Weekly briefing · Aug 3–10, 2026
Linux mainline: week of Aug 3
A weekly briefing built from 7 published daily update(s).
In brief
This weekly briefing gathers the meaningful changes that entered Linux mainline over the previous seven days.
Bug fixes
PSI: fork psimon kthread outside cgroup_mutex to break deadlock
An earlier PSI fix made pressure_write() hold cgroup_mutex across psi_trigger_create(), which forks the psimon kthread. Because kthread creation depends on the whole fork path, this introduced broad locking dependencies. sched_ext's enable path blocks forks then grabs cgroup_mutex, so a pressure write racing a scheduler enable deadlocked and piled up every other fork.
Why it matters: Fixes a deadlock between PSI pressure writes and sched_ext enable; relevant for systems using sched_ext with PSI triggers.
PSI: shut down rtpoll_timer in psi_cgroup_free to avoid use-after-free
psi_schedule_rtpoll_work() is called locklessly from the scheduler hot path and can race psi_trigger_destroy(). A re-armed rtpoll_timer could remain pending after the group is freed, so poll_timer_fn() ran on freed memory. The fix explicitly shuts down rtpoll_timer in psi_cgroup_free().
Why it matters: Prevents a use-after-free in PSI rtpoll teardown during cgroup destruction.
sched_ext: fix cgroup_lock ordering deadlock
scx_cgroup_lock() write-locked scx_cgroup_ops_rwsem then took cgroup_lock(), which could deadlock through kernfs when cgroup rmdir and cpu.weight writes overlapped. Taking cgroup_lock() first removes the circular dependency.
Why it matters: Fixes a deadlock across sched_ext enable/disable, cgroup rmdir, and cpu.weight writes.
sched_ext: skip sub-disable teardown for never-linked sub-schedulers
A sub-scheduler enable can fail before being linked into the hierarchy, yet cleanup still ran the full scx_sub_disable(). That was racy against root disable and could cause a use-after-free where tasks exited to no scheduler. The fix skips teardown when the sub was never linked.
Why it matters: Avoids a use-after-free and WARN during sched_ext sub-scheduler enable failure racing root disable.
sched_ext: gate task enable on class in sub-sched loops
Root enable and fork only enable tasks already on the ext class, but the sub enable-commit and sub-disable re-home loops enabled unconditionally. A fair-class READY task could become ENABLED while not on sched_ext, later tripping state validation and calling ops.enable() twice.
Why it matters: Fixes invalid task state and double ops.enable() under SCX_OPS_SWITCH_PARTIAL with sub-schedulers.
sched_ext: reject disallow from init_task outside enable path
The p->scx.disallow revert assumed the root enable path, but the sub-scheduler disable path also reached it when re-initializing returned tasks on a root parent. Nothing reads the policy there, so the task kept running on the ext class with a silently rewritten policy. The fix kills the sched instead, matching fork and non-root branches.
Why it matters: Corrects sched_ext behavior when disabling sub-schedulers under a root parent; avoids silent policy rewriting.
sched_ext: mark waker CPU busy in WAKE_SYNC case
SCX's built-in idle tracking can be out of sync, especially right after enabling. scx_select_cpu_dfl() skipped marking the selected CPU busy when it was the waker CPU in WAKE_SYNC, so an idle-marked waker stayed idle and could be selected again. The fix explicitly marks the waker busy.
Why it matters: Fixes an allowed_cpus selftest failure and improves idle CPU tracking accuracy.
selftests/sched_ext: handle sleeping task affinity changes in numa test
When a sleeping task's affinity changed, task_cpu(p) could be outside p->cpus_ptr until wakeup selected a new runqueue, so numa_select_cpu() could pick a CPU outside the cpumask and fail with -EBUSY, causing the numa scheduler to exit with 'invalid CPU -16'. The fix accounts for the transient mismatch.
Why it matters: Stabilizes the sched_ext numa selftest under affinity changes.
KHO: align kho_scratch to MAX_ORDER_NR_PAGES pages
Booting with kexec handover (KHO) crashed in __free_one_page with a page fault because kho_scratch was not aligned to MAX_ORDER_NR_PAGES. The fix aligns the scratch allocation accordingly.
Why it matters: Fixes a boot-time page fault crash when using KHO.
fscrypt: use mount idmap for owner check in set_policy
fscrypt_ioctl_set_policy() used &nop_mnt_idmap instead of the actual mount's idmap, so on idmapped mounts it compared the caller's fsuid against the unmapped on-disk owner. The real owner could be denied -EACCES and an unrelated caller wrongly allowed. The fix uses file_mnt_idmap(filp).
Why it matters: Corrects encryption policy permission checks on idmapped ext4/f2fs mounts.
fsverity: remove unnecessary enabled check in setattr_prepare
The check for fs-verity being enabled in the kernel was unnecessary because filesystems can have fsverity files without fs-verity enabled, and the check did not actually prevent truncate in that case. The fix removes the check.
Why it matters: Cleanup of incorrect fsverity truncation guard; marked for stable.
Aspeed LPC snoop: fix usercopy overflow exposing kernel memory
The LPC snoop driver's IRQ handler and read path both access a kfifo without synchronization; on SMP the in/out indices can diverge beyond the buffer size, causing copy_to_user() to read past the kmalloc-2k backing store and trigger a kernel memory exposure abort.
Why it matters: Fixes a kernel memory disclosure path on multi-core Aspeed BMC systems using the LPC snoop interface.
mm: correct TLB flush address in direct page table reclaim
zap_pte_range passed addr to pte_free_tlb even though addr always points one past the end of the table's range, meaning architectures that use the flush parameter would invalidate the wrong paging-structure-cache entry.
Why it matters: Correctness fix for architectures relying on the TLB flush address; existing systems mostly worked by accident due to surrounding flush behavior.
Raspberry Pi 5: remove non-functional EL2 virtual timer
A prior arch_timer change defaulted to the EL2 virtual timer under VHE, but Broadcom confirmed the interrupt line was never connected on bcm2712, causing boot to hang. The corresponding DT node is removed.
Why it matters: Fixes boot hangs on Raspberry Pi 5 introduced by the arm_arch_timer default change.
BCM5301X: fix PCIe controller 2 interrupt and EA9200 NVRAM size
A copy-paste error mapped PCIe controller 2 interrupt 1 to GIC SPI 138 instead of 139; separately, the Linksys EA9200 NVRAM size was oversized, triggering a driver warning.
Why it matters: Corrects interrupt routing on BCM5301X routers and silences an NVRAM size warning on EA9200.
Glymur: correct ESPI interrupt mappings for PCIe SMMU and QUP serial engines
Glymur's PCIe SMMUv3 wired interrupts and QUP wrapper 0 serial-engine interrupts are routed to GIC extended SPI INTIDs but were described as regular SPIs, producing incorrect interrupt specifiers. Both commits correct them to ESPI-relative numbers.
Why it matters: Fixes interrupt descriptions on the Qualcomm Glymur platform since its initial introduction.
Purwa: remove unsupported GPU SID 1 from IOMMU property
Purwa's GPU does not support SID 1, used for LPAC traffic; including it caused a synchronous external abort in arm_smmu_write_s2cr under some Gunyah hypervisor versions.
Why it matters: Fixes a crash during GPU probe on Purwa IoT EVK with affected Gunyah versions.
sc8280xp: add missing PDC entries and fix gaokun3 EC interrupt pin
PDC mappings for interrupts 215, 256, and 257 were missing; on the Huawei gaokun3, the EC interrupt GPIO was incorrectly set to 107 instead of 103, causing a permanent interrupt storm and continuous event polling.
Why it matters: Fixes missing wake-capable interrupt routing on sc8280xp and stops an interrupt storm on the gaokun3 laptop.
Lenovo Yoga C630: lower PSCI cluster idle depth for stability
The default PSCI cluster idle suspend value caused instability, including resets when the display device was not probed early. Dropping bit 0x4000 yields a shallower sleep state but a stable system.
Why it matters: Improves stability on the Lenovo Yoga C630 at the cost of slightly higher suspend power use.
sm8650 IPA IMEM slice, eliza DSI1 phy clock, and monaco GIC address-cells
sm8650's IPA IMEM slice is corrected to match downstream; eliza's DSI1 PHY reference clock was copy-pasted with the wrong parent, which would produce incorrect PLL frequencies; monaco gets a missing #address-cells on its GIC node to silence a W=1 warning.
Why it matters: Fixes IPA modem tables on SM8650, corrects DSI1 PHY clocking on eliza, and clears a device tree warning on monaco.
amdgpu: JPEG reset fixes in DPG mode
In dynamic power-gating (DPG) mode, the JPEG engine's queue-reset path only cleared a power-gating bit and never reset a hung JPEG core, so recovery could time out. These patches temporarily force the static power-gating path so the stop/start sequence power-cycles the block, matching the v4.0 reset code.
