Daily update · Oct 11–12, 2026
Linux 7.3-rc7 bug-fix batch: RISC-V, io_uring, NVMe, and more
A wide fix batch covers RISC-V errata and ptrace issues, io_uring memlock and restriction fallout, NVMe ZNS and multipath fixes, SPI clock/status bugs, plus XFS and regulator corrections.
In brief
Most of this batch is bug fixing, with RISC-V, io_uring, NVMe, and storage drivers getting the largest share of changes. It also includes the Linux 7.3-rc7 tag. The fixes cover memory-lock regressions, zone-reporting spec mismatches, errata workarounds, and several reset/error-path bugs.
Bug fixes
RISC-V: close shadow-call-stack, ptrace, and futex tagged-pointer holes
The kernel shadow call stack reload is now gated on sstatus.SPP instead of the user-writable tp register, CFI regset access is rejected when Zicfilp/Zicfiss are absent, ptrace regset buffers are zeroed before partial copyin, and futex atomics untag user pointers before the atomic access.
Why it matters: Prevents stale shadow-stack pointers, misleading CFI regsets, uninitialized ptrace data, and tagged-address atomic access on RISC-V.
RISC-V: vector context save plus string and unaligned access fixes
Vector save/restore asm declares datap read-write and drops a wrong vcsr output; ZBB strnlen avoids boundary wrap-around on huge counts; load_unaligned_zeropad() fixup now handles 32-bit loads instead of assuming 8-byte loads.
Why it matters: Fixes corrupted per-task vector state, wrong strnlen results with FORTIFY, and incorrect zero-padding on RV32 efficient-unaligned-access builds.
RISC-V: SiFive/T-Head errata and HSTATUS.HU cleanup
HSTATUS.HU is cleared during CPU init so hypervisor load/store instructions are not usable from U-mode; a SiFive MAL-9092 workaround adds fence.rw around HLV/HLVX/HSV; THEAD ghostwrite mitigation now selects RISCV_ALTERNATIVE_EARLY so the vulnerable state is recorded before boot alternatives are patched.
Why it matters: Reduces unintended guest-memory access from U-mode and ensures ghostwrite mitigation actually runs on affected T-Head CPUs when MAE errata is disabled.
RISC-V: uapi, build-config, and BPF patching fixes
The hwprobe MIPS vendor UAPI header replaces kernel-only BIT() with _BITULL(); SiFive errata are limited to 64-bit builds to silence a clang tautological warning; NR_CPUS no longer leaks the 64-bit default into rv32_defconfig; patch_map() handles read-only BPF execmem in vmalloc space.
Why it matters: Fixes userspace hwprobe compilation, clang 32-bit allmodconfig, rv32 early-boot hangs from an oversized NR_CPUS, and BPF JIT text patching on RISC-V.
io_uring: restore memlock exemptions and fix restriction/cancel behavior
SQ/CQ rings and provided-buffer rings are no longer charged to RLIMIT_MEMLOCK, undoing a region-API regression; disabled rings inherited from task restrictions still have register opcodes checked; cancellation no longer spins forever on local work the exiting task cannot run.
Why it matters: Avoids ENOMEM for unprivileged ring setup, closes a restriction bypass with IORING_SETUP_R_DISABLED, and prevents a do_exit busy-loop on DEFER_TASKRUN rings.
io_uring: populate BPF connect filter fields for 24-byte IPv6 addresses
The connect filter now treats SIN6_LEN_RFC2133 (24-byte sockaddr_in6) as enough to fill port and address fields, instead of requiring the full 28-byte structure.
Why it matters: Stops filters from being bypassed by using the shorter accepted IPv6 sockaddr length.
NVMe: zone-state correction, multipath revalidate, target fixes, and revert
The ZRASF Full/Read Only values are swapped back to spec; multipath revalidates zones after unfreezing the head queue to avoid lock-order inversion; nvmet returns Invalid Field for reservation-notification masks on invalid NSIDs and cleans up P2P memory with the right device; a prior 'do not reset in NEW state' change is reverted because the Apple driver needs more work.
Why it matters: Fixes wrong Report Zones results, a potential multipath deadlock, spec non-compliance in nvmet, a P2P cleanup bug, and a reset regression on Apple hardware.
