Weekly briefing · Aug 31, 2026 – Sep 7, 2026
Linux mainline: week of Aug 31
A weekly briefing built from 7 published daily update(s).
In brief
This weekly briefing gathers the meaningful changes that entered Linux mainline over the previous seven days.
Bug fixes
Fix EDAC/igen6 address decoding on Intel client SoCs
The igen6 EDAC driver had several bugs in its address translation logic: the interleave boundary was off by one, hash-mode channel selection XORed the interleave bit twice, non-hash mode used a hardcoded bit position, and Raptor Lake-P used a wrong error-address format. These are corrected so the reported DIMM/channel matches the hardware.
Why it matters: More accurate ECC error reporting on affected Intel client platforms, including Alder Lake, Raptor Lake, and derivatives.
f4008169bd32540b79536f3a7b348d0d401d0361f576ec0da118a5e2f172
Fix EDAC device polling sysfs handling
The poll_msec sysfs file used a conversion that could silently truncate large values and accepted zero, which would make the polling work spin without delay. It now rejects out-of-range values.
Why it matters: Prevents CPU-spinning and misconfigured polling intervals when adjusting EDAC device polling.
Fix XFS superblock sync deadlock and zoned-write bugs
XFS no longer holds buffer locks across a synchronous transaction commit, avoiding a deadlock during shutdown. Zoned-storage paths also get fixes for open-zone caching races, lost bio device pointers on stacked devices, incorrect iomap flags, and a NULL dereference with merged ioends.
Why it matters: Prevents hangs and potential data corruption on XFS, particularly with zoned block devices and stacked DM devices.
41a28c865d1d2d829cc76777885435535bb14bc67fc800edae285611891f
Fix XFS quota bypass via group ID change
A capability check in XFS used the wrong credential set, letting a user evade group quota by changing a file's group ID. The fix uses a new capable_noaudit() helper that checks effective credentials without triggering audit noise.
Why it matters: Closes a quota enforcement bypass and avoids spurious SELinux audit messages.
e2f62a9744eb1b91724d0bdc4642259374fcbe9c45bdb194412f89fb3988
Fix sched_ext scheduler bugs
sched_ext gets fixes for spurious scheduler aborts during DSQ ownership races, timer re-arming on kernels without BPF timer CPU pinning, lost vtime credit in flatcg cgroup migration, and silent timer failures in example schedulers. A documentation example also uses the correct exit-info field.
Why it matters: More reliable BPF schedulers, especially for cgroup-aware scheduling and older kernels.
cca061dccf5623761359861cb6ee92d7f7f084590dbb9f354fb8d6379d2c
Fix workqueue deadlocks and watchdog edge cases
Workqueue fixes address a use-after-free in unbound pool lifetime, a softirq-triggering bug on PREEMPT_RT, lockdep-recursive locking when draining dead BH pools, and watchdog thresholds that could overflow jiffies.
Why it matters: Prevents crashes and hangs in kernel workqueue operations, particularly on real-time kernels.
Fix cgroup kill and cpuset isolation regressions
A race in cgroup.kill handling could SIGKILL children created with clone3(CLONE_INTO_CGROUP) even when the cgroup was not being killed. Cpuset also failed to preserve CPUs isolated at boot when an isolated partition was released.
Why it matters: Avoids unexpected process termination and keeps boot-isolated CPUs isolated.
Heap memory leak via pipe read compound padding
When ksmbd handles a compound SMB2 read on a named pipe, it allocates only the payload size but the compound response handler extends the last iov to an eight-byte boundary, exposing up to seven bytes of uninitialized kernel heap memory to the client. The fix allocates the aligned size and zeroes the tail before pinning the response buffer.
Why it matters: An authenticated client could read uninitialized kernel heap bytes from the server.
Buffer overflow in normalized file name responses
ksmbd left FILE_NORMALIZED_NAME_INFORMATION responses in a small 448-byte buffer and converted the file path to UTF-16 without checking remaining space, allowing an authenticated client with a long path to write beyond the response buffer. The fix uses the large response buffer and validates space for worst-case UTF-16 output plus terminator.
Why it matters: An authenticated client could trigger an out-of-bounds write on the server.
Out-of-bounds reads in share config responses
ksmbd's IPC share configuration handling consumed variable-length fields without validating payload sizes, allowing out-of-bounds reads in veto list parsing and path length derivation. The fix validates payload sizes before consuming variable-length fields.
Why it matters: Malformed IPC responses could cause out-of-bounds reads in the server.
Listener task lifetime race on netdev events
When a netdevice event shuts down the listening socket, the listener thread could exit and have its task_struct freed before kthread_stop() obtains its reference. The fix creates the listener in a stopped state, holds an extra task_struct reference until kthread_stop_put() completes, and stops listeners before freeing interface records.
Why it matters: A network configuration change could trigger a use-after-free of the listener task_struct.
DACL parsing errors silently accepted
parse_dacl() silently accepted truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion. The fix propagates parsing and allocation errors so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.
Why it matters: A malformed security descriptor could lead to an incomplete ACL being applied to a file.
Information leak via uninitialized response fields in compound requests
Three separate ksmbd filesystem information queries (FS_OBJECT_ID_INFORMATION, FS_CONTROL_INFORMATION, FS_POSIX_INFORMATION) reported fixed-size responses without initializing all fields. While standalone requests were safe due to zeroed allocation, compound requests could leak up to 31 bytes of stale buffer content from a previous response. The fixes explicitly initialize the previously unset fields.
Why it matters: An authenticated client could potentially read stale kernel heap data via compound requests.
Session teardown race in multichannel logoff
SMB3 multichannel allows one session to run on multiple connections, but session teardown during LOGOFF did not wait for all bound channels or properly handle deferred byte-range locks, synchronous CANCEL requests, and CHANGE_NOTIFY completions. The fix serializes teardown with channel registration and uses atomic work-state transitions.
Why it matters: Premature freeing of shared session objects during LOGOFF could cause crashes under multichannel workloads.
Kernel log flooding from unmapped SIDs
A client could include many structurally valid but unmapped SIDs in a DACL, causing ksmbd to log hundreds of error messages per request. The fix rate-limits the message.
Why it matters: An authenticated client could flood the kernel log with SID mapping errors.
Data corruption in emulated insert range via overlapping COPYCHUNK
smb3_insert_range() shifts data right using COPYCHUNK from low to high offsets, but when source and target ranges overlap, the copy overwrites source data before it is copied. For a 1 MiB insert at offset 0, this turns [A][B][C][D] into [hole][A][A][A][A]. The fix copies in server-allowed chunk sizes starting from the highest offset to avoid overwriting unread source data.
Why it matters: Insert-range fallocate on a CIFS mount could silently corrupt file contents.
Integer truncation in collapse range for large files
smb3_collapse_range() stored the ssize_t return of smb2_copychunk_range() in an int, so a successful copy larger than INT_MAX was truncated to a negative value and treated as an error. The fix uses __smb2_copychunk_range(), which reports success as zero instead of a byte count.
Why it matters: Collapse-range fallocate on files larger than 2 GiB would fail silently and leave the file unchanged.
Stale page cache after insert and collapse range
smb3_insert_range() and smb3_collapse_range() used truncate_pagecache_range() to invalidate page cache, but non-page-aligned boundaries left partial pages marked uptodate. After COPYCHUNK moved data on the server, those cached pages could return stale data. The fix ensures boundary pages are fully invalidated.
Why it matters: Reading a file after insert or collapse range on a CIFS mount could return stale cached data.
FS-Cache not invalidated after fallocate range operations
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and smb3_collapse_range() discarded page cache but left the FS-Cache cookie valid, so a later read could return data cached before the range operation. The fix invalidates FS-Cache after outstanding I/O completes and before modifying the file on the server.
Why it matters: With fscache enabled, reads after fallocate operations could return pre-operation cached data.
Data corruption with concurrent writes and O_TRUNC
cifs_do_truncate() flushed dirty pages and truncated the server file without holding i_rwsem or invalidate_lock, so a concurrent buffered write could dirty new pages after the flush but before local truncation, and those pages would be silently discarded. The fix acquires exclusive i_rwsem and filemap_invalidate_lock for the entire flush-truncate-resize sequence.
Why it matters: A concurrent write during O_TRUNC on a CIFS mount could lose data silently.
Inode size set to zero when no cached handle is available during truncate
If find_writable_file() returned null, cifs_do_truncate would set i_size to zero before telling the server to truncate. If the subsequent O_TRUNC open failed, the inode had size zero while the server file was unchanged. The fix moves the size update into the branch where a writable file handle exists, and evicts stale pages before the open.
Why it matters: A failed open with O_TRUNC on CIFS could leave the local inode with a size of zero while the server file retained its data.
Stale inode metadata after FSCTL_DUPLICATE_EXTENTS_TO_FILE failure
smb2_duplicate_extents() had no handling for FSCTL failure: when the server-side duplicate extents operation failed, local inode metadata could be stale from pre-extension state or concurrent remote writes but was never refreshed. The fix forces revalidation on FSCTL failure.
Why it matters: After a failed server-side reflink copy on SMB3, the client could serve stale file size or metadata.
Heap overflow in ACL set via mismatched size validation
cifs_set_acl() validated ACL size using the xattr format (4 + count*8 bytes), but cifs_do_set_acl() then wrote the larger CIFS wire format (6 + count*10 bytes) into the same buffer, causing a heap overflow. Additionally, the on-wire data_count is a __u16, so sizes above USHRT_MAX truncate the packet length and cause the server to apply a partial ACL. The fix validates the CIFS format size against remaining buffer space and USHRT_MAX before converting.
Why it matters: A crafted ACL could overflow a heap buffer in the CIFS client; a large valid ACL could also cause a partial ACL to be applied server-side.
SetEA requests not validated against request buffer size
CIFSSMBSetEA() copied the extended attribute value into the SMB request buffer without checking that it fit alongside the header and EA name. The only incoming bound was CIFSMaxBufSize (the full payload capacity), so a value of exactly that size left no room for the SMB header and overran the buffer. The fix rejects values that do not fit the negotiated buffer size.
Why it matters: Setting an xattr of maximum allowed size on a CIFS mount could overflow the request buffer.
RLIMIT_FSIZE bypass via insert range and zero range
smb3_insert_range() and smb3_zero_range() (without KEEP_SIZE) could extend the file beyond RLIMIT_FSIZE, s_maxbytes, or the loff_t range because they did not validate the new EOF before sending the server-side request. The fixes use check_add_overflow() and inode_newsize_ok() to validate the new size before modifying the file.
Why it matters: A process with an RLIMIT_FSIZE set could grow a CIFS file beyond that limit via fallocate.
Steve French removed as maintainer; Paulo Alcantara added as SMBDIRECT co-maintainer
Steve French, long-time maintainer of Linux's SMB support, passed away. The KSMBD entry was updated to remove him, and Paulo Alcantara was added as a co-maintainer of SMBDIRECT.
Why it matters: Maintainership of SMBDIRECT transitions to Paulo Alcantara; KSMBD no longer lists Steve French.
Multiuser mount with krb5 fails to find credentials
The CIFS client was not duplicating the username option when creating multiuser connections with krb5, so cifs.upcall could not find credentials in the keytab. The fix duplicates the username option from the original fs context before creating multiuser connections.
Why it matters: Multiuser SMB mounts with krb5 authentication would fail to establish secondary sessions.
Emulated insert range does not mark file sparse first
The SMB client emulates FALLOC_FL_INSERT_RANGE with SET_EOF, COPYCHUNK, and SET_ZERO_DATA, but SET_ZERO_DATA only creates a hole on sparse files. On a non-sparse file, the inserted range was cleared but blocks remained allocated, causing extent-count checks to fail. The fix marks the file sparse before modifying it.
Why it matters: xfstests generic/064 fails on CIFS mounts where the server block size matches the deallocation granularity; real-world impact is sparse-extent metadata rather than data loss.
Debug print split across log levels in transport release
A prior printk-to-pr_level conversion accidentally split a single debug message into two messages on different log levels, confusing users in rare error cases. The fix restores the original single-message behavior.
Why it matters: Cosmetic; affects debug output readability in rare transport error paths.
Silent disk corruption on 4K-sector volumes
The NTFS driver computed bi_sector in volume-sector-size units instead of 512-byte units, causing silent disk corruption on writes to volumes with 4K sector sizes.