Why it matters: More reliable recovery from hung JPEG engines on affected AMD GPUs.
amdgpu: command submission, coredump, and gfx12 hardening
Amdgpu gets several reliability fixes: oversized command buffers (IBs) are now rejected using per-ring packet limits, user-queue creation is serialized against GPU resets so MES timeouts don't fail valid creates, gfx12 reads the TRUNCATE_COORD_MODE register to report the conformant texture-coordinate flag, gmc12.1 TLB invalidation gains a semaphore and fixes an MMHUB0/1 typo, and coredump ring buffers are allocated per ring with vmalloc fallback so large dumps no longer fail as a single huge allocation. A lockdep false-positive in amdgpu_lockdep_init is also fixed.
Why it matters: Targets hangs, crashes, and missing crash-dump data on newer AMD GPUs, and restores a userspace-visible conformance flag on gfx12.
2d69604b4d0bcda6ab11c1a2384c1d907eebb77a725e50c8fd37f9dd5b5ab88a5a43c070e40ff9840fa85227c2c77c38
amdgpu display, teardown, and radeon fixes
Display and teardown paths get fixes: Cyan Skillfish disables DP audio spread-spectrum compensation because the hardware doesn't actually downspread, DCE110 checks that its timing-generator ops exist to avoid a NULL dereference on Southern Islands when turning off HDMI, self-refresh exit is allowed while entry is blocked, and the aperture iounmap is no longer skipped on device removal, which had left stale WB mappings that broke re-probe. A prior 'aperture mapping leak' fix is reverted because devres LIFO teardown could unmap the aperture before IP fini callbacks used it. The old radeon driver also restores hardware polling in fence_is_signaled, fixing a performance regression.
Why it matters: Avoids display-off crashes on older GPUs, re-probe failures, and a performance regression in radeon.
ff209cd04845b96c529cd2553141e3d61469f9e5f51549008099bd0864655f08eee9c3fb
Other DRM fixes (Panthor, V3D, Xe, ps8640)
Panthor and the shared GEM shmem helper now check VMA boundaries before installing PMD (2 MiB) huge-page mappings, avoiding a VM_BUG_ON for out-of-range faults; Panthor also skips zero-sized firmware sections instead of keeping NULL entries that crash reload and unplug. The ps8640 DisplayPort bridge propagates AUX transfer register errors, the V3D driver serializes its scheduler timeout handlers because a timeout on any queue triggers a global reset, and two Xe fixes cover a memory leak in exec-queue hang-replay state and missing RCS/CCS yield-policy application for SR-IOV virtual functions.
Why it matters: Mostly crash and hang fixes for Arm GPUs (Panthor, V3D), Intel Xe, and the ps8640 bridge chip.
2b8f13d3c7e2e0d2b5902c5c617bbd08714820697ecb299c4da94744707bc5f500161709d1643db3b037
pmbus core and LM25066 fixes
PMBus is a protocol for power-supply monitoring chips. The core driver now takes locks during probe-time SMBALERT mask setup and debugfs init, and fixes a type confusion in its notification loop where attributes could be misread as a different struct. The LM25066 driver fixes 32-bit overflow when scaling current/power coefficients for large shunt-resistor values from device tree.
Why it matters: Prevents races, crashes, and wrong current/power readings on supported PMBus devices.
Corsair PSU, LTC4282, and other hwmon fixes
Corsair PSU fixes cover a possible out-of-bounds string read in debugfs, a missing lock that allowed debugfs reads to land between another reader's rail-select and value read (reporting the wrong rail), and wrong decoding of negative temperatures in Linear11 format. The NZXT Smart2 driver now propagates initialization failures, ADS7828 properly gets and enables its external voltage-reference regulator, and LTC4282 gets fixes for a 32-bit overflow in maximum power, negative current limits wrapping to large values, and device-tree property parsing that checked the wrong variable.
Why it matters: Avoids wrong readings, hangs, and rare out-of-bounds access on these sensor and PSU devices.
d533882ce10636c4d73ce05d2da6050809d4c6c4234928d2fddb5ceaf901edd11a943357e253dd5f9f6d335698fd7f60
Watchdog fixes
Three watchdog driver fixes: atcwdt200 returns a proper error code when the watchdog is already enabled at probe instead of a bogus enum value, bd96801 computes heartbeat timeout limits correctly for watchdogs enabled at probe (the previous math used wrong multipliers), and at91sam9_wdt uses timer_shutdown_sync() on teardown so the ping callback can't rearm the timer after driver memory is freed.
Why it matters: Prevents probe failures, misconfigured watchdog timeouts, and use-after-free on teardown.
Qualcomm pinctrl fixes
Pinctrl drivers describe how each GPIO pin can be muxed to different functions. On IPQ9650, two audio MCLK groups pointed at the wrong GPIO, making those mux selections fail; they're corrected to gpio39. On IPQ806x, the GPIO function and the PCIe reset function are now marked as GPIO-mode functions, matching other Qualcomm drivers, so strict pinmux checks don't reject valid device-tree configurations.
Why it matters: Restores audio MCLK muxing on some IPQ9650 boards and prevents pinmux rejections on IPQ806x.
ATA fixes
libata-core adds a quirk disabling link power management (LPM) for the WDC WD141KFGX-68FH9N0 drive after a user bug report, and the pata_sl82c105 driver reads the PCI bridge revision before dropping its reference, fixing a use-after-free.
Why it matters: Avoids LPM problems on that WDC drive and a potential crash on sl82c105 PATA systems.
amxdna accelerator crash fixes
Two fixes for the AMD amxdna AI-accelerator driver. One removes a manual vm_ops->close() call on error paths that could underflow reference counts when the VMA is later torn down. The other fixes a locally triggerable BUG_ON: an unprivileged process could mmap a GEM object, call madvise(MADV_DONTNEED), then access the memory to hit a kernel assertion and crash the system.
Why it matters: Fixes crash bugs on systems using this accelerator, including one a local user could trigger.
xHCI broken on 32-bit ARM due to CRCR bit mask truncation
The switch to the BIT() macro cleared the upper 32 bits of the 64-bit CRCR command register, making xHCI unusable on systems such as Raspberry Pi 4B compiled for arm32. BIT_ULL restores the correct 64-bit mask.
Why it matters: Users of 32-bit ARM boards, notably Raspberry Pi 4B, regain working USB host functionality.
futex indefinite hang during private hash resize
A task performing a custom private futex hash resize could block in uninterruptible sleep indefinitely, triggering the hung-task detector and kernel panic. The pivot logic now correctly waits for the reference count to reach zero.
Why it matters: Threads using per-task private futex hashes no longer risk system-wide hangs when resizing the hash table.
fbdev sysfs and console OOB, stale-pointer, and use-after-free fixes
Fixes bound mode sysfs output to the page buffer, clear fb_info->mode before deleting videomodes, serialize mode sysfs access, break out of fb_io_read on partial copy_to_user, and bounds-check glyph indices after font resize.
Why it matters: Framebuffer console and sysfs users avoid memory corruption, stale pointer dereferences, and out-of-bounds I/O during font resize, console rotation, and mode reads.
d15d51fb26e895e647d2a530061db6b7a91081cc73be40c6ef7656e85f1ae033cbf3975a
NXP LPC32xx UART interrupt storm livelock
The LPC3220 UART can latch an RX timeout interrupt with an empty FIFO that serial8250_rx_chars never clears, causing a level-triggered interrupt storm that livelocks single-core ARM926 CPUs. The driver now explicitly clears the stuck condition.
Why it matters: Devices using the LPC32xx front-panel serial port no longer hang when the port is repeatedly opened.
SC16IS7xx serial TX stall with both UART channels active
THRI interrupt enable was requested asynchronously after filling the TX FIFO; if the FIFO drained past the trigger level before THRI was enabled, no new interrupt fired and characters remained queued indefinitely. THRI is now enabled before filling.
Why it matters: Multi-channel SC16IS7xx SPI UART users no longer experience indefinite transmit stalls.
x86 MCE polling timer crash on systems with CMCI storm inheritance
CMCI discovery could trigger mce_timer_kick before the MCE polling timer was initialized, hitting a debugobjects assert and warning during boot. The timer is now set up before CMCI discovery runs.
Why it matters: Affected machines boot cleanly without MCE timer debug warnings.
Qualcomm fastrpc memory leaks, races, and refcount leaks
Multiple fixes address an empty Audio PD memory pool leak, list races during interrupted invokes and unmaps, a channel context refcount leak on session alloc failure, and an undestroyed ctx_idr leak on free.
Why it matters: Qualcomm fastrpc users get stable Audio PD memory allocation and fewer resource leaks on error and interrupt paths.
ab99eaafb0c46102ceb4eab8b85a0e91d7d6310f786839962fae94ee14f7
Rust io helpers and doctests gated on CONFIG_HAS_IOMEM
The Rust ioremap/iounmap helpers and doctests now gate on CONFIG_HAS_IOMEM, fixing build failures on architectures like s390 allnoconfig where these functions are not provided.
Why it matters: Rust kernel support builds cleanly on architectures without CONFIG_HAS_IOMEM, improving cross-architecture build coverage.
Hardware support
AMD KVM TLB flush fix prevents Windows guest corruption
With nested page tables enabled, SVM's guest-virtual-address TLB flush was insufficient for Hyper-V TLB flush requests; the fix forces a full ASID flush on AMD.