564e46d9f6e8b3ce7572130fd99bc5b456fd4aa9c0f377a45755f1bd0217
UFS/SCSI: probe, reset, and device-reference fixes
UFS holds a clock reference across probe, cleans up MediaTek mPHY power-on failures, avoids unsafe CQTPy MMIO reads and redundant whole-queue sweeps during MCQ host reset, initializes qedi callback state before registration, and stops the SCSI changer from keeping scsi_device references to removable elements.
Why it matters: Prevents clock-gating crashes, stuck mPHY state, reset-time MMIO hazards, recovery slowdowns, qedi callback races, and SCSI device leak/rebind failures.
02a31783196378e04810542d375f3a5691dd27c0f718d3b3469fa055664b85de8b3a5eaa
SPI: DLL lock, status-opcode, and SG2044 error/speed fixes
NXP FlexSPI leaves stop mode before waiting for DLL lock; Cadence QSPI no longer keeps the default 0x05 RDSR opcode when polling is disabled for octal DTR; SG2044 NOR returns transfer errors and computes divider from device/controller clock limits.
Why it matters: Avoids hangs/timeouts on octal DTR, wrong status polling, silent SPI transfer failures, and overclocking on SG2044.
Regulator: range overflow, bulk-array ownership, and write-only register exposure
TPS6594/TPS65224 BUCK2-4 descriptors now use ARRAY_SIZE for n_linear_ranges; of_regulator_bulk_get_all() fills supply names into its own allocation and documents the caller's ownership; LTC3676 no longer allows reading write-only HRST/CLIRQ command registers.
Why it matters: Prevents out-of-bounds linear-range reads, uninitialized/leaked regulator bulk arrays, and an accidental board reset from debugfs register dumps.
zloop: zero only unread tail on short reads
Short reads from a zone backing file now zero only the bytes beyond the returned data instead of the whole bio request.
Why it matters: Prevents valid zone data from being clobbered and fixes fio zone-test failures (e.g. 'bad magic header').
x86/AMD: work around TLBI erratum #1718
AMD CPUs affected by possible TLB invalidation failure during INVLPGB/TLBSYNC are detected, and a software workaround is applied when no microcode fix is present.
Why it matters: Prevents stale TLB entries after kernel TLB flushes on affected AMD systems.
Input: ATI remote2 attribute fix and new xpad controllers
ati_remote2 handlers now convert from usb_interface instead of usb_device after attributes moved to the interface device; xpad gains IDs for the Corsair Novablade Pro and the newer 8BitDo Pro 2 Wired Controller for Xbox.
Why it matters: Fixes invalid device pointers in sysfs attribute handlers and makes these controllers show up with the correct gamepad identity.
XFS: exchange-range reflink flag and TO_EOF size fixes
Exchange-range stops transferring reflink flags based on the assumption that all mappings were moved, and the TO_EOF variant no longer manipulates file sizes in a way that leaves shared blocks beyond EOF.
Why it matters: Prevents in-place overwrites of shared blocks and post-EOF shared-block corruption after XFS_IOC_EXCHANGE_RANGE.
Landlock: remove __counted_by causing false FORTIFY panic
Dropping __counted_by from handled_masks avoids a clang 22/FORTIFY_SOURCE bogus buffer-overflow report during the second landlock_restrict_self() call.
Why it matters: Allows repeated Landlock restriction with clang-built FORTIFY kernels.