Why it matters: Anyone using NTFS on 4K-native storage could experience silent data corruption on writes.
FITRIM could discard allocated clusters
ntfs_trim_fs() derived discard length by aligning the original extent length down rather than aligning the absolute end, extending the discard range past free extents into allocated clusters.
Why it matters: Running fstrim on an NTFS volume could silently discard data from allocated clusters.
Information leak via fallocate and mmap read race
The fallocate path did not hold invalidate_lock for standard allocation modes, allowing concurrent mmap page faults to read uninitialized disk data from newly allocated clusters before they were zeroed.
Why it matters: A local user could read stale disk contents through a racing mmap read during fallocate.
Volume incorrectly marked clean after errors
ntfs_sync_fs() unconditionally cleared the dirty bit even when volume errors had been recorded, so a sync() on an errored volume marked it clean and prevented recovery on next mount.
Why it matters: NTFS volumes that experienced errors could be marked clean, skipping needed recovery and leaving corruption unrepaired.
Truncate races with mmap writes causing SIGBUS and corruption
ntfs_setattr_size() and ntfs_filemap_page_mkwrite() did not hold invalidate_lock, allowing concurrent truncate or fallocate to race with page faults and produce spurious SIGBUS or corrupt data.
Why it matters: Programs using memory-mapped NTFS files could experience unexpected SIGBUS or data corruption during concurrent file resizing.
fallocate returns success when interrupted by signal
ntfs_attr_fallocate() checked for pending signals but returned 0 instead of -EINTR when interrupted, so callers believed the allocation succeeded even though it was incomplete.
Why it matters: Applications using fallocate on NTFS files could silently receive incomplete allocations when interrupted by signals.
WOF system-compressed file reads serialized globally
WOF decompression held a module-global mutex across the entire chunk loop including disk I/O, serializing all readers system-wide on disk waits rather than just on decompressor scratch space.
Why it matters: Reading system-compressed files on NTFS could see dramatically reduced throughput when multiple processes accessed them concurrently.
IPv4 multipath divide-by-zero crash during route rebalancing
A concurrent change to ignore_routes_with_linkdown could make the first pass of fib_rebalance() compute zero total weight while the second pass sees an eligible nexthop, causing a division by zero.
Why it matters: Systems using IPv4 multipath routing could experience a kernel crash during link state changes.
IPv6 Segment Routing Header network header restoration
ipv6_srh_rcv() incorrectly assumed the SRH immediately follows the fixed IPv6 header; when another extension header precedes it, the network offset became negative, breaking flow dissection, BPF, and forwarding.
Why it matters: IPv6 Segment Routing users with Hop-by-Hop or other extension headers get correct routing, forwarding, and BPF flow dissection.
IPv6 multicast RCU list corruption fixes
Multiple commits fix RCU-protected IPv6 multicast list updates that used direct pointer assignments or in-place mutations instead of proper copy-on-write or rcu_assign_pointer, causing torn reads and list diversion for concurrent readers.
Why it matters: IPv6 multicast users gain protection against corrupted source filter lists and incorrect group membership checks during concurrent updates.
IGMP multicast source list converted to RCU for performance
The IGMP source filter list used a spinlock in the multicast receive fast path, causing lock contention; converting to RCU eliminates the spinlock acquisition in packet receive and route lookup paths.
Why it matters: Systems with heavy IPv4 multicast traffic experience reduced lock contention and improved throughput.
GRO prevents nesting of hardware-GRO SKBs inside fraglist GRO packets
Fraglist GRO combined with hardware GRO could construct a GSO packet that could not be correctly segmented back during TCP tethering or forwarding. The fix flushes an already-built fraglist GRO packet when a hardware GRO packet arrives.
Why it matters: Users doing TCP tethering or forwarding on systems with hardware GRO support may avoid corrupted segmented packets.
Bonding ALB out-of-bounds memory access via uninitialized transport header
alb_determine_nd() used icmp6_hdr(skb) which dereferences an uninitialized transport_header for packets from raw sockets or forwarded paths. The fix fetches the ICMPv6 header directly after the IPv6 header following pskb_network_may_pull().
Why it matters: Systems using bonding in ALB mode with IPv6 traffic could experience kernel memory corruption or crashes.
TIPC NULL dereference on full publication list
When user-space binds more than 65535 service addresses, protocol service types are no longer inserted into the TIPC name table, causing a NULL pointer dereference in the idle task.
Why it matters: TIPC users who bind large numbers of services are protected against kernel crashes and broken topology notifications.
page_pool fragment offset alignment for odd-sized requests
page_pool_alloc_frag_netmem() did not round fragment sizes on DMA-coherent architectures like x86, leaving frag_offset misaligned for all subsequent fragments carved from the same shared page.
Why it matters: Network performance on x86 and other DMA-coherent architectures improves as shared page pool fragments stay properly cache-aligned.
Revert sleepable static key reset to avoid deadlock
The reverted change replaced a work queue with a direct static_key_disable() call in DO_ONCE_SLEEPABLE(), but callers such as __inet_hash_connect() may hold the socket lock, causing deadlock. The revert restores the work queue approach.
Why it matters: This prevents a potential deadlock when network connections trigger one-time initialization while holding socket locks.
QMI WWAN driver adds Compal EXM-G1x LTE modem support
Adds the QMI WWAN interface for the Compal EXM-G1x, a Qualcomm SDX12-based LTE modem, using the DTR quirk on interface 8.
Why it matters: Owners of devices with this embedded LTE modem can now use it for cellular connectivity under Linux.
amd-xgbe: driver accepted packets with bad checksums
The amd-xgbe driver set the MAC_RCR.DCRCC bit which disabled hardware FCS validation, causing packets with bad frame check sequences to be accepted unconditionally.
Why it matters: Systems with AMD 10GbE network hardware could receive corrupted packets silently.
QRTR sends HELLO on endpoint registration to unblock slave-role devices
Previously the HELLO handshake was owned solely by the name server, which could cause a deadlock when both host and remote waited for the other to send first. The handshake is now moved to the core layer.
Why it matters: External peripherals such as WLAN chipsets attached over MHI that operate in a slave role will now reliably establish QRTR communication.
Bluetooth hci_core device registration race
hci_register_dev() queued power_on work before initializing the MSFT extension, allowing hci_power_on() to run msft_do_close() on an uninitialized mutex, causing use-after-free on concurrent teardown.
Why it matters: Bluetooth users are protected against crashes during device registration races on Intel controllers using MSFT extensions.
Bridge multicast teardown use-after-free fix
During port teardown, br_multicast_del_port() and __br_multicast_disable_port_ctx() could have their hlist walk terminated early if br_multicast_find_del_pg() deleted the iterator's saved next node, leaving dangling port group entries.
Why it matters: Systems using bridge multicast snooping could avoid kernel memory corruption when removing bridge ports with active multicast groups.
af_packet tpacket negative length BUG() trigger
tpacket_parse_header() cast the user-provided u32 tp_len to int, so values above INT_MAX could produce negative return values interpreted as error codes, triggering BUG() in sock_sendmsg_nosec().
Why it matters: Users of AF_PACKET TPACKET interfaces are protected against kernel BUG() triggers from malformed packet ring headers.
rtl8723bs wireless driver out-of-bounds reads from attacker-controlled frames
WPS attribute, action frame, and WMM IE parsing in the staging rtl8723bs driver lacked proper bounds checks on data from wireless management frames, allowing a malicious peer to trigger heap OOB reads or stack overflows.
Why it matters: A nearby malicious Wi-Fi peer could craft management frames to trigger kernel memory corruption on systems using rtl8723bs wireless adapters.
Hisilicon Hi1616 hns NIC regression fixed by reverting mbigen IRQ address change
A prior fix to the mbigen node address layout caused a regression where the second hns NIC port could not pass any traffic, with the break occurring at an mbigen node boundary. The revert restores working behavior.
Why it matters: Users of Hisilicon Hi1616 systems with hns NICs regain use of all network ports.
STM32MP hwspinlock timeout corrected from 1 second to 1 millisecond
The hwspinlock timeout was passed in microseconds where milliseconds were expected, causing a 1000x longer busy-wait that disabled preemption during interrupt type configuration.
Why it matters: STM32MP platforms, especially real-time configurations, avoid excessively long preemption-disabled windows during interrupt configuration.
virtio_console sleeping allocation fixed in atomic console write path
The port_buffer struct was allocated with GFP_KERNEL even when called from the hvc console write path with preemption disabled, causing sleeping-in-atomic-context warnings.
Why it matters: VM guests using virtio console no longer trigger debug splats or potential stalls when writing to /dev/kmsg under preemption-disabled contexts.
Softirq deferred indefinitely by interrupt disable ordering
A pending softirq could be missed if the triggering interrupt arrived between hardirq_disable_enter() and _local_interrupt_disable(), deferring softirq processing to the next interrupt which might never come.
Why it matters: Systems could experience indefinite softirq delays, potentially causing network or other softirq-dependent processing to stall.
Hardware support
VirtIO-GPU error handling and teardown fixes
Corrects NULL/ERR_PTR confusion in framebuffer creation, propagates output init failures, drains pending vbufs before tearing down queues, and fixes DMA addressing on Xen PV domains.
Why it matters: More reliable VirtIO GPU in VMs, no leaks/warnings on device removal, and working framebuffers under Xen PV.
Nouveau stability fixes for Turing+, GB20x and ARM/Tegra
Fixes a channel-kill use-after-free, adds real scanline position on Turing+ GSP, corrects HDMI infoframe/AVMute and DP config on GB20x/r570, fixes head state/vblank on GB20x, switches coherent mappings to write-combined on ARM/Tegra, and repairs VM bind error unwinding.
Why it matters: Fewer crashes, accurate vblank timestamps, working HDMI audio signaling, and stable VM bind error paths for Nouveau users.
511585987d27554ab79cfd1092f09dcb4e84764deff8450c39fd4b7427209421dfe912e55bb489b33323774b73428e6e412a6ceb56d5ccf930812f2338a62306c426
AMD display and compute fixes
Sets 4K GPUVM page size on DCN35/36 to avoid 8K corruption, selects VESA AUX backlight for OLED panels, guards USB4/DP bandwidth estimation against division by zero, fixes cursor visibility with split planes, updates color blocks for Gamescope night mode, improves LUT distribution, and adds TLB flushes after compute queue eviction.
Why it matters: Fixes 8K splash corruption, black OLED panels, USB4 dock crashes, disappearing cursors, color management issues, and compute queue hangs.
9ce3169430f15a67d2e05589f63de9054da86293f2e1439f88f8113ab1184278d65a41a294e25cb6ab7f
Intel display fixes
Avoids a spurious CDCLK change and visible glitch on Panther Lake, fixes PSR selective fetch state after plane disable, and removes a duplicate MST pfit compute call.
Why it matters: Cleaner boot on Panther Lake, fewer PSR-related display issues, and less redundant MST work.
GUD USB display fixes
NUL-terminates and validates TV mode names, avoids a WARN_ON when rotation 0 is missing, and rejects malformed modes.
Why it matters: No out-of-bounds reads or kernel warnings with GUD displays.
DRM core, DMA-BUF and misc display fixes
Fixes a dma-buf fd leak/race by publishing after copy_to_user, restores DMA-BUF tracing for PRIME exports, fixes a DRM atomic commit leak with PAGE_FLIP_EVENT, adds blend mode property to Tegra, fixes ofdrm framebuffer overflow/device detection, and validates cirrus-qemu BAR size.
Why it matters: Better fd handling, restored tracepoints, fewer leaks, and safer framebuffer drivers.
30d0aff2c65aa4a1a2bfcb293e164bf592bb4d4be202165e20839d02c0cfc6f48e59ece0958f35cbb89592312d333bf7
Accelerator driver fixes
Fixes an out-of-bounds read in QAIC response handling, a zero-length SYNC_BO fault and unsafe counted-by annotation in AMD XDNA, plus BO ref leaks and MMIO/command parsing fixes in Arm Ethos-U.