Why it matters: Fixes rare Windows BSODs and memory corruption in AMD-hosted KVM VMs with Hyper-V enlightenments.
mlx5e BQL reset crash fixed
mlx5e_queue_start() could reset BQL counters for channels with in-flight TX WQEs, causing a kernel BUG in dql_completed(). It now only resets when no bytes are in flight.
Why it matters: Prevents kernel panics during channel reconfiguration on Mellanox/BlueField Ethernet controllers.
Broadcom NIC receive-data corruption prevented
On older Broadcom chips, EOP padding on AGG rings could overwrite the next segment's data when Relaxed Ordering is enabled. TPA now disables EOP.
Why it matters: Prevents silent receive-data corruption on affected Broadcom adapters, especially on ARM systems.
Intel igc NICs usable again after resume when interface was down
igc's resume path only re-attached the netdev when the interface was running; now it re-attaches unconditionally.
Why it matters: Users with Intel I225/I226 2.5GbE NICs no longer need to reload the driver after suspend/resume when Wake-on-LAN is disabled.
stmmac MTU change hang fixed on PHYs that stop RX clock
__stmmac_open() now resumes the PHY before performing the DMA software reset; some PHYs stop their receive clock while powered down, making the reset time out.
Why it matters: Boards using stmmac Ethernet (such as RK3566 with RTL8211F) can change MTU without hanging the interface.
Laptop audio quirks add working microphones
DMI quirks enable the ACP6x sound card on HP Victus 16-e1xxx, Xiaomi RedmiBook 16, and MSI Raider A18 HX laptops.
Why it matters: Owners of these 2025 AMD laptops get a working internal microphone on Linux.
Thermal hwmon sysfs compatibility restored
Reverts two changes that registered a separate hwmon device for each thermal zone and altered sysfs layout, breaking user-space thermal monitoring tools.
Why it matters: Existing thermal monitoring scripts and tools keep working with the familiar hwmon device names and paths.
Xbox-compatible gamepads needing 255-byte config descriptors now enumerate
Some third-party and spoofed Xbox-compatible gamepads disconnect during standard enumeration because they expect a 255-byte GET_DESCRIPTOR(CONFIGURATION) request. A new USB quirk and ShanWan-specific entry force that size.
Why it matters: Owners of affected ShanWan and similar gamepads regain XInput mode with rumble instead of falling back to limited HID.
Xiaomi Book Pro 14 and HONOR MagicBook Pro 14 internal keyboards fixed
Both laptops ship with keyboards that stop responding after the standard ATKBD deactivate command; a quirk skips that command so the keyboard and Caps Lock LED work without boot parameters.
Why it matters: Owners get a working keyboard out of the box instead of needing i8042.dumbkbd.
Performance
SELinux SysV IPC performance regression fixed
Expensive MLS level-category validation is now done once at policy load time instead of on every access check.
Why it matters: Reverses an 89-94% throughput regression in msgsnd/msgrcv for SELinux users.
TCP receive threshold no longer shrinks when window scaling changes
The receive-MSS measurement path now updates the window clamp without trimming rcv_ssthresh, avoiding repeated cuts from oscillating scaling ratios.
Why it matters: Network connections with varying segment sizes should see more stable receive performance.
XFS read-ahead sized using realtime device limits
XFS now configures I/O and read-ahead sizes using the realtime device's limits instead of only the main device's.
Why it matters: Improves read performance by up to 5% on XFS setups using separate metadata and realtime devices.
Security and hardening
XFS log-recovery heap overflow fixed
XFS now bounds-checks the dirty-region bitmap of buffer log items before replaying them at mount time, preventing a crafted filesystem image from driving memcpy() past the buffer allocation.
Why it matters: Mounting untrusted XFS images can no longer corrupt kernel heap memory, closing a potential local privilege-escalation or denial-of-service vector.
x86 Safe-RET mitigation can't be bypassed by interrupts
On AMD systems affected by SRSO, an interrupt arriving during the Safe-RET sequence could neutralize the mitigation. Interrupt entry now emulates a successful Safe-RET state and avoids executing a RET afterward.
Why it matters: AMD systems remain protected against SRSO/Spectre-v2 side-channel attacks even when interrupts arrive during the mitigation sequence.
SELinux rejects malformed policy images instead of corrupting memory
Multiple policy-loading paths now validate permission counts, inherited commons, sparse tables, and conversion state before use, and a failed load no longer dereferences an unconverted old policy.
Why it matters: Crafted or malformed SELinux policies can no longer cause out-of-bounds heap writes, NULL-pointer crashes, or a stuck policy reload.
d14b5d0e97fc9a82dcd98b6ee5c0235a3c4eb98a8ac5077522b05fec62c0a93d37a09b86
IPv6 Router Advertisement route option validation fixed
Two off-by-one checks allowed a short Route Information option to pass validation and then copy up to 8 bytes beyond the option. The length checks now match RFC 4191.
Why it matters: IPv6 hosts are protected from malformed Router Advertisements triggering an out-of-bounds read.
IPVS NAT ICMP handling hardened against concurrent header changes
The IPv4 IHL is now read once and the validated transport-header length is used, preventing an out-of-bounds write if a local attacker changes packet headers while IPVS processes them.
Why it matters: Prevents memory corruption on systems using IPVS load balancing.
BPF sockmap send-verdict use-after-free fixed
A cached socket reference could be consumed by one sendmsg while another thread still used a raw pointer to the same socket. The race is now closed.
Why it matters: Prevents kernel crashes or memory corruption in BPF sockmap redirection paths.
Packet socket transmit path hardened against out-of-bounds access
Protocol-bound PACKET_QDISC_BYPASS frames now get a valid skb->mac_header, and packet send paths snapshot dev->hard_header_len so concurrent device reconfiguration can't make headroom too small. The CAP_SYS_RAWIO zero-padding path was also removed.
Why it matters: Closes multiple out-of-bounds read/write paths in AF_PACKET transmit, including a ~64 KiB read past the skb head.
ksmbd SMB compression receive validation tightened
ksmbd now rejects unnegotiated Pattern_V1 payloads, validates compression flags before allocating decompression buffers, and applies the pre-authentication PDU limit when decompressing requests.
Why it matters: Protects ksmbd SMB shares from unauthenticated clients causing oversized allocations or invalid compression modes.
rtl8723bs WiFi driver: multiple out-of-bounds reads reachable before association
Several IE parsers in the staging rtl8723bs driver read fixed-offset fields without length checks, and the WEP shared-key auth handler copies up to 255 bytes of challenge text into a 128-byte buffer. These paths are reachable from a malicious AP before association.
Why it matters: Protects rtl8723bs SDIO adapter users from kernel memory corruption or disclosure triggered by crafted wireless frames.
Synaptics RMI4 touchpad diagnostics heap overflow fixes
A series of fixes corrects TX/RX electrode count handling, report-size validation, stale-buffer propagation, and mid-stream input changes in the F54 diagnostics V4L2 interface.
Why it matters: Protects users of RMI4 touchpads exposing diagnostics via V4L2 from heap corruption via malformed sensor data or runtime format changes.
6058f0fea10fdc76c3c8e8ad49c5adc2b7d6fbfd76746adc8786d74bf50e
evdev: stack memory leak and Spectre-v1 mitigation
evdev previously passed partially uninitialized input_event instances to userspace, leaking stack bytes on padded architectures such as SPARC64. Separately, EVIOCGMASK/EVIOCSMASK event type indices are now clamped with array_index_mask_nospec() to prevent speculative out-of-bounds loads.
Why it matters: Prevents kernel memory disclosure to unprivileged evdev clients and hardens against speculative side-channel attacks.
s390 zcrypt CPRB hardening
CCA and EP11 CPRB processing paths now validate minimum sizes, guard against integer/arithmetic overflow, replace struct overlays with proper ASN.1 parsing, zero-pad trailing bytes, and round allocations to 4-byte boundaries.
Why it matters: Protects s390 crypto card users from userspace-triggered buffer overflows and kernel memory leakage to firmware.
5004889551df35ac6754ba6d17ac0bc866fc0864a163783beb3632544724
powerpc/pseries buffer overflow and underflow fixes
papr-phy-attest validates cmd.length to prevent overflow and fixes a memory leak; pseries PCI SR-IOV fixes an AND/OR logic bug in VF count checks; lparcfg_write guards against a kbuf[-1] underflow on zero-length writes.
Why it matters: Avoids memory corruption and SR-IOV misconfiguration when using attestation, PCI virtual functions, or partition config writes.
USB gadget NCM NDP offset bypass and Thunderbolt DROM bounds fixes
A signed ndp_index in the USB NCM gadget could overflow negative via a large attacker offset, bypassing unsigned checks and causing an out-of-bounds read. Separately, a malformed Thunderbolt device could set dual_link_port_nr beyond sw->ports[], storing and dereferencing an out-of-bounds pointer.
