Daily update · Oct 1–2, 2026
Linux kernel update: WiFi, KVM, and networking fixes
A roundup of notable fixes merged into the Linux mainline kernel, covering WiFi security, KVM stability, Bluetooth races, and driver issues.
In brief
Today's mainline merge includes a broad set of fixes. WiFi drivers and mac80211 receive several security and stability improvements, KVM sees fixes for nested virtualization and vCPU races, and networking gets corrections for checksums, GSO, and TCP timestamps. Driver updates cover Ethernet, Bluetooth, and modem support.
WiFi & wireless
Fix WiFi AP VLAN frame isolation
mac80211 could match unicast frames sent on one AP VLAN interface to a station of a different VLAN of the same BSS. Station lookup is now restricted to the interface the frame is sent on, except for control port frames.
Why it matters: Prevents frames from leaking between VLANs on the same access point, restoring network isolation.
Prevent WiFi fragment-size overflow
The mac80211 defragmentation path could overflow its accumulated length counter with oversized fragments, leading to insufficient tailroom and potential memory corruption. Oversized fragments are now dropped.
Why it matters: Hardens the WiFi stack against malicious or malformed fragmented frames.
Fix ath9k_htc USB TX buffer overflow
The ath9k_htc driver could copy more data into a fixed-size USB transfer buffer than allocated when aggregating large frames, overflowing the buffer. TX batches are now bounded by byte length as well as frame count.
Why it matters: Prevents memory corruption on systems using ath9k_htc-based USB WiFi adapters with large MTUs.
Fix cw1200 WiFi heap data leak to device
The cw1200 WiFi driver read past the end of TX frames when padding for bus alignment and sent those bytes to the device, exposing up to 511 bytes of kernel heap per frame. Padding is now zeroed and bounded.
Why it matters: Prevents a malicious or faulty WiFi device from collecting kernel memory contents through the driver.
Fix WiFi association use-after-free with non-transmitted MBSSID
When an association response omitted WMM/HT/VHT, mac80211 copied element pointers from a fallback parse that was freed immediately, leaving dangling pointers used later. The fallback parse is now kept alive through association setup.
Why it matters: Prevents crashes when associating to APs using non-transmitted MBSSID profiles with missing capability elements.
Fix WiFi channel context use-after-free during replacement
Two bugs in mac80211 could free an old channel context while a replacement operation still referenced it, leading to use-after-free in beacon generation. The replacement logic now counts only matching reservations and keeps paired old contexts alive.
Why it matters: Improves stability for WiFi users during channel switches and link reconfigurations.
Fix ath11k station acceptance after hardware restart
ath11k did not reset its station counter on hardware restart, so after a restart the driver refused new stations or mesh peers. The counter is now cleared in the start path.
Why it matters: Restores normal operation of ath11k-based access points after firmware/hardware restarts.
Fix RTS threshold setting for single-radio WiFi
A bad check in cfg80211 prevented the RTS threshold from being propagated on single-radio PHYs. The condition is corrected so the threshold reaches lower layers.
Why it matters: Makes the RTS threshold setting work on single-radio WiFi devices.
Fix empty FILS association request crash
An association request whose last element was a FILS Session element produced an empty plaintext, causing a kernel BUG in scatterlist setup. mac80211 now handles the empty-payload case correctly.
Why it matters: Prevents kernel crashes during association to FILS-enabled networks with certain request layouts.
Fix WiFi mesh path table and fast-xmit issues
Failed mesh path additions did not release reserved slots, proxy paths were not charged against the shared path limit, and the fast-xmit cache could retain pointers to freed paths. These are fixed by releasing quota on failure, charging proxy paths, and marking paths deleted before cache flush.
Why it matters: Improves stability and path capacity of mesh WiFi networks.
Fix slab-out-of-bounds read in mac80211 monitor queue selection
ieee80211_monitor_select_queue() trusted skb->len without ensuring the 802.11 header was in the linear head buffer, so non-linear AF_PACKET frames could trigger a KASAN slab-out-of-bounds read.
Why it matters: Prevents a potential kernel crash or memory exposure when using monitor mode with crafted packets.
