Daily update · Oct 9–10, 2026
Linux kernel: mount namespace hardening, audio fixes, and platform reliability
Mount namespace locking, fs-verity use-after-free, a wave of audio quirks, plus PCIe and Xen fixes.
In brief
This update tightens mount namespace isolation, fixes several mount propagation races, and closes a use-after-free in fs-verity. It also brings a broad set of audio driver improvements, including native DSD support, new laptop quirks, and SoundWire fixes, along with targeted platform fixes for PCIe AER, Xen dom0 DMA, ARM64 PMU, and em28xx.
Mount namespace and filesystem hardening
Fix mount namespace and automount locking bugs
Multiple fixes tighten mount locking: automounts can no longer be placed below mounts outside the caller's namespace, locked mounts cannot be expired by an ancestor's umount, and locks survive when propagated copies are moved beneath a cover.
Why it matters: Strengthens mount namespace isolation for containers and unprivileged user namespaces, preventing directory-reveal and namespace-confusion attacks.
Fix mount namespace and umount propagation races
Multiple fixes prevent busy or lazily-unmounted mounts from being silently unmounted, copied, or used to pin namespace resources, and close races that could expose files hidden by mounts.
Why it matters: Users who rely on bind mounts, mount namespaces, and umount in scripts or container runtimes should see fewer spurious EBUSY failures and avoid cases where an open file could outlive an unmounted filesystem or hidden files could be revealed.
6857e209015f7eb84d54fac58bacbf6be95932bf924166140febe278ec458189ab688f5a0b6f31a3c0b1b138e16fb1e8c640a01a78e4
Block reconfiguration of internal superblocks via fspick, remount, and umount
fspick(), mount(MS_REMOUNT), and umount() now refuse to target SB_NOUSER internal superblocks like the nullfs root of an empty mount namespace.
Why it matters: Prevents unprivileged namespace owners from changing global internal mount state, avoiding undefined behavior and potential isolation issues.
Prevent cross-user interference through shared nullfs roots
The nullfs root shared by kernel threads and empty mount namespaces is now read-only, cannot be watched, cannot take file locks, and readdir no longer holds its inode lock across page faults.
Why it matters: Avoids information leaks and denial-of-service where one process could observe or stall all other users of the shared kernel-thread directory.
Fix mount cycle leaks in UMOUNT_CONNECTED handling
Connected-mount handling was reworked so it no longer creates reference-count cycles between mounts, loop devices, and mount covers.
Why it matters: Prevents leaked mounts/loop devices and stale mount graphs for users doing namespace and loopback mount tricks.
Fix fsverity use-after-free during concurrent verification
struct fsverity_info is now freed after an RCU grace period, closing a race where two inodes doing fsverity lookups could access freed memory.
Why it matters: Users of fs-verity file integrity get a stability and security fix.
Audio driver updates
Add native DSD playback for Cambridge Audio streamers
The USB audio driver now recognizes the Cambridge Audio streamer's DSD-capable raw-data altsetting and exposes it as DSD_U32_BE, enabling native DSD64/128/256 playback.
Why it matters: Owners of compatible Cambridge Audio network players can play DSD files directly instead of falling back to PCM conversion.
Add HDA and ACP audio quirks for ASRock, HP, Acer, and ASUS laptops
New quirks fix headphone jack detection on ASRock NUC BOX-358H, enable mute LED on HP Pavilion 15-eg3xxx, register PDM DMICs on Acer Aspire Go 15, and override the ACP audio flag on ASUS ExpertBook AM7406CKA.
Why it matters: Users of these systems get working headphone detection, mute-LED feedback, internal microphones, and audio.
Improve speaker calibration on Lenovo laptops using TAS2781 amps
The HDA TAS2781 driver now accepts valid V1 calibration data when the TimeStamp and CRC fields are zero, which some Lenovo BIOSes leave blank.
Why it matters: Affected Lenovo Legion laptops no longer run speakers with default parameters, improving audio quality.
