Weekly briefing · Aug 10–17, 2026
Linux mainline: week of Aug 10
A weekly briefing built from 6 published daily update(s).
In brief
This weekly briefing gathers the meaningful changes that entered Linux mainline over the previous seven days.
Bug fixes
crypto: ccm - Set rfc4309 maxauthsize from child
The rfc4309 (CCM with AES key wrap) wrapper now derives its maximum authentication size from the child algorithm instead of a hardcoded value.
Why it matters: Correctly reports auth size limits for rfc4309 users, fixing potential API misuse.
crypto: tegra - fix cryptlen calculation in GCM request
Fixes a crash when tegra_gcm_setauthsize() is not called before decrypt, which could cause a write beyond the destination scatter-gather buffer. Also removes an unused authsize field.
Why it matters: Avoids memory corruption on Tegra Security Engine.
rhashtable: fix false-positive lockdep splat on rhltable destruction
After dropping ht->mutex in the free path, one function still used a lockdep-checked dereference, causing a spurious warning when destroying rhltables.
Why it matters: Cleans up lockdep reports during netfilter/table teardown.
crypto: qce - fix error path in devm_qce_register_algs
On registration failure, the error path now unregisters only the algorithms that were successfully registered, rather than repeatedly calling unregister on the same failed one.
Why it matters: Avoids incorrect cleanup during probe failure on Qualcomm crypto engines.
crypto: starfive - use scatterlist length before DMA mapping
The driver read sg_dma_len() before DMA mapping, which is only valid after mapping. It now uses the original scatterlist length.
Why it matters: Fixes potential wrong length handling with CONFIG_NEED_SG_DMA_LENGTH.
crypto: af_alg - Allow cbc(paes)
A previous commit dropped support for off-CPU crypto and accidentally broke cbc(paes), a special algorithm that lets userspace use AES keys stored as CAAM BLOBs. This restores the ability to use it through the AF_ALG interface.
Why it matters: Restores functionality for NXP CAAM users who need kernel-side key handling.
regcache: Use a consistent sort for defaults table
The lookup and sort functions used different comparison functions, causing unexpected results when register addresses have the top bit set. Now both use the same explicit comparison.
Why it matters: Makes regmap cache lookups behave consistently for high addresses.
regcache: Sort the local copy of an unsorted reg_defaults array
If a driver provides a reg_defaults array that isn't sorted, binary search misses some entries, causing them to be synced on every cache sync. The kernel now detects misordering and sorts a local copy.
Why it matters: Prevents unnecessary writes to hardware, reducing I/O.
Pair runtime PM get/put in SCSI error handling
In the SCSI error handler, the decision to resume the host (scsi_autopm_get_host) and later release it (scsi_autopm_put_host) each checked a separate flag, shost->eh_noresume. When a power-management error path changed that flag mid-iteration, the get could be skipped while the put still ran, leaving the PM reference count unbalanced. The patch makes the get and put happen as a pair so this race cannot occur.
Why it matters: Prevents unbalanced runtime power-management calls during error recovery, which could otherwise leave a device in the wrong power state.
Avoid blocking on tag allocation in scsi_eh_lock_door()
scsi_eh_lock_door() runs while the host is still in recovery and before its queues are restarted. It allocates a request, which can block waiting for a free tag. But tags may be held by commands that were requeued during error handling and cannot be dispatched until after lock_door returns, creating a circular wait. The fix prevents that blocking allocation.
Why it matters: Removes a potential deadlock that could stall SCSI error recovery when all command slots are occupied.
Fix scsi_debug compare-and-write for wrapped buffers
In the scsi_debug driver, comp_write_worker() returns whether the compared data matches. The first segment correctly used !memcmp(), but the wrapped segment used memcmp() directly, so the match result was inverted when the compare crossed the end of the test buffer. The patch applies the same negation.
Why it matters: Makes scsi_debug's compare-and-write emulation report correct results for tests that wrap around, avoiding false failures in storage test suites.
nf_tables flowtable use-after-free on partially installed flows
Publishing the original-direction tuple node first let garbage collection observe and free a flow while flow_offload_add() was still inserting the reply node, triggering KASAN slab-use-after-free in rhashtable and flowtable paths. The fix publishes the reply node first and the original node last.
Why it matters: Systems using hardware or software flow offload could hit memory corruption under flow churn.
TCP delayed ACK bitfield overflow caused ACK storms
icsk_ack.ato was squeezed into 8 bits but writers still bounded it by icsk_rto, which can exceed 255 jiffies; the bitfield silently wrapped mod 256, making ato==0 trigger the 'first data packet' sentinel and turn delayed ACKs into immediate ACKs plus a TC_MAX_QUICKACKS burst on cross-region connections.