Source commits49 entries +
riscv: ptrace: reject CFI regset access when extensions are absent
Chen Pei · Aug 20, 2026 · 1 files
riscv: ptrace: Zero-initialize regset buffers before copyin
Zongmin Zhou · Aug 26, 2026 · 1 files
regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
Abhishek Ojha · Sep 2, 2026 · 1 files
riscv: fix load_unaligned_zeropad() fixup for RV32
Karl Mehltretter · Sep 7, 2026 · 1 files
scsi: ufs: core: Hold a clock reference across the probe
Naomi Chu · Sep 9, 2026 · 1 files
scsi: qedi: Initialize callback state before registration
Runyu Xiao · Sep 10, 2026 · 1 files
zloop: zero out only the unread tail of short reads
Shin'ichiro Kawasaki · Sep 16, 2026 · 1 files
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
Zongmin Zhou · Sep 17, 2026 · 1 files
nvmet: return Invalid Field for invalid NSIDs feature 82h
Guixin Liu · Sep 20, 2026 · 1 files
scsi: ufs: mediatek: Handle mPHY power-on failures
Pengpeng Hou · Sep 20, 2026 · 1 files
scsi: ch: Do not keep references to data transfer element devices
Ahmed Abdelhaleem Ahmed · Sep 22, 2026 · 1 files
Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
Bihaan Sen · Sep 25, 2026 · 1 files
scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
Stanley Jhu · Sep 28, 2026 · 1 files
scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
Stanley Jhu · Sep 28, 2026 · 1 files
spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock
Haibo Chen · Sep 28, 2026 · 1 files
nvme: fix swapped ZRASF zone state values for full and read only
Karl Bonde Torp · Sep 29, 2026 · 1 files
nvme-multipath: revalidate head zones after unfreezing the head queue
Palla Raghunath · Sep 30, 2026 · 1 files
nvmet: use the local P2P device on metadata allocation failure
Sang-Hoon Choi · Sep 30, 2026 · 1 files
regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
Ridham Khurana · Sep 30, 2026 · 1 files
regulator: of: fill in supply names in of_regulator_bulk_get_all()
Alexey Charkov · Sep 30, 2026 · 1 files
regulator: of: state who owns the array from of_regulator_bulk_get_all()
Alexey Charkov · Sep 30, 2026 · 1 files
spi: sg2044-nor: Return transfer errors
Han Gao · Sep 30, 2026 · 1 files
spi: sg2044-nor: Honor SPI clock limits
Han Gao · Sep 30, 2026 · 1 files
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
Ziyi Guo · Oct 1, 2026 · 2 files
spi: cadence-qspi: Fix status polling with octal DTR chips
Miquel Raynal · Oct 1, 2026 · 1 files
x86/CPU/AMD: Fix AMD TLBI Erratum #1718
Borislav Petkov (AMD) · Oct 2, 2026 · 3 files
Revert "nvme: do not reset controllers in NVME_CTRL_NEW state"
Keith Busch · Oct 5, 2026 · 1 files
riscv: vector: Fix output operands in context save
Aurelien Jarno · Oct 6, 2026 · 1 files
riscv: vector: Fix data pointer constraints in context save/restore
Troy Mitchell · Oct 6, 2026 · 1 files
riscv: limit sifive errata to CONFIG_64BIT
Arnd Bergmann · Oct 6, 2026 · 2 files
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
Zongmin Zhou · Oct 6, 2026 · 1 files
RISC-V: errata: Add SiFive MAL-9092 workaround
Yong-Xuan Wang · Oct 6, 2026 · 4 files
riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
Shao Mingyin · Oct 6, 2026 · 1 files
RISC-V: Clear HSTATUS.HU on CPU initialization
Yong-Xuan Wang · Oct 6, 2026 · 5 files
riscv: patch: fix handling of bpf-jit execmem addresses
Wei-Jie Hung · Oct 6, 2026 · 1 files
io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
Hengyu Liang · Oct 6, 2026 · 6 files
riscv: futex: untag the user pointer before the atomic access
Ziyi Guo · Oct 6, 2026 · 1 files
riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
Leo Yu-Chi Liang · Oct 7, 2026 · 1 files
xfs: stop exchanging reflink flags when exchanging mappings
Norbert Szetei · Oct 7, 2026 · 3 files
xfs: fix exchange-range-to-eof file size exchange
Darrick J. Wong · Oct 7, 2026 · 2 files
spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi
Jisheng Zhang · Oct 8, 2026 · 1 files
io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
Jens Axboe · Oct 8, 2026 · 1 files
io_uring/cancel: don't spin on local work the task can't run
Cen Zhang (Microsoft Security FORGE Labs) · Oct 8, 2026 · 1 files
io_uring/register: don't exempt disabled rings from task restrictions
Eugene Gvozdetsky · Oct 8, 2026 · 3 files
io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
Natasha Klaus · Oct 9, 2026 · 1 files
Input: xpad - add support for Corsair Novablade Pro
Krzysztof Furman · Oct 9, 2026 · 1 files
Input: ati_remote2 - fix type confusion in device attribute handlers
Haotian Zhang · Oct 9, 2026 · 1 files
landlock: Drop __counted_by from landlock_domain.handled_masks
Nguyen Ngoc Thang · Oct 10, 2026 · 1 files
Linux 7.3-rc7
Linus Torvalds · Oct 12, 2026 · 1 files