Networking
Fix IPv6 prefix route expiry when changing address lifetime
Changing an IPv6 address's valid lifetime passed a relative time where an absolute jiffies value was expected, making the prefix route appear already expired and be removed by GC.
Why it matters: Fixes `ip -6 addr change` so changing address lifetimes keeps the connected route usable.
Prevent AF_PACKET TX_RING byte-count overflow from panicking the kernel
tpacket_snd() added packet lengths to a signed int; concurrent frame recycling allowed a single send call to exceed INT_MAX, wrap to -EIOCBQUEUED, and trigger a BUG.
Why it matters: Closes a local denial-of-service where a CAP_NET_RAW user could panic a host configured to panic on oops.
Limit recursive IP-in-IP GSO segmentation
Nested IP-in-IP GSO could re-enter the segmentation handlers without a depth limit and exhaust the kernel stack; a per-skb recursion counter now enforces IP_TUNNEL_RECURSION_LIMIT.
Why it matters: Prevents a kernel stack overflow from deeply nested tunneled GSO traffic.
Prevent SO_RESERVE_MEM from corrupting UDP socket accounting
SO_RESERVE_MEM was accepted on UDP even though only TCP implements it, leading to races on sk_forward_alloc and incorrect memcg accounting; it is now restricted to TCP sockets and the maximum reservation is capped.
Why it matters: Avoids memory corruption and accounting bugs for applications that tried the option on UDP, and clarifies the intended API.
Fix checksum corruption when splicing into UDP datagrams
skb_splice_from_iter() used the original skb length as the checksum offset for every appended fragment, so odd-length fragments produced incorrect checksums and dropped packets.
Why it matters: splice() to UDP sockets now produces valid checksums for IPv4 and IPv6, including fragmented and page-boundary cases.
Fix IPv6 tunnel GSO with outer extension headers and no outer transport header
GSO checks for IPv6 extension headers missed cases with skb->encapsulation set and tunnels without an outer transport header, causing software checksum fallback to warn and drop GSO packets.
Why it matters: Improves reliability and throughput for IPv6 tunnels such as ip6_gre and ip6_tunnel.
Match CoDel no-drop threshold to actual packet size on small-MTU links
CoDel's default no-drop threshold was clamped to a 256-byte floor, so on links with smaller MTU it exempted more than one packet from dropping and delayed marks; the floor is removed while keeping the upper bound.
Why it matters: Better latency and queue management for codel/fq_codel users on low-MTU links.
Fix TCP timestamp refresh for old ACKs carrying new data
TCP now updates the timestamp saved for outgoing acknowledgments when accepting an old ACK that fills a receive gap, preventing RTT estimates from including idle time.
Why it matters: Avoids unnecessary TCP send-rate reductions after idle periods, improving throughput on long-lived connections.
Fix use-after-free in nftables rbtree garbage collection
Skips transaction-state elements during rbtree set garbage collection to prevent freeing elements that are still being committed.
Why it matters: Prevents potential crashes or memory corruption in nftables when using interval sets with garbage collection.
KVM & virtualization
Fix nested VMX MSR bitmap refresh for eVMCS
When runtime eVMCS controls changed, KVM could fail to refresh the MSR bitmap and leave TPR in passthrough mode, allowing L2 to read/write L0's TPR. The bitmap is now forced to refresh on nested VM-Enter.
Why it matters: Closes a security-relevant hole in nested virtualization with Hyper-V enlightened VMCS.
Serialize KVM vCPU creation and reduce per-VM memory
KVM now holds the VM lock for the entire vCPU creation path, preventing races with VM-wide operations. The duplicate vCPU ID tracking was reverted, saving about 2 KB of memory per VM.
Why it matters: Improves KVM stability for VMMs and reduces memory overhead of each VM.
Fix KVM shadow page-table walk with dummy root
A race between memslot creation and a stage-2 fault from L2 could make KVM walk the zero page as a shadow root, causing a NULL pointer dereference. Shadow walks now bail immediately if the root is invalid or a dummy.
Why it matters: Fixes a KVM crash in nested virtualization under memory slot changes.