Why it matters: Cross-region TCP connections could suffer sudden ACK bursts and degraded throughput.
ipvlan/macvlan did not inherit headroom/tailroom from lower device
ipvlan and macvlan devices inherited hard_header_len but left needed_headroom and needed_tailroom at 0, so upper layers under-reserved space for headers/trailers required by macsec, ipsec, wireguard, tunnels, or veth with RX headroom, causing reallocation overhead, headroom underflows, or KASAN slab-use-after-free crashes.
Why it matters: Users stacking ipvlan/macvlan over devices needing extra headroom could hit crashes or performance regressions.
veth multi-queue GRO path woke wrong peer TX queue
veth_poll() derived the peer TX queue index from rq->xdp_rxq.queue_index, which stays 0 when no XDP program is attached, so in multi-queue GRO setups every NAPI instance woke peer TX queue 0; a full TX queue 1 was never woken and veth has no tx_timeout handler, stalling transmission.
Why it matters: Multi-queue veth users with GRO and no XDP could silently stall under load.
bnxt TPH support broke aRFS and caused IRQ affinity deadlock
Installing the TPH notifier overrode the implicit aRFS rmap notifier, breaking receive flow steering, and unregistering the notifier while holding the netdev instance lock could deadlock since the notifier callback takes the same lock. The fix updates the rmap from the TPH notifier and moves queue restart to an async service task.
Why it matters: bnxt users with TPH enabled lost aRFS and could deadlock when affinity changed.
ovpn module removal could free code while callbacks still running
ovpn work items ran on global system workqueues with no driver-owned drain point, so module exit could free module text while a worker was still executing ovpn code after dropping the final peer reference; the fix adds a module-owned workqueue, flushes it, and runs rcu_barrier before module exit, plus defers crypto freeing to workqueue context where sleeping is allowed.
Why it matters: ovpn users could trigger use-after-free on module unload or during crypto teardown.
Unix domain socket garbage collector could free dead SCC partially
A race between send() and close() left a B->B edge visible to GC while its skb was not yet queued, so GC judged A->B as dead but could not collect B, leaking or corrupting socket state. The fix unlinks the scc_entry in unix_del_edge() to prevent partial collection.
Why it matters: Applications heavily using Unix domain sockets could hit socket leaks or UAF under concurrent send/close.
am65-cpsw-nuss port_id extraction caused out-of-bounds access
The MAC Port ID was extracted from all 16 bits of the RX DMA Source Tag, but only the lower 8 bits are valid; the upper reserved bits carried arbitrary values leading to an invalid port_id and sporadic kernel crashes from out-of-bounds memory access.
Why it matters: Fixes sporadic crashes on TI K3 CPSW Ethernet (e.g., AM654 boards).
tracing: fix userspace-triggerable NULL pointer dereference in module event cache
Writing a module-only event filter such as ':mod:foo' for an unloaded module cached a NULL match pointer; a subsequent append write removing a specific match passed that NULL to strcmp(), crashing the kernel.
Why it matters: Unprivileged userspace could trigger a kernel NULL pointer dereference through the tracing interface on systems where tracing is accessible.
mt76: revert disabling NAPI on device removal to fix mt7921e/mt7925e hang
A previous fix that disabled RX NAPI before deletion caused napi_disable() to be called twice on mt7921e and mt7925e, where instances were already disabled earlier in unregister; since napi_disable() is not idempotent, the second call hung forever in usleep_range(). The offending commit is reverted.
Why it matters: Resolves a hard hang when unloading Mediatek mt7921e/mt7925e Wi-Fi drivers.
firewire ohci: fix NULL pointer dereference in probe error path
If pci_probe() failed early (e.g., pcim_enable_device() or MMIO mapping failure), the devres cleanup unconditionally called ar_context_release(), which dereferenced a still-NULL ctx->ohci pointer, crashing the kernel.
Why it matters: Prevents a kernel crash when a FireWire OHCI controller fails to initialize.
OpenRISC signal return no longer restores privileged SR bits
restore_sigcontext() previously copied the entire supervision register from a signal frame and only cleared the mode bit. A crafted frame could therefore clear privileged bits such as the data-MMU enable bit, giving an unprivileged task access to arbitrary physical memory. The fix restricts which SR bits can be restored on sigreturn.
Why it matters: Fixes a potential local privilege escalation on OpenRISC systems.
Apple M3 (T8122) I2C device-tree correction
Corrects the MMIO ranges and IRQs for T8122 I2C controllers, which had wrong values in the initial device tree.
Why it matters: I2C-dependent hardware such as audio codecs can function correctly on affected Apple Silicon machines.
