Daily update · Oct 16–17, 2026

Linux mainline update: memory-safety fixes, GPU/DRM improvements, audio and PCI NVMe readiness

Today's batch closes several use-after-free races, stabilizes Intel Xe and AMD audio, and adds PCI quirks for Samsung NVMe drives.

#audio #gpu #pci #qualcomm #rcu #use-after-free

115 meaningful commitsDaily snapshot

In brief

This daily mainline update covers core kernel memory-safety fixes, GPU/DRM reliability changes, audio resume fixes, and platform/PCI updates. Several patches address RCU-related use-after-free bugs in filesystems and notification paths.

Core kernel and memory safety

Fix initramfs memory leak after pivot_root on SMP systems

Idle threads on secondary CPUs kept a reference to the initial filesystem, so unmounting the initramfs after pivot_root left 70-150MB permanently allocated. The commit makes idle threads share init_fs.

Why it matters: Systemd users no longer lose that memory to an unreclaimable initramfs after boot.

d2bdb9b61b42

Prevent suspend hangs caused by exiting pid namespaces

When a pid namespace init exits while outside tracers hold zombie tasks, cleanup waited forever and the freezer gave up after 20 seconds. The wait loops are now freezable.

Why it matters: Container hosts and systems using suspend are less likely to fail to suspend when processes in containers are traced.

81933038f5e2

Start printk console kthreads later to avoid boot hangs

NBCON console printing kthreads were started too early and could interfere with SMP setup, causing boot hangs on some machines. Their startup is postponed until after arch initialization.

Why it matters: Users with intermittent SMP boot hangs may see reliable boots again.

5f339c46f153

Prevent locked mount bypass via mount namespace file

A mount of a mount namespace file was omitted by copy_tree(), allowing a user-namespace root to move it beneath a locked mount and escape the lock. The mount is now rejected in that situation.

Why it matters: Strengthens protections for locked mounts used in container and mount namespace isolation.

69fbe94f80bc

Fix use-after-free in casefolded filesystems

The Unicode casefold map was freed while RCU pathwalks could still access it, causing potential crashes in ext4, f2fs, and tmpfs. The map is now freed after a grace period.

Why it matters: Users mounting those filesystems with casefold enabled get a rarer crash condition fixed.

a96c5299bd73

Fix ext4 use-after-free when RCU symlink pathwalk races unmount

ext4 now frees the superblock info after a grace period instead of immediately clearing it, so RCU pathwalks still in ext4_get_link cannot touch freed memory.

Why it matters: ext4 users avoid rare crashes or KASAN reports when a symlink lookup races with the last unmount.

c17b44266a1f

Fix tracefs eventfs use-after-free during RCU pathwalk

eventfs inodes are now freed after an RCU grace period instead of only an SRCU grace period, matching the RCU read-side used by tracefs_d_revalidate.

Why it matters: Tracing filesystem users avoid a rare use-after-free when a dentry is evicted during an RCU pathwalk.

6e6928b39668

Fix pipe FASYNC use-after-free on failed writer setup

pipe_fasync now preserves existing reader fasync entries if adding the writer entry fails. Previously the reader entry was removed, and later pipe notifications could dereference a freed file.

Why it matters: Closes an unprivileged-triggerable slab-use-after-free in pipe notification handling.

40bb03d3ea6f

Fix watch_queue note pool publication race

watch_queue_set_size now publishes the new note pool with proper ordering so a concurrent poster cannot read the new note count before the note array exists.

Why it matters: Keyctl watch users avoid a race that an unprivileged user could trigger into a kernel crash.

5e531d62f1f8

Fix fsnotify race that could crash inotify users

A new mark could be inserted while the fsnotify connector was being torn down, causing a NULL pointer dereference during fdinfo reads. Mark additions are now prevented during connector teardown.

Why it matters: Applications relying on inotify, such as file browsers and backup tools, are less likely to trigger a kernel crash.

36ebddca56b9

Ignore autofs notification errors from replaced pipes

An error from writing to an old notification pipe could incorrectly put autofs into catatonic mode and close the new daemon pipe. Errors from pipes that have been replaced are now ignored.

Why it matters: Automount setups (e.g., NFS) won't lose their autofs daemon unexpectedly during a daemon restart.

65676cd4203c

GPU and DRM

Zero Intel Xe OA buffer to stop kernel memory disclosure

OA buffers are zeroed at allocation because kernel-type BOs may reuse stale pages and the buffer is mmapable to userspace.

Why it matters: Intel GPU users get a fix for a memory-disclosure issue in the Xe OA performance counter interface.

fd8662823caa

Fix Intel Xe memory shrinker accounting and eviction edge cases

Pinned BOs no longer change shrinker page counts while pinned, and BOs without a TTM resource are skipped during eviction instead of dereferencing NULL.