Why it matters: Protects USB NCM gadget systems from malicious host frames and hosts from crafted Thunderbolt devices triggering OOB kernel access.
vt KDSKBMETA ioctl now requires permission
The KDSKBMETA ioctl lacked the permission check enforced by every other keyboard setter in vt_k_ioctl().
Why it matters: Non-controlling-console users can no longer alter keyboard meta mode.
Source commits430 entries +
arm64: dts: qcom: monaco: Add default GIC address cells
Krzysztof Kozlowski · Apr 7, 2026 · 1 files
arm64: dts: qcom: purwa: Fix GPU IOMMU property
Akhil P Oommen · Apr 9, 2026 · 1 files
arm64: dts: qcom: sm8650: Fix IPA IMEM slice
Alexander Koskovich · Apr 15, 2026 · 1 files
arm64: dts: qcom: sc8280xp: add several missing pdc map entries
Pengyu Luo · Apr 19, 2026 · 1 files
arm64: dts: qcom: sc8280xp: gaokun3: correct EC interrupt pin
Pengyu Luo · Apr 19, 2026 · 1 files
arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle
Dmitry Baryshkov · Apr 28, 2026 · 1 files
ARM: npcm: Fix OF node refcount leaks in SMP setup
Yuho Choi · May 25, 2026 · 1 files
x86/bugs: Make Safe-RET robust against interrupt injection
Borislav Petkov (AMD) · Jun 3, 2026 · 4 files
thunderbolt: stream: Unmap buffers with mapped size
Xu Rao · Jun 11, 2026 · 1 files
arm64: dts: qcom: glymur: fix QUP serial engine IRQs
Bjorn Andersson · Jun 11, 2026 · 1 files
arm64: dts: qcom: glymur: fix PCIe SMMU interrupts
Bjorn Andersson · Jun 11, 2026 · 1 files
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
Karthikeyan KS · Jun 12, 2026 · 2 files
vhost_iotlb: bound map allocation in add_range
Linfeng Sun · Jun 20, 2026 · 8 files
drm/shmem_helper: Check VMA boundaries for PMD mappings
Christian A. Ehrhardt · Jun 22, 2026 · 1 files
drm/panthor: Check VMA boundaries for PMD mappings
Christian A. Ehrhardt · Jun 23, 2026 · 1 files
driver core: add missing kernel-doc for union members
Randy Dunlap · Jun 23, 2026 · 1 files
thunderbolt: Fix bandwidth group reservation indexing
Xu Rao · Jun 24, 2026 · 1 files
drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()
Michał Winiarski · Jun 24, 2026 · 1 files
vhost/vdpa: reject overflowing PA map page counts on 32-bit
Yousef Alhouseen · Jun 24, 2026 · 1 files
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
Bryam Vargas · Jun 25, 2026 · 1 files
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Dmitry Torokhov · Jun 26, 2026 · 1 files
Input: synaptics-rmi4 - zero report size on F54 work error
Dmitry Torokhov · Jun 26, 2026 · 1 files
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Bryam Vargas · Jun 26, 2026 · 1 files
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Dmitry Torokhov · Jun 26, 2026 · 1 files
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Dmitry Torokhov · Jun 26, 2026 · 1 files
ARM: dts: BCM5301X: EA9200: fix NVRAM size
Rosen Penev · Jun 28, 2026 · 1 files
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
Anna Schumaker · Jun 30, 2026 · 1 files
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails
Anna Schumaker · Jun 30, 2026 · 1 files
MAINTAINERS: ARM/FREESCALE: merge Layerscape entry into i.MX entry
Frank Li · Jun 30, 2026 · 1 files
fbdev: bound mode sysfs output to the sysfs buffer
Melbin K Mathew · Jul 1, 2026 · 1 files
fbdev: clear fb_info->mode before deleting a videomode
Melbin K Mathew · Jul 1, 2026 · 1 files
fbdev: serialize mode sysfs access with lock_fb_info()
Melbin K Mathew · Jul 1, 2026 · 1 files
vdpa/mlx5: Fix buffer length in create_direct_keys()
Christian Borntraeger · Jul 6, 2026 · 1 files
NFSv4.2: fix nfs4_listxattr size accounting
Achilles Gaikwad · Jul 7, 2026 · 1 files
drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs
Marcin Bernatowicz · Jul 9, 2026 · 1 files
xfs: propagate errors from xfs_rtginode_load
Guanghui Yang · Jul 12, 2026 · 1 files
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
Tejun Heo · Jul 12, 2026 · 1 files
sched/psi: Create the psimon kthread outside of cgroup_mutex
Tejun Heo · Jul 12, 2026 · 3 files
thunderbolt: icm: Preserve USB4 proxy data-valid bit
Xu Rao · Jul 13, 2026 · 1 files
arm64: dts: qcom: eliza: Fix DSI1 phy reference clock rate
Krzysztof Kozlowski · Jul 13, 2026 · 1 files
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
Sean Christopherson · Jul 13, 2026 · 1 files
counter: microchip-tcb-capture: Fix DT channel validation
Babanpreet Singh · Jul 14, 2026 · 1 files
xfs: fix off-by-one in rtrefcount btree root level validation
Xiang Mei · Jul 14, 2026 · 1 files
xfs: bounds-check buffer log item's dirty bitmap
Ibrahim Hashimov · Jul 15, 2026 · 1 files
btrfs: lzo: reject inline extents without valid headers
David Lee · Jul 15, 2026 · 1 files
xfs: clear zapped attr fork state when bmap repair finds no attr fork
Qiang Ma · Jul 16, 2026 · 1 files
sched_ext: Reject setting disallow from init_task outside the enable path
Tejun Heo · Jul 16, 2026 · 2 files
sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
Tejun Heo · Jul 16, 2026 · 1 files
sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
Tejun Heo · Jul 16, 2026 · 1 files
arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
Daniel Drake · Jul 16, 2026 · 1 files
sched_ext: Don't enable non-ext tasks in the sub-sched task loops
Tejun Heo · Jul 16, 2026 · 1 files
kho: align kho_scratch to MAX_ORDER_NR_PAGES pages
Michal Clapinski · Jul 17, 2026 · 1 files
pinctrl: qcom: ipq9650: fix audio_sec_mclk_in1/out1 group pins
Taceddin Sancak · Jul 18, 2026 · 1 files
Input: cs40l50-vibra - validate custom data from user space
HyeongJun An · Jul 18, 2026 · 1 files
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
Muhammad Bilal · Jul 19, 2026 · 1 files
staging: rtl8723bs: fix OOB read in WMM_param_handler()
Muhammad Bilal · Jul 19, 2026 · 1 files
mei: pull kvfree out of spinlock
Alexander Usyskin · Jul 19, 2026 · 1 files
pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function
Hans Ulli Kroll · Jul 19, 2026 · 2 files
pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function
Hans Ulli Kroll · Jul 19, 2026 · 1 files
xfs: handle NULL b_addr in xfs_buf_free
Yun Zhou · Jul 19, 2026 · 1 files
bpf, sockmap: Fix sk_redir use-after-free in send verdict
Chengfeng Ye · Jul 19, 2026 · 1 files
Input: byd - synchronize timer deletion before freeing private data
Linmao Li · Jul 20, 2026 · 1 files
staging: rtl8723bs: fix missing shared-key auth challenge length check
Panagiotis Petrakopoulos · Jul 20, 2026 · 1 files
btrfs: disable large folios for systems with highmem
Qu Wenruo · Jul 20, 2026 · 1 files
usb: cdnsp: fix incorrect endian conversions for APB timeout register
Pawel Laszczak · Jul 20, 2026 · 1 files
xfs: update BDI {io,ra}_pages values based on the RT device limits
Christoph Hellwig · Jul 20, 2026 · 2 files
usb: gadget: f_ncm: Use unsigned int for ndp_index
Sonali Pradhan · Jul 20, 2026 · 1 files
futex: Prevent robust futex exit race some more
Keno Fischer · Jul 21, 2026 · 1 files
xfs: check cowextsize in xrep_inode_cowextsize
Darrick J. Wong · Jul 21, 2026 · 1 files
xfs: fix transaction block reservation in xrep_rtbitmap
Darrick J. Wong · Jul 21, 2026 · 1 files
xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error
Darrick J. Wong · Jul 21, 2026 · 1 files
xfs: zero i_nlink before repair puts inode on unlinked list
Darrick J. Wong · Jul 21, 2026 · 1 files
xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
Darrick J. Wong · Jul 21, 2026 · 1 files
fbdev: core: Fix pointer desynchronization in fb_io_read()
Mingyu Wang · Jul 21, 2026 · 1 files
serial: sc16is7xx: enable THRI before filling TX FIFO
Luca Fresi · Jul 21, 2026 · 1 files
ovpn: limit keepalive values to one day
Marco Baffo · Jul 22, 2026 · 2 files
xfs: fix inverted clearance of inode junk flags
Andrey Albershteyn · Jul 22, 2026 · 1 files
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
Jiangshan Yi · Jul 22, 2026 · 1 files
sched_ext: Mark waker CPU busy when selected in WAKE_SYNC case
Kuba Piecuch · Jul 22, 2026 · 1 files
mm/page_table_check: skip special zero mappings
Zhiling Zou · Jul 22, 2026 · 1 files
watchdog: atcwdt200: fix return value when watchdog is enabled
Surendra Singh Chouhan · Jul 23, 2026 · 1 files
MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEED
Billy Tsai · Jul 23, 2026 · 1 files
drm/bridge: ps8640: propagate AUX transfer register errors
Pengpeng Hou · Jul 23, 2026 · 1 files
accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
Lizhi Hou · Jul 23, 2026 · 1 files
KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled
Paolo Bonzini · Jul 23, 2026 · 7 files
drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
Qiang Yu · Jul 23, 2026 · 1 files
selftests/sched_ext: Handle sleeping task affinity changes in numa test
Kuba Piecuch · Jul 23, 2026 · 1 files
Input: xpad - add support for ZENAIM LEVERLESS
Kyohei Kadota · Jul 23, 2026 · 1 files
Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
Alexandre Hamamdjian · Jul 23, 2026 · 1 files
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
Lorenzo Stoakes (ARM) · Jul 23, 2026 · 3 files
mm/ptdump: always stabilise against page table freeing using init_mm
Lorenzo Stoakes (ARM) · Jul 23, 2026 · 2 files
arm64: remove redundant concurrent ptdump UAF mitigation
Lorenzo Stoakes (ARM) · Jul 23, 2026 · 4 files
hwmon: (pmbus) Fix type confusion in notification logic
Guenter Roeck · Jul 23, 2026 · 1 files
ovpn: fix incorrect use of rcu_access_pointer()
Qingfang Deng · Jul 24, 2026 · 1 files
vhost-scsi: flush backend after device ioctls
Jia Jia · Jul 24, 2026 · 1 files
net: hns3: fix speed configuration residue after driver reload
Jijie Shao · Jul 24, 2026 · 1 files
net/packet: reset the MAC header on the packet-socket transmit path
Doruk Tan Ozturk · Jul 24, 2026 · 1 files
drm/panthor: skip zero-sized firmware sections
Osama Abdelkader · Jul 24, 2026 · 1 files
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
Ekansh Gupta · Jul 24, 2026 · 1 files
misc: fastrpc: Remove buffer from list prior to unmap operation
Ekansh Gupta · Jul 24, 2026 · 1 files
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
Junrui Luo · Jul 24, 2026 · 1 files
misc: fastrpc: fix channel ctx ref leak when session alloc fails
Anandu Krishnan E · Jul 24, 2026 · 1 files
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
Eddie Lin · Jul 24, 2026 · 1 files
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
Aelin Reidel · Jul 24, 2026 · 1 files
nvmem: layouts: Add fixed-layout driver
Mathieu Dubois-Briand · Jul 24, 2026 · 7 files
Input: psxpad-spi - set driver data before use
Linmao Li · Jul 25, 2026 · 1 files
tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
Nathan Gao · Jul 25, 2026 · 1 files
Input: iforce - validate input packet lengths
Pengpeng Hou · Jul 25, 2026 · 2 files
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
Zhan Xusheng · Jul 25, 2026 · 1 files
mm/huge_memory: initialise workingset state before folio split
Matt Fleming · Jul 25, 2026 · 1 files
ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
Rosen Penev · Jul 25, 2026 · 1 files
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
Xiang Mei (Microsoft) · Jul 25, 2026 · 1 files
mm/damon/ops-common: putback folios on invalid migrate nid
liyouhong · Jul 26, 2026 · 1 files
vhost-scsi: reject feature changes after endpoint
Jia Jia · Jul 26, 2026 · 1 files
net/x25: fix use-after-free of the socket by its timers
Baul Lee · Jul 26, 2026 · 2 files
xfs: fix ilock leak on error in xfs_dq_get_next_id
Long Li · Jul 27, 2026 · 1 files
xfs: don't swallow dquot recovery verification errors
Long Li · Jul 27, 2026 · 1 files
xfs: only check mergeability of bnobt records
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't double-lock when deleting a self-referential directory
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't zap the attr fork on repair when there are queued pptr updates
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: nlink scrub must take IOLOCK before determining ILOCK state
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: avoid UAF on sc->tempip in xrep_tempfile_create
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: hoist per-bucket unlinked list check to helper
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't livelock in scrub on a circular unlinked list
Darrick J. Wong · Jul 27, 2026 · 2 files
xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: check xfarray iteration errors when committing unlinked inode lists
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: fix allocated inodes that show up in the unlinked list
Darrick J. Wong · Jul 27, 2026 · 2 files
xfs: fix another iunlink infinite loop bug in online fsck
Darrick J. Wong · Jul 27, 2026 · 2 files
xfs: set the prev pointer when reinserting an inode on the unlinked list
Darrick J. Wong · Jul 27, 2026 · 1 files
xfs: don't ignore runtime errors in xrep_iunlink_reload_next
Darrick J. Wong · Jul 27, 2026 · 1 files
serial: 8250_dma: Clear stale RX state on shutdown
Cunhao Lu · Jul 27, 2026 · 1 files
vhost-scsi: Validate T10 PI scatterlist counts
Linfeng Sun · Jul 27, 2026 · 1 files
fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
Andrey Albershteyn · Jul 27, 2026 · 1 files
net: devmem: prevent net-iov / page mixing
Pavel Begunkov · Jul 27, 2026 · 1 files
btrfs: fix memory leak in btrfs_do_encoded_write()
Dmitry Antipov · Jul 27, 2026 · 1 files
rust_binder: do not query current thread for all ioctls
Alice Ryhl · Jul 27, 2026 · 1 files
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
Fan Ye · Jul 27, 2026 · 1 files
staging: rtl8723bs: validate monitor transmit frame lengths
Mariano Baragiola · Jul 27, 2026 · 1 files
xsk: require at least 16 bytes of TX metadata
Stanislav Fomichev · Jul 27, 2026 · 1 files
xsk: pass TX metadata pointer by reference
Stanislav Fomichev · Jul 27, 2026 · 8 files
xsk: clear metadata pointer when no timestamp is requested
Stanislav Fomichev · Jul 27, 2026 · 2 files
xsk: validate launch-time metadata size
Stanislav Fomichev · Jul 27, 2026 · 2 files
xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
Stanislav Fomichev · Jul 27, 2026 · 2 files
xsk: validate metadata when processing requests
Stanislav Fomichev · Jul 27, 2026 · 6 files
pds_core: keep the health thread stopped during reset
Nikhil P. Rao · Jul 27, 2026 · 2 files
pds_core: cancel pending PCI reset work on AER recovery
Nikhil P. Rao · Jul 27, 2026 · 1 files
inet: frags: publish queues before arming timer
Zhiling Zou · Jul 27, 2026 · 1 files
microblaze: restore the page alignment of swapper_pg_dir
Ramin Moussavi · Jul 27, 2026 · 1 files
btrfs: trigger cow fixup via dirty_folio()
Boris Burkov · Jul 27, 2026 · 8 files
ima: Instantiate file_truncate and path_truncate hooks
Mimi Zohar · Jul 28, 2026 · 1 files
selinux: reject a permission value exceeding the class permission count
Bryam Vargas · Jul 28, 2026 · 1 files
selinux: reject a class permission count below its inherited common
Bryam Vargas · Jul 28, 2026 · 1 files
s390/vfio_ccw: Free all memory if cp_init() fails
Eric Farman · Jul 28, 2026 · 1 files
s390/vfio_ccw: Limit the number of channel program segments
Eric Farman · Jul 28, 2026 · 2 files
s390/vfio_ccw: Fix out of bounds check on CCW array
Eric Farman · Jul 28, 2026 · 1 files
s390/vfio_ccw: Ensure first IDAW remains constant
Eric Farman · Jul 28, 2026 · 2 files
s390/vfio_ccw: Calculate idal length based on idaw type
Eric Farman · Jul 28, 2026 · 1 files
s390/vfio_ccw: Ensure index for read/write regions are within range
Eric Farman · Jul 28, 2026 · 3 files
s390/vfio_ccw: Cancel existing workqueues
Eric Farman · Jul 28, 2026 · 1 files
s390/vfio_ccw: Move cp cleanup out of not operational
Eric Farman · Jul 28, 2026 · 4 files
s390/vfio_ccw: Selectively expand io_mutex
Eric Farman · Jul 28, 2026 · 5 files
s390/vfio_ccw: Implement a crw lock
Eric Farman · Jul 28, 2026 · 4 files
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
Shay Drory · Jul 28, 2026 · 2 files
mm/filemap: __filemap_add_folio() restore index before retrying
Hugh Dickins · Jul 28, 2026 · 1 files
thunderbolt: Initialize ->domain_released completion before it is being used
Mika Westerberg · Jul 28, 2026 · 1 files
enic: fix tx_hang_reset use-after-free on device removal
Satish Kharat · Jul 28, 2026 · 1 files
xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