Tegra194 EL2 virtual timer interrupt added
Adds the per-CPU interrupt for the EL2 virtual timer on Tegra194, so the ARM arch timer driver no longer warns when running at EL2 with VHE.
Why it matters: Removes the 'Firmware Bug' warning on Tegra194 platforms and lets the timer driver use the intended interrupt.
OP-TEE FF-A memory lending NULL check
optee_ffa_lend_protmem() now validates the allocated pointer, closing a possible NULL dereference under memory pressure.
Why it matters: Avoids a kernel crash in the OP-TEE FF-A path when allocation fails.
perf: Reject exited events as group leaders
The perf subsystem now rejects events that are in the EXIT state when used as group leaders. Previously, a detached event could still be used as a leader, leading to a use-after-free when the group was cleaned up.
Why it matters: Prevents a potential crash when using performance monitoring with exec'd processes.
perf/core: Fix group leader use-after-free after sibling detach
When a sibling event was detached but kept alive (e.g., during CPU hotplug), its group_leader pointer was left pointing to the old leader, which could be freed. This fix resets the pointer properly in that path.
Why it matters: Fixes a potential use-after-free that could occur during CPU hotplug with perf groups.
rseq: Prevent hard lockup on granted time slice extension
A locking issue in the restartable sequences (rseq) code could cause a livelock when granting a time slice extension. The fix disables interrupts around the rearm call, matching the locking requirements.
Why it matters: Prevents a potential hard lockup on systems using rseq with time slice extensions.
x86/CPU: Add a tlbi= cmdline switch
Adds a kernel command-line option 'tlbi=' to disable the new INVLPGB-based TLB flushing. This is useful for debugging potential CPU bugs in that feature.
Why it matters: Gives users a way to work around a possible CPU issue by falling back to older TLB flush methods.
tick: Include ktime.h and jiffies.h in linux/tick.h
The tick.h header was relying on transitive includes for ktime and jiffies functions. This fix adds the direct includes to prevent build breakage after recent changes.
Why it matters: Fixes a build failure that could occur in certain kernel configurations.
clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer
The Raspberry Pi 5 (BCM2712) has a broken EL2 virtual timer where the interrupt never fires. This change detects the broken hardware and falls back to the physical timer, also tainting the kernel.
Why it matters: Fixes timer issues on Raspberry Pi 5, making the system more reliable.
io_uring/rsrc: reject overflowing regvec bvec byte counts
On 32-bit kernels, a large registered buffer could cause an integer overflow when converting bio_vec counts, leading to a buffer overflow. The fix adds overflow checks.
Why it matters: Prevents a potential memory corruption on 32-bit systems using io_uring with large buffers.
sched: Update time before requeueing delayed entities
The scheduler now updates the current time before requeueing delayed entities. This ensures the lag calculation is accurate, preventing entities from appearing younger than they are.
Why it matters: Improves fairness in the scheduler for workloads that use delayed entities.
drbd: don't leak the shared secret to unprivileged netlink dumps
DRBD's netlink interface was leaking the CRAM-HMAC secret to any local user through dump operations. The fix adds a sanitized version that excludes the sensitive data.
Why it matters: Fixes a security vulnerability that allowed unprivileged users to read a shared secret.
Revert "i2c: designware: defer probe if child GpioInt controllers are not bound"
This reverts a previous change that broke touchpads on some Thinkpads. The revert restores the previous behavior.
Why it matters: Fixes touchpad regression on certain ThinkPad laptops.
wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
The mt7921 WiFi driver had a recursive mutex acquisition that could cause a deadlock. The fix splits the function to avoid the recursion.
Why it matters: Fixes a potential deadlock in the mt7921 WiFi driver.
Linux 7.2
This is the release commit for Linux 7.2.
Why it matters: Marks the official release of the 7.2 kernel.
Hardware support
Fix MediaTek MT8183 boot hang from MFG power domain
On MT8183, the kernel could power off a partially-on MFG power domain during sync_state while the ACP was prefetching, causing an AXI stall. The fix keeps firmware-enabled domains powered.
Why it matters: MT8183 Chromebooks and tablets boot without random hangs.
Fix SCMI performance domain error on zero performance state
The SCMI perf domain returned -EINVAL for performance state 0, which the OPP framework uses to drop a perf vote (e.g., at runtime suspend). It's now a no-op.
Why it matters: More reliable runtime PM on ARM SoCs using SCMI performance domains.
Fix busy_timeout overflow on 32-bit omap_hsmmc
The milliseconds-to-nanoseconds conversion used 32-bit arithmetic and wrapped for busy timeouts above ~4.3 seconds, corrupting long MMC operations. The driver now casts properly.
Why it matters: 32-bit OMAP platforms can reliably run long eMMC commands like erase or SANITIZE.
