Daily update · Sep 25–26, 2026
Linux mainline update: security hardening, GPU corrections, and filesystem reliability
A roundup of today's kernel changes: security fixes for BPF, SMB, and IPE; GPU stability patches; and filesystem/storage improvements.
In brief
This update brings a wide range of fixes: memory-safety and race-condition hardening across BPF, iSCSI, SMB, and IPE; GPU driver corrections for Nouveau, i915, AMD, and VirtIO; filesystem and storage reliability improvements; and a performance fix for cgroup writeback cleanup.
Security & hardening
Fix BPF binfmt_misc interpreter selection race and out-of-bounds read
Two fixes close memory-safety holes in the BPF hooks that choose and configure interpreters for binfmt_misc. One prevents an out-of-bounds strcmp() when a BPF map value is concurrently modified, and the other prevents staged interpreter paths and arguments from being changed between validation and use.
Why it matters: Users relying on binfmt_misc with BPF programs get protection against local memory corruption and potential privilege escalation via race conditions.
Reject iSCSI Data-In PDUs for write commands
The iSCSI initiator now verifies the data direction before processing a Data-In PDU, so a malicious or buggy target cannot write target-supplied data into the pages of a write command.
Why it matters: Protects iSCSI users from data corruption and potential security issues when connecting to untrusted storage targets.
Fix multiple use-after-free vulnerabilities in Nouveau
Three patches fix use-after-free bugs in Nouveau's VMM teardown, UVMM mapping, and scheduler lifetime, all reachable from userspace.
Why it matters: Nouveau users get improved stability and security; these bugs could crash the system or be exploited by local users.
Prevent shift overflow when mounting crafted SquashFS images
SquashFS now validates the XZ dictionary size before shifting, preventing a shift-out-of-bounds crash on malformed images.
Why it matters: Makes mounting untrusted SquashFS filesystems safer and avoids kernel crashes.
Harden SMB client against malformed create contexts
Multiple fixes validate SMB create-context lengths and offsets, prevent out-of-bounds reads, preserve parsing errors, and close handles after parsing failures.
Why it matters: Protects SMB users against crafted responses from malicious servers that could crash the client or leak kernel memory.
Fix kernel stack leak in GPIO character device error path
If the GPIO chip guard acquisition failed, the ioctl returned before zeroing the info structure, potentially leaking kernel stack contents to userspace. The fix propagates the error and moves the zeroing earlier.
Why it matters: Prevents information disclosure through /dev/gpiochip.
Fix missing inode locking in BPF LSM xattr kfuncs on path hooks
The BPF verifier assumed i_rwsem was held for path_unlink/path_rmdir and used the _locked variants of bpf_set/remove_dentry_xattr, but those hooks run before VFS takes the lock. The fix keeps the locking variants for those hooks.
Why it matters: Prevents race conditions and potential xattr corruption for sleepable BPF LSM programs attached to path_unlink/path_rmdir.
Fix use-after-free when auditing newly loaded IPE policy
IPE audited a new policy after publishing it and dropping the directory inode lock, allowing a concurrent delete to free the policy. The audit now happens under the lock.
Why it matters: Eliminates a crash/security bug in IPE policy loading.
Protect IPE dm-verity root hash with RCU
IPE could free a dm-verity root hash on ->preresume while policy evaluation was still dereferencing it. The hash is now RCU-protected.
Why it matters: Fixes a race condition in IPE's dm-verity trust provider, improving reliability and security.
GPU & display fixes
Fix HDMI audio on older Nouveau GPUs with SCDC-capable displays
Nouveau no longer rejects HDMI configuration on pre-Maxwell-2 cards when the sink supports SCDC, so AVI/VSI infoframes are sent and audio works again.
Why it matters: Users with older Nvidia graphics cards get HDMI audio working when connected to modern displays.
Revert virtio-gpu prime buffer import that broke 3D acceleration
Reverts a change that allowed importing prime buffers with 3D enabled because it caused failures with virglrenderer in virtual machines.
Why it matters: Fixes regressions for virtio-gpu users (e.g., QEMU/KVM guests) using 3D acceleration and imported buffers like mouse cursor images.
Fix endless loop in i915 GEM busy ioctl during object destruction
The RCU-based fence iteration in i915_gem_busy_ioctl could loop forever if the GEM object was destroyed concurrently, because the fence list was freed without installing a new one. The fix corrects the RCU teardown order.
Why it matters: Prevents hangs in Intel GPU userspace when querying buffer busy status.
