Daily update · Oct 18–19, 2026
Linux 7.3 lands with storage, scheduler, and perf fixes
A broad round of mainline fixes hardens iSCSI handling, fixes CPU hotplug event migration, and addresses several I2C/SPI/regmap driver bugs.
In brief
This mainline batch is dominated by bug fixes in storage and SCSI paths, including iSCSI PDU validation and tape/remove races, along with scheduler and perf corrections. Several regmap, I2C, SPI, and firewire driver fixes also landed, and the tree has been tagged as Linux 7.3.
Storage and SCSI fixes
SCSI tape: fix use-after-free and partition position
st_remove() drops the last reference before removing the tape from the lookup table, so a concurrent open can find freed memory. Separately, after a device reset the saved tape block is recorded under the wrong partition. Both are corrected.
Why it matters: Avoids a slab use-after-free on driver unload and prevents tape positioning errors after resets.
iSCSI: validate command tags from incoming PDUs
libiscsi trusted the ITT in Reject responses, management responses, and transport-parsed indexes with only an upper bound. A negative index reads before the command array, and a stale or unsolicited tag can name a task whose slot is NULL or already released. The patches add lower-bound and NULL checks.
Why it matters: Prevents crashes and use-after-free variants when an iSCSI target sends malformed or unsolicited PDUs.
iSCSI target: serialize discovery auth updates
Two concurrent configfs writes to the discovery AuthMethod parameter could free the same string twice. The update now takes the TPG access lock around lookup and replacement.
Why it matters: Avoids a double-free crash when changing iSCSI discovery authentication settings concurrently.
SCSI target: take delayed command lock with IRQs disabled
One workqueue path took delayed_cmd_lock with interrupts enabled while all other paths disabled them. The patch switches to the irqsave variant so no interrupt can nest on the same lock.
Why it matters: Closes a potential deadlock in ordered command handling.
Xen SCSI frontend: check shadow entry before dereferencing
A backend response with an in-range but unused request ID dereferences a NULL shadow slot. The frontend now checks the entry before testing its inflight flag.
Why it matters: Prevents a guest kernel crash from a buggy or malicious Xen SCSI backend.
libsas: avoid SMP command deadlock during host resume
Resuming a SAS host can trigger a SATA hard reset that issues an SMP command; that path called pm_runtime_get_sync(), which waits for the ongoing resume and deadlocks. The patch avoids the runtime PM wait on this path.
Why it matters: Fixes a hang when resuming systems with expander-attached SATA disks.
BSG: size reply buffers for UFS RPMB
bsg-lib always allocated 96-byte reply buffers, but UFS Advanced RPMB replies are 104 bytes. Transports can now pass the required size, and UFS BSG requests enough space for the header plus EHS bytes.
Why it matters: Prevents a buffer overrun from UFS RPMB and returns full replies to userspace.
Scheduler, futex, and entry fixes
sched: wake up preemption on scheduler class changes
When a queued task changes class (for example from CFS to RT), the scheduler did not always re-evaluate preemption, leaving an idle CPU with a runnable task. sched_change_end() now calls wakeup_preempt() for queued tasks.
Why it matters: Fixes lost wakeups reported under RCU torture, where a CPU idled with an RT task waiting.
sched/fair: fix overflow in EEVDF placement
place_entity() multiplies virtual lag by load+weight before dividing, and with scaled weights the intermediate product can overflow s64. The calculation is now done in a wider/ordered way to avoid the overflow.
Why it matters: Prevents incorrect task placement in corner cases with group scheduling and very small effective weights.
futex: use stable per-MM ID for shared futexes
A shared futex was keyed by the MM pointer, so a freed and reallocated MM at the same address could consume wakeups intended for another process. A unique 64-bit per-MM ID now identifies FUT_OFF_MMSHARED futexes.
Why it matters: Avoids lost or misdirected wakeups on shared futexes after an MM is reused.
entry: count deferred hrtimer rearm as part of timer interrupt
Lockdep saw the deferred clock-event reprogramming after an interrupt as a separate context, creating a huge number of lock chains and eventually exhausting the lockdep pool. It is now counted as part of the timer interrupt's hardirq context.
Why it matters: Keeps lockdep validation alive much longer on debug kernels instead of switching itself off after a couple of days.
Perf and x86 updates
perf: fix event migration during CPU hotplug
perf_pmu_migrate_context() removed group leaders from the rbtree while iterating it, so later groups were skipped and stayed on the dying CPU. It now walks the event list and filters by PMU context.
Why it matters: Ensures perf events are actually migrated when a CPU goes offline instead of running until teardown on the old CPU.
perf: keep cgroup event times correct across rotations
Multiplexed cgroup events lost their accumulated running time because perf_rotate_context() stopped updating cgroup time. The update is restored so rotation credits time properly.
Why it matters: Improves accuracy of time_running and scaled counts for cgroup-based perf events.
perf: separate per-user mlock gift from other locked-vm users
perf's per-user buffer 'gift' is charged to user_struct.locked_vm without RLIMIT_MEMLOCK checks, and other components have since reused that field as a general limit. The gift is now tracked separately.
Why it matters: Prevents perf's mlock budget from being conflated with unrelated locked-memory accounting.
perf/x86/uncore: correct DMR CXL CM invert filter
The Diamond Rapids CXL CM PMU puts its invert filter at config bit 21, but the generic event mask covered a different bit. A PMU-specific mask now includes bit 21 so inv=1 reaches the hardware.
Why it matters: Makes invert filtering work as intended on this uncore PMU.
x86/kcfi: fix failure decoding and silence assembler warning
With optimized kCFI checks, a failed check traps one byte past the original ud2, so the handler must step back to find the trap; it also decodes from the wrong IP. The FineIBT 'cs' prefix is now emitted as a raw byte to stop GNU as from warning.
Why it matters: Produces correct CFI failure reports and avoids build warnings on CONFIG_FINEIBT kernels.
Regmap, I2C, SPI, and firewire driver fixes
regmap: fix IRQ domain leak and cache lifecycle races
regmap IRQ creation now frees its irqdomain on error, debugfs is removed before cache teardown to avoid concurrent access, and the map lock is released during cache allocation so raw spinlocks are not held while allocating memory.
Why it matters: Avoids a leaked IRQ domain, a debugfs use-after-free, and lockdep 'invalid wait context' warnings on Apple GPIO and similar regmap users.
i2c: fix clock selection and runtime PM in several drivers
QCom Geni now keeps the platform's chosen source clock instead of always switching to 32 MHz, QCom CCI accumulates HALT_ACK reset requests instead of dropping one, Wondermedia uses devm_clk_get() to avoid a clock leak, and Xiic drops the devres runtime-PM conversion that caused a suspend/clock WARN.
Why it matters: Fixes HID keyboard/touchpad probe failures on X1E80100, lost CCI master resets, clock leaks, and remove-time WARN floods.
spi: fix chip-select handling and DMA bounce-buffer corruption
Tegra114's SPI driver deasserted the CS GPIO between transfers when cs_change was set, so later transfers in a message ran with the chip deselected. i.MX SPI allocated DMA bounce buffers rounded only to 4 bytes but DMA-mapped them rounded to cache line size, corrupting slab memory.
Why it matters: Fixes broken multi-transfer register reads with ADIS16470 on Tegra and slab corruption observed with mcp251xfd on i.MX8MP.
firewire: close split-transaction race
For split transactions both the response handler and the timeout callback can manipulate the same pending entry; a refactor let both run, causing a use-after-free. The response handler now leaves the entry alone when the timeout callback is already running.
Why it matters: Prevents a firewire core use-after-free under split-transaction timing races.
Release
Linux 7.3
The kernel version has been bumped to 7.3 in the top-level Makefile.
Why it matters: Indicates the mainline tree is now version 7.3.
Source commits33 entries +
scsi: target: iscsi: Fix race in discovery auth updates
Linfeng Sun · Aug 11, 2026 · 1 files
regmap: irq: Free the irqdomain we create
Mark Brown · Sep 1, 2026 · 1 files
i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
Wentao Liang · Sep 16, 2026 · 1 files
scsi: target: Disable interrupts while holding delayed_cmd_lock
Yu Zhang · Sep 27, 2026 · 1 files
scsi: libsas: Fix SMP IO deadlock during HA resume
Xingui Yang · Sep 28, 2026 · 1 files
sched/fair: Avoid overflow in place_entity()
Hui Su · Sep 28, 2026 · 1 files
i2c: qcom-geni: Restore the source-clock selection policy
Abel Vesa · Sep 28, 2026 · 1 files
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
Jann Horn · Sep 29, 2026 · 3 files
spi: tegra114: assert CS GPIO for every transfer in a message
Carlos Jones Jr · Oct 2, 2026 · 1 files
perf: Track the perf mlock gift separately
Lorenzo Stoakes (ARM) · Oct 3, 2026 · 2 files
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
Yehyeong Lee · Oct 5, 2026 · 1 files
regmap: Remove debugfs before cache teardown
Michael Reeves · Oct 6, 2026 · 2 files
regmap: Drop map lock during cache init and exit
Michael Reeves · Oct 6, 2026 · 3 files
scsi: st: Save the visited block for the partition the drive is in
Laurence Oberman · Oct 6, 2026 · 1 files
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
Yehyeong Lee · Oct 7, 2026 · 1 files
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
Yehyeong Lee · Oct 7, 2026 · 1 files
scsi: libiscsi: Validate the task named by a management response
Yehyeong Lee · Oct 7, 2026 · 1 files
perf/x86/intel/uncore: Fix DMR CXL CM invert filter
Guixiong Wei · Oct 8, 2026 · 1 files
spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible
Marc Kleine-Budde · Oct 9, 2026 · 1 files
spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()
Marc Kleine-Budde · Oct 9, 2026 · 1 files
x86/kcfi: Decode the kCFI check from the trap address
Kees Cook · Oct 12, 2026 · 1 files
x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
Kees Cook · Oct 12, 2026 · 1 files
i2c: qcom-cci: Fix HALT_ACK reset request being dropped
Loic Poulain · Oct 12, 2026 · 1 files
entry: Account the deferred hrtimer rearm as hardirq context for lockdep
Mikhail Gavrilov · Oct 13, 2026 · 1 files
scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
Stanley Jhu · Oct 13, 2026 · 7 files
sched/core: Call wakeup_preempt() for queued tasks during class change
K Prateek Nayak · Oct 13, 2026 · 1 files
perf: Fix perf_pmu_migrate_context() leaving events behind
Haris Okanovic · Oct 13, 2026 · 1 files
scsi: st: Fix use-after-free race between st_remove() and st_open()
Laurence Oberman · Oct 13, 2026 · 1 files
i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
Abdurrahman Hussain · Oct 14, 2026 · 1 files
perf: Update cgroup time when rotating multiplexed events
Antoine Huret · Oct 15, 2026 · 1 files
spi: imx: fix slab corruption from undersized DMA bounce buffers
Richard Leitner · Oct 15, 2026 · 1 files
firewire: core: fix race condition in split transaction handling
Takashi Sakamoto · Oct 18, 2026 · 1 files
Linux 7.3
Linus Torvalds · Oct 18, 2026 · 1 files