Lin Jiapeng · Jul 28, 2026 · 1 files
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
Jiawen Liu · Jul 28, 2026 · 1 files
Docs/admin-guide/cgroup-v2: document io.latency rotational vs non-rotational behavior
Tao Cui · Jul 28, 2026 · 1 files
ovpn: skip rehash for peers already removed from by_id
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
Antonio Quartulli · Jul 28, 2026 · 3 files
ovpn: ensure socket is owned by ovpn before deref sk_user_data
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: zero-initialize sockaddr before learning a floated endpoint
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: hash floated peer by transport identity only
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: disable IPv4 redirects on MP interfaces
Antonio Quartulli · Jul 28, 2026 · 1 files
ovpn: ensure TCP vars are initialized first
Antonio Quartulli · Jul 28, 2026 · 1 files
mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
SJ Park · Jul 28, 2026 · 3 files
drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush
Alex Deucher · Jul 28, 2026 · 1 files
usb: core: Add quirk for 255-bytes initial config read
Nikhil Solanke · Jul 28, 2026 · 4 files
usb: hub: Split announce_device() to log device identity before enumeration
Nikhil Solanke · Jul 28, 2026 · 1 files
drm/v3d: Serialize the scheduler timeout handlers
Maíra Canal · Jul 29, 2026 · 2 files
fbdev: Fix out-of-bounds access when rotating console after font resize
Zizhi Wo · Jul 29, 2026 · 1 files
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
Yi Cong · Jul 29, 2026 · 1 files
net/mlx5: SF, Handle function changed event
Chris Mi · Jul 29, 2026 · 5 files
drm/amdgpu: Use virtual alloc during coredump
Lijo Lazar · Jul 29, 2026 · 1 files
net/mlx5: fw_tracer, return NULL on create error
Michael Guralnik · Jul 29, 2026 · 1 files
devlink: fix net namespace reference leak in reload
Or Har-Toov · Jul 29, 2026 · 1 files
drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode
Jesse Zhang · Jul 29, 2026 · 1 files
drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode
Jesse Zhang · Jul 29, 2026 · 1 files
drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode
Jesse Zhang · Jul 29, 2026 · 1 files
packet: synchronize pressure clearing with ring reconfiguration
Zihan Xi · Jul 29, 2026 · 1 files
net/sched: cls_route: fix fastmap use-after-free on filter
Jamal Hadi Salim · Jul 29, 2026 · 1 files
drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression
Wang Jiang · Jul 29, 2026 · 1 files
drm/amdgpu: Allocate coredump ring buffers per ring
Lijo Lazar · Jul 29, 2026 · 2 files
MAINTAINERS: update address for Brendan Jackman
Brendan Jackman · Jul 29, 2026 · 2 files
xfs: check v5 superblock features early
Christoph Hellwig · Jul 29, 2026 · 1 files
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
Mahanta Jambigi · Jul 29, 2026 · 1 files
xfs: add a separate bio_set for spliting GC writes
Christoph Hellwig · Jul 29, 2026 · 1 files
xfs: add a comment to describe xfs_gc_bio.victim_rtg
Christoph Hellwig · Jul 29, 2026 · 1 files
net: bridge: mrp: fix uninitialised bytes on the wire
Baul Lee · Jul 29, 2026 · 1 files
ovpn: add missing rtnl_link_ops->get_size callback
Ralf Lici · Jul 29, 2026 · 1 files
ipvs: stop estimator after disabled calc phase
Zhiling Zou · Jul 29, 2026 · 1 files
bpf: Simplify sanitize_err() signature
Eduard Zingerman · Jul 29, 2026 · 1 files
bpf: Preserve pointer state for commuted arithmetic
Yiyang Chen · Jul 29, 2026 · 1 files
bpf: Propagate untrusted pointer state in commuted arithmetic
Yiyang Chen · Jul 29, 2026 · 1 files
selftests/bpf: Cover commuted pointer state propagation
Yiyang Chen · Jul 29, 2026 · 3 files
sctp: keep chunk->transport in step with the list it is queued on
Baul Lee · Jul 29, 2026 · 1 files
netfilter: ebt_nflog: pin the NFLOG backend
Chengfeng Ye · Jul 29, 2026 · 1 files
serial: qcom-geni: fix TX DMA buffer flush
Jan Sebastian Götte · Jul 29, 2026 · 1 files
Input: evdev - fix information leak in evdev_pass_values()
Dmitry Torokhov · Jul 29, 2026 · 1 files
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Toke Høiland-Jørgensen · Jul 29, 2026 · 1 files
vsock/virtio: read virtqueues under worker locks
Weiming Shi · Jul 29, 2026 · 1 files
vsock/virtio: avoid refilling the RX queue after teardown
Weiming Shi · Jul 29, 2026 · 1 files
bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
Will Chen · Jul 29, 2026 · 1 files
ASoC/soundwire: Intel: reset the PCMSyCM registers in hda_sdw_bpt_close
Bard Liao · Jul 30, 2026 · 3 files
drm/amdgpu: reject oversized IBs with per-ring packet limits
Candice Li · Jul 30, 2026 · 1 files
drm/amd/display: allow self-refresh exit while entry is blocked
David Weber · Jul 30, 2026 · 1 files
ipv6: fix Route Information option length validation
Yuejie Shi · Jul 30, 2026 · 1 files
ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
Peter Ujfalusi · Jul 30, 2026 · 1 files
Revert "drm/amdgpu: fix aperture mapping leak"
Asad Kamal · Jul 30, 2026 · 2 files
drm/amdgpu: fix aperture iounmap skipped on device removal
Asad Kamal · Jul 30, 2026 · 1 files
btrfs: disable bs > ps support if no transparent hugepage support
Qu Wenruo · Jul 30, 2026 · 2 files
ASoC: SOF: topology: Use acpi mach from the machine driver
Bard Liao · Jul 30, 2026 · 1 files
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
Peter Ujfalusi · Jul 30, 2026 · 1 files
udp: fix potential use-after-free in tunnel segmentation
Xuanqiang Luo · Jul 30, 2026 · 1 files
mm/huge_memory: fix huge_zero_pfn race
Lorenzo Stoakes (ARM) · Jul 30, 2026 · 1 files
mm/huge_memory: separate out CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic
Lorenzo Stoakes (ARM) · Jul 30, 2026 · 1 files
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
Dawid Wróbel · Jul 30, 2026 · 1 files
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
Dawid Wróbel · Jul 30, 2026 · 1 files
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
Peter Ujfalusi · Jul 30, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
Zhang Heng · Jul 30, 2026 · 1 files
dibs: initialise dibs->lock in dibs_dev_alloc()
Hidayath Khan · Jul 30, 2026 · 2 files
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
Zihan Xi · Jul 30, 2026 · 1 files
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
Hidayath Khan · Jul 30, 2026 · 2 files
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
Daming Li · Jul 30, 2026 · 1 files
ftrace: Protect direct_functions in ftrace_find_rec_direct
Leon Hwang · Jul 30, 2026 · 1 files
ftrace: Protect direct_functions in update_ftrace_direct_del
Leon Hwang · Jul 30, 2026 · 1 files
ftrace: Protect direct_functions in update_ftrace_direct_mod
Leon Hwang · Jul 30, 2026 · 1 files
ftrace: Drop extra comma in trace_buffered_event_enable
Leon Hwang · Jul 30, 2026 · 1 files
drm/amdgpu/gmc12.1: implement tlb inv semaphore
Alex Deucher · Jul 30, 2026 · 1 files
btrfs: flush the fixup workers during close_ctree
Boris Burkov · Jul 30, 2026 · 2 files
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Julian Anastasov · Jul 30, 2026 · 3 files
ipvs: return the csum validation for forward hook
Julian Anastasov · Jul 30, 2026 · 2 files
netfilter: ipset: rework cidr bookkeeping
Jozsef Kadlecsik · Jul 30, 2026 · 7 files
netfilter: ipset: switch ext_size to atomic64_t
Jozsef Kadlecsik · Jul 30, 2026 · 5 files
netfilter: ipset: add small wrappers for hash and bucket sizes
Florian Westphal · Jul 30, 2026 · 1 files
netfilter: ipset: add and use mtype_del_cidr_all helper
Florian Westphal · Jul 30, 2026 · 1 files
netfilter: ipset: switch to rcu work
Florian Westphal · Jul 30, 2026 · 2 files
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
Ryan Wilbur · Jul 30, 2026 · 1 files
selinux: bpf: check SBLABEL_MNT before isec init
Carlos Llamas · Jul 30, 2026 · 1 files
net/openvswitch: check Ethernet header length in key_extract()
Cen Zhang (Microsoft) · Jul 30, 2026 · 1 files
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Jose Fernandez (Anthropic) · Jul 30, 2026 · 1 files
btrfs: initialize inode mapping flags for cached inodes
Qu Wenruo · Jul 31, 2026 · 1 files
ALSA: hda/tas2781: fix ACPI reference handling
Xu Rao · Jul 31, 2026 · 1 files
fixp-arith: convert comments to kernel-doc format
Randy Dunlap · Jul 31, 2026 · 1 files
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Joshua Rogers · Jul 31, 2026 · 1 files
vt: add permission check for KDSKBMETA ioctl
Joshua Rogers · Jul 31, 2026 · 1 files
serial: amba-pl011: fix indefinite RS485 post-send delay
Fan Wu · Jul 31, 2026 · 1 files
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
Fan Wu · Jul 31, 2026 · 1 files
serial: amba-pl011: synchronize DMA teardown
Fan Wu · Jul 31, 2026 · 1 files
usbnet: cap max_mtu for drivers without bind callback
Laurent Vivier · Jul 31, 2026 · 1 files
watchdog: bd96801_wdt: Fix timeout for enabled WDG
Matti Vaittinen · Jul 31, 2026 · 1 files
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
Aleksandr Nogikh · Jul 31, 2026 · 1 files
Revert "thermal: hwmon: Use extra_groups for adding temperature attributes"
Rafael J. Wysocki · Jul 31, 2026 · 3 files
Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
Rafael J. Wysocki · Jul 31, 2026 · 1 files
ALSA: usb-audio: Add QUIRK_FLAG_MIXER_GET_CUR_BROKEN for Logitech PRO X 2 LIGHTSPEED
Rong Zhang · Jul 31, 2026 · 1 files
net: prestera: validate firmware header length
Pengpeng Hou · Jul 31, 2026 · 1 files
bpf: Fix netns reference imbalance in conntrack kfuncs
Chengfeng Ye · Jul 31, 2026 · 1 files
selinux: do not cancel a policy conversion that never started
Bryam Vargas · Jul 31, 2026 · 1 files
selinux: require a class's permission values to cover its permission count
Bryam Vargas · Jul 31, 2026 · 1 files
selinux: reject an unclaimed class value in security_get_classes()
Bryam Vargas · Jul 31, 2026 · 1 files
selinux: require every boolean value to be defined
Bryam Vargas · Jul 31, 2026 · 1 files
accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
Lizhi Hou · Jul 31, 2026 · 1 files
bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
Shravya KN · Jul 31, 2026 · 1 files
bnxt_en: Determine and store default RX ring in vnic structure
Shravya KN · Jul 31, 2026 · 2 files
bnxt_en: Refresh VNIC default ring on queue restart if needed
Shravya KN · Jul 31, 2026 · 1 files
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
Michael Chan · Jul 31, 2026 · 1 files
bnxt_en: Fix PTP PPS setting bug
Keegan Freyhof · Jul 31, 2026 · 1 files
bnge: Fix NULL pointer dereference in aux device release
Alok Tiwari · Jul 31, 2026 · 1 files
drm/amdgpu: Fix lockdep false positive in amdgpu_lockdep_init
Vitaly Prosyak · Aug 1, 2026 · 1 files
smb: compress: reject Pattern_V1 when not negotiated
Anatolii Shumak · Aug 1, 2026 · 3 files
ksmbd: validate compression Flags before kvmalloc
Anatolii Shumak · Aug 1, 2026 · 1 files
smb/client: show compress mount option
ChenXiaoSong · Aug 1, 2026 · 1 files
bnge: use int for bnge_fix_rings_count() return value
Alok Tiwari · Aug 1, 2026 · 1 files
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
Jamal Hadi Salim · Aug 1, 2026 · 1 files
net/sched: reject overly deep qdisc hierarchies
Zijie Huang · Aug 1, 2026 · 2 files
selftests/tc-testing: add qdisc hierarchy depth tests
Zijie Huang · Aug 1, 2026 · 1 files
mailmap: map old addresses to Danila Tikhonov
Danila Tikhonov · Aug 1, 2026 · 1 files
ksmbd: apply the pre-authentication PDU limit when decompressing
Sujal Tuladhar · Aug 1, 2026 · 3 files
smb: client: Fix use-after-free in cifs_try_adding_channels()
Shuangpeng Bai · Aug 2, 2026 · 1 files
rqspinlock: Reset tail when preserving queue on deadlock
Kumar Kartikeya Dwivedi · Aug 2, 2026 · 1 files
mac802154: fix netdev use-after-free in beacon worker
Zihan Xi · Aug 2, 2026 · 1 files
usb: quirks: Add ShanWan gamepad to quirk list
Ishaan Dandekar · Aug 2, 2026 · 1 files
net: usb: ipheth: fix carrier_work UAF on disconnect
Doruk Tan Ozturk · Aug 2, 2026 · 1 files
net: atlantic: free stranded TX buffers on ring deinit
Yangyu Chen · Aug 2, 2026 · 3 files
net: atlantic: free RX pages of consumed but not refilled buffers
Yangyu Chen · Aug 2, 2026 · 1 files
docs: threat-model: clarify "security bug" vs "vulnerability"
Willy Tarreau · Aug 2, 2026 · 1 files
docs: threat-model: move fake devices out of "non production use"
Willy Tarreau · Aug 2, 2026 · 1 files
docs: security-bugs: clarify what counts as a valid version
Willy Tarreau · Aug 2, 2026 · 1 files
docs: coding-assistant: explain important steps when looking for bugs
Willy Tarreau · Aug 2, 2026 · 1 files
docs: security-bugs: clarify some mandatory steps for AI reports
Willy Tarreau · Aug 2, 2026 · 1 files
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Zhefu Zhang · Aug 2, 2026 · 1 files
Input: atkbd - skip deactivate for HONOR ZQC-P
Donglin Lyu · Aug 2, 2026 · 1 files
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
Dongli Zhang · Aug 2, 2026 · 1 files
net: openvswitch: reallocate update replies for mismatched IDs
Zhiling Zou · Aug 3, 2026 · 1 files
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Richard Davies · Aug 3, 2026 · 1 files
ring-buffer: Use current_context for safe per-CPU buffer swap
Tengda Wu · Aug 3, 2026 · 1 files
vhost: reset the vring metadata cache on vring reconfiguration
Jun Yang · Aug 3, 2026 · 1 files
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
Henry Martin · Aug 3, 2026 · 1 files
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
Zhiling Zou · Aug 3, 2026 · 1 files
tcp: fix TFO max_qlen accounting across reuseport migration
Jiayuan Chen · Aug 3, 2026 · 1 files
net/smc: fix TOCTOU race between smc_listen_out() and listener close
Sidraya Jayagond · Aug 3, 2026 · 1 files
s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
Harald Freudenberger · Aug 3, 2026 · 2 files
s390/zcrypt: Improve CCA CPRB length and overflow checks
Harald Freudenberger · Aug 3, 2026 · 1 files
s390/zcrypt: Improve EP11 CPRB length and overflow checks
Harald Freudenberger · Aug 3, 2026 · 1 files
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
Harald Freudenberger · Aug 3, 2026 · 1 files
s390/zcrypt: Pad trailing CCA or EP11 message with zeros
Harald Freudenberger · Aug 3, 2026 · 1 files
drm/amdgpu/userq: serialize queue map against GPU reset
Jesse Zhang · Aug 3, 2026 · 1 files
x86/mce: Set up the polling timer before CMCI discovery
Breno Leitao · Aug 3, 2026 · 1 files
net: stmmac: resume PHY before hardware setup when opening the interface
Stefan Agner · Aug 3, 2026 · 1 files
xdp: reject clones that overrun skb_shared_info tailroom
Zhiling Zou · Aug 3, 2026 · 1 files
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
Kyle Zeng · Aug 3, 2026 · 1 files
KVM: s390: Fix unlikely NULL gmap dereference
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: Do not free SCA if it was not allocated
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Fix kvm_s390_vcpu_unsetup_cmma()
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Fix overclearing ESCA in case of error
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: ucontrol: Fix sca_clear_ext_call()
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: Fix leaking of PGM_ADDRESSING to userspace
Claudio Imbrenda · Aug 3, 2026 · 4 files
KVM: s390: Fix race in __do_essa()
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: cmma: Fix dirty tracking when removing memslot
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: ucontrol: Add missing locking around gmap_remove_child()
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Free the mmu cache when kvm_arch_vcpu_create() fails
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Return -EINTR if a signal is pending while faulting-in
Claudio Imbrenda · Aug 3, 2026 · 2 files
KVM: s390: Fix ordering when adding to SCA
Claudio Imbrenda · Aug 3, 2026 · 1 files
KVM: s390: Fix cleanup in kvm_s390_pv_create_cpu()
Claudio Imbrenda · Aug 3, 2026 · 1 files
samples/damon/mtier: error out for zero quota goal target values
SJ Park · Aug 3, 2026 · 1 files
mm/damon/lru_sort: error out for >10000 active_mem_bp
SJ Park · Aug 3, 2026 · 1 files
mm/damon/reclaim: skip damon_call() if ctx has not started
SJ Park · Aug 3, 2026 · 1 files
mm/damon/lru_sort: skip damon_call() if ctx has not started
SJ Park · Aug 3, 2026 · 1 files