Fix spurious AMD GPU resets from wrong user queue timeout conversion
The hang detection timeout was stored in jiffies but converted again with msecs_to_jiffies(), shortening the window to about 500 ms and triggering false GPU resets. The fix passes jiffies directly.
Why it matters: Avoids unexpected GPU resets and queue disruptions for AMD GPU users.
Fix Intel GPU display corruption on Xen PV dom0
On Xen PV, DMA buffers are not machine-contiguous, so bounce buffering broke Xe's coherency assumptions. Limiting SG segment size to PAGE_SIZE applies the same workaround i915 uses.
Why it matters: Stable display output for Xen PV users with Intel GPUs.
Fix VirtIO GPU data corruption and crash on fence allocation failure
Guest-bound transfers now sync shmem backing before returning data, and a NULL fence from allocation failure is properly checked, fixing stale data and a NULL pointer dereference.
Why it matters: Reliable VirtIO GPU operation in virtual machines.
Fix AMD display stream use-after-free on modeset failure
An extra reference put could drop the stream reference owned by the new CRTC state when color management setup failed, leading to premature stream release. The fix balances the reference count correctly.
Why it matters: Prevents potential crashes during modeset failures on AMD GPUs.
Fix stale PSR2 selective fetch state on Intel displays
Selective fetch enable bits were not cleared when a plane was disabled while PSR2 sel fetch was off, causing the hardware to resume fetching for disabled planes and reserving DDB. The fix clears them on disable.
Why it matters: Avoids display corruption and resource waste on Intel GPUs with PSR2.
Filesystems & storage
Fix SMB client credit handling on compound request send failure
The SMB client now removes pending compound request MIDs before unlocking, preventing a double-return of credits and a kernel warning during reconnects.
Why it matters: Improves reliability of SMB/CIFS mounts, especially on flaky networks.
Fix unmount hang when block device is removed while in use
evict_inodes() no longer rescans the same inodes from the head of the list, avoiding long-held locks and hung-task reports during unmount after device removal.
Why it matters: Users can unmount filesystems on disconnected devices without the system hanging.
Fix missing entries in tightly packed isofs directories
ISO images where directory entries exactly fill a block lost entries after a previous change. The readdir and lookup code now correctly transitions to the next block in that case.
Why it matters: Correct file listings when mounting affected ISO images, such as some Fedora ISOs.
Revert mount namespace change that leaked superblocks and loop devices
Keeping mounts of a dying namespace connected introduced ownership cycles, leaking superblocks and loop devices. The revert restores the previous behavior.
Why it matters: Prevents resource leaks for users creating and destroying mount namespaces, e.g., with unshare and loop mounts.
Fix O_CREAT handling of symlinks and non-regular files on SMB mounts
cifs_atomic_open() used finish_open() on existing symlinks or other non-regular inodes, leaking a dentry reference and preventing VFS from following the symlink. The fix switches to finish_no_open() and closes any server handle for such inodes.
Why it matters: SMB/CIFS users get correct symlink behavior and no leaked references when opening paths with O_CREAT.
Core kernel & performance
Speed up cgroup writeback cleanup with many inodes
cleanup_offline_cgwb() now rotates scanned inodes to avoid quadratic rescans, preventing soft lockups when draining dying cgroup writeback domains with millions of inodes.
Why it matters: Improves responsiveness on systems with heavy cgroup usage and large file counts.
Fix hibernation deadlocks by reordering kernel thread freeze
Hibernation memory preallocation was happening after kernel threads were frozen, and swap I/O can depend on those threads, causing intermittent deadlocks. This moves preallocation before freezing kernel threads.
Why it matters: More reliable hibernation for users who suspend to disk.
Fix stale thermal mitigation vote with shared cooling devices
The step_wise governor could leave a cooling device active after a trip cleared when multiple thermal zones share it and one uses a non-zero lower bound. The fix corrects the target state calculation.
Why it matters: Better thermal management and power savings on systems with shared cooling devices.