Why it matters: Intel Xe users see more stable memory management and avoid faults with pinned or imported buffers.

ffbfd3f98f43 448e76cbdc66

Keep shared Intel Xe buffers from being evicted too eagerly

External BOs shared across VMs are now bumped on exec and rebind, just like private BOs, rather than staying at stale LRU positions.

Why it matters: Shared-buffer and multi-VM workloads on Intel Xe should see fewer unnecessary evictions and stalls.

d2ce8fcd778e

Revert debug default that broke Qualcomm GPU buffer imports

The default-on DMABUF_DEBUG option enabled an sg_table wrapper that zeroed sg->length and stripped page pointers, silently breaking drm/msm imported buffer mappings.

Why it matters: Qualcomm/Adreno GPU users on debug-enabled distro kernels get working DMA-BUF imports again.

5e0ed1108504

Reset virtio-gpu before deleting virtqueues on suspend

virtgpu_freeze now resets the device before deleting virtqueues, preventing the device from staying DRIVER_OK with vrings pointing into freed memory.

Why it matters: virtio-gpu users get safer suspend/resume behavior without stale device queue state.

8907eb42c08b

Work around SDMA hangs on Polaris GPUs

Random SDMA hangs, especially frequent when Mesa uses SDMA on Polaris 10, are mitigated by adding NOP packets before POLL_REGMEM and FENCE packets.

Why it matters: AMD Polaris owners using the open-source driver should experience fewer GPU hangs.

752480ad6296

Return GPU BO alignment in bytes in GEM_LIST_HANDLES

The ioctl returned alignment in pages rather than bytes, so tools like CRIU could recreate BOs with incorrect alignment. It now matches the documented and GEM_CREATE behavior.

Why it matters: GPU checkpoint/restore users on AMD hardware get correct alignment info.

d65a459dbc9a

Enable zero fan stop temperature on SMU 14.0.2 GPUs

Adds support for configuring a zero RPM fan stop temperature on AMD GPUs using the SMU 14.0.2 power management controller.

Why it matters: Users with supported newer AMD graphics cards can let fans stop at idle, reducing noise.

a2eae9f4fa1b

Fix Rockchip NPU accel driver unbind and probe failure paths

rdev is now cleared on init failure, and core slot searches no longer shrink as cores are removed, so NULL or error-pointer dereferences are avoided.

Why it matters: RK3588 NPU users can safely bind and unbind NPU cores without kernel crashes.

4ac852419f0d 6eff1d69dae8 89c2c777df17

Audio

Fix IOMMU page faults on AMD audio controller resume

The AMD ACP driver clears the MSI enable bit before reinitializing audio hardware on resume, because firmware may restore stale MSI address/data registers.

Why it matters: AMD laptop users avoid IOMMU IO_PAGE_FAULT errors and related audio issues after suspend/resume.

2a31b5378c6d

Fix PipeWire recovery after underruns on Intel AVS audio

The HDA stream is now reset only when it is already prepared, so the PipeWire drop/prepare recovery path works instead of repeating the same failure.

Why it matters: Users on Intel AVS hardware, such as the Pixelbook, no longer lose audio for minutes after an underrun.

f6be9f558a83

Fix SOF crash on aggregated SoundWire capture streams

When channel count is smaller than device count, the same channel mask is applied to all devices instead of computing a zero step and underflowing GENMASK.

Why it matters: Aggregated SoundWire/ALH capture streams no longer trigger a UBSAN shift-out-of-bounds or kernel oops.

746de48c3a25

Fix Raspberry Pi HDMI audio infoframe warning when audio starts before video restore

Packet RAM is now enabled via PM runtime, so audio infoframes can be written even if video has not yet been restored.

Why it matters: Raspberry Pi users avoid kernel warnings and splats around HDMI audio after hotplug or resume.

3f57b34485dc

Platform and PCI

Fix spurious reboot after shutdown on AMD laptops with ACPI _AEI

pinctrl-amd now clears S4 wake bits when firmware exposes ACPI GPIO events. A leftover wake bit on GPIO 24 caused the machine to power back on immediately after shutdown.

Why it matters: Affected laptops such as the Chuwi CoreBook Plus stay off after shutdown instead of unexpectedly rebooting.

1cca81a683da

Harden Intel DMC firmware parsing and load address checks

DMC firmware size conversion is checked for overflow, zero-sized payloads and MMIO counts are rejected, and the version 3 load address is range-checked.

Why it matters: Malformed or corrupt Intel DMC firmware is less likely to cause memory corruption or invalid MMIO writes.