Why it matters: Prevents crashes, panics, and resource leaks in Qualcomm, AMD, and Arm NPU/accelerator drivers.
ab243f74ab40dc1475366424b3709d354545ef6d27af71e17e33ba3a1d487ab64476a610db9deec5a3452d2a3adc9195
Performance
Per-CPU maps crash and freelist deadlock on sparse and single-CPU systems
On arm64 systems with non-contiguous CPU IDs, BPF per-CPU maps used the logical CPU ID instead of the possible-CPU index, causing page faults and scrambled values. Separately, on single-CPU systems, an NMI re-entering pcpu_freelist_push() while the interrupted context held the lock would spin forever.
Why it matters: arm64 systems with CPU topology holes no longer crash on per-CPU BPF maps; single-CPU systems no longer hard-lock under NMI on the freelist path.
Use-after-free fixes in resizable hash maps and nested map callbacks
Resizable hash map element recycling could clear timer fields without cancelling them, and nested map-of-maps callbacks could pair timers with the wrong inner map, both leading to use-after-free conditions.
Why it matters: Prevents kernel memory corruption from BPF programs using timers with resizable hash maps or nested map-of-maps constructs.
Trampoline allocation throughput improved on x86
BPF trampoline allocation on x86 triggered unnecessary ROX-to-WNX memory protection flips; switching to EXECMEM_MODULE_DATA allocations avoids the extra protection changes.
Why it matters: Workloads allocating large numbers of BPF trampolines will see significantly improved allocation throughput.
RISC-V BPF arena maps now report missing ZACAS support clearly
BPF arena map creation silently failed with -ENOMEM on RISC-V systems lacking the ZACAS extension because the allocator requires cmpxchg128 support. The fix returns -EOPNOTSUPP instead.
Why it matters: RISC-V users without ZACAS get a clear error instead of a misleading out-of-memory error.
Security and hardening
TCP use-after-free in getsockopt for congestion control info
do_tcp_getsockopt() read icsk_ca_ops without RCU protection; with BPF struct_ops congestion control, the pointer could be freed concurrently via setsockopt, causing a slab use-after-free.
Why it matters: A local attacker could trigger a use-after-free in the TCP stack, potentially leading to privilege escalation.
SCTP remote denial of service via crafted ASCONF-ACK
A mismatch between padded and unpadded parameter iteration in ASCONF-ACK processing could cause an infinite loop in softirq context when an attacker sends a crafted odd-length parameter.
Why it matters: A remote peer can trigger a kernel soft lockup on any SCTP-enabled kernel, causing denial of service without application credentials.
Bluetooth L2CAP out-of-bounds write fixes
Multiple commits fix out-of-bounds writes in the Bluetooth L2CAP ECRED connection path caused by incorrect channel counting and mode selection, which could corrupt kernel memory.
Why it matters: Bluetooth users could be affected by kernel memory corruption from crafted L2CAP connection requests.
vsock connected socket source validation
The virtio and VMCI vsock transports did not validate that incoming packets for connected sockets came from the stored peer address, allowing unrelated sources to establish or reset connections.
Why it matters: vsock users are protected against spoofed packets that could hijack or reset connections.
UDP exception cache side-channel mitigations
ICMP error handling for UDP sockets created FIB nexthop exceptions only after matching a socket, allowing off-path attackers to probe the exception cache and discover ephemeral ports via side-channel.
Why it matters: Connected UDP socket users gain improved protection against off-path attackers discovering ephemeral port numbers.
SELinux BPF token permission TOCTOU fix
The SELinux BPF token access control checks looked up creator SID via the token file descriptor multiple times, allowing a TOCTOU race if the user changes the fd between lookups.
Why it matters: Users of SELinux with BPF token access control are protected against a time-of-check-to-time-of-use race that could bypass permission checks.
Bluetooth Intel TLV parsing bounds checks
Several fixes validate TLV value lengths and firmware ID boundaries in the btintel driver to prevent out-of-bounds reads from malformed controller responses.
Why it matters: Users with Intel Bluetooth controllers are protected against kernel memory exposure from malformed device responses.
s390/pci: uninitialized kernel data leaked in SCLP error reports
report_error_write() did not validate that the user-provided buffer was large enough to contain the report length claimed by the report header, allowing up to ~4K of uninitialized kernel data to leak into the SCLP report.
Why it matters: A privileged entity processing SCLP reports could observe uninitialized kernel memory contents.
zcrypt CRT key structure leaks kernel memory
The zcrypt CCA CRT key token had uninitialized padding bytes between key components that were sent to the crypto card, potentially leaking kernel memory contents.
Why it matters: s390 zcrypt users are protected against kernel memory leakage to crypto hardware.
ksmbd memory-safety fixes
Fixes use-after-free in oplock break notifications, heap overflow via COPYCHUNK range validation, and a tree-connect use-after-free.
Why it matters: Authenticated SMB clients can no longer crash or corrupt kernel memory on ksmbd hosts.
Marvell SATA interrupt fix
Adjusts AHCI interrupt clearing for Marvell 88SE61xx to avoid lost interrupts and command timeouts.
Why it matters: Reliable disk I/O on NAS/embedded systems with these controllers.
IMA/configfs deadlock fix
Adds configfs to the built-in IMA exclude list to prevent a lock cycle with nvmet.
Why it matters: Avoids deadlocks on systems using IMA with configfs-backed nvmet.
Prevent write upgrade on read-only ublk mmaps
The ublk driver now clears VM_MAYWRITE on read-only command-buffer mappings, so mprotect cannot make them writable.
Why it matters: Closes a security issue where an unprivileged ublk daemon could corrupt kernel-written I/O descriptors.
Fix io_uring SCSI passthrough buffer overruns
The SCSI bsg passthrough path now caps sense-data copies to the user buffer size and closes a time-of-check/time-of-use race on the shared SQE.
Why it matters: Prevents userspace from overflowing kernel command buffers or overrunning response buffers when using io_uring SCSI passthrough.
Verifier bypasses closed for null pointers, kptr, percpu, and precision tracking
Multiple independent verifier flaws allowed unsafe BPF programs to pass verification: comparing pointers could strip PTR_MAYBE_NULL, kptr fields could accept arbitrary scalars, precision backtracking missed NULL-nullable arguments, and JMP32 branch prediction or fastcall rewriting could accept out-of-bounds programs. Collectively these could allow null dereferences, kernel memory corruption, or state-pruning bypasses.
Why it matters: Unprivileged BPF programs could crash the kernel or escalate privileges on affected systems; these fixes close a broad class of verifier bypasses.
d3ef6c097ba0387b1baefbb7e3e4f66cc4b7374b2c5561db4814ed6406f30b1c83dc3c44369f4ce73457266aa4ad0b2e7b7b8b596010d05524794240620614bf76729d02927fdf4ee7d28823c66267b529f521a673a98f96811ee51179a4e0986aed0134d3cd048029ba1c79ecdc5043794ccd6f72d7f38e7441ee8276641a3a10b030c9f1e418129f2e506ada89629ee726fc6b9afec3fd8e5fd100
Signal tracepoint siginfo arguments marked scalar to prevent kernel panic
The signal_generate and signal_deliver tracepoints can pass sentinel values SEND_SIG_NOINFO (zero) or SEND_SIG_PRIV (one) as the info pointer. A tp_bpf program dereferencing these would panic the kernel, especially since signal_generate can fire from timer interrupt context.
Why it matters: Prevents a local user with CAP_BPF from crashing the kernel via a crafted BPF tracepoint program.
Source commits615 entries +
EDAC/sysfs: Use sysfs_emit_at() in dimmdev_location_show()
Abhinav Ananthu · Jun 19, 2025 · 1 files
drm/nouveau/disp/r535: Add scanline position support + head state support
Lyude Paul · Apr 29, 2026 · 3 files
EDAC/mpc85xx: Orphan it
Borislav Petkov (AMD) · Jun 12, 2026 · 1 files
MAINTAINERS: Add Radhey Shyam Pandey as Xilinx EDAC reviewer
Radhey Shyam Pandey · Jun 25, 2026 · 1 files
EDAC/debugfs: Remove the fake_inject debugfs interface
Yazen Ghannam · Jun 29, 2026 · 2 files
MAINTAINERS: Remove Mark Gross from relevant entries
Uwe Kleine-König · Jul 3, 2026 · 2 files
scsi: sg: Report request-table problems when any status is set
Xu Rao · Jul 6, 2026 · 1 files
RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed
Yazen Ghannam · Jul 6, 2026 · 2 files
mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
Wupeng Ma · Jul 7, 2026 · 1 files
EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout
Rounak Das · Jul 8, 2026 · 2 files
EDAC/altera: Remove remaining CONFIG_64BIT ifdefs in the DB-error path
Rounak Das · Jul 8, 2026 · 1 files
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
Ibrahim Hashimov · Jul 13, 2026 · 1 files
EDAC: Remove redundant dev_err()
Pan Chuang · Jul 13, 2026 · 5 files
accel/ethosu: check MMIO mapping errors in probe
GuoHan Zhao · Jul 16, 2026 · 1 files
workqueue: Use raise_softirq() to trigger softirq in irq_work handler
Zqiang · Jul 16, 2026 · 1 files
accel/ethosu: fix job completion fence cleanup
GuoHan Zhao · Jul 17, 2026 · 1 files
scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
Maurizio Lombardi · Jul 17, 2026 · 1 files
drm/i915/cdclk: Avoid spurious cdclk sanitization on PTL+
Ville Syrjälä · Jul 17, 2026 · 1 files
xfs: split an assert in xfs_trans_log_buf
Christoph Hellwig · Jul 20, 2026 · 1 files
xfs: don't flush and invalidate internal RT device twice in xfs_shutdown_devices
Christoph Hellwig · Jul 20, 2026 · 1 files
MAINTAINERS, mailmap: use Aditya Garg's linux.dev account
Aditya Garg · Jul 23, 2026 · 2 files
RAS/AMD/ATL: Remove conditional return with no effect
Sang-Heon Jeon · Jul 23, 2026 · 1 files
usb: storage: realtek_cr: fix use-after-free on disconnect
Myeonghun Pak · Jul 27, 2026 · 1 files
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
Thadeu Lima de Souza Cascardo · Jul 27, 2026 · 1 files
HID: i2c-hid: Add a quirk for a Cirque I2C device.