Enable huge mappings for VM_PFNMAP in KVM on ARM64
KVM arm64 now uses stage-1 leaf size for VM_PFNMAP regions, enabling huge mappings for device MMIO.
Why it matters: Improves performance for VFIO device passthrough and similar workloads on ARM64 by reducing TLB pressure.
Bluetooth
Fix Bluetooth Intel PCIe TX buffer overflow
The btintel_pcie driver allowed oversized HCI packets from user space to overflow a fixed-size DMA buffer. Oversized packets are now rejected before transmission.
Why it matters: Prevents a local user with HCI channel access from corrupting kernel memory on Intel Bluetooth PCIe devices.
Fix Bluetooth inquiry cache timestamps on 64-bit systems
The Bluetooth inquiry cache used 32-bit jiffies timestamps, so after about five minutes of uptime on 64-bit systems cached inquiry results appeared expired. This caused outgoing connections to fall back to slower page scan mode.
Why it matters: Restores fast Bluetooth page scans and reduces the risk of Page Timeout on long-running systems.
Fix multiple Bluetooth use-after-free races
Several Bluetooth paths lacked proper locking or lifetime management around connection teardown, ISO/SCO scheduling, SMP OOB data, and RFCOMM port release, leading to KASAN-reported use-after-free conditions.
Why it matters: Reduces the risk of kernel crashes or memory corruption during Bluetooth pairing, SCO/ISO audio, and serial-port operations.
024e05f73a4c1a572db43c058ed67535fdff2d696c1ed34681a2345f1984f4845ab191a4848a7a91c7f0
Drivers & hardware
Fix bcmgenet RX buffer overhead on large pages
The bcmgenet driver allocated whole pages for every RX buffer, making each packet count up to 64 KiB against socket buffers on 64 KiB-page systems. It now uses page fragments, so truesize matches actual packet size.
Why it matters: Prevents UDP sockets from dropping after only a few packets and reduces memory waste on systems with 64 KiB pages.
Fix stmmac RX scatter-gather on IOMMU platforms
Secondary RX buffers were only allocated for split-header mode, so frames larger than the DMA buffer wrote to unmapped addresses and caused SMMU faults; regular RX now gets the secondary buffer it needs.
Why it matters: Ethernet on stmmac-based systems behind an IOMMU no longer faults on large frames, enabling reliable jumbo-frame and scatter-gather reception.
Fix MediaTek Ethernet probe race with shared NAPI setup
mtk_eth_soc created its internal dummy netdev and shared NAPI after registering MAC netdevs, so an immediate open could dereference a NULL dummy_dev; the dummy device is now allocated before registration.
Why it matters: Prevents crashes on MediaTek Ethernet devices such as MT7623 and newer NETSYS SoCs when interfaces are brought up immediately after probe.
Fix spurious cpufreq pressure in intel_pstate
After a fallback to cpuinfo.max_freq, cpufreq pressure could be set even when the scheduler's capacity reference frequency was unknown, causing unexpected load-balancer behavior; intel_pstate now exposes the capacity reference frequency through a new driver interface.
Why it matters: Avoids confusing scheduler decisions and performance regressions on Intel CPUs using intel_pstate.
Disable broken EEE on Realtek RTL8168h/8111h
Forces Energy-Efficient Ethernet off on Realtek RTL8168h/8111h to avoid a latent PHY defect that stalls RX after several minutes.
Why it matters: Prevents random network freezes on common Realtek-based motherboards and NICs.
Fix RSS indirection table size in OcteonTX2 driver
Corrects the RSS table size calculation so all 256 indirection entries are initialized instead of only four.
Why it matters: Restores proper receive queue spreading on Marvell OcteonTX2 NICs, avoiding traffic concentration on one queue.
Add Rolling Wireless RN947R modem support
Adds USB IDs for the Rolling Wireless RN947R modem to the qmi_wwan driver.
Why it matters: Allows Linux to use this modem for mobile broadband connections.
Core fixes & hardening
Fix audit executable-mark use-after-free
Removing an audit directory rule could free an executable mark while another task was still evaluating the rule, causing a use-after-free. Rules are now unlinked from RCU-visible lists before cleanup.
Why it matters: Prevents a kernel crash or memory corruption when audit rules with executable watches are removed while being evaluated.