Source commits124 entries +
selftests/filesystems: fix missing and stale TARGETS entries
Disha Goel · Jul 3, 2026 · 1 files
squashfs: Add dictionary size range check to prevent shift-out-of-bounds
Ran Hongyun · Jul 13, 2026 · 1 files
drm/amdgpu: move userq fence wait out of signalling section
Prike Liang · Jul 31, 2026 · 3 files
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
Yehyeong Lee · Aug 1, 2026 · 1 files
drm/nouveau: fix autosuspend cleanup during teardown
Guangshuo Li · Aug 8, 2026 · 1 files
drm/virtio: sync shmem backing on guest-bound transfers
Benjamin Leggett · Aug 14, 2026 · 3 files
drm/nouveau/dmem: pin VRAM for the whole registered range
Junrui Luo · Aug 17, 2026 · 1 files
drm/amd/display: Bump frame warning limit for clang builds of dml
Ivan Lipski · Aug 21, 2026 · 1 files
drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
Asad Kamal · Aug 28, 2026 · 1 files
drm/virtio: Add pixel blend mode property to cursor plane
Shixiong Ou · Aug 28, 2026 · 1 files
scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
Bart Van Assche · Aug 31, 2026 · 1 files
drm/nouveau: RCU-free the scheduler-containing nouveau_sched
Jonghyuk Kim(MalHyuk) · Sep 2, 2026 · 2 files
drm/i915: fix incorrect RCU teardown order
Christian König · Sep 3, 2026 · 1 files
drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
Li Youhong · Sep 4, 2026 · 1 files
drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1
Ankit Nautiyal · Sep 7, 2026 · 1 files
drm/client: fix restore of partially initialized client
shechenglong · Sep 7, 2026 · 1 files
drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
Peiyang He · Sep 7, 2026 · 1 files
s390/pci/docs: Fix sriov_numvfs attribute name
Karl Mehltretter · Sep 7, 2026 · 1 files
s390: Fix typos in comments
Hemanth Selam · Sep 7, 2026 · 4 files
drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
Imre Deak · Sep 7, 2026 · 1 files
drm/i915/dp_mst: Fix configuring TUs for a disconnected stream
Imre Deak · Sep 7, 2026 · 3 files
drm/virtio: fix memory leak of fence event on execbuffer failure
Peiyang He · Sep 8, 2026 · 1 files
block: Fix start and length check added to iov_iter_extract_bvecs()
David Howells · Sep 9, 2026 · 1 files
fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
Christian Brauner · Sep 9, 2026 · 1 files
drm/virtio: fix NULL pointer dereference on fence allocation failure
Peiyang He · Sep 9, 2026 · 1 files
drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable
Nemesa Garg · Sep 9, 2026 · 4 files
drm/xe/gt_throttle: Report power brake as a throttle reason on CRI
Sk Anirban · Sep 9, 2026 · 2 files
super: make iterate_supers_type() deletion-safe
Christian Brauner · Sep 9, 2026 · 2 files
s390/cio: Fix cio_update_schib() to not cache invalid schib
Vineeth Vijayan · Sep 10, 2026 · 1 files
s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
Vineeth Vijayan · Sep 10, 2026 · 1 files
s390/cio: Guard PMCW field accesses with dnv check
Vineeth Vijayan · Sep 10, 2026 · 5 files
Revert "drm/virtio: Allow importing prime buffers when 3D is enabled"
Dmitry Osipenko · Sep 11, 2026 · 1 files
writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
Patrick Lu (Anthropic) · Sep 11, 2026 · 1 files
scsi: ufs: core: Keep internal commands dispatchable during error handling
Stanley Jhu · Sep 12, 2026 · 1 files
accel/ivpu: Use separate flag for job timeout
Jakub Pawlak · Sep 14, 2026 · 5 files
scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction
Geert Uytterhoeven · Sep 14, 2026 · 1 files
netfs: Fix netfs_read_gaps() to use separate sink folios
David Howells · Sep 14, 2026 · 1 files
drm/xe/tlb_inval: Treat wedged-device invalidations as complete
Shuicheng Lin · Sep 14, 2026 · 1 files
gpio: mvebu: keep resume masks within the irqchip cache
Rosen Penev · Sep 15, 2026 · 1 files
fs: avoid repeated scans in evict_inodes()
Julian Sun · Sep 15, 2026 · 1 files
drm/virtio: fix object leak when drm_gem_handle_create() fails
Junrui Luo · Sep 15, 2026 · 1 files
drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
Junrui Luo · Sep 15, 2026 · 1 files
drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
Junrui Luo · Sep 15, 2026 · 1 files
drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
Junrui Luo · Sep 15, 2026 · 1 files
drm/i915/dp: use EXPORT_SYMBOL_IF_KUNIT() for kunit helpers
Jani Nikula · Sep 15, 2026 · 2 files
netfs, afs: Fix symlink reading
David Howells · Sep 15, 2026 · 1 files
scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix
Ewan D. Milne · Sep 15, 2026 · 1 files
scsi: leapraid: Avoid -Wformat-security warning
Arnd Bergmann · Sep 15, 2026 · 2 files
gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
Wentao Liang · Sep 16, 2026 · 1 files
drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
Wentao Liang · Sep 16, 2026 · 1 files
drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
Wentao Liang · Sep 16, 2026 · 1 files
drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
Wentao Liang · Sep 16, 2026 · 1 files
drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
Wentao Liang · Sep 16, 2026 · 1 files
drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
Wentao Liang · Sep 16, 2026 · 1 files
drm/xe: harden adjust_idledly() against divide-by-zero and overflow
Tangudu Tilak Tirumalesh · Sep 16, 2026 · 1 files
drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platforms
Tangudu Tilak Tirumalesh · Sep 16, 2026 · 3 files
drm/nouveau: fix double-free in nvif_vmm_dtor
Peiyang He · Sep 16, 2026 · 2 files
scsi: block: Fix zones_cond out-of-bounds write on zone report
ZHOU Jiaxiang · Sep 16, 2026 · 1 files
scsi: sd_zbc: Reject disks with too many zones
ZHOU Jiaxiang · Sep 16, 2026 · 1 files
s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()
Niklas Schnelle · Sep 16, 2026 · 3 files
s390/pci: Fix missing device lock in zpci_report_status()
Niklas Schnelle · Sep 16, 2026 · 2 files
s390/pci: Report SCLP status on error events when no pdev is associated
Niklas Schnelle · Sep 16, 2026 · 1 files
s390/pci: Don't report recovery success on skipped recovery
Niklas Schnelle · Sep 16, 2026 · 1 files
smb: client: fix create context out-of-bounds reads
Zihan Xi · Sep 16, 2026 · 2 files
smb: client: validate POSIX create context length
Zihan Xi · Sep 16, 2026 · 1 files
smb: client: close handle after create-context parsing failure
Zihan Xi · Sep 16, 2026 · 1 files
smb: client: clean up failed cached directory opens
Zihan Xi · Sep 16, 2026 · 1 files
smb: client: close completed creates on compound wait errors
Zihan Xi · Sep 16, 2026 · 3 files
smb: client: preserve create-context parsing errors
Zihan Xi · Sep 16, 2026 · 1 files
s390/debug: Fix NULL pointer dereference in debug_info_copy()
Mikhail Zaslonko · Sep 16, 2026 · 1 files
s390/debug: Reject NULL debug info in debug_dump()
Mikhail Zaslonko · Sep 16, 2026 · 1 files
drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
Szymon Acedański · Sep 16, 2026 · 1 files
drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
Wentao Liang · Sep 16, 2026 · 1 files
drm/nouveau: Fix gem reference leak in validate_init()
Wentao Liang · Sep 16, 2026 · 1 files
drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
Wentao Liang · Sep 16, 2026 · 1 files
fs: don't create the private nullfs mount under namespace_sem
Christian Brauner · Sep 17, 2026 · 1 files
Revert "selftests/filesystems: add mntns cleanup test"
Christian Brauner · Sep 17, 2026 · 4 files
Revert "put_mnt_ns(): leave mounts connected"
Christian Brauner · Sep 17, 2026 · 1 files
drm/amdgpu/vcn4.0.3: fix video_timeout unit mismatch in jpeg reset wait
Sunil Khatri · Sep 17, 2026 · 1 files
drm/amdgpu/userq: fix double jiffies conversion in hang detect timeout
Sunil Khatri · Sep 17, 2026 · 1 files
drm/amdgpu/vcn5.0.1: fix video_timeout unit mismatch in jpeg reset wait
Sunil Khatri · Sep 17, 2026 · 1 files
gpiolib: use of_node_name if line-name is missing
Frank Wunderlich · Sep 17, 2026 · 1 files
drm/nouveau/gsp/r570: Add support for INTERNAL_GCX_ENTRY_PREREQUISITE