Fix virtio SPI device registration race
virtio_spi_probe() now calls virtio_device_ready() before registering the SPI controller, preventing SPI transfers before DRIVER_OK is set as required by the virtio spec.
Why it matters: Fixes potential hangs or crashes with virtio SPI devices in VMs and embedded environments.
Performance
IPVS connection accounting reduces atomic ops via totalconns counter
Replacing the inactconns dest counter with totalconns lets inactconns be derived as totalconns - activeconns, cutting atomic inc/dec ops for TCP/SCTP from 6 to 4 on established+closed connections, and separates destination availability from overload state to avoid racing read-modify-write updates on shared flags.
Why it matters: High-connection-rate IPVS deployments gain lower per-connection overhead and more accurate overload tracking.
Security and hardening
SCTP cookie validation closes local privilege escalation
Forged SCTP cookies could inject invalid AUTH parameters, causing out-of-bounds reads and a 32-byte write past a zero-length AUTH chunk that gave a primitive for local privilege escalation. The fix validates RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association.
Why it matters: Closes a local privilege escalation chain for SCTP users via crafted cookies.
Two remotely reachable SCTP ASCONF use-after-free bugs fixed
An authenticated ASCONF chunk from a remote peer could add and remove a transport in the same chunk, leaving a dangling pointer dereferenced when sending a HEARTBEAT. Separately, the cached outstanding ASCONF chunk pointer was not cleared during peer restart teardown, so a delayed authenticated ASCONF-ACK could access and double-free the stale chunk.
Why it matters: Remote attackers able to authenticate SCTP ASCONF chunks could trigger kernel memory corruption; both paths are now closed.
XDP fragment accounting leaked kernel pointer to userspace
Generic XDP and veth left skb->len stale after fragment adjustment, causing __skb_datagram_iter() to copy 1024 bytes past the linear tail into userspace, including nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo. Real packet data was truncated by the same amount.
Why it matters: Malformed or adjusted packets on XDP-enabled paths could leak kernel memory addresses and corrupt delivered data.
IPVS tunnel ICMP rebasing caused stack out-of-bounds write
ip_vs_in_icmp() rebased an skb to the quoted original request but left IPCB(skb)->opt describing the outer IPv4 header; a timestamp option could then make __ip_options_echo() copy a stale length byte into fixed-size stack storage, causing a stack out-of-bounds write in __icmp_send().
Why it matters: A crafted ICMP error routed through IPVS tunneling could corrupt kernel stack memory.
TLS splice delivered plaintext after failed decrypt
tls_sw_splice_read() did not check async_wait.err after a failed async decrypt, so splice kept delivering records on a connection that recvmsg() and read_sock() refused to read, exposing plaintext of unauthenticated records.
Why it matters: TLS users using splice could receive unauthenticated plaintext that normal read paths correctly reject.
cls_bpf rejects device-bound TC programs attached to a different device
A BPF program loaded and offloaded for device A could be attached via cls_bpf with skip_sw to device B; deleting device A then destroyed offload state while still attached to device B, causing a WARN or panic with panic_on_warn=1. The attach is now rejected with -EINVAL when the bound device does not match.
Why it matters: Prevents misuse of device-bound BPF classifier programs that could lead to kernel warnings or panics.
Source commits194 entries +
riscv: lib: Fix ZBB strnlen reading past count boundary
Michael Neuling · Apr 13, 2026 · 1 files
clk: spacemit: k3: fix USB2 bus clock
Yixun Lan · May 18, 2026 · 1 files
libceph: fix multiple unsafe decodes in decode_locker()
Pavitra Jha · Jun 2, 2026 · 1 files
drm/amdgpu: fix missing check in vm_flush()
Alex Deucher · Jun 5, 2026 · 1 files
libceph: tolerate addrvecs with multiple entries of the same type
Kefu Chai · Jun 11, 2026 · 1 files
Input: sur40 - fix input device registration ordering
Dmitry Torokhov · Jun 16, 2026 · 1 files
Input: sur40 - fix V4L error path cleanup
Dmitry Torokhov · Jun 16, 2026 · 1 files
optee: ffa: Add NULL check in optee_ffa_lend_protmem
Mostafa Saleh · Jun 17, 2026 · 1 files
Revert "clk: qcom: regmap-phy-mux: Rework the implementation"
Konrad Dybcio · Jun 22, 2026 · 1 files
dt-bindings: clock: Replace bouncing emails
Krzysztof Kozlowski · Jun 23, 2026 · 4 files
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
Krzysztof Kozlowski · Jun 23, 2026 · 1 files
clk: rockchip: rk3588: don't disable unused I2S MCLK output gates
Daniele Briguglio · Jun 24, 2026 · 1 files
wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
Charlie-cy Wu · Jun 29, 2026 · 3 files
arm64: dts: apple: t8122: Fix I2C resources
Michael Reeves · Jun 29, 2026 · 1 files
clk: spacemit: k3: set hdma clock as critical
Yixun Lan · Jun 30, 2026 · 1 files
drm/xe: Fix DPT allocation paths.
Maarten Lankhorst · Jun 30, 2026 · 1 files
libceph: fix OOB read in decode_watchers() via missing bounds check
Pavitra Jha · Jul 8, 2026 · 1 files
pmdomain: mediatek: fix remaining %pOF after of_node_put()
Guangshuo Li · Jul 8, 2026 · 1 files
clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer
Marc Zyngier · Jul 10, 2026 · 1 files
drm/xe/oa: Check managed mutex initialization errors
Linmao Li · Jul 13, 2026 · 1 files
drm/amdgpu: Prefer default discovery offset
Lijo Lazar · Jul 13, 2026 · 1 files
pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE
AngeloGioacchino Del Regno · Jul 16, 2026 · 1 files
crypto: ccm - Set rfc4309 maxauthsize from child
Herbert Xu · Jul 20, 2026 · 1 files
drm/xe/pxp: add termination on resume
Daniele Ceraolo Spurio · Jul 20, 2026 · 2 files
crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
Vladislav Dronov · Jul 20, 2026 · 1 files
riscv: hwprobe: Register unaligned probes before usermode
Rui Qi · Jul 21, 2026 · 1 files
tick: Include ktime.h and jiffies.h in linux/tick.h
Karl Mehltretter · Jul 22, 2026 · 1 files
rhashtable: fix false-positive lockdep splat on rhltable destruction
Florian Westphal · Jul 22, 2026 · 1 files
netfilter: ipset: fix refcount race between list:set GC and swap
Xiang Mei (Microsoft) · Jul 22, 2026 · 1 files
scsi: core: Do not block on tag allocation in scsi_eh_lock_door()
Zizhi Wo · Jul 23, 2026 · 1 files
regulator: dt-bindings: qcom,rpmh: Add support for PM8350B
Esteban Urrutia · Jul 23, 2026 · 1 files
regulator: qcom-rpmh: Add support for PM8350B
Esteban Urrutia · Jul 23, 2026 · 1 files
drm/connector/hdmi: Fix out of bounds memory read
John Harrison · Jul 23, 2026 · 1 files
crypto: qce - fix error path in devm_qce_register_algs
Thorsten Blum · Jul 24, 2026 · 1 files
regulator: fp9931: Fix VPOS/VNEG voltage selector table
Robby Cai · Jul 24, 2026 · 1 files
ceph: fix MDS random selection readiness predicate
Yiming Zhu · Jul 24, 2026 · 1 files
crypto: starfive - use scatterlist length before DMA mapping
Thorsten Blum · Jul 25, 2026 · 1 files
crypto: af_alg - Allow cbc(paes)
Richard Weinberger · Jul 26, 2026 · 1 files
ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls
Zhan Xusheng · Jul 27, 2026 · 1 files
drm/amdgpu: validate GEM_CREATE domain combinations
Candice Li · Jul 27, 2026 · 1 files
mmc: sdhci: make tuning_err a signed int
Haibo Chen · Jul 27, 2026 · 1 files
mmc: sdhci: unmap the bounce buffer before device release
Myeonghun Pak · Jul 27, 2026 · 1 files
libceph: Avoid using invalid osd indices from primary_temp
Raphael Zimmer · Jul 28, 2026 · 1 files
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
Jon Hunter · Jul 28, 2026 · 1 files
drm/log: Fix out-of-bounds read on empty message length
Shixiong Ou · Jul 29, 2026 · 1 files
drm/log: Fix infinite loop when scale is too large for display
Shixiong Ou · Jul 29, 2026 · 1 files
gpiolib: Check gc->get_direction() before calling gpiod_get_direction()
Christophe Leroy (CS GROUP) · Jul 29, 2026 · 1 files
ovpn: fix NULL dereference when killing missing key
Ralf Lici · Jul 29, 2026 · 1 files
ovpn: finish crypto callback cleanup before peer release
Ralf Lici · Jul 29, 2026 · 1 files
ovpn: defer key slot crypto freeing to workqueue
Ralf Lici · Jul 29, 2026 · 4 files
scsi: core: pair EH runtime PM get and put
Hongjie Fang · Jul 29, 2026 · 3 files
pmdomain: mediatek: Fix mt8183 hang on boot
Dmitry Osipenko · Jul 29, 2026 · 1 files
drm/log: Fix division by zero when scale module parameter is 0
Shixiong Ou · Jul 30, 2026 · 1 files
drm/amdgpu: Reject UVD message with dimensions above 4096
David Rosca · Jul 30, 2026 · 1 files
drm/amdgpu: Fix UVD dpb min size calculation for H264
David Rosca · Jul 30, 2026 · 1 files
drm/amdgpu: Fix UVD decode image min size calculation
David Rosca · Jul 30, 2026 · 1 files
drm/amdgpu: Fix UVD min buffer sizes
David Rosca · Jul 30, 2026 · 1 files
gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
Cengiz Can · Jul 30, 2026 · 1 files
drm/xe/oa: Fix sync entry leak on OA config emit failure
Linmao Li · Jul 31, 2026 · 1 files
gpio: ml-ioh: use raw_spinlock_t for the register lock
Junjie Cao · Jul 31, 2026 · 1 files
netfilter: bridge: release template ct on non-IP path
Zhiling Zou · Jul 31, 2026 · 1 files
m68k: Define NR_CPUS to 1
Uwe Kleine-König · Jul 31, 2026 · 1 files
ipvs: add totalconns for dest
Julian Anastasov · Jul 31, 2026 · 7 files