Vadim Klishko · Jul 28, 2026 · 2 files
drm/pagemap: Reset migration page count on eviction retry
Arvind Yadav · Jul 28, 2026 · 1 files
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
Muhammad Bilal · Jul 28, 2026 · 1 files
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
Muhammad Bilal · Jul 28, 2026 · 1 files
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
Muhammad Bilal · Jul 28, 2026 · 1 files
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
Aleksandr Nogikh · Jul 29, 2026 · 1 files
EDAC/ie31200: Decouple DIMM width decoding from enum order
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Fix interleave boundary condition
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Fix channel selection hash
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Fix channel address decode for non-hash mode
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Fix Raptor Lake-P logged error address
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Remove unnecessary XOR on the zero-valued interleave bit
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Simplify compute die ID comments
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Detect present memory controllers at runtime
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Remove redundant resource configuration tables
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Refactor address translation logic
Qiuxu Zhuo · Jul 30, 2026 · 1 files
EDAC/igen6: Add Intel Starfire SoCs support
Qiuxu Zhuo · Jul 30, 2026 · 1 files
HID: multitouch: Fix stale MT slots when contact count drops to zero
Dave Carey · Jul 30, 2026 · 1 files
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
Jad Keskes · Jul 30, 2026 · 1 files
xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
Yun Zhou · Jul 31, 2026 · 2 files
drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
Shixiong Ou · Jul 31, 2026 · 1 files
accel/qaic: Address potential out-of-bounds read in resp_worker()
Youssef Samir · Jul 31, 2026 · 1 files
scsi: target: iscsi: Reserve a terminator byte for the login payload
Sujal Tuladhar · Aug 1, 2026 · 1 files
drm/virtio: reclaim pending vbufs before tearing down vqs
Anuj Bolewar · Aug 2, 2026 · 3 files
HID: bpf: serialize device reference release in struct_ops destroy path
Shen Yongchao · Aug 3, 2026 · 1 files
xfs: fix capability check in xfs
Carlos Maiolino · Aug 4, 2026 · 3 files
capability: Add new capable_noaudit
Carlos Maiolino · Aug 4, 2026 · 2 files
quota: Don't issue audit messages on quota enforcing
Carlos Maiolino · Aug 4, 2026 · 1 files
xfs: replace ns_capable_noaudit
Carlos Maiolino · Aug 4, 2026 · 3 files
capability: unexport has_capability_noaudit
Carlos Maiolino · Aug 4, 2026 · 1 files
drm/i915/dp_mst: Remove duplicate intel_pfit_compute_config() call
Chaitanya Kumar Borah · Aug 6, 2026 · 1 files
s390/pci: Fix leak of uninitialized kernel data in SCLP report
Niklas Schnelle · Aug 6, 2026 · 1 files
s390/ap: Drop unused member from ap_device_id
Uwe Kleine-König (The Capable Hub) · Aug 6, 2026 · 1 files
bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
Hui Su · Aug 6, 2026 · 2 files
drm/virtio: use the DMA API for resource backing on Xen
Benjamin Leggett · Aug 6, 2026 · 3 files
xfs: remove kmem_to_page()
Tal Zussman · Aug 7, 2026 · 1 files
drm/amd/display: use plane color_mgmt_changed to track colorop changes
Melissa Wen · Aug 7, 2026 · 1 files
staging: fbtft: make dirty_lock IRQ-safe
Hui Su · Aug 7, 2026 · 1 files
dm-ebs: fix incorrect device offset check in ebs_ctr()
Genjian Zhang · Aug 7, 2026 · 1 files
sched/core: Skip rq->avg_idle update without a valid idle_stamp
Shubhang Kaushik (Ampere) · Aug 7, 2026 · 1 files
EDAC/device_sysfs: Cleanup around edac_device_ctl_poll_msec_store()
Borislav Petkov (AMD) · Aug 7, 2026 · 3 files
btrfs: clean up target device if block group marking fails
Guanghui Yang · Aug 8, 2026 · 1 files
drm/pagemap: Prevent double migration of device pages
Arvind Yadav · Aug 10, 2026 · 2 files
btrfs: send: fix lost error return value in will_overwrite_ref()
Avi Weiss · Aug 10, 2026 · 1 files
btrfs: detach failed sprout device from transaction update list
Guanghui Yang · Aug 10, 2026 · 1 files
btrfs: restore active device pointers after failed sprout
Guanghui Yang · Aug 10, 2026 · 1 files
EDAC/thunderx: Orphan it
Borislav Petkov (AMD) · Aug 10, 2026 · 1 files
xfs: use inode_init_always_gfp with __GFP_NOFAIL in xfs_inode_alloc
Christoph Hellwig · Aug 10, 2026 · 1 files
virtio_console: allocate the port_buffer with the caller's gfp
Breno Leitao · Aug 10, 2026 · 1 files
loop, zloop: fix dma_alignment for large or unreported limits
Keith Busch · Aug 10, 2026 · 2 files
drm/virtio: check return value of vgdev_output_init()
shechenglong · Aug 11, 2026 · 1 files
mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
Sourav Panda · Aug 11, 2026 · 1 files
btrfs: tests: do not touch page cache if root/inode allocation failed
Qu Wenruo · Aug 11, 2026 · 1 files
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
Zhenhao Wan · Aug 11, 2026 · 1 files
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
Zhenhao Wan · Aug 11, 2026 · 1 files
drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
Zhenhao Wan · Aug 11, 2026 · 1 files
s390/diag324: Preserve -EBUSY return code
Sumanth Korikkar · Aug 11, 2026 · 1 files
drm/nouveau/dmem: fix mismatched DMA unmap size for large folios
Zhenhao Wan · Aug 11, 2026 · 1 files
drm/nouveau/dmem: fix callocated underflow on large folio split
Zhenhao Wan · Aug 11, 2026 · 1 files
xfs: handle NULL open_zone for merged ioends in xfs_ioend_put_open_zones
Christoph Hellwig · Aug 11, 2026 · 1 files
xfs: fix racy open zone caching
Christoph Hellwig · Aug 11, 2026 · 1 files
xfs: fix zoned write iomap flags assignments
Christoph Hellwig · Aug 11, 2026 · 2 files
xfs: factor out a xfs_iomap_set_anon_write helper
Christoph Hellwig · Aug 11, 2026 · 3 files
xfs: split ioend handling into a separate source file
Christoph Hellwig · Aug 11, 2026 · 6 files
drm/i915/ddi: add helper to compute DDI clock frequency
Suraj Kandpal · Aug 11, 2026 · 2 files
drm/i915/cx0: program DDI_CLK_VALFREQ with DDI clock frequency
Suraj Kandpal · Aug 11, 2026 · 1 files
drm/i915/lt_phy: program DDI_CLK_VALFREQ with DDI clock frequency
Suraj Kandpal · Aug 11, 2026 · 1 files
memcg: make the v1 soft limit knob inert
Shakeel Butt · Aug 11, 2026 · 2 files
nvme: add opcode filtering for fault injection
Mohamed Khalfella · Aug 11, 2026 · 3 files
scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
Milan P. Gandhi · Aug 12, 2026 · 1 files
scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
Milan P. Gandhi · Aug 12, 2026 · 1 files
drm/nouveau: unsubscribe the channel-kill event before the fence context
Marek Czernohous · Aug 12, 2026 · 1 files
drm/amd/display: Fix DCN5/6 DML2 compilation warnings
Ivan Lipski · Aug 13, 2026 · 2 files
nvmet-rdma: fix queue leak when connect backlog is exceeded
Xixin Liu · Aug 13, 2026 · 1 files
drm/i915: Guard against NULL driver_data in i915_pci_probe()
Deepanshu Kartikey · Aug 13, 2026 · 1 files
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
Dan Carpenter · Aug 13, 2026 · 1 files
nvme-fabrics: fix DHCHAP secret leak on parse failure
Xu Rao · Aug 13, 2026 · 1 files
s390/ipl: Fix NULL deref in kdump without re-IPL parm block
Vasily Gorbik · Aug 13, 2026 · 1 files
s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
Vasily Gorbik · Aug 13, 2026 · 1 files
s390/time: Use jiffies instead of jiffies_64
Heiko Carstens · Aug 13, 2026 · 1 files
xfs: restore bi_bdev in xfs_zone_gc_write_chunk
Christoph Hellwig · Aug 13, 2026 · 1 files
usb: dwc3: clear forceRM when issuing EndTransfer
Elson Serrao · Aug 13, 2026 · 2 files
bpf: Fix percpu map update indexing with sparse CPU IDs
Hui Su · Aug 13, 2026 · 3 files
bpf: Fix BPF_F_CPU validation for sparse CPU IDs
Hui Su · Aug 13, 2026 · 1 files
usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
Sven Peter · Aug 13, 2026 · 2 files
mm/hugetlb: keep max_huge_pages when dissolving surplus folios
Longlong Xia · Aug 14, 2026 · 1 files
s390/cpacf: Unpoison instruction results
Ilya Leoshkevich · Aug 14, 2026 · 1 files
btrfs: preserve the compression property when other inode flags change
Sam Ho · Aug 14, 2026 · 1 files
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
Niklas Cassel · Aug 14, 2026 · 1 files
btrfs: scrub: report the failing sector's address, not the stripe base
James C. Owens · Aug 14, 2026 · 1 files
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
Shivam Kumar · Aug 14, 2026 · 1 files
selinux: fix BPF token permission checks
Paul Moore · Aug 14, 2026 · 1 files
drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
Roman Li · Aug 14, 2026 · 1 files
nvme: add missing SRCU grace period in error path
Tristan Madani · Aug 15, 2026 · 1 files
usb: gadget: f_midi: initialize work in f_midi_alloc()
Jeffin Philip · Aug 15, 2026 · 1 files
usb: gadget: f_midi2: fix use-after-free in string attribute show path
Ivy Lopez · Aug 16, 2026 · 1 files
usb: gadget: fix null pointer dereference in usb_put_function_instance()
Jeffin Philip · Aug 16, 2026 · 1 files
drm/gud: NUL-terminate TV mode names read from the device
Deepanshu Kartikey · Aug 16, 2026 · 1 files
btrfs: fix transaction use-after-free in raid stripe insertion
Shuangpeng Bai · Aug 17, 2026 · 1 files
dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
Baineng Shou · Aug 17, 2026 · 3 files
misc: fastrpc: don't publish fd before copy_to_user() succeeds
Baineng Shou · Aug 17, 2026 · 1 files
drm/prime: use dma_buf_fd_install() to preserve export tracing
Baineng Shou · Aug 17, 2026 · 1 files
selftests: dmabuf-heaps: add fd-leak-on-EFAULT regression test
Baineng Shou · Aug 17, 2026 · 1 files
btrfs: fix the possible bioc_list memory leak during error
Qu Wenruo · Aug 17, 2026 · 3 files
btrfs: return proper negative error code for update_raid_extent_item()
Qu Wenruo · Aug 17, 2026 · 1 files
scsi: bsg: Cap io_uring sense copy to max_response_len
Yang Xiuwei · Aug 17, 2026 · 1 files
scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
Rahul Chandelkar · Aug 17, 2026 · 1 files
mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
Narek Jilavyan · Aug 17, 2026 · 1 files
mm/migrate_device: avoid out-of-bounds writes for compound folios
Hui Su · Aug 17, 2026 · 1 files
btrfs: send: reject extents for non-regular inodes
ZhengYuan Huang · Aug 17, 2026 · 1 files
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
Andy Shevchenko · Aug 17, 2026 · 1 files
nvme: skip the zoned limits update if the zone info query failed
Chao Shi · Aug 17, 2026 · 1 files
usb: typec: mux: Fix typec_switch_match()
Marek Vasut · Aug 17, 2026 · 1 files
drm/atomic: remove bogus check for file_priv
Thadeu Lima de Souza Cascardo · Aug 17, 2026 · 1 files
accel/amdxdna: return early from a zero-length flush
Taimuraz Kaitmazov · Aug 17, 2026 · 1 files
accel/amdxdna: reject a command chain that carries no commands
Taimuraz Kaitmazov · Aug 18, 2026 · 1 files
mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
Baolin Wang · Aug 18, 2026 · 2 files
usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
Jeffin Philip · Aug 18, 2026 · 1 files
nvme: set ns->head in nvme_alloc_ns_head
Kanchan Joshi · Aug 18, 2026 · 1 files
nvme: fix racy access to FDP placement id array
Kanchan Joshi · Aug 18, 2026 · 2 files
drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable
Nemesa Garg · Aug 18, 2026 · 2 files
btrfs: zoned: propagate do_zone_finish() error in btrfs_zone_finish_endio()
Johannes Thumshirn · Aug 18, 2026 · 1 files
dm cache: fix demotion stats in passthrough mode
Ming-Hung Tsai · Aug 18, 2026 · 1 files
nvme-tcp: check the data direction of a C2HData PDU
Yehyeong Lee · Aug 18, 2026 · 1 files
scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5
sangram kumar yerra · Aug 18, 2026 · 1 files
scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers
sangram kumar yerra · Aug 18, 2026 · 1 files
x86/bpf: Make arch_bpf_trampoline_size allocate from EXECMEM_MODULE_DATA
Mike Rapoport (Microsoft) · Aug 18, 2026 · 3 files
sched_ext: Allow ops.cgroup_set_bandwidth() to be sleepable
Changwoo Min · Aug 18, 2026 · 2 files
workqueue: Annotate cb_lock nesting when draining a dead BH pool
Tejun Heo · Aug 18, 2026 · 1 files
firmware_loader: Change contact for sysfs nodes
Russ Weight · Aug 18, 2026 · 1 files
CREDITS: Add CREDITS entry for Firmware Upload
Russ Weight · Aug 18, 2026 · 1 files
MAINTAINERS: Remove Russ Weight from Firmware Loader
Russ Weight · Aug 18, 2026 · 1 files
sched_ext: Sync common and compat headers from the scx repo
Tejun Heo · Aug 18, 2026 · 3 files
sched_ext: Sync tools autogen enum headers from the scx repo
Tejun Heo · Aug 18, 2026 · 2 files
btrfs: abort transaction before releasing tree_log_mutex on commit failure
Leo Martins · Aug 19, 2026 · 1 files
nvme-tcp: defer TLS inline send to io_work
Xixin Liu · Aug 19, 2026 · 1 files
userfaultfd: reset err to be 0 when move_pages_ptes succeeded
Bryan Lim · Aug 19, 2026 · 1 files
sched_ext: Fix nonexistent field in sched-ext.rst example
Liang Luo · Aug 19, 2026 · 1 files
Revert "pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza"
Abel Vesa · Aug 19, 2026 · 1 files
s390/pai: Handle multiple PMU stop callback invocations
Thomas Richter · Aug 19, 2026 · 1 files
nvme-rdma: fix -EIO cleanup order in queue_rq
Xixin Liu · Aug 19, 2026 · 1 files
drm/gud: validate TV mode names before creating enum property
Tao Yu · Aug 19, 2026 · 1 files
selftests/cgroup: set the test plan after the setup checks
Hemanth Selam · Aug 19, 2026 · 9 files
usb: image: mdc800: change kmalloc() to kzalloc()
Griffin Kroah-Hartman · Aug 19, 2026 · 1 files
mm/huge_memory: transfer the pmd dirty bit to the folio on zap
Usama Arif · Aug 19, 2026 · 1 files
btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
Johannes Thumshirn · Aug 19, 2026 · 1 files
s390/boot: Fix physical memory search range
Vasily Gorbik · Aug 19, 2026 · 1 files
s390/boot: Avoid IPL parameter append past command line
Vasily Gorbik · Aug 19, 2026 · 1 files
s390/boot: Bound command line facility ranges
Vasily Gorbik · Aug 19, 2026 · 2 files
scsi: fnic: Initialize the NVMe local port info before registering
Linmao Li · Aug 19, 2026 · 1 files
bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
Jiayuan Chen · Aug 19, 2026 · 1 files
selftests/bpf: Add reg-invariants test for speculative pointer arithmetic
Jiayuan Chen · Aug 19, 2026 · 1 files
drm/amd/display: Remove const Qualifier From Non-Pointer Fields
Austin Zheng · Aug 19, 2026 · 1 files
usb: typec: hd3ss3220: track VBUS enable state per consumer
Chang Wu · Aug 19, 2026 · 1 files
block: save page offset gaps in cloned bio
Keith Busch · Aug 19, 2026 · 1 files
usb: typec: qcom-pmic: cancel reset_work on stop
Fan Wu · Aug 19, 2026 · 1 files
usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
Radhey Shyam Pandey · Aug 19, 2026 · 1 files
accel/amdxdna: refuse to flush an imported BO
Taimuraz Kaitmazov · Aug 19, 2026 · 1 files
accel/amdxdna: put the chained BO when its mapping fails
Taimuraz Kaitmazov · Aug 19, 2026 · 1 files
configfs: move CONFIGFS_MAGIC definition to magic.h
Frederick Lawler · Aug 19, 2026 · 2 files
ima: don't measure/appraise files on configfs
Frederick Lawler · Aug 19, 2026 · 2 files
MAINTAINERS: add Lance Yang as a hung task detector co-maintainer
Lance Yang · Aug 20, 2026 · 1 files
bpf: Reject invalid LDSX instruction in disassembly
Kumar Kartikeya Dwivedi · Aug 20, 2026 · 1 files
selftests/bpf: Test invalid DW LDSX diagnostics
Kumar Kartikeya Dwivedi · Aug 20, 2026 · 1 files
Docs/admin-guide/cgroup-v2: document BPF scheduler callbacks for cpu.max and cpu.idle
Liang Luo · Aug 20, 2026 · 1 files
drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile
Yogesh Mohan Marimuthu · Aug 20, 2026 · 1 files
selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
Hongfu Li · Aug 20, 2026 · 1 files
btrfs: do not force reloc root creation during qgroup_account_snapshot()
Qu Wenruo · Aug 20, 2026 · 1 files
drm/amd/display: use halving distribution for all encode-to-linear curves
Melissa Wen · Aug 20, 2026 · 1 files
usb: cdnsp: fix wakeup from S3 after controller context loss
Pawel Laszczak · Aug 20, 2026 · 3 files
drm/amdgpu/gfx8: only apply compute quantums to KCQs
Alex Deucher · Aug 20, 2026 · 1 files
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
Fan Wu · Aug 20, 2026 · 1 files
usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
Fan Wu · Aug 20, 2026 · 1 files
drivers: base: test: DRIVER_PE_KUNIT_TEST should not select OF
Geert Uytterhoeven · Aug 20, 2026 · 2 files
s390/zcrypt: Validate length in reply before using it
Holger Dengler · Aug 20, 2026 · 1 files
dm-integrity: fix buffer overflow with keyed discard
Ben Cressey · Aug 20, 2026 · 1 files
dm-integrity: fix infinite loop on discard with large tag size
Ben Cressey · Aug 20, 2026 · 1 files
irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
Ju Nan · Aug 21, 2026 · 1 files
accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
Lizhi Hou · Aug 21, 2026 · 1 files
ntfs: return DT_UNKNOWN on inode lookup failure in readdir
Baolin Liu · Aug 21, 2026 · 1 files
ntfs: propagate reparse index insertion failure
Baolin Liu · Aug 21, 2026 · 1 files
ntfs: return -ERANGE for undersized xattr buffer
Baolin Liu · Aug 21, 2026 · 1 files
ntfs: preserve error code in ntfs_resident_attr_record_add()
Baolin Liu · Aug 21, 2026 · 1 files
ntfs: return real error from ntfs_non_resident_attr_record_add()
Baolin Liu · Aug 21, 2026 · 1 files
ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
Baolin Liu · Aug 21, 2026 · 1 files
ntfs: only count successfully cleared runs when freeing clusters
Baolin Liu · Aug 21, 2026 · 1 files
ntfs: skip free cluster decrement when rollback fails
Baolin Liu · Aug 21, 2026 · 1 files
drm/gud: validate GUD_ROTATION_0 is present in supported rotations
Sajal Gupta · Aug 21, 2026 · 1 files
cpuidle: dt_idle_genpd: kfree() the original name allocation
Linkai Gong · Aug 21, 2026 · 1 files
pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
Christian Marangi · Aug 21, 2026 · 1 files
usb-storage: ene_ub6250: fix race between scan work and probe
Liu Qi · Aug 21, 2026 · 1 files
Revert "irqchip/mbigen: Fix mbigen node address layout"
caina · Aug 21, 2026 · 1 files
HID: hyperv: fix build breakage with certain configs
Jiri Kosina · Aug 21, 2026 · 1 files
HID: hyperv: make pointer arithmetics understandable for FORTIFY_SOURCE
Jiri Kosina · Aug 21, 2026 · 1 files
drm/amd/display: Fix backlight control for luminance-capable OLED
Roman Li · Aug 21, 2026 · 1 files
mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
Eric Dumazet · Aug 21, 2026 · 1 files
btrfs: zstd: fix lost wakeup when waiting for a workspace
FAN YE · Aug 21, 2026 · 1 files
sched_ext: Fix spurious aborts in scx_bpf_dsq_move() on ownership change races
Tejun Heo · Aug 21, 2026 · 1 files
nvme: print namespace IDs as unsigned 32bit value
Mohamed Khalfella · Aug 21, 2026 · 3 files
nvmet: print namespace IDs as unsigned 32bit value
Mohamed Khalfella · Aug 21, 2026 · 3 files
drm/nouveau: Use write-combined maps for coherent
Faith Ekstrand · Aug 22, 2026 · 1 files
kernfs: preserve security xattrs without allocating iattrs
Hengyu Liang · Aug 22, 2026 · 1 files
usb: typec: mux: avoid duplicated mux switches
Marek Vasut · Aug 22, 2026 · 1 files
sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers
Zhan Xusheng · Aug 22, 2026 · 1 files
drm/amd/display: fix division by zero in get_estimated_bw()
Hari Mishal · Aug 22, 2026 · 1 files
nvme: remove stale namespaces by NSID range during scan
Mohamed Khalfella · Aug 23, 2026 · 1 files
ntfs: compute bi_sector in 512-byte units
Dennis Tighe · Aug 23, 2026 · 5 files
nvme-tcp: return -EPROTO for a C2HData on a write
Yehyeong Lee · Aug 23, 2026 · 1 files
cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
Frank Sorenson · Aug 23, 2026 · 1 files
selftests/cgroup: Drop invalid boot isolation comparison
Guopeng Zhang · Aug 24, 2026 · 1 files
cgroup/cpuset: Preserve boot-isolated CPUs on partition release
Guopeng Zhang · Aug 24, 2026 · 1 files
selftests/cgroup: Add test for preserving boot-isolated CPUs
Guopeng Zhang · Aug 24, 2026 · 1 files
workqueue: Fix unbound pool lifetime for pending pwqs
Yao Kai · Aug 24, 2026 · 1 files
ntfs: do not mark the volume clean in sync_fs when errors were recorded
Dennis Tighe · Aug 24, 2026 · 1 files
ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
Hongling Zeng · Aug 24, 2026 · 1 files
ntfs: fix memmove overlap in ntfs_new_attr_flags
Hongling Zeng · Aug 24, 2026 · 1 files
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
Aleksandr Khromov · Aug 24, 2026 · 1 files
dm-integrity: require stable writes for internal hash modes
Chen Cheng · Aug 24, 2026 · 1 files
scsi: pm8001: Use rollback index when freeing MSI-X vectors
Runyu Xiao · Aug 24, 2026 · 1 files
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
Aleksandr Khromov · Aug 24, 2026 · 1 files
docs: cgroup-v2: fix misc.events key format description
Cheng Lingfei · Aug 24, 2026 · 1 files
docs/sched_ext: document that cgroup CPU knobs are scheduler-dependent
Tao Cui · Aug 24, 2026 · 1 files
net/mlx5e: Prevent stale XSK buffer release on refill retry
Jerome Tollet · Aug 24, 2026 · 1 files
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
Jerome Tollet · Aug 24, 2026 · 1 files
accel: ethosu: Don't read the U65 rounding mode as a storage mode
Tomeu Vizoso · Aug 24, 2026 · 1 files
net/sched: act_api: budget all shared attributes in notify skbs
Victor Nogueira · Aug 24, 2026 · 1 files
net/sched: act_api: size the RTM_GETACTION reply from the actions
Victor Nogueira · Aug 24, 2026 · 1 files
net/sched: act_api: fix skb sizing and action leak on reoffload delete
Victor Nogueira · Aug 24, 2026 · 1 files
locking/lockdep: Invalidate stale class_cache entries for zapped classes
Eric Dumazet · Aug 24, 2026 · 1 files
ceph: lock mutex in ceph_mds_check_access()
Max Kellermann · Aug 24, 2026 · 2 files
smb: client: fix multiuser mount with krb5
Paulo Alcantara · Aug 24, 2026 · 1 files
net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances
Selvamani Rajagopal · Aug 24, 2026 · 1 files
net: ethernet: oa_tc6: Improve the error recovery
Selvamani Rajagopal · Aug 24, 2026 · 1 files
net: ethernet: oa_tc6: Disable tx queues on fatal error
Selvamani Rajagopal · Aug 24, 2026 · 1 files
net: ethernet: oa_tc6: Fix for the wrong data type
Selvamani Rajagopal · Aug 24, 2026 · 1 files
drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c
Mohamed Ahmed · Aug 25, 2026 · 4 files
drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp
Mohamed Ahmed · Aug 25, 2026 · 3 files
drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks
Mohamed Ahmed · Aug 25, 2026 · 5 files
drm/nouveau/disp: fix HDMI vendor infoframes on GB20x
Mohamed Ahmed · Aug 25, 2026 · 4 files
drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x
Mohamed Ahmed · Aug 25, 2026 · 1 files
drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware
Mohamed Ahmed · Aug 25, 2026 · 4 files
drm/nouveau/disp: fix head state readback on GB20x
Mohamed Ahmed · Aug 25, 2026 · 1 files
drm/nouveau/gsp: fix vblank interrupts on GB20x
Mohamed Ahmed · Aug 25, 2026 · 6 files
ksmbd: zero pipe read compound padding
Namjae Jeon · Aug 25, 2026 · 1 files
ksmbd: propagate DACL parsing errors
Namjae Jeon · Aug 25, 2026 · 1 files
ksmbd: rate limit unmapped SID errors
Namjae Jeon · Aug 25, 2026 · 1 files
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
Aleksandr Khromov · Aug 25, 2026 · 1 files
Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
Gongwei Li · Aug 25, 2026 · 1 files
nouveau/instmem: handle iomapping already existing
Dave Airlie · Aug 25, 2026 · 1 files
octeontx2-af: fix CN20K default MCAM rule removal on port cleanup
Kiran Kumar K · Aug 25, 2026 · 1 files
ntfs: treat any nonzero dio zero-range return as an error
Wentao Guan · Aug 25, 2026 · 1 files
sched_ext: Fix missing @slice and @vtime descriptions in finish_dispatch() kernel-doc
Liang Luo · Aug 25, 2026 · 1 files
workqueue: reject watchdog thresholds that overflow jiffies
Jiacheng Xu · Aug 25, 2026 · 1 files
mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
Lorenzo Stoakes (ARM) · Aug 25, 2026 · 1 files
net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
Jamal Hadi Salim · Aug 25, 2026 · 1 files
selftests: tc-testing: add u32 node ID pool exhaustion test
Jamal Hadi Salim · Aug 25, 2026 · 1 files
smb: client: transport: Fix debug printing in __release_mid()
Andy Shevchenko · Aug 25, 2026 · 1 files
net: icmp: avoid invalid transport header access in icmp_send tracepoint
Eric Dumazet · Aug 25, 2026 · 1 files
s390/pai: Reduce excessive debug feature size
Heiko Carstens · Aug 25, 2026 · 1 files
ntfs: fix undefined behavior in mft/index record size calculation
Hongling Zeng · Aug 25, 2026 · 1 files
HID: bpf: mark struct hid_device as safe BPF pointer
Benjamin Tissoires · Aug 25, 2026 · 1 files
selftests/hid: Add a test to ensure we can write fields in hid_device
Benjamin Tissoires · Aug 25, 2026 · 3 files
selftests/hid: prepare test_rdesc_fixup_get_data_overflow for the new verifier
Benjamin Tissoires · Aug 25, 2026 · 1 files
HID: rmi: fix OOB access with undersized RMI reports
Wei Jie Law · Aug 25, 2026 · 1 files
perf/core: Skip empty AUX records with only format flags
Leo Yan · Aug 25, 2026 · 1 files
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
Shixiong Ou · Aug 25, 2026 · 1 files
drm/cirrus-qemu: Validate BAR0 size during probe
Slawomir Stepien · Aug 25, 2026 · 1 files
net: iptunnel: fix stale transport header during tunnel decapsulation
Dong Chenchen · Aug 25, 2026 · 3 files
s390/topology: Switch to common cpu capacity code
Mete Durlu · Aug 25, 2026 · 4 files
Revert "once: don't use a work queue to reset sleepable static key"
Eric Dumazet · Aug 25, 2026 · 1 files
scsi: ufs: ufs-qcom: Restore HS/LS link startup mode for Qualcomm UFS controller v6.2+
Nitin Rawat · Aug 25, 2026 · 2 files
scsi: ufs: ufs-qcom: Fix sequential read variance
Nitin Rawat · Aug 25, 2026 · 1 files
libceph: remove pinning assertion in ceph_msg_data_iter_next()
Tal Zussman · Aug 25, 2026 · 1 files
s390/zcrypt: Fix uninitialized padding in CRT key structure
Harald Freudenberger · Aug 25, 2026 · 1 files
MAINTAINERS: mailmap: update entries for Thorsten Blum
Thorsten Blum · Aug 25, 2026 · 2 files
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
Lovekesh Solanki · Aug 25, 2026 · 1 files
Bluetooth: btintel_pcie: Clear automask on spurious interrupts
Kiran K · Aug 25, 2026 · 1 files
tipc: protect node reset trace dump with node lock
Chengfeng Ye · Aug 25, 2026 · 1 files
scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
Ivy Lopez · Aug 25, 2026 · 1 files
dm cache: fix issue with background work locking
Benjamin Marzinski · Aug 25, 2026 · 1 files
usb: typec: ucsi: displayport: Fix OOB altmode array index
Jameson Thies · Aug 25, 2026 · 1 files
dm-crypt: fix a tiny race condition in crypt_dec_pending
Ben Cressey · Aug 26, 2026 · 1 files
vsock/virtio: validate packet source for connected sockets
Daehyeon Ko · Aug 26, 2026 · 3 files
vsock/vmci: validate packet source for connected sockets
Daehyeon Ko · Aug 26, 2026 · 1 files
net/sched: cls_flower: validate mask pointer after nla_next()
Aohan Mei · Aug 26, 2026 · 1 files
tracing/probes: Fix use-after-free on field name/type of events with multiple probes
Henry Martin · Aug 26, 2026 · 2 files
ntfs: bound $AttrDef table walk to the loaded table size
Dennis Tighe · Aug 26, 2026 · 2 files
ntfs: reject invalid sectors_per_cluster in the boot sector
Dennis Tighe · Aug 26, 2026 · 1 files
ntfs: handle signal interruption in fallocate
Hongling Zeng · Aug 26, 2026 · 1 files
cpuidle: psci: Fix support for probe deferral by dropping the faux device
Ulf Hansson · Aug 26, 2026 · 1 files
MAINTAINERS: remove Lorenzo as THP co-maintainer
Lorenzo Stoakes (ARM) · Aug 26, 2026 · 1 files
drm/atomic-state-helper: set pixel_blend_mode to prop default on reset
Melissa Wen · Aug 26, 2026 · 1 files
drm/amd/display: fix missing blend-mode-prop warning for DCN
Melissa Wen · Aug 26, 2026 · 1 files
drm/amd/display: advertise PIXEL_NONE and PREMULTI blend mode for DCE
Melissa Wen · Aug 26, 2026 · 1 files
drm/tegra: Add blend mode properties
Thierry Reding · Aug 26, 2026 · 2 files
net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
Lorenzo Bianconi · Aug 26, 2026 · 1 files
MAINTAINERS: Add Paulo Alcantara as an SMBDIRECT co-maintainer
Namjae Jeon · Aug 26, 2026 · 1 files
drm/i915/cdclk: Fix dg2_power_well_count() return type
Ville Syrjälä · Aug 26, 2026 · 1 files
MAINTAINERS: Update the KSMBD entry
Namjae Jeon · Aug 26, 2026 · 1 files
mm/secretmem: properly account locked pages
Lorenzo Stoakes (ARM) · Aug 26, 2026 · 3 files
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
Baul Lee · Aug 26, 2026 · 2 files
bpf: check_cond_jmp_op(): properly infer if register is null
Eduard Zingerman · Aug 26, 2026 · 1 files
selftests/bpf: a demo for check_cond_jmp_op() non-null inference bug
Eduard Zingerman · Aug 26, 2026 · 1 files
drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only
Mario Limonciello · Aug 26, 2026 · 1 files
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
Xin Long · Aug 26, 2026 · 1 files
netlink: specs: fix the conntrack filter type
Ilya Maximets · Aug 26, 2026 · 1 files
netlink: specs: add missing mask attributes for conntrack dump
Ilya Maximets · Aug 26, 2026 · 1 files
cifs: don't update i_size in cifs_do_truncate without a cached handle
Frank Sorenson · Aug 27, 2026 · 1 files
smb: client: fix heap overflow in cifs_do_set_acl()
Frank Sorenson · Aug 27, 2026 · 1 files
ntfs: fix race between fallocate and mmap reads
Hongling Zeng · Aug 27, 2026 · 1 files
s390/ctcm: Prevent XID null dereference
Aswin Karuvally · Aug 27, 2026 · 1 files
ntfs: leave HasEA flag untouched on setxattr failure
Baolin Liu · Aug 27, 2026 · 1 files
MAINTAINERS: cover all of RAID
Geert Uytterhoeven · Aug 27, 2026 · 1 files
nvmet: reject namespace enable without device path
Seokgyu Choi · Aug 27, 2026 · 1 files
sched_ext: Fix timer pinning and return value in scx_central
Wanwu Li · Aug 27, 2026 · 1 files
sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration
Wanwu Li · Aug 27, 2026 · 1 files
sched_ext: Check bpf_timer_start return values in scx_qmap
Wanwu Li · Aug 27, 2026 · 1 files
sched_ext: Fix several comment issues
Wanwu Li · Aug 27, 2026 · 2 files
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
Priya Hosur · Aug 27, 2026 · 1 files
tcp: use GFP_ATOMIC in tcp_send_active_reset()
Eric Dumazet · Aug 27, 2026 · 6 files
s390/mm: Simplify crst_table_upgrade()
Heiko Carstens · Aug 27, 2026 · 1 files
MAINTAINERS: add Kiryl as a THP reviewer
Kiryl Shutsemau (Meta) · Aug 27, 2026 · 1 files
tipc: fix NULL deref in tipc_named_node_up() on empty publication list
Tung Nguyen · Aug 27, 2026 · 1 files
scsi: ibmvfc: Fix kernel-doc name for ibmvfc_scsi_relogin()
Muhammad Falak R Wani · Aug 27, 2026 · 1 files
scsi: ibmvfc: Document protocol parameter of ibmvfc_alloc_target()
Muhammad Falak R Wani · Aug 27, 2026 · 1 files
net: qrtr: Send HELLO message on endpoint register
Chris Lew · Aug 27, 2026 · 2 files
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
Sunil Khatri · Aug 27, 2026 · 1 files
ceph: apply nearfull_sync option on remount
Alex Markuze · Aug 27, 2026 · 1 files
drm/amdgpu: fix Idle BOs list in VM debugfs status info
Sunil Khatri · Aug 27, 2026 · 1 files
igmp: convert struct ip_sf_list to RCU
Eric Dumazet · Aug 27, 2026 · 2 files
scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
Thomas Lamprecht · Aug 27, 2026 · 1 files
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
Bradley Morgan · Aug 27, 2026 · 1 files
ipv4: avoid divide by zero in fib_rebalance
Zihan Xi · Aug 27, 2026 · 1 files
arm64: Don't read GMID_EL1 when MTE is disabled
Fuad Tabba · Aug 27, 2026 · 4 files
drm/amdgpu: Update queue reset support version
Amber Lin · Aug 27, 2026 · 1 files
nvmet-tcp: reject unsolicited H2CData PDUs
Shivam Kumar · Aug 27, 2026 · 1 files
MAINTAINERS: update Chris Mason's email address
Chris Mason · Aug 27, 2026 · 1 files
preempt: Remove hardirq_disable_count()
Boqun Feng · Aug 27, 2026 · 2 files
usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
Amit Sunil Dhamne · Aug 27, 2026 · 1 files
sctp: validate chunk length in the inqueue parser
Charles Vosburgh · Aug 27, 2026 · 1 files
bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO
Eduard Zingerman · Aug 27, 2026 · 1 files
selftests/bpf: half-dead scalar zero stack spill test
Eduard Zingerman · Aug 27, 2026 · 1 files
ALSA: usb-audio: Add PM guard to Studio 1810c controls
Will Porter · Aug 27, 2026 · 1 files
ALSA: usb-audio: Add PM guards to US-16x08 transfers
Will Porter · Aug 27, 2026 · 1 files
ALSA: usb-audio: Add PM guard to Scarlett meter reads
Will Porter · Aug 27, 2026 · 1 files
ALSA: usb-audio: Guard Scarlett2 protocol transfers
Will Porter · Aug 27, 2026 · 1 files
ALSA: usb-audio: Add PM guards to RME Digiface controls
Will Porter · Aug 27, 2026 · 1 files
ALSA: usb-audio: Guard FCP protocol transfers
Will Porter · Aug 27, 2026 · 1 files
net: amd-xgbe: discard rx packets with bad FCS
James Nugraha · Aug 27, 2026 · 1 files
ksmbd: prevent out-of-bounds reads in share config responses
Namjae Jeon · Aug 27, 2026 · 2 files
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
Cen Zhang (Microsoft Security FORGE Labs) · Aug 27, 2026 · 5 files
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
Cen Zhang (Microsoft Security FORGE Labs) · Aug 27, 2026 · 2 files
ksmbd: fix listener task lifetime on netdev events
Namjae Jeon · Aug 28, 2026 · 1 files
raw: annotate disconnect-side IPv4 match writers
Xuanqiang Luo · Aug 28, 2026 · 2 files
ksmbd: safely drain sessions during logoff
Namjae Jeon · Aug 28, 2026 · 6 files
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
Henry Martin · Aug 28, 2026 · 1 files
ntfs: read WOF chunks outside the decompression lock
Zhan Xusheng · Aug 28, 2026 · 1 files