Fix sysctl integer conversion for negative and overflowing values
The int sysctl read path negated after converting, so negative values such as tcp_fin_timeout could be displayed as enormous numbers, and mult_hz() wrapped instead of saturating so oversized writes were accepted and displayed as 0.
Why it matters: Users get correct values from /proc/sys and out-of-range writes are rejected instead of silently wrapping.
Restore optimized AES mode implementations
Fixes crypto algorithm priorities so generic AES mode wrappers no longer override architecture-optimized implementations.
Why it matters: Preserves hardware-accelerated AES performance on systems with optimized crypto code.
Source commits137 entries +
KVM: selftests: Add x2APIC MSR test for inhibiting APICv while nested
Sean Christopherson · Jul 10, 2026 · 2 files
wifi: mac80211: count only matching reservations in reserved switch
Zhiling Zou · Aug 3, 2026 · 1 files
wifi: mac80211: keep paired old chanctx alive
Zhiling Zou · Aug 3, 2026 · 1 files
wifi: ath11k: reset ar->num_stations on hardware start
Nicolas Escande · Aug 12, 2026 · 1 files
KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
Sean Christopherson · Aug 13, 2026 · 1 files
KVM: selftests: Run the nested x2APIC with and without APICv being inhibited in L2
Sean Christopherson · Aug 13, 2026 · 1 files
KVM: selftests: Verify that L0's TPR doesn't get clobbered
Sean Christopherson · Aug 13, 2026 · 1 files
KVM: selftests: Extend nested x2APIC test to validate using eVMCS for vmcs12
Sean Christopherson · Aug 13, 2026 · 1 files
wifi: ath9k: reject short WMI command responses
Pengpeng Hou · Aug 14, 2026 · 2 files
KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
Sean Christopherson · Aug 26, 2026 · 1 files
of/overlay: put property on deadprops only after changeset add succeeds
Abdurrahman Hussain · Sep 1, 2026 · 1 files
of/overlay: only treat a positive changeset id as registered
Abdurrahman Hussain · Sep 1, 2026 · 1 files
of/overlay: don't leak fragment references when changeset init fails
Abdurrahman Hussain · Sep 1, 2026 · 1 files
of/overlay: don't create "//" paths for fragments targeting the root
Abdurrahman Hussain · Sep 1, 2026 · 1 files
wifi: cw1200: fix TX padding OOB read leaking heap data to device
Tianchu Chen · Sep 4, 2026 · 2 files
KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
Sean Christopherson · Sep 4, 2026 · 2 files
KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded
Sean Christopherson · Sep 4, 2026 · 1 files
KVM: SVM: Don't mark ASID fields as dirty when setting control.tlb_ctl
Sean Christopherson · Sep 4, 2026 · 2 files
KVM: SVM: Sync guest's PERF_CNTR_GLOBAL_CTL from h/w only on successful VMRUN
Sean Christopherson · Sep 4, 2026 · 1 files
netfilter: ipset: do not update comments from kernel-side adds
Florian Westphal · Sep 4, 2026 · 1 files
wifi: ath9k: Clean up device initialisation guards
Toke Høiland-Jørgensen · Sep 8, 2026 · 4 files
wifi: mac80211: keep fallback association elements alive
Zhao Li · Sep 10, 2026 · 1 files
wifi: mac80211: shut down RX BA session timer on teardown
Zhao Li · Sep 10, 2026 · 1 files
netfilter: nft_flow_offload: drop flowtable reference on init error path
Aohan Mei · Sep 10, 2026 · 1 files
ipvs: fix missing counter decrement in lblc
Julian Anastasov · Sep 10, 2026 · 1 files
ipvs: bound LBLCR and LBLC cache growth
Zhiling Zou · Sep 10, 2026 · 2 files
wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
Georgios Karantzas · Sep 11, 2026 · 1 files
wifi: wfx: validate MIB read length before copying to caller