ipvs: properly update the overload flag on dest edit
Julian Anastasov · Jul 31, 2026 · 3 files
ipvs: separate destination availability state
Yizhou Zhao · Jul 31, 2026 · 9 files
netfilter: nf_conntrack: defer invalid log until after unlock
Zihan Xi · Aug 1, 2026 · 3 files
riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
Pu Lehui · Aug 2, 2026 · 1 files
rseq: Prevent hard lockup on granted time slice extension
Niels Pressel · Aug 2, 2026 · 1 files
drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
Nathan Lucas · Aug 2, 2026 · 1 files
drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
Nathan Lucas · Aug 2, 2026 · 2 files
ovl: don't warn when the mount is completed from another user namespace
Christian Brauner · Aug 2, 2026 · 1 files
binfmt_misc: don't warn when the mount is completed from another user namespace
Christian Brauner · Aug 2, 2026 · 1 files
selftests/filesystems: test completing a context from another user namespace
Christian Brauner · Aug 2, 2026 · 3 files
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
Florian Westphal · Aug 3, 2026 · 2 files
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
Pei Xiao · Aug 3, 2026 · 1 files
scsi: scsi_debug: Negate wrapped memcmp() result
Xu Rao · Aug 3, 2026 · 1 files
spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
Jisheng Zhang · Aug 3, 2026 · 1 files
eth: bnxt: cancel IRQ notifier before freeing affinity mask
Jakub Kicinski · Aug 3, 2026 · 1 files
eth: bnxt: keep the aRFS rmap updated when TPH is enabled
Jakub Kicinski · Aug 3, 2026 · 1 files
eth: bnxt: decrease indent in bnxt_request_irq()
Jakub Kicinski · Aug 3, 2026 · 1 files
eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
Jakub Kicinski · Aug 3, 2026 · 2 files
af_unix: Unlink scc_entry in unix_del_edge().
Kuniyuki Iwashima · Aug 4, 2026 · 1 files
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
Zhan Xusheng · Aug 4, 2026 · 1 files
net: fix skb length accounting after generic XDP frag adjustment
Sun Jian · Aug 4, 2026 · 1 files
veth: fix skb length accounting after XDP frag adjustment
Sun Jian · Aug 4, 2026 · 1 files
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
Kyle Zeng · Aug 4, 2026 · 1 files
mmc: loongson2: Fix sg iteration in data reorder functions
Binbin Zhou · Aug 4, 2026 · 1 files
gpio: ml-ioh: share the register lock across channels
Junjie Cao · Aug 4, 2026 · 1 files
Revert "wifi: mt76: Disable napi when removing device"
Mikhail Gavrilov · Aug 4, 2026 · 1 files
drm/xe/guc_ads: allocate UM queues in a separate BO
Jia Yao · Aug 4, 2026 · 4 files
drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
Jia Yao · Aug 4, 2026 · 2 files
drm/xe/guc_ads: use uncached mapping for UM queue BO
Jia Yao · Aug 4, 2026 · 1 files
pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0
Praveen Talari · Aug 4, 2026 · 1 files
sctp: validate cookie AUTH state before use
Jérémy Jean · Aug 4, 2026 · 3 files
ASoC: rt1320: run the initialisation preset on the first hardware init
Sergey Lebedev · Aug 4, 2026 · 1 files
drm/amdgpu: check ASPM on the dGPU host link
Yang Wang · Aug 5, 2026 · 1 files
regcache: Sort the local copy of an unsorted reg_defaults array
Peter Ujfalusi · Aug 5, 2026 · 1 files
ASoC: rt5645: Perform the initial jack detect at probe
Rudi Heitbaum · Aug 5, 2026 · 1 files
regcache: Use a consistent sort for defaults table
Mark Brown · Aug 5, 2026 · 1 files
drm/xe: Fix a bug in pc_adjust_freq_bounds()
Vinay Belgaumkar · Aug 5, 2026 · 1 files
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
Koichiro Den · Aug 6, 2026 · 1 files
drm/amdgpu: disallow multiple FENCE chunks in one submit
Junrui Luo · Aug 6, 2026 · 1 files
spi: dt-bindings: snps,dw-apb-ssi: Document Axiado AX3005
Swark Yang · Aug 6, 2026 · 1 files
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
Hyunjung Ko · Aug 6, 2026 · 1 files
selftests: tc-testing: add act_ct test for malformed header handling
Hyunjung Ko · Aug 6, 2026 · 1 files
net/sched: act_gact, act_police: range check the fallback control action
Hyunjung Ko · Aug 6, 2026 · 3 files
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Eric Dumazet · Aug 6, 2026 · 1 files
ipvs: revalidate ihl to prevent out-of-bounds access
Julian Anastasov · Aug 6, 2026 · 3 files
ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in NVL match table
Balamurugan C · Aug 6, 2026 · 2 files
ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for NVL.