Add Cirrus SoundWire match entries for AMD ACP7.0 platforms
New ACP7.0 SoundWire match entries support cs42l43b plus cs35l57 amplifier combinations.
Why it matters: Enables audio on newer AMD laptops using these Cirrus Logic codecs.
Fix Cirrus amplifier feedback DAI on SoundWire
CS35L56/57/62/63 amp feedback now uses the SDCA OT25 stream on DP4 instead of the DP3 companion-amp DAI, with a DAI added for CS35L56.
Why it matters: Fixes amplifier feedback/AEC capture on laptops with Cirrus SoundWire amps.
Fix ADAU1372 codec mux defaults and sleepy GPIO handling
The codec's output ASRC and DAC source muxes are now initialized from valid register values, and powerdown GPIOs can sleep.
Why it matters: Fixes missing or corrupt audio output on ADAU1372 hardware and removes warnings when using I2C GPIO expanders.
Fix Samsung I2S clock imbalance at probe/runtime PM
op_clk is now enabled during probe so the first runtime suspend doesn't disable an already-disabled clock.
Why it matters: Eliminates boot-time I2S clock warnings on Exynos5250 Arndale.
Fix memory leak in Sound Blaster X-Fi DAO mapper cleanup
The ctxfi driver now frees the DAO input mapper array after clearing entries, fixing a leak introduced by a simplification commit.
Why it matters: Owners of Creative X-Fi sound cards will no longer leak kernel memory over time when using DAO features.
Platform and driver fixes
Fix swiotlb DMA limit for Xen dom0 non-growable pools
default_swiotlb_limit() now respects the actual default pool limit when the pool cannot grow, instead of returning the highest possible physical address.
Why it matters: Fixes rejection of 32-bit DMA devices in Xen dom0 after the swiotlb dynamic-pool regression.
Skip PCIe error recovery on false AER alarms
PCIe AER now checks whether any unmasked error was actually signaled before triggering recovery, avoiding resets when firmware raises a fatal-error alarm with empty status registers.
Why it matters: Fixes amdgpu probe failures and unnecessary GPU/root-port resets on systems with false firmware error reports.
Fix ARM64 PMUv3p9 EL2 trap configuration
The boot code no longer sets PMUv3p9 FGT2 bits when a CPU has an implementation-defined PMU, because those bits are reserved and could cause trapping problems.
Why it matters: ARM64 systems with non-standard PMU implementations are less likely to encounter EL2 trap or boot issues.
Fix em28xx device unregister warning for radio interfaces
The em28xx driver now uses video_unregister_device() for radio devices instead of the videobuf2 variant that requires a queue, avoiding a WARNING during device removal.
Why it matters: Users with em28xx-based TV/radio tuners should no longer see kernel warnings when the device is unbound or disconnected.
Source commits88 entries +
mmc: mtk-sd: Cancel request timeout work on remove
Yibo Tan · Sep 15, 2026 · 1 files
mmc: cavium-octeon: destroy slot platform devices on remove
Guangshuo Li · Sep 15, 2026 · 1 files
mmc: cavium-thunderx: destroy slot platform devices on remove
Guangshuo Li · Sep 15, 2026 · 1 files
mmc: sdhci-sprd: disable runtime PM on remove
Guangshuo Li · Sep 15, 2026 · 1 files
iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys
Peng Fan · Sep 16, 2026 · 1 files
pmdomain: rockchip: propagate subdomain add errors
Shawn Lin · Sep 21, 2026 · 1 files
pmdomain: rockchip: fix clock leak on domain probe failure
Shawn Lin · Sep 21, 2026 · 1 files
pmdomain: rockchip: don't ignore clock lookup errors on attach
Shawn Lin · Sep 21, 2026 · 1 files
pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
Ming Qian · Sep 21, 2026 · 1 files
media: em28xx: use video_unregister_device for radio_dev
Rohinthan P · Sep 23, 2026 · 1 files
mount: keep a copied mount unbindable
Christian Brauner · Sep 23, 2026 · 1 files
selftests/filesystems: check that a copied mount namespace keeps unbindable