8bb1858db453 7dedc5bb11f9

Fix Arrow Lake-S host bridge detection for HDMI TMDS settings

Host bridge detection previously checked the PCI ID after the loop had already exited with pdev NULL, so it always returned false; the check now happens inside the loop.

Why it matters: Arrow Lake-S systems get correct HDMI TMDS register values instead of the wrong tx_misc setting.

6a8bf59de3ef

Fix GPIO interrupt target width on Qualcomm TLMM platforms

Several TLMM drivers used the default three-bit interrupt target mask where the field is four bits wide. The leftover bit could route interrupts to the wrong processor and prevent the summary interrupt from firing.

Why it matters: GPIO-driven peripherals on Nord, Hawi, Maili, and QCS8300 platforms now get working interrupts.

68ab4a6a84b9 9d4c3e0c6a53 912df33f296e dcb5df182b37

Enable missing PWM muxing on Qualcomm IPQ5018 routers

Missing pwm2/pwm3 mux slots and PWM groups are added for GPIOs used by router LEDs and fans.

Why it matters: Owners of GL.iNet, Linksys, and Xiaomi AX3000T routers can use PWM LEDs and fans through Linux.

c6c159fcdb4e 65db42a9fae0 709ba1c547ea

Fix Qualcomm SPMI GPIO direction leaving pads in dual mode

The direction callbacks now clear the opposite buffer, so a pad left in DIGITAL_INPUT_OUTPUT by the bootloader does not stay driving and direction reads are accurate.

Why it matters: PMIC GPIO users avoid regulator setup failures and misreported GPIO directions on Qualcomm platforms.

19fc4240358b

Add PCI quirk for Samsung 990 PRO and 990 EVO Plus NVMe immediate readiness

These Samsung NVMe drives advertise PCI immediate readiness but can briefly return invalid values after a function-level reset, breaking VFIO passthrough. A quirk makes the PCI core wait properly for these devices.

Why it matters: Users with Samsung 990 PRO or 990 EVO Plus SSDs may see reliable behavior with VFIO passthrough and avoid reset-related failures.

0f8b5d90d179

Fix PCI device readiness check when reads return 0xFFFFFFFF

PCI device readiness with RRS Software Visibility now treats reads of ~0 as not-ready, preventing the kernel from stopping early before the device is actually ready. This addresses problems seen with certain Intel and Samsung NVMe SSDs.

Why it matters: Systems with affected NVMe drives may avoid spurious timeout or initialization failures during boot, reset, or hotplug.

e8df1d194c39

Source commits115 entries +

4ac852419f0d

accel/rocket: clear rdev on device init failure

Guangshuo Li · Jul 8, 2026 · 1 files

fbfd6d0d3596

pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions

Shawn Guo · Aug 30, 2026 · 2 files

6eff1d69dae8

accel/rocket: search every core slot when a core is removed

Igor Paunovic · Sep 4, 2026 · 3 files

818103dc7f59

pinctrl: qcom: ipq5210: Publish the OF module alias

hpp.iscas · Sep 5, 2026 · 1 files

89c2c777df17

accel/rocket: search every core slot when looking up a scheduler

Igor Paunovic · Sep 5, 2026 · 1 files

b5629f4a0869

drm/amdgpu: fix sched entity leak in ttm buffer entity init

Perry Yuan · Sep 10, 2026 · 1 files

5b0a459f990b

drm/amdgpu: destroy mutex when tearing down ttm buffer entity

Perry Yuan · Sep 10, 2026 · 1 files

3c516a564628

drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl

Perry Yuan · Sep 10, 2026 · 1 files

a0777b9e5315

tracing: Fix NULL dereference when copying keys for a field variable

Donggeun Yoo · Sep 14, 2026 · 1 files

2afe7575fb24

tracing: Take trace_types_lock when dropping the buffer_meta reference

David Carlier · Sep 14, 2026 · 1 files

3f23cae09a46

ring-buffer: Do not show buffer_meta for CPUs without a buffer

David Carlier · Sep 14, 2026 · 1 files

647c2f97fcb9

tracing: Fix the shift out of bounds in the log2 histogram modifier

Donggeun Yoo · Sep 16, 2026 · 1 files

68ab4a6a84b9

pinctrl: qcom: nord: fix GPIO interrupt target width

Zhangfei Gao · Sep 16, 2026 · 1 files

55a67aa89342

drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions

Srinivasan Shanmugam · Sep 17, 2026 · 1 files

9d4c3e0c6a53

pinctrl: qcom: hawi: Fix intr_target_width

Konrad Dybcio · Sep 17, 2026 · 1 files

912df33f296e

pinctrl: qcom: maili: Fix intr_target_width

Konrad Dybcio · Sep 17, 2026 · 1 files

dcb5df182b37

pinctrl: qcom: qcs8300: Fix intr_target_width

Konrad Dybcio · Sep 17, 2026 · 1 files

25132363c723

ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()