Balamurugan C · Aug 6, 2026 · 2 files
veth: fix queue index used to wake the peer txq in veth_poll
Jonas Köppeler · Aug 6, 2026 · 1 files
net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
Oleksij Rempel · Aug 6, 2026 · 1 files
netfilter: ipset: fix list type element drift bug
Florian Westphal · Aug 6, 2026 · 1 files
netfilter: ipset: let destroy callbacks adjust ext mem size
Florian Westphal · Aug 6, 2026 · 2 files
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
Eric Dumazet · Aug 6, 2026 · 1 files
x86/CPU: Add a tlbi= cmdline switch
Rik van Riel · Aug 6, 2026 · 2 files
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
Alexey Velichayshiy · Aug 6, 2026 · 1 files
mailmap: add entries for Christoph Paasch
Christoph Paasch · Aug 6, 2026 · 1 files
perf: Reject exited events as group leaders
Kyle Zeng · Aug 6, 2026 · 1 files
net: expect instance lock in netdev_queue_get_dma_dev()
Jakub Kicinski · Aug 6, 2026 · 1 files
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
Rosen Penev · Aug 6, 2026 · 1 files
ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
Shenghao Ding · Aug 7, 2026 · 1 files
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
Chuck Lever · Aug 7, 2026 · 1 files
selftests: tls: cover splice after a failed decrypt
Chuck Lever · Aug 7, 2026 · 1 files
tcp: fix icsk_ack.ato bitfield overflow
Jiayuan Chen · Aug 7, 2026 · 2 files
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
Jiawen Wu · Aug 7, 2026 · 1 files
net: packet: fix wrong transport_header when sending VLAN-tagged frame
Wei Fang · Aug 7, 2026 · 1 files
net: tap: fix wrong transport_header when sending VLAN-tagged frame
Wei Fang · Aug 7, 2026 · 1 files
net/sched: cls_u32: skip hash tables in u32_bind_class()
Zhang Changzhong · Aug 7, 2026 · 1 files
ovpn: run deferred work on a module-owned workqueue
Ralf Lici · Aug 7, 2026 · 4 files
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
Siddharth Vadapalli · Aug 7, 2026 · 1 files
perf/core: Fix group leader use-after-free after sibling detach
Aditya Chillara · Aug 7, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
Lin Xianglin · Aug 7, 2026 · 1 files
firewire: ohci: fix NULL pointer dereference in ar_context_release
Aleksandr Nogikh · Aug 7, 2026 · 1 files
drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
Samuel Pitoiset · Aug 7, 2026 · 1 files
ASoC: tac5xx2-sdw: select REGMAP_SOUNDWIRE_MBQ
Niranjan H Y · Aug 7, 2026 · 1 files
drm/xe: Order ring writes before ring tail updates
Matthew Brost · Aug 7, 2026 · 1 files
ipv4: fix use-after-free in fib_nhc_update_mtu()
Chengfeng Ye · Aug 7, 2026 · 3 files
gve: fix zero-length skb frag with header-split
Jordan Rhee · Aug 7, 2026 · 1 files
gve: fix NULL dereference due to missing ptp adjfine
Jordan Rhee · Aug 7, 2026 · 1 files
openrisc: signal: do not restore privileged SR bits on sigreturn
Ali Ahmet Memis · Aug 7, 2026 · 2 files
netfilter: flowtable: publish GC-visible tuple last
Jérémy Jean · Aug 8, 2026 · 1 files
drm/radeon: fix autosuspend cleanup during teardown
Guangshuo Li · Aug 8, 2026 · 1 files
pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
Karl Mehltretter · Aug 8, 2026 · 1 files
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
Takashi Iwai · Aug 8, 2026 · 1 files
ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
Takashi Iwai · Aug 8, 2026 · 1 files
sctp: fix use-after-free of cached ASCONF chunk
Yuxiang Yang · Aug 9, 2026 · 2 files
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
Jamal Hadi Salim · Aug 9, 2026 · 1 files
net/sched: cls_bpf: reject dev-bound programs bound to a different device
Jamal Hadi Salim · Aug 9, 2026 · 1 files
vxlan: do not arm the ageing timer on a device that is down
Baul Lee · Aug 9, 2026 · 1 files
drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