page_pool: keep frag_offset aligned for odd-sized requests
Florian Schauer · Aug 28, 2026 · 1 files
ALSA: hda/conexant:Fix abnormal Mic/Speaker functionality on SN6140 after S3 wake-up
feng liu · Aug 28, 2026 · 1 files
smb/client: validate new EOF for insert range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: validate new EOF for zero range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: mark file sparse before emulating insert range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: fix data corruption in emulated insert range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: fix integer truncation in collapse range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: fix stale page cache in insert/collapse range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: invalidate fscache for fallocate range operations
Huiwen He · Aug 28, 2026 · 1 files
ppp: ppp_async: simplify tty disc_data access
Qingfang Deng · Aug 28, 2026 · 1 files
ppp: ppp_synctty: simplify tty disc_data access
Qingfang Deng · Aug 28, 2026 · 1 files
ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
Eric Dumazet · Aug 28, 2026 · 1 files
ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
Eric Dumazet · Aug 28, 2026 · 2 files
ipv6: mcast: fix delay calculation in igmp6_join_group()
Eric Dumazet · Aug 28, 2026 · 1 files
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
Eric Dumazet · Aug 28, 2026 · 1 files
ipv6: mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show()
Eric Dumazet · Aug 28, 2026 · 1 files
Bluetooth: hci_core: Fix race condition during device registration
Aleksandr Nogikh · Aug 28, 2026 · 2 files
octeontx2-af: Fix limiting SRIOV VF count logic
Sunil Goutham · Aug 28, 2026 · 1 files
arm64: trans_pgd: clone only the linear map that exists at runtime
Breno Leitao · Aug 28, 2026 · 1 files
ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 9 14ILL10
Zhang Heng · Aug 28, 2026 · 1 files
ALSA: hda/realtek: Add quirk for Acer Predator PHN16-72
Zhang Heng · Aug 28, 2026 · 1 files
ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
Eric Dumazet · Aug 28, 2026 · 1 files
ALSA: pcm: Fix race between non-atomic ops and trigger-start
Takashi Iwai · Aug 28, 2026 · 1 files
tracing: Have show_event_filters/triggers files take trace array ref
Steven Rostedt · Aug 28, 2026 · 1 files
ipv6: sr: restore network header before routing and forwarding
Eric Dumazet · Aug 28, 2026 · 1 files
ipvlan: unregister upper devices outside pnodes_lock
Maciej Fijalkowski · Aug 28, 2026 · 1 files
selftests/bpf: Bound the offset accumulator in __tld_fetch_key()
Yonghong Song · Aug 28, 2026 · 1 files
arm64: mm: Fix the lockless page-table walk in show_pte()
Karl Mehltretter · Aug 28, 2026 · 1 files
net/iucv: fix the recvmsg window update
Bryam Vargas · Aug 28, 2026 · 1 files
ipv6: Fix redirect exception creation for UDP/RAW sockets
Ido Schimmel · Aug 28, 2026 · 1 files
ipv4: udp: Create exceptions before socket matching
Ido Schimmel · Aug 28, 2026 · 1 files
ipv6: udp: Create exceptions before socket matching
Ido Schimmel · Aug 28, 2026 · 1 files
selftests: net: Add exception cache tests
Ido Schimmel · Aug 28, 2026 · 2 files
cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
Etienne Perot · Aug 28, 2026 · 2 files
selftests/cgroup: test clone3() into a previously killed cgroup
Etienne Perot · Aug 28, 2026 · 1 files
smb: client: fix data corruption with concurrent writes and O_TRUNC
Paulo Alcantara · Aug 28, 2026 · 1 files
net/rds: use wq_has_sleeper() in release_in_xmit()
Allison Henderson · Aug 28, 2026 · 1 files
net/rds: use clear_bit_unlock() in release_refill()
Allison Henderson · Aug 28, 2026 · 1 files
net/rds: clear cp_flags bits individually in rds_conn_path_reset()
Allison Henderson · Aug 28, 2026 · 1 files
net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
Gerd Rausch · Aug 28, 2026 · 2 files
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
Allison Henderson · Aug 28, 2026 · 1 files
net/rds: acquire the fastpath locks in rds_conn_shutdown()
Håkon Bugge · Aug 28, 2026 · 4 files
net/rds: don't let rds_conn_shutdown() consume a concurrent drop
Allison Henderson · Aug 28, 2026 · 2 files
ftrace: Take trace_array reference before accessing its ftrace_ops
Steven Rostedt · Aug 29, 2026 · 5 files
ksmbd: validate normalized name response length
Alon Shakevsky · Aug 29, 2026 · 1 files
tipc: Dont send random pad bytes in RESET/ACTIVATE messages
David Laight · Aug 29, 2026 · 1 files
ksmbd: fix use-after-free in oplock break notification
Abdifatah Suruur · Aug 29, 2026 · 1 files
net: psp: do not inherit the Rx association on clone
Norbert Szetei · Aug 29, 2026 · 1 files
interrupt: Disable interrupt before modifying hardirq_disable counter
Boqun Feng · Aug 29, 2026 · 2 files
mac802154: fix data race and NULL deref on local->assoc_dev
Kaiwen Shi · Aug 29, 2026 · 3 files
ALSA: hda/realtek: Add quirk for VAIO VJS131
Riku Matsumura · Aug 30, 2026 · 1 files
ntfs: fix FITRIM range alignment
Jacopo Labardi · Aug 30, 2026 · 1 files
ALSA: harmony: initialize locks before requesting IRQ
Runyu Xiao · Aug 30, 2026 · 1 files
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
Kanishka De Silva · Aug 30, 2026 · 1 files
sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
Seiji Nishikawa · Aug 30, 2026 · 2 files
Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
Pauli Virtanen · Aug 30, 2026 · 1 files
Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
Pauli Virtanen · Aug 30, 2026 · 1 files
net: airoha: enable RX_DONE interrupt for RX queue 31
Lorenzo Bianconi · Aug 30, 2026 · 1 files
nvmet-auth: Synchronize timeout work during SQ teardown
Kazuki Hanai · Aug 30, 2026 · 3 files
kprobes: Protect kprobe_blacklist with RCU
Masami Hiramatsu (Google) · Aug 30, 2026 · 2 files
net: ntb_netdev: Fix statistics races
Koichiro Den · Aug 30, 2026 · 1 files
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
Pauli Virtanen · Aug 30, 2026 · 1 files
af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
Kuniyuki Iwashima · Aug 30, 2026 · 1 files
drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl()
Lu Yao · Aug 31, 2026 · 1 files
smb: client: reject SetEA requests that do not fit the request buffer
Yunpeng Tian · Aug 31, 2026 · 1 files
block: flag zoned disks with GENHD_FL_NO_PART
Damien Le Moal · Aug 31, 2026 · 1 files
dma-buf: fix some kernel-doc warnings
Randy Dunlap · Aug 31, 2026 · 2 files
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
Yilin Zhang · Aug 31, 2026 · 1 files
x86/itmt: Don't make ITMT enablement depend on debugfs
Mario Limonciello · Aug 31, 2026 · 1 files
nvme-tcp.h: drop kernel-doc comments, fix a few descriptions
Randy Dunlap · Aug 31, 2026 · 1 files
net: bonding: annotate lockless writes with WRITE_ONCE()
Eric Dumazet · Aug 31, 2026 · 3 files
ntfs: take invalidate_lock in ntfs_setattr_size()
Hongling Zeng · Aug 31, 2026 · 1 files
ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()
Hongling Zeng · Aug 31, 2026 · 1 files
net: usb: qmi_wwan: add Compal EXM-G1x support
Ian Lin · Aug 31, 2026 · 1 files
usb: xhci: Fix HCS_ERST_MAX conversion
Chen-Yu Tsai · Aug 31, 2026 · 1 files
usb: xhci: Fix isochronous scheduling regression
Michal Pecio · Aug 31, 2026 · 1 files
xhci: fix lost bounce buffers on TDs spanning several ring segments
Arthur Gautier · Aug 31, 2026 · 1 files
Bluetooth: btintel: validate version TLV value lengths
Laxman Acharya Padhya · Aug 31, 2026 · 1 files
Bluetooth: btintel: bound firmware ID by TLV length
Laxman Acharya Padhya · Aug 31, 2026 · 1 files
Bluetooth: btintel: propagate version TLV parsing errors
Laxman Acharya Padhya · Aug 31, 2026 · 1 files
sched/fair: Use cfs_rq->h_curr in throttle_cfs_rq()
Wanwu Li · Aug 31, 2026 · 1 files
sched/fair: Use cfs_rq->h_curr in distribute_cfs_runtime()
Wanwu Li · Aug 31, 2026 · 1 files
arm64: errata: pass REVIDR when matching target implementation CPUs
Khushit Shah · Aug 31, 2026 · 1 files
net: bridge: mcast: don't truncate the port group walk on teardown
Jun Yang · Aug 31, 2026 · 1 files
net: macb: exclude software FCS from TX byte statistics
Nicolai Buchwitz · Aug 31, 2026 · 2 files
scsi: mpi3mr: Fix use-after-free on tgt_dev->starget during target device refresh/update
Laurence Oberman · Aug 31, 2026 · 1 files
ata: ahci: work around lost interrupts on Marvell 88SE61xx
Hajo Noerenberg · Aug 31, 2026 · 1 files
drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
Mario Limonciello · Aug 31, 2026 · 1 files
drm/amdgpu: Skip accessing psp rum time db for APUs
Kanala Ramalingeswara Reddy · Aug 31, 2026 · 1 files
drm/amdgpu: update the fw version for gfx11 userqueues
Sunil Khatri · Aug 31, 2026 · 1 files
drm/amdgpu: update the fw version for gfx12 userqueues
Sunil Khatri · Aug 31, 2026 · 1 files
uprobes: guard trace cleanup against error pointers
Andi Kleen · Aug 31, 2026 · 1 files
drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump
Sunil Khatri · Aug 31, 2026 · 1 files
perf: Fix use-after-free when perf mmap() revival races with the last munmap()
Yilin Zhang · Aug 31, 2026 · 1 files
net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
Lorenzo Bianconi · Aug 31, 2026 · 1 files
rust: pci: reject IRQ vector indices that do not fit in u32
Sophon Zhang · Aug 31, 2026 · 1 files
sched/fair: Avoid creating misfits during cache-aware balancing
Tim Chen · Aug 31, 2026 · 1 files
tools/workqueue/wq_dump.py: Support backward compatibility for wq->attrs rename
Aaron Tomlin · Aug 31, 2026 · 1 files
bonding: alb: fix uninitialized transport header access in alb_determine_nd()
Eric Dumazet · Aug 31, 2026 · 1 files
ALSA: usb-audio: Add mixer map quirk for Audient iD24
Peter Drabik · Aug 31, 2026 · 1 files
ACPI: bus: Drop two fields from struct acpi_device_pnp
Rafael J. Wysocki · Aug 31, 2026 · 2 files
bonding: do not clear curr_active_slave prematurely when releasing all slaves
Eric Dumazet · Aug 31, 2026 · 1 files
ksmbd: validate COPYCHUNK source and target ranges
Alon Shakevsky · Sep 1, 2026 · 1 files
net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
Kuniyuki Iwashima · Sep 1, 2026 · 1 files
bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
Eduard Zingerman · Sep 1, 2026 · 1 files
selftests/bpf: test case for unsafe pruning of bpf_loop checkpoints
Eduard Zingerman · Sep 1, 2026 · 1 files
ALSA: hda: restore MFG widget enumeration after core split
Xu Rao · Sep 1, 2026 · 1 files
irqdomain: Delete irq_domain_add_linear()
Jiri Slaby (SUSE) · Sep 1, 2026 · 2 files
drm/amd/display: Fix cursor disable with horizontally split planes
Yuling Li · Sep 1, 2026 · 1 files
net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
HW He · Sep 1, 2026 · 2 files
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
HyeongJun An · Sep 1, 2026 · 1 files
bpf: Reject key-less BTF for hash maps
Jiayuan Chen · Sep 1, 2026 · 1 files
bpf: Fix NULL-ptr-deref when showing a void BTF type
Jiayuan Chen · Sep 1, 2026 · 1 files
bpf: Fix NULL-ptr-deref in btf_var_show()
Jiayuan Chen · Sep 1, 2026 · 1 files
selftests/bpf: Add test for key-less BTF hash map
Jiayuan Chen · Sep 1, 2026 · 1 files
selftests/bpf: Add test for showing a void BTF type
Jiayuan Chen · Sep 1, 2026 · 2 files
drm/amdgpu/userq: dont overwrite the error of subsequent map call
Sunil Khatri · Sep 1, 2026 · 1 files
staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