ASoC: rt5645: Make the Kconfig symbol user selectable
Rudi Heitbaum · Aug 3, 2026 · 1 files
ima: fix out-of-bounds read in xattr_verify()
Lincoln Wallace · Aug 3, 2026 · 1 files
ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0
Niklas Cassel · Aug 3, 2026 · 1 files
net: thunderbolt: Tear down DMA paths before stopping the rings
Fan XinRan · Aug 3, 2026 · 1 files
mptcp: options: reset DSS fields in case of unexpected size
Matthieu Baerts (NGI0) · Aug 3, 2026 · 1 files
mptcp: avoid combining some incoming suboptions
Matthieu Baerts (NGI0) · Aug 3, 2026 · 2 files
mptcp: remove MPC && MPJ check
Matthieu Baerts (NGI0) · Aug 3, 2026 · 1 files
mptcp: pm: fix data race in add_addr timer callback
Qing Luo · Aug 3, 2026 · 1 files
selftests: mptcp: join: mark tests with data corruption as failed
Gang Yan · Aug 3, 2026 · 1 files
mptcp: pm: fix memory leak from alloc-during-teardown race
Shardul Bankar · Aug 3, 2026 · 3 files
mptcp: fastopen: only mark MPTFO subflows with SYN data
Wyatt Feng · Aug 3, 2026 · 1 files
mptcp: reclaim forward-allocated memory on RX path errors
Paolo Abeni · Aug 3, 2026 · 1 files
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
Eric Biggers · Aug 3, 2026 · 1 files
fsverity: Fix silent truncation in bpf_get_fsverity_digest()
Eric Biggers · Aug 3, 2026 · 1 files
hwmon: (pmbus/core) Avoid race condition during probe
Guenter Roeck · Aug 3, 2026 · 1 files
drm/amd: Disable DP audio spread spectrum for Cyan Skillfish
Travis K. Bangs · Aug 3, 2026 · 1 files
net/mlx5e: fix BQL reset on SQ re-activation
Bobby Eshleman · Aug 3, 2026 · 1 files
mm: fix incorrect flush address in direct page table reclaim
Andy Lutomirski · Aug 4, 2026 · 1 files
Input: evdev - sanitize event type index when fetching event masks
Dmitry Torokhov · Aug 4, 2026 · 1 files
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
Qing Luo · Aug 4, 2026 · 1 files
hwmon: (corsair-psu) Fix linear11 calculation
Guenter Roeck · Aug 4, 2026 · 1 files
Input: hynitron_cstxxx - validate touch count and finger IDs
Jianing Li · Aug 4, 2026 · 1 files
tls: don't leave a full plaintext sk_msg ring unpushed
chanyoung · Aug 4, 2026 · 1 files
selftests: tls: add a test for splicing onto a full plaintext record
chanyoung · Aug 4, 2026 · 1 files
hwmon: (nzxt-smart2) Check return value of init_device() in probe
Qingshuang Fu · Aug 4, 2026 · 1 files
MAINTAINERS: add SpacemiT K1/K3 I2S entry
Troy Mitchell · Aug 4, 2026 · 1 files
usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
Lachlan Hodges · Aug 4, 2026 · 1 files
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Eric Dumazet · Aug 4, 2026 · 1 files
net: phy: mediatek: fix TX blink masks using the RX bits
Ahmed Naseef · Aug 4, 2026 · 1 files
net: octeontx2-pf: Fix UB in shift operation
Sergey V. Frolov · Aug 4, 2026 · 1 files
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
Baul Lee · Aug 4, 2026 · 1 files
ALSA: us144mkii: re-anchor capture URBs on resubmission
Baul Lee · Aug 4, 2026 · 1 files
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
Jérémy Jean · Aug 4, 2026 · 2 files
futex: Fix race in futex_pivot_pending() during private hash resize
Yao Kai · Aug 4, 2026 · 1 files
MAINTAINERS: add myself as a maintainer for Hisilicon Network Subsystem
Jijie Shao · Aug 4, 2026 · 1 files
selinux: check level category sets once at load time
Stephen Smalley · Aug 4, 2026 · 2 files
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
Luxiao Xu · Aug 4, 2026 · 1 files
net: remove WARN_ON_ONCE() from sk_mc_loop()
Eric Dumazet · Aug 4, 2026 · 1 files
smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
Frank Sorenson · Aug 4, 2026 · 1 files
selftests/ftrace: refactor eprobes test to fix argument checks
Martin Kaiser · Aug 4, 2026 · 1 files
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
Rafael J. Wysocki · Aug 4, 2026 · 1 files
net: qrtr: ns: Raise lookup limit to 128
Łukasz Patron · Aug 4, 2026 · 1 files
ptp: ocp: Fix board ID over-read
Ahmad Byagowi · Aug 4, 2026 · 1 files
hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
Guenter Roeck · Aug 4, 2026 · 1 files
igc: fix netdev not re-attached after resume if interface is down
Philipp David · Aug 4, 2026 · 1 files
hwmon: (ltc4282) Avoid overflow in maximum power calculation
Guenter Roeck · Aug 4, 2026 · 1 files
hwmon: (ltc4282) Clamp negative current limits
Guenter Roeck · Aug 4, 2026 · 1 files
hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
Guenter Roeck · Aug 5, 2026 · 1 files
ALSA: usb-audio: fix OOB write on Type II inbound URBs
Baul Lee · Aug 5, 2026 · 1 files
ALSA: usx2y: bound the hwdep mmap fault offset
Baul Lee · Aug 5, 2026 · 2 files
drm/amd/display: Check for tg ops in dce110_set_avmute
Ray Wu · Aug 5, 2026 · 1 files
hwmon: (ads7828) Fix external VREF regulator handling
Qingshuang Fu · Aug 5, 2026 · 1 files
tls: don't abort the connection on signal-interrupted sends
Maximilian Immanuel Brandtner · Aug 5, 2026 · 1 files
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
Wilken Gottwalt · Aug 5, 2026 · 1 files
ASoC: cs35l41: sort the register default table
Peter Ujfalusi · Aug 5, 2026 · 1 files
ASoC: cs35l45: sort the register default table
Peter Ujfalusi · Aug 5, 2026 · 1 files
ASoC: cs4265: sort the register default table
Peter Ujfalusi · Aug 5, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for Xiaomi RedmiBook 16 2025
Zhang Heng · Aug 5, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for MSI Raider A18 HX A7VHG
Zhang Heng · Aug 5, 2026 · 1 files
bnge: Fix resource leak in bnge_init_nic() error path
Bhargava Marreddy · Aug 5, 2026 · 1 files
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
Qihang Tang · Aug 5, 2026 · 1 files
packet: use consistent hard_header_len in non-ring send paths
Qihang Tang · Aug 5, 2026 · 2 files
packet: use consistent hard_header_len in TX_RING send path
Qihang Tang · Aug 5, 2026 · 1 files
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
Alexandra Winter · Aug 5, 2026 · 1 files
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
Eric Dumazet · Aug 5, 2026 · 1 files
sctp: clear control chunk transport if it is being removed
Xin Long · Aug 5, 2026 · 1 files
MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li
Ivan Vecera · Aug 5, 2026 · 1 files
rust: io: gate ioremap/iounmap on CONFIG_HAS_IOMEM
Danilo Krummrich · Aug 5, 2026 · 3 files
rust: io: gate ioremap doctests on CONFIG_HAS_IOMEM
Danilo Krummrich · Aug 5, 2026 · 2 files
eventfs: Fix use-after-free in eventfs_remove_rec()
Shuangpeng Bai · Aug 6, 2026 · 1 files
net: avoid theoretical races with ref drain
Jakub Kicinski · Aug 6, 2026 · 3 files
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
Josh Poimboeuf · Aug 6, 2026 · 1 files
watchdog: at91sam9_wdt: prevent timer rearm during teardown
Hongyan Xu · Aug 6, 2026 · 1 files
ata: pata_sl82c105: fix bridge revision use-after-free
Hongyan Xu · Aug 6, 2026 · 1 files
net: Defer netdev KOBJ_ADD uevent until the device is published
Dragos Tatulea · Aug 6, 2026 · 3 files
hwmon: (corsair-psu) serialize debugfs access against hwmon
Ali Ahmet Memis · Aug 6, 2026 · 1 files
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
Paolo Bonzini · Aug 6, 2026 · 2 files
ring-buffer: Prevent resizing of persistent ring buffer
Vincent Donnefort · Aug 6, 2026 · 1 files
ring-buffer: Prevent subbuf order change when resizing is disabled
Vincent Donnefort · Aug 6, 2026 · 1 files
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
Vincent Donnefort · Aug 6, 2026 · 1 files
ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra
Takashi Iwai · Aug 7, 2026 · 1 files
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
Hui Su · Aug 7, 2026 · 1 files
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
George Wilson · Aug 7, 2026 · 1 files
powerpc/pseries: pci - logic bug
George Wilson · Aug 7, 2026 · 1 files
powerpc/pseries: lparcfg - fix kbuf[] underflow
George Wilson · Aug 7, 2026 · 1 files
fbdev: bitblit: bound-check glyph index in bit_cursor()
Rik van Riel · Aug 8, 2026 · 1 files
eventfs: Use children field for rcu head and add memory barriers
Steven Rostedt · Aug 8, 2026 · 2 files
Linux 7.2-rc7
Linus Torvalds · Aug 9, 2026 · 1 files