Christian Brauner · Sep 23, 2026 · 3 files
mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount
Christian Brauner · Sep 23, 2026 · 1 files
selftests/move_mount_set_group: check that an unbindable target is refused
Christian Brauner · Sep 23, 2026 · 1 files
fs: don't silently unmount busy mounts
Christian Brauner · Sep 23, 2026 · 1 files
selftests/filesystems: check that a busy propagated copy blocks a synchronous umount
Christian Brauner · Sep 23, 2026 · 3 files
fs: don't let a migrating task hide its reference from do_umount()
Christian Brauner · Sep 23, 2026 · 2 files
docs: update the unmount propagation rule
Christian Brauner · Sep 23, 2026 · 1 files
memstick: core: wait for request completion before freeing card
Raj Ojha · Sep 24, 2026 · 1 files
namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
Christian Brauner · Sep 26, 2026 · 1 files
statmount: read the parent of an unmounted mount under mount_lock
Christian Brauner · Sep 26, 2026 · 1 files
namespace: don't inherit MNT_UMOUNT in clone_mnt()
Christian Brauner · Sep 26, 2026 · 2 files
namespace: don't copy an unmounted mount tree
Christian Brauner · Sep 26, 2026 · 1 files
namespace: check the target before walking it in do_mount_setattr()
Christian Brauner · Sep 26, 2026 · 1 files
fs: refuse fspick() on internal superblocks
Christian Brauner · Sep 26, 2026 · 1 files
fs: put the old fs_struct before the old namespaces in unshare()
Christian Brauner · Sep 26, 2026 · 1 files
namespace: drop the file's reference first in dissolve_on_fput()
Christian Brauner · Sep 26, 2026 · 2 files
selftests/filesystems: check that an unmounted mount tree isn't walked
Christian Brauner · Sep 26, 2026 · 4 files
selftests/filesystems: check that a dead mount's overmount isn't followed
Christian Brauner · Sep 26, 2026 · 3 files
arm64: irq: exclude the softirq stack switch from KCOV
Karl Mehltretter · Sep 26, 2026 · 1 files
swiotlb: fix default_swiotlb_limit() for non-growable default pool
Marek Szyprowski · Sep 30, 2026 · 1 files
arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
Fuad Tabba · Sep 30, 2026 · 1 files
namespace: queue a mount only once for mount notifications
Christian Brauner · Sep 30, 2026 · 2 files
namespace: check a submount for references right before unmounting it
Christian Brauner · Sep 30, 2026 · 1 files
selftests/filesystems: check that a busy submount survives a synchronous umount
Christian Brauner · Sep 30, 2026 · 2 files
namespace: check a recursive bind mount for mount namespace loops
Christian Brauner · Sep 30, 2026 · 1 files
selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace
Christian Brauner · Sep 30, 2026 · 3 files
namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
Christian Brauner · Sep 30, 2026 · 1 files
selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered
Christian Brauner · Sep 30, 2026 · 3 files
namespace: look at the topmost mount for a mount namespace file
Christian Brauner · Sep 30, 2026 · 1 files
selftests/filesystems: check that a mount namespace file on top doesn't bury a mount
Christian Brauner · Sep 30, 2026 · 3 files
namespace: check the mounts before reading their parents in pivot_root()
Christian Brauner · Sep 30, 2026 · 1 files
namespace: don't reconfigure internal superblocks via remount and umount
Christian Brauner · Sep 30, 2026 · 2 files
selftests/filesystems: check that the nullfs root can't be reconfigured
Christian Brauner · Sep 30, 2026 · 3 files
namespace: remove the fsnotify marks of a mount namespace in process context
Christian Brauner · Sep 30, 2026 · 1 files
dcache: don't put a mountpoint on a dentry that's being removed
Christian Brauner · Sep 30, 2026 · 1 files
unshare: don't drop active namespace references that were never taken
Christian Brauner · Sep 30, 2026 · 3 files
namespace: don't let a pseudo dentry become the root of a mount