Donggeun Yoo · Sep 18, 2026 · 1 files

6a8bf59de3ef

drm/i915/cx0_phy: Fix ARL-S host bridge detection

Dnyaneshwar Bhadane · Sep 21, 2026 · 1 files

c6c159fcdb4e

pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13

Gilberto Conde · Sep 21, 2026 · 1 files

8bb1858db453

drm/i915/dmc: Harden DMC firmware payload parsing

Dibin Moolakadan Subrahmanian · Sep 22, 2026 · 1 files

7dedc5bb11f9

drm/i915/dmc: Add sanity check for DMC load address

Dibin Moolakadan Subrahmanian · Sep 22, 2026 · 2 files

c902b6d70984

tracing: Fix empty symbol names in simple_ring_buffer undef check

Vincent Donnefort · Sep 23, 2026 · 1 files

ba875c448335

tracing: Fix simple_ring_buffer undef check on parisc

Vincent Donnefort · Sep 23, 2026 · 1 files

0fa993581aaa

tracing: Fix simple_ring_buffer undef check on sparc64

Vincent Donnefort · Sep 23, 2026 · 1 files

89bab1dba8a0

ring-buffer: Fix false warning in ring_buffer_map_get_reader()

Krystian Kaniewski · Sep 24, 2026 · 1 files

5e0ed1108504

Revert "dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels"

Jianfeng Liu · Sep 26, 2026 · 1 files

8907eb42c08b

drm/virtio: Reset device before deleting virtqueues on freeze

Yuho Choi · Sep 26, 2026 · 1 files

19fc4240358b

pinctrl: qcom: spmi-gpio: make direction changes exclusive

Shawn Guo · Sep 27, 2026 · 1 files

65db42a9fae0

pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions

George Moussalem · Sep 28, 2026 · 1 files

3110d09bb98e

tracing: Fix ignored return value of resize_buffer_duplicate_size()

Dmitry Kandybka · Sep 28, 2026 · 1 files

9414ca3b99e5

tracing: Fix hist trigger timestamps for buffered events

Tengda Wu · Sep 29, 2026 · 1 files

36ebddca56b9

fsnotify: prevent mark additions during connector teardown

Kyle Zeng · Oct 2, 2026 · 2 files

40bb03d3ea6f

pipe: preserve existing fasync readers on writer setup failure

Kyle Zeng · Oct 2, 2026 · 1 files

3f57b34485dc

drm/vc4: hdmi: Move packet RAM enable to PM runtime

Dave Stevenson · Oct 2, 2026 · 1 files

709ba1c547ea

pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12

Adriel Santos · Oct 2, 2026 · 1 files

81933038f5e2

pid_namespace: make zap_pid_ns_processes() freezable

Aviv Vaknin · Oct 2, 2026 · 2 files

dbd674ccf30f

power: sequencing: qcom-wcn: power off WLAN at probe

François Roux · Oct 4, 2026 · 1 files

1cca81a683da

pinctrl: amd: Clear S4 wake bits when firmware has _AEI

Mario Limonciello · Oct 5, 2026 · 1 files

fd8662823caa

drm/xe/oa: Zero OA buffer at allocation

Bommu Krishnaiah · Oct 6, 2026 · 1 files

800ea86e83e1

drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set

Timur Kristóf · Oct 6, 2026 · 1 files

752480ad6296

drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang

Timur Kristóf · Oct 6, 2026 · 1 files

c5895eadf287

pinctrl: sunxi: dt: do not accumulate npins across probe attempts

Pablo Mazzini · Oct 7, 2026 · 1 files

fcbc48dc650d

gpio: nct6694: Mark the GPIO controller as sleeping

Ming Yu · Oct 7, 2026 · 1 files

26401a4999f1

drm/exec: don't immediately add prelocked obj to array of locked objs

Christian König · Oct 7, 2026 · 2 files

65676cd4203c

autofs: ignore notification errors from a replaced pipe

Sung Byeongchan · Oct 7, 2026 · 1 files

e415915c5258

Revert "drm/virtio: Add pixel blend mode property to cursor plane"

Dmitry Osipenko · Oct 7, 2026 · 1 files

746de48c3a25

ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture

Peter Ujfalusi · Oct 8, 2026 · 1 files

f90f8afb61be

ASoC: SOF: sof-client: Use event-handler mutex consistently

Peter Ujfalusi · Oct 8, 2026 · 1 files

a2eae9f4fa1b