Aamir Ahmed · Sep 12, 2026 · 1 files
wifi: cfg80211: preserve hidden-group beacon IE ownership
Zhao Li · Sep 14, 2026 · 1 files
wifi: iwlegacy: 3945: free EEPROM data on remove
Guangshuo Li · Sep 16, 2026 · 1 files
wifi: mac80211: prevent AP VLAN tx from other interfaces
Felix Fietkau · Sep 16, 2026 · 2 files
wifi: mac80211: release mesh path quota on failed additions
Zhao Li · Sep 16, 2026 · 1 files
wifi: mac80211: account proxy paths against the mesh path limit
Zhao Li · Sep 16, 2026 · 1 files
wifi: mac80211: drain PS delivery work during station teardown
Zhao Li · Sep 16, 2026 · 1 files
wifi: wlcore: Fix runtime PM leak in wlcore_remove()
Wentao Liang · Sep 17, 2026 · 1 files
of/irq: Fix remaining refcount leaks in of_irq_init()
Wentao Liang · Sep 17, 2026 · 1 files
wifi: mac80211: drop oversized fragments to avoid extra_len overflow
Yuchao Zhang · Sep 18, 2026 · 2 files
wifi: mac80211: fix mesh fast xmit path deletion UAF
Zihan Xi · Sep 18, 2026 · 1 files
wifi: p54: validate firmware record lengths
Heyang Tan · Sep 18, 2026 · 1 files
wifi: mac80211: minstrel_ht: validate fixed rate index
Yuqi Xu · Sep 19, 2026 · 1 files
wifi: mac80211: handle empty FILS association request payload
Yuqi Xu · Sep 19, 2026 · 1 files
wifi: cfg80211: fix RTS threshold setting for single-radio PHY
Stanislaw Gruszka · Sep 19, 2026 · 1 files
ipvs: do not create invisible templates
Julian Anastasov · Sep 19, 2026 · 1 files
ipvs: filter some flags received in the backup server
Julian Anastasov · Sep 19, 2026 · 1 files
netfilter: nft_set_rbtree: skip transaction elements during GC
Weiming Shi · Sep 21, 2026 · 1 files
wifi: mac80211: validate TX status rate metadata
Yuqi Xu · Sep 21, 2026 · 2 files
KVM: Reject attempts to lock all vCPUs if vCPU creation is in-progress
Sean Christopherson · Sep 21, 2026 · 3 files
KVM: arm64: vgic: Rely on vCPU creation check in "trylock all vCPUs"
Sean Christopherson · Sep 21, 2026 · 1 files
KVM: RISC-V: Use kvm_is_vcpu_creation_in_progress() instead of open-coded equivalent
Sean Christopherson · Sep 21, 2026 · 1 files
KVM: Protect all of kvm_vm_ioctl_create_vcpu() with kvm->lock
Sean Christopherson · Sep 21, 2026 · 3 files
KVM: Move check for existing vCPU ID to the top of vCPU creation
Sean Christopherson · Sep 21, 2026 · 1 files
Revert "KVM: Check for duplicate vcpu_id as early as possible"
Sean Christopherson · Sep 21, 2026 · 2 files
KVM: WARN if vCPU creation is in-progress when locking all vCPUs
Sean Christopherson · Sep 21, 2026 · 1 files
Bluetooth: hci_core: free the HCI ID if naming fails
Sang-Hoon Choi · Sep 21, 2026 · 1 files
cpufreq: intel_pstate: Fix max_freq fallback in cpufreq_update_pressure()
Rafael J. Wysocki · Sep 21, 2026 · 3 files
Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
Linmao Li · Sep 22, 2026 · 2 files
Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
Chandrashekar Devegowda · Sep 22, 2026 · 1 files
Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
Chandrashekar Devegowda · Sep 22, 2026 · 1 files
Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
Chandrashekar Devegowda · Sep 22, 2026 · 1 files
octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled
Geetha sowjanya · Sep 22, 2026 · 3 files
octeontx2-af: mcs: Fix SC resource cleanup loop
Baha Mesleh · Sep 22, 2026 · 1 files
Bluetooth: btintel: validate DDC record lengths
Sai Teja Aluvala · Sep 22, 2026 · 1 files
net/mctp: publish the mctp_dev only after it is initialised
Binbin Deng · Sep 22, 2026 · 1 files
wifi: mac80211: reject invalid 320 MHz CSA bandwidth
Ruide Cao · Sep 22, 2026 · 1 files
netfilter: bpf: reject invalid NAT manipulation types
Fernando Fernandez Mancera · Sep 22, 2026 · 2 files
audit: fix exe mark UAF in kill_rules()
Jérémy Jean · Sep 22, 2026 · 1 files
MAINTAINERS: add missing entry for b53.rst
Christian Melendez · Sep 22, 2026 · 1 files
net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
Florian Fainelli · Sep 22, 2026 · 1 files
net: systemport: Fix RUNT MIB counter register offset calculation
Florian Fainelli · Sep 22, 2026 · 1 files
MAINTAINERS: update Eric Dumazet's email address
Eric Dumazet · Sep 23, 2026 · 2 files
netfilter: flowtable: generalize pending status bit
Pablo Neira Ayuso · Sep 23, 2026 · 4 files
net: stmmac: fix rx Scatter-Gather support
Lorenzo Bianconi · Sep 23, 2026 · 1 files
ipv6: fix prefix route expiry in modify_prefix_route()
Qishuai Liu · Sep 23, 2026 · 1 files
net: phy: aquantia: fix system interface type not updated in forced mode
Bartosz Golaszewski · Sep 23, 2026 · 1 files
netfilter: flowtable: restore ieee80211 forward path
Pablo Neira Ayuso · Sep 23, 2026 · 3 files
of: Put coreboot node after compatibility check
Yuho Choi · Sep 24, 2026 · 1 files
net: gso: limit recursive IP-in-IP segmentation
Zihan Xi · Sep 24, 2026 · 4 files
pfcp: fix socket lifetime on netdevice registration failure
Xuanqiang Luo · Sep 24, 2026 · 1 files
net/mlx5: Fix slab-out-of-bounds when handling team device events
Anirudh Virdi · Sep 24, 2026 · 1 files
net/sched: cls_api: reclaim an empty proto on the error path
Jamal Hadi Salim · Sep 24, 2026 · 1 files
net: bcmgenet: allocate RX buffers as page fragments
Nicolai Buchwitz · Sep 24, 2026 · 2 files
net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence
Yoshihisa Yamamoto · Sep 24, 2026 · 1 files
net: fix checksum offsets in skb_splice_from_iter()
Alireza Asgari · Sep 24, 2026 · 1 files
selftests: net: cover UDP splice checksum fragment alignment
Alireza Asgari · Sep 24, 2026 · 3 files
tipc: prevent GCM nonce reuse on peer key changes
Jérémy Jean · Sep 24, 2026 · 1 files
net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
Sandeep Haemoon · Sep 24, 2026 · 1 files
tcp: refresh TS.Recent for accepted old ACKs
Jeff Jo · Sep 24, 2026 · 1 files
selftests: net: check timestamp echo after an old ACK
Jeff Jo · Sep 24, 2026 · 1 files
wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()
Cen Zhang (Microsoft) · Sep 25, 2026 · 2 files
net: microchip: vcap: stop scanning after deleting key field
Harshit Mogalapalli · Sep 25, 2026 · 1 files
r8169: disable EEE on RTL8168h/8111h
Oleksij Rempel · Sep 25, 2026 · 1 files
rust: net: netlink: validate attribute length before casting to `c_int`
Sagar Taunk · Sep 25, 2026 · 1 files
gve: DQO: accept TSO packets with non-protocol gso_type bits
Hannu Varjoranta · Sep 25, 2026 · 1 files
net/packet: prevent TX_RING byte count overflow
Ilkka Lappeteläinen · Sep 25, 2026 · 1 files
net: usb: qmi_wwan: add Rolling Wireless RN947R
Reinhard Speyerer · Sep 25, 2026 · 1 files
seg6: ensure packet data is writable before modifying SRH and IPv6 DA
Andrea Mayer · Sep 25, 2026 · 1 files
net: ethtool: let tsconfig reach a PHY-only timestamp provider
Nicolai Buchwitz · Sep 25, 2026 · 2 files
net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
Eric Dumazet · Sep 25, 2026 · 1 files
net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
Mina Almasry · Sep 25, 2026 · 1 files
KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
Sean Christopherson · Sep 25, 2026 · 1 files
KVM: selftests: Extend nested x2APIC test to validate disabling x2APIC virt