Lyude Paul · Sep 17, 2026 · 11 files
drm/nouveau/gsp/r535: Add support for MEMSYS_GET_STATIC_CONFIG
Lyude Paul · Sep 17, 2026 · 5 files
drm/nouveau/gsp/r570: Add comp mode workaround from issue #3172217
Lyude Paul · Sep 17, 2026 · 2 files
drm/nouveau/gsp/r570: Start saving comptag backing stores
Lyude Paul · Sep 17, 2026 · 2 files
drm/nouveau/gsp/r570: Enable Gcoff in fbsr again
Lyude Paul · Sep 17, 2026 · 1 files
drm/xe: Keep walking on SVM eviction failure
Matthew Brost · Sep 17, 2026 · 1 files
drm/nouveau/disp: don't reject HDMI config on cards without SCDC
Giuseppe Ranieri · Sep 17, 2026 · 1 files
drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
Peiyang He · Sep 18, 2026 · 1 files
binfmt_misc: fix OOB read in bpf_binprm_select_interp()
Chris Mason · Sep 18, 2026 · 1 files
binfmt_misc: fix racy checks in bpf set_interp kfuncs
Chris Mason · Sep 18, 2026 · 1 files
drm/xe/vm: nuke PTs only after unlinking contested VMAs
Matthew Auld · Sep 18, 2026 · 1 files
drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
Dan Carpenter · Sep 18, 2026 · 1 files
drm/nouveau/clk: don't use the pstate cursor after the loop
Francesco Magazzu · Sep 18, 2026 · 1 files
drm/nouveau/device: don't use the pstate cursor after the loop
Francesco Magazzu · Sep 18, 2026 · 1 files
drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
Francesco Magazzu · Sep 18, 2026 · 1 files
s390/debug: Do not register views for failed static debug areas
Mikhail Zaslonko · Sep 18, 2026 · 2 files
dcache: unpoison the inline name buffer in __d_alloc()
Drif Abdelmalek Mohamed Said · Sep 18, 2026 · 1 files
smb: client: delete compound mids on send failure before unlock
Adarsh Das · Sep 19, 2026 · 1 files
gpio: tps65219: Fix GPIO input value reads
Karl Mehltretter · Sep 19, 2026 · 1 files
gpio: tps65219: Use the variant-specific direction callback
Karl Mehltretter · Sep 19, 2026 · 1 files
gpio: tps65219: Fix TPS65214 GPIO direction programming
Karl Mehltretter · Sep 19, 2026 · 1 files
autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
Hui Peng · Sep 19, 2026 · 1 files
drm/imagination: clamp freelist reconstruction requests
Pengpeng Hou · Sep 20, 2026 · 1 files
PM: hibernate: Freeze kernel threads after image preallocation
Florian Schmaus · Sep 20, 2026 · 1 files
smb: client: update POSIX extension specification references
ZhangGuoDong · Sep 21, 2026 · 1 files
ovl: fix UAF in ovl_do_mkdir() debug print
Amir Goldstein · Sep 21, 2026 · 1 files
s390/cmf: Fix virtual vs physical address confusion
Peter Oberparleiter · Sep 21, 2026 · 2 files
drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
Brajesh Gupta · Sep 22, 2026 · 1 files
drm/imagination: Fix page count for page table for map() interface
Brajesh Gupta · Sep 22, 2026 · 3 files
gpio: cdev: fix kernel stack leak to user-space in error path
Bartosz Golaszewski · Sep 22, 2026 · 1 files
gpio: zynq: fix runtime PM leak on request error path
Ridham Khurana · Sep 22, 2026 · 1 files
isofs: Fix handling of directories with tight blocks
Jan Kara · Sep 22, 2026 · 2 files
thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds
Manaf Meethalavalappu Pallikunhi · Sep 22, 2026 · 1 files
bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
Andrea Parri · Sep 22, 2026 · 1 files
smb: client: use GFP_KERNEL in get_targets()
Fredric Cover · Sep 22, 2026 · 1 files
s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
Vineeth Vijayan · Sep 22, 2026 · 1 files
ipe: fix use-after-free when auditing a newly loaded policy
Fan Wu · Sep 23, 2026 · 2 files
ipe: protect the dm-verity root hash with RCU
Fan Wu · Sep 23, 2026 · 3 files
netfs: Fix missing alloc tagging of direct mempool allocations
Hao Ge · Sep 23, 2026 · 3 files
smb: client: use finish_no_open() for non-regular inodes
Namjae Jeon · Sep 23, 2026 · 1 files
drm/amd/display: Relax DML frame limit with UBSAN
Alex Hung · Sep 23, 2026 · 2 files
drm/amd/display: Bump frame warning limit for all builds of dml
Alex Deucher · Sep 24, 2026 · 2 files