Muhammad Bilal · Sep 1, 2026 · 4 files
futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
Sebastian Andrzej Siewior · Sep 1, 2026 · 4 files
futex: Prevent rcuwait use-after-free during requeue PI
Yao Kai · Sep 1, 2026 · 1 files
tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
Masami Hiramatsu (Google) · Sep 1, 2026 · 1 files
tracing/probes: Fix BTF kflag check for anonymous struct member access
Masami Hiramatsu (Google) · Sep 1, 2026 · 3 files
tracing/probes: Fix code indent in get_bitoffset_of_field()
Masami Hiramatsu (Google) · Sep 1, 2026 · 1 files
ALSA: dummy: Report a change when one capture switch channel moves
HyeongJun An · Sep 1, 2026 · 1 files
ring-buffer: Allow splice reads on static buffers
Vincent Donnefort · Sep 1, 2026 · 1 files
MAINTAINERS: update nvme entry
Keith Busch · Sep 1, 2026 · 1 files
ksmbd: fix tree connection use-after-free in smb2_tree_connect()
Cen Zhang (Microsoft Security FORGE Labs) · Sep 1, 2026 · 2 files
ALSA: hda/cs420x: Add CS4208 fixup for MacBookAir 7,2
Jonne Vuorela · Sep 1, 2026 · 1 files
hardening: Default randstruct off with rust for better allmodconfig support
Mark Brown · Sep 1, 2026 · 1 files
ata: libata-scsi: do not raise UA for storage element depopulation and restoration
Damien Le Moal · Sep 2, 2026 · 1 files
ksmbd: fix sparc build with atomic work state
Namjae Jeon · Sep 2, 2026 · 1 files
bpf, riscv: Make arena support depend on ZACAS
Chen Pei · Sep 2, 2026 · 1 files
drm/pagemap: dma-unmap pages before handling migration errors
Matthew Brost · Sep 2, 2026 · 1 files
drm/pagemap: Fix folio allocation fallback and use-after-put
Matthew Brost · Sep 2, 2026 · 1 files
bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
Eduard Zingerman · Sep 2, 2026 · 1 files
selftests/bpf: Precision tracking across BPF_ABS subprog exit
Eduard Zingerman · Sep 2, 2026 · 1 files
ALSA: ump: do not touch legacy_rmidi before it exists
Qingyu Zhang · Sep 2, 2026 · 1 files
drm/xe/vram: report FLAT_CCS base misalignment
Matthew Auld · Sep 2, 2026 · 1 files
ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
HyeongJun An · Sep 2, 2026 · 1 files
ftrace: Synchronize the initialization of ftrace_ops
Steven Rostedt · Sep 2, 2026 · 1 files
dm-integrity: fix NULL pointer dereference when the 'R' flag is used
Mikulas Patocka · Sep 2, 2026 · 1 files
tracing: Take trace_array reference when opening options file
Steven Rostedt · Sep 2, 2026 · 1 files
ALSA: hda/realtek: Fix cold-boot headset misdetection on Acer Aspire A515-57G
Oleksandr Kovalov · Sep 2, 2026 · 1 files
treewide: refresh kmalloc_obj() conversions
Kees Cook · Sep 2, 2026 · 304 files
bpf: reject BPF_PSEUDO_FUNC reference to the main program
Eduard Zingerman · Sep 2, 2026 · 1 files
selftests/bpf: BPF_PSEUDO_FUNC reference to the main program
Eduard Zingerman · Sep 2, 2026 · 1 files
selftests/bpf: Add tests to assert that netfilter progs cannot write to skb
Florian Westphal · Sep 3, 2026 · 1 files
ALSA: caiaq: Fix potential double-free at error path
Takashi Iwai · Sep 3, 2026 · 1 files
selftests/alsa: Fix the step check for INTEGER controls
HyeongJun An · Sep 3, 2026 · 1 files
bpf: Mark signal tracepoint siginfo arguments as scalar
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Cover signal tracepoint siginfo sentinels
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Reject tail calls directly from callback frames
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Test direct tail calls from callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Reject resilient lock operations in rbtree callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Reject resilient unlock in rbtree callback
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Mark sched_process_wait argument as nullable
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Test sched_process_wait nullable argument
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Mark syscall helpers as sleepable
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Check syscall helpers in timer callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
MAINTAINERS, mailmap: update email address for Ondrej Mosnáček
Ondrej Mosnáček · Sep 3, 2026 · 2 files
bpf: zero extend the result of an arena 32-bit cmpxchg
Eduard Zingerman · Sep 3, 2026 · 1 files
bpf: update disasm.c to print BPF_PROBE_ATOMIC as atomics
Eduard Zingerman · Sep 3, 2026 · 1 files
selftests/bpf: check zero extension of an arena 32-bit cmpxchg
Eduard Zingerman · Sep 3, 2026 · 1 files
ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
Steven Rostedt · Sep 3, 2026 · 1 files
drm/amd/display: Fix harmless type mismatch in allocation
Kees Cook · Sep 3, 2026 · 1 files
bpf: don't rewrite bpf_fastcall patterns entered by a jump
Eduard Zingerman · Sep 3, 2026 · 3 files
selftests/bpf: bpf_fastcall patterns entered by a jump
Eduard Zingerman · Sep 3, 2026 · 1 files
bpf: Check ancestor frames for rbtree callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Check rbtree callback restrictions in subprogs
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Mark bpf_btf_find_by_name_kind() as sleepable
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Test btf lookup helper sleepability
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Mark faultable stack helpers as sleepable
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Check faultable stack helper contexts
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Reject legacy packet loads from callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Reject legacy packet loads from callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
tracing: Fix to avoid creating trace instances with duplicate names
Masami Hiramatsu (Google) · Sep 3, 2026 · 1 files
selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0
Jiayuan Chen · Sep 4, 2026 · 1 files
bpf: Don't infer non-NULL from a pointer with an unbounded offset
Eduard Zingerman · Sep 4, 2026 · 1 files
selftests/bpf: No non-NULL inference from unbounded offset pointers
Eduard Zingerman · Sep 4, 2026 · 1 files
bpf: Don't resurrect a scalar id dropped by collect_linked_regs()
Eduard Zingerman · Sep 4, 2026 · 1 files
selftests/bpf: Check the linked regs cap for the compared register
Eduard Zingerman · Sep 4, 2026 · 1 files
bpf: Don't predict JMP32 pointer vs zero comparisons
Eduard Zingerman · Sep 4, 2026 · 1 files
selftests/bpf: Check that JMP32 pointer vs zero jumps are not predicted
Eduard Zingerman · Sep 4, 2026 · 1 files
bpf: Mark the zero register precise for a register-form NULL check
Eduard Zingerman · Sep 4, 2026 · 1 files
selftests/bpf: No non-NULL inference from an imprecise zero register
Eduard Zingerman · Sep 4, 2026 · 1 files
bpf: Require MEM_PERCPU for percpu kptr stores
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
selftests/bpf: Reject non-percpu values in percpu kptr fields
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
Ning Ding · Sep 4, 2026 · 1 files
selftests/bpf: Test borrowed refcount acquisition nullability
Ning Ding · Sep 4, 2026 · 2 files
bpf: Clear NON_OWN_REF after RCU protection ends
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
selftests/bpf: Reject graph kptr use after RCU unlock
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 2 files
bpf: Reject untrusted allocated-object pointers
Ning Ding · Sep 4, 2026 · 1 files
selftests/bpf: Reject refcount acquisition after RCU unlock
Ning Ding · Sep 4, 2026 · 1 files
bpf: Preserve special fields in recycled rhtab elements
Yuan Chen · Sep 4, 2026 · 1 files
selftests/bpf: Test timer field on recycled rhtab element
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 2 files
bpf: Cancel special fields when recycling rhtab elements
Nuoqi Gui · Sep 4, 2026 · 1 files
selftests/bpf: Test rhtab kptr cancellation semantics
Nuoqi Gui · Sep 4, 2026 · 2 files
bpf: Mark NULL kptr stores precise
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
selftests/bpf: Test imprecise scalar kptr stores
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
bpf: Preserve inner map identity in callback frames
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
selftests/bpf: Test inner map identities in callbacks
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 2 files
ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX
Julian Braha · Sep 4, 2026 · 1 files
LoongArch: Do not select HAVE_RUST when KASAN is enabled
Nathan Chancellor · Sep 4, 2026 · 1 files
LoongArch: Fix typo "avaliable" in comment of vmlinux.lds.S
Hemanth Selam · Sep 4, 2026 · 1 files
LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()
Tiezhu Yang · Sep 4, 2026 · 1 files
LoongArch: Remove unused setup_profiling_timer() function
Anthony Iliopoulos · Sep 4, 2026 · 1 files
LoongArch: Avoid preempt count underflow without probe
Jérémy Jean · Sep 4, 2026 · 1 files
LoongArch: Do not save/restore percpu base register in rethook trampoline
Wentao Guan · Sep 4, 2026 · 1 files
LoongArch: KVM: Add unregister helpers for the KVM interrupt devices
Chaithanya Lagisetty · Sep 4, 2026 · 8 files
LoongArch: KVM: Free init resources if kvm_init() fails
Chaithanya Lagisetty · Sep 4, 2026 · 1 files
LoongArch: KVM: Remove unused function kvm_arch_flush_remote_tlbs_memslot()
Bibo Mao · Sep 4, 2026 · 2 files
LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path
Chaithanya Lagisetty · Sep 4, 2026 · 1 files
LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
Zeng Chi · Sep 4, 2026 · 1 files
LoongArch: KVM: Validate MSI data before routing it to EIOINTC
Zeng Chi · Sep 4, 2026 · 1 files
LoongArch: KVM: Fix TOCTOU race on pv_features
Tao Cui · Sep 4, 2026 · 3 files
perf build: Add clang and rust target flags for LoongArch
Haiyong Sun · Sep 4, 2026 · 1 files
tracing: Fix subbuf resize races with trace_pipe_raw readers
Vincent Donnefort · Sep 4, 2026 · 5 files
ring-buffer: Cap static ring buffer nr_pages
Vincent Donnefort · Sep 4, 2026 · 1 files
ring-buffer: Prevent truncation of nr_pages / nr_subbufs
Vincent Donnefort · Sep 4, 2026 · 1 files
tracing: Fix comment in tracing_buffers_splice_read()
Steven Rostedt · Sep 4, 2026 · 1 files
ring-buffer: Use a macro for static buffer bits
Steven Rostedt · Sep 4, 2026 · 1 files
bpf: mark a NULL call argument precise
Eduard Zingerman · Sep 5, 2026 · 2 files
selftests/bpf: precision of a NULL helper argument
Eduard Zingerman · Sep 5, 2026 · 2 files
bpf: mark a NULL memory argument of a call precise
Eduard Zingerman · Sep 5, 2026 · 1 files
selftests/bpf: precision of a NULL global subprogram memory argument
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: mark a NULL kfunc argument precise
Eduard Zingerman · Sep 5, 2026 · 1 files
selftests/bpf: precision of a NULL kfunc argument
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: mark a NULL BTF_ID argument of a global subprogram precise
Eduard Zingerman · Sep 5, 2026 · 1 files
selftests/bpf: precision of a NULL global subprogram BTF_ID argument
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: use mark_arg_precision() in check_mem_size_reg()
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: Reject non-scalar bpf_loop iteration counts
Kumar Kartikeya Dwivedi · Sep 5, 2026 · 3 files
selftests/bpf: Test pointer bpf_loop iteration count rejection
Kumar Kartikeya Dwivedi · Sep 5, 2026 · 1 files
Linux 7.3-rc2
Linus Torvalds · Sep 6, 2026 · 1 files