Sean Christopherson · Sep 26, 2026 · 1 files
sctp: check RCV_SHUTDOWN after the sendmsg connect wait
Jun Yang · Sep 26, 2026 · 1 files
wifi: mac80211: set info->band for 802.3 encap offload frames
Felix Fietkau · Sep 26, 2026 · 1 files
net: extend IPv6 exthdr detection of tunneled packets
Willem de Bruijn · Sep 26, 2026 · 1 files
crypto: x86/aes-gcm - fix always true check for last AAD segment
Mohamad Raizudeen · Sep 26, 2026 · 1 files
net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
Prathamesh Deshpande · Sep 26, 2026 · 1 files
Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
Chengfeng Ye · Sep 26, 2026 · 1 files
Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
Chengfeng Ye · Sep 26, 2026 · 1 files
Bluetooth: RFCOMM: Fix initial port reference race
Chengfeng Ye · Sep 26, 2026 · 1 files
Bluetooth: hci_sync: Fix inquiry cache use-after-free
Chengfeng Ye · Sep 26, 2026 · 1 files
Bluetooth: hci_core: Serialize fragmented ISO packet queueing
Chengfeng Ye · Sep 26, 2026 · 1 files
net/sched: fq_codel: match the no-drop threshold to the packet size
Jamal Hadi Salim · Sep 26, 2026 · 1 files
net/sched: sch_codel: match the no-drop threshold to the packet size
Jamal Hadi Salim · Sep 26, 2026 · 1 files
Bluetooth: Serialize SMP remote OOB data access
Chengfeng Ye · Sep 27, 2026 · 3 files
Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
Chengfeng Ye · Sep 27, 2026 · 1 files
Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
Nguyen Ngoc Thang · Sep 27, 2026 · 1 files
net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values
Yongzhao Chen · Sep 27, 2026 · 1 files
sysctl: Negate before converting in the int read path
Zhan Xusheng · Sep 28, 2026 · 1 files
time/jiffies: Saturate in mult_hz() instead of wrapping
Zhan Xusheng · Sep 28, 2026 · 1 files
net: sparx5: skip ptp deinit if init was skipped
Quentin Freimanis · Sep 28, 2026 · 1 files
net: sparx5: make ports inherit the switch base mac address type
Quentin Freimanis · Sep 28, 2026 · 3 files
octeontx2-pf: Fix RSS indirection table size
Jari Seppälä · Sep 28, 2026 · 1 files
net: bcmgenet: fix NULL dereference in set_coalesce before first open
Nicolai Buchwitz · Sep 28, 2026 · 1 files
net: cap skb->queue_mapping when the tx queue is picked
Jamal Hadi Salim · Sep 28, 2026 · 6 files
KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
Sean Christopherson · Sep 28, 2026 · 1 files
KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
Sean Christopherson · Sep 28, 2026 · 1 files
ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
Eric Dumazet · Sep 28, 2026 · 1 files
KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
Fuad Tabba · Sep 29, 2026 · 1 files
KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs
Fuad Tabba · Sep 29, 2026 · 1 files
KVM: arm64: Use the host's HCR_EL2 for non-protected VMs in pKVM
Fuad Tabba · Sep 29, 2026 · 3 files
KVM: arm64: selftests: Check a feature hidden in an ID register is UNDEF
Fuad Tabba · Sep 29, 2026 · 2 files
KVM: arm64: vgic: Allow last_lr_irq to be NULL when LRs are not overflowing
Marc Zyngier · Sep 29, 2026 · 3 files
KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
Marc Zyngier · Sep 29, 2026 · 1 files
KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor
Marc Zyngier · Sep 29, 2026 · 1 files
net: mvneta: clear XDP pfmemalloc flag between frames
Lorenzo Bianconi · Sep 29, 2026 · 2 files
KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
Mostafa Saleh · Sep 29, 2026 · 1 files
crypto: aes - Fix undesired override of some optimized AES modes
Eric Biggers · Sep 29, 2026 · 1 files