Yang Wang · Aug 10, 2026 · 1 files
tracing: Fix race between update_event_fields and, event_define_fields
Michael Wu · Aug 10, 2026 · 1 files
drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
Gajendra Uttamchand · Aug 10, 2026 · 2 files
drm/amdgpu: Implement insert_end for VCE 3
David Rosca · Aug 10, 2026 · 1 files
tipc: read le->link under the node lock in tipc_node_link_down()
Jun Yang · Aug 10, 2026 · 1 files
pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza
Abel Vesa · Aug 10, 2026 · 1 files
net/dibs: Correct freeing of dmb_clientid_arr
Alexandra Winter · Aug 10, 2026 · 2 files
drm/xe: Fix xe_device_probe() failure
Raag Jadav · Aug 10, 2026 · 1 files
af_packet: Don't send zero-byte data in tpacket_snd().
Eric Dumazet · Aug 10, 2026 · 1 files
ASoC: Intel: NVL: Add entry for HDMI-In capture support to non-I2S codec boards.
Balamurugan C · Aug 11, 2026 · 2 files
drm/amdgpu: Reject UVD message with invalid number of h265 refs
David Rosca · Aug 11, 2026 · 1 files
regmap: sdw-mbq: Fix swap of timeout and retry times
Charles Keepax · Aug 11, 2026 · 1 files
l2tp: fix tunnel and session refcount leak on seq_file release
Eric Dumazet · Aug 11, 2026 · 2 files
sctp: clear new_transport when removing a peer
Qing Ming · Aug 11, 2026 · 1 files
Revert "drm/sched: Remove drm_sched_init_args->num_rqs"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/xe: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 3 files
Revert "drm/v3d: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/sched: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/panthor: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 2 files
Revert "drm/panfrost: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/nouveau: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/msm: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 2 files
Revert "drm/lima: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/imagination: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/etnaviv: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/amdgpu: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "accel/ethosu: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "accel/rocket: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "accel/amdxdna: Remove drm_sched_init_args->num_rqs usage"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
Revert "drm/sched: Embed run queue singleton into the scheduler"
Tvrtko Ursulin · Aug 11, 2026 · 12 files
Revert "drm/sched: Remove FIFO and RR and simplify to a single run queue"
Tvrtko Ursulin · Aug 11, 2026 · 6 files
Revert "drm/sched: Switch default policy to fair"
Tvrtko Ursulin · Aug 11, 2026 · 1 files
drm/sched: Mark fair policy as experimental
Tvrtko Ursulin · Aug 11, 2026 · 1 files
tracing: Fix NULL pointer dereference in module event cache removal
Hui Su · Aug 11, 2026 · 1 files
pid: reject allocations through dead ancestor pid namespaces
Jérémy Jean · Aug 11, 2026 · 1 files
regmap: sdw-mbq: don't call an unset readable_reg callback
Andrey Golovko · Aug 11, 2026 · 1 files
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
Gao Xiang · Aug 12, 2026 · 1 files
io_uring/rsrc: reject overflowing regvec bvec byte counts
Jérémy Jean · Aug 12, 2026 · 1 files
accel/amdxdna: Skip unmapped range in aie2_populate_range()
Lizhi Hou · Aug 12, 2026 · 1 files
spi: virtio: mark device ready before registering the controller
Jasper Wise · Aug 13, 2026 · 1 files
sched: Update time before requeueing delayed entities
Vincent Guittot · Aug 14, 2026 · 1 files
drbd: don't leak the shared secret to unprivileged netlink dumps
Christoph Böhmwalder · Aug 14, 2026 · 1 files
Revert "i2c: designware: defer probe if child GpioInt controllers are not bound"
Linus Torvalds · Aug 16, 2026 · 1 files
Linux 7.2
Linus Torvalds · Aug 16, 2026 · 1 files