Christian Brauner · Sep 30, 2026 · 1 files
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
Nguyen Ngoc Thang · Sep 30, 2026 · 1 files
ALSA: hda/tas2781: Accept V1 calibration data without CRC
Mohamed Yassine Jebabli · Oct 1, 2026 · 1 files
ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
Harin Lee · Oct 1, 2026 · 1 files
fsverity: RCU-delay the freeing of struct fsverity_info
Eric Biggers · Oct 1, 2026 · 2 files
ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H
Eckhart Mohr · Oct 1, 2026 · 1 files
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
Marek Szyprowski · Oct 2, 2026 · 1 files
ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers
Matus Gajdos · Oct 2, 2026 · 1 files
namespace: unhash a dentry before detaching the mounts on it
Christian Brauner · Oct 2, 2026 · 1 files
namei: don't reveal overmounted entries in refwalk
Christian Brauner · Oct 2, 2026 · 1 files
fcntl: refuse F_SET_RW_HINT on an immutable inode
Christian Brauner · Oct 2, 2026 · 1 files
selftests/filesystems: check that an immutable inode takes no write hint
Christian Brauner · Oct 2, 2026 · 3 files
namespace: refuse an automount below a mount that is in no namespace
Christian Brauner · Oct 2, 2026 · 1 files
namespace: handle mount locking for automounts correctly
Christian Brauner · Oct 2, 2026 · 1 files
nullfs: don't update the access time
Christian Brauner · Oct 2, 2026 · 1 files
namespace: never expire a locked mount
Christian Brauner · Oct 2, 2026 · 1 files
namespace: keep the lock on a mount that a propagated copy is moved beneath
Christian Brauner · Oct 2, 2026 · 1 files
selftests/filesystems: check that a lock lands on the right mount and stays
Christian Brauner · Oct 2, 2026 · 2 files
selftests/filesystems: check the atime of the empty mount namespace root
Christian Brauner · Oct 2, 2026 · 3 files
selftests/filesystems: check that an automount below an overlay layer is refused
Christian Brauner · Oct 2, 2026 · 3 files
fhandle: decide the subtree check under mount_lock
Christian Brauner · Oct 2, 2026 · 2 files
namespace: keep the private nullfs instance in knullfs
Christian Brauner · Oct 2, 2026 · 2 files
namespace: nothing is mounted on or written through knullfs
Christian Brauner · Oct 2, 2026 · 1 files
fsnotify: let a filesystem refuse marks on its objects
Christian Brauner · Oct 2, 2026 · 3 files
nullfs: refuse file locks
Christian Brauner · Oct 2, 2026 · 1 files
readdir: take no inode lock on an immutable directory
Christian Brauner · Oct 2, 2026 · 3 files
selftests/filesystems: add a helper that holds a readdir in a page fault
Christian Brauner · Oct 2, 2026 · 1 files
selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody
Christian Brauner · Oct 2, 2026 · 3 files
nullfs: add an empty immutable regular file
Christian Brauner · Oct 2, 2026 · 3 files
namespace: rework connected mounts
Christian Brauner · Oct 2, 2026 · 4 files
selftests/filesystems: test covered mounts
Christian Brauner · Oct 2, 2026 · 7 files
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)
Jaidheer Sirigineedi · Oct 2, 2026 · 1 files
namespace: simplify disconnect_mount()
Christian Brauner · Oct 4, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
Michael Garland · Oct 5, 2026 · 1 files
ASoC: cs35l56: Add DAI for SDCA OT25 stream
Richard Fitzgerald · Oct 5, 2026 · 3 files
ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI
Richard Fitzgerald · Oct 5, 2026 · 1 files
ASoC: adau1372: allow sleepy powerdown GPIOs
Alvin Šipraga · Oct 6, 2026 · 1 files
ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
Alvin Šipraga · Oct 6, 2026 · 1 files
ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA
Simon Trimmer · Oct 7, 2026 · 1 files
ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts
Simon Trimmer · Oct 7, 2026 · 1 files
PCI/AER: Skip error recovery on false alarms
Lukas Wunner · Oct 8, 2026 · 1 files