Weekly briefing · Oct 5–12, 2026
Linux mainline: week of Oct 5
A weekly briefing built from 7 published daily update(s).
In brief
This weekly briefing gathers the meaningful changes that entered Linux mainline over the previous seven days.
Bug fixes
SELinux: annotate AVC notification race
KCSAN detected concurrent reads and writes of `latest_notif` in the SELinux Access Vector Cache. The fix marks the lockless read and update with READ_ONCE/WRITE_ONCE while keeping the spinlock for writer serialization.
Why it matters: Removes a reported data race; no user-visible behavior change is expected.
SELinux: keep NFS labeling on reused superblocks
When an NFSv4 filesystem with `security_label` is mounted again, SELinux's option handling could skip setting SECURITY_LSM_NATIVE_LABELS because the superblock was already initialized. NFS then cleared its security-label capability on the shared server, disabling per-file labels for both mounts.
Why it matters: Fixes loss of per-file labeling on NFS remounts.
keys: apply persistent keyring timeout even if link fails
KEYCTL_GET_PERSISTENT creates a persistent keyring before trying to link it into the destination keyring. If the link failed (e.g. due to a restriction), the timeout was never set, leaving the keyring in a hidden register without an expiry.
Why it matters: Prevents persistent keyrings from lingering without their configured timeout after a failed link attempt.
KEYS: close add_key race with keyring restrictions
The kernel snapshot a keyring's restriction before taking the keyring semaphore, letting a concurrent restriction install be bypassed. The fix moves the restriction read to after locking, serializing it with restriction changes.
Why it matters: Closes a race that could allow adding keys to a keyring after a reject-all restriction is installed.
sched_ext: Fix CPU hotplug hang with BPF-held tasks
sched_ext is the BPF-based CPU scheduler extension. A CPU going offline must empty its run queue (rq), and the hotplug thread waits until that is done. With sched_ext, a task can remain counted on the dying CPU's rq while held by the BPF scheduler or placed in a user dispatch queue; once the CPU stops dispatching, the task may never be pulled back, so the hotplug wait can hang.
Why it matters: Avoids a CPU-offline hang on systems using the sched_ext BPF scheduler.
sched_ext: Correct ops.dequeue() for remote local-DSQ moves
When a task in BPF scheduler custody moves to another CPU's local dispatch queue (DSQ), ops.dequeue() was delayed until the task was picked and was called with a core-scheduling execution flag even though no core-scheduling pick occurred. The fix calls ops.dequeue() without flags when the task is inserted into the destination DSQ, matching same-rq behavior. A new selftest exercises both direct dispatch to a local DSQ and the move-to-local BPF helper.
Why it matters: BPF schedulers now receive accurate dequeue notifications for these cross-CPU moves.
sched_ext: Avoid qseq collisions after task migration
sched_ext uses a sequence number in task state to tell whether a queued instance is the same one a BPF helper saw when inserting it into a dispatch queue. The old per-run-queue counters are independent, so a task dequeued and re-enqueued on a different CPU could receive the same sequence and be mistaken for the earlier instance. The sequence is now generated from a per-task counter.
Why it matters: Prevents stale dispatch-queue claims when tasks migrate between CPUs.
workqueue: Fix NULL current_pwq dereference in chained-work check
current_wq_worker() identifies kworkers but does not guarantee one is currently running a work item, because worker->current_pwq is set only while a work function executes. Queueing on a draining or destroying workqueue could reach the chained-work check from a kworker outside work execution and dereference NULL. The check now requires worker->current_pwq before proceeding.
Why it matters: Prevents a NULL-pointer fault during workqueue drain/destroy operations.
libata: Preserve CHECK CONDITION for failed ATAPI commands
ATAPI completion set the SCSI status to CHECK CONDITION only if the command's result field was zero, to preserve host bytes for timed-out or requeued commands. But a regular failed command completed through libata error handling can also have a non-zero result because the SCSI midlayer stores an internal byte for some sense codes, causing the error status to be lost. The fix avoids losing CHECK CONDITION in that case.
Why it matters: Failed ATAPI commands keep their error status when reported to the SCSI layer.
cpuset: Fix v2-mode and hotplug races
is_in_v2_mode() previously read a cpuset subsystem root pointer directly, which can become stale when a cgroup filesystem is rebound; it now uses a dedicated cpuset_v2_mode flag. The hotplug path also called is_in_v2_mode() before taking cpuset_mutex, leaving a race if the hierarchy switched between v1 and v2; the call now happens under the mutex. In addition, guarantee_active_cpus() had a race with CPU offline because the CPU active mask is updated before the cpuset hotplug handler runs.
Why it matters: Avoids cpuset use-after-free, mode-check races, and hotplug-related state corruption.
dm-integrity: avoid stack buffer overflow with large tag sizes
In inline mode, the checksum buffer was sized for the maximum hash digest, but the tag size can be larger; zero-padding overflowed the stack. The buffer now uses MAX_TAG_SIZE.
Why it matters: Prevents a kernel panic on first read when dm-integrity inline mode is used with a tag size larger than the default hash digest size.
dm-integrity: validate superblock on resume
Resume re-reads the superblock without checking it against constructor-time values, so a modified superblock could make journal indexing inconsistent with in-memory structures. Added validation.
Why it matters: Prevents possible memory corruption or crashes if the superblock is changed while the device is suspended.
dm-crypt: reject lmk IV with AEAD ciphers
The legacy lmk IV mode assumes 64 transforms, but AEAD allocation only creates one, leading to out-of-bounds reads. The combination is now rejected at table load.
Why it matters: Prevents an oops when loading a malformed dm-crypt table that pairs an AEAD cipher with lmk.
dm ioctl: fix out-of-bounds reads and a resume race
Two ioctl fixes: data_start could run past a short buffer, and do_resume could read a table's mode after it was freed by a concurrent ioctl. Both are now handled by validating buffer size and reading the mode before swapping.
Why it matters: Prevents KASAN-detected out-of-bounds reads and a use-after-free race in device-mapper ioctls.
dm-snap: reject transient exception store for snapshot-merge
The transient exception store lacks prepare_merge/commit_merge, so a directly constructed snapshot-merge would call NULL and oops. Now rejected at table load.
Why it matters: Prevents an oops from an invalid snapshot-merge configuration.
btrfs: fix io_uring encoded read/write error handling
Several fixes in the io_uring encoded read/write path: avoid double cleanup after -EIOCBQUEUED, free iov on failure, unlock inode/extent locks in the caller, and don't stash allocations across -EAGAIN.
Why it matters: Prevents double-unlock/free, memory leaks, and lock leaks when io_uring encoded reads/writes fail or need reissue.
btrfs: fix xattr corruption and listxattr error handling
Replacing an xattr in a dir_item that packs multiple xattrs could leave a partially initialized item and trigger tree-checker corruption; listxattr could also lose -ERANGE when the buffer was too small.
Why it matters: Prevents metadata corruption during setxattr and fixes incorrect listxattr return codes.
btrfs: transaction and scrub reference fixes
An early exit in record_root_in_trans() left a flag set, causing unnecessary lock contention in the transaction hot path; scrub warning path leaked a root reference when path resolution failed.
Why it matters: Reduces transaction start contention and fixes a root reference leak during scrub warnings.
Surface Pro 11 microphone fix
The DMIC clock divider was set to /2 instead of /4, causing distorted recordings. dmic-sample-rate was lowered to match the Windows configuration.
Why it matters: Makes the built-in microphones on the Surface Pro 11 usable.
NXP Layerscape and i.MX8MP board fixes
Three Layerscape pinmux fixes correct wrong offsets/values that pinctrl-single rejected or ignored; the Variscite Sonata board now references the LDO5 regulator for its SD I/O supply, keeping it enabled.
Why it matters: Fixes pinmux configuration on Layerscape boards and prevents SD card removal/IO errors on the Sonata board.
Qualcomm GCC: correct PCIE_RSCC clock enable bits
Three global clock controllers used BIT(0) to enable PCIE_RSCC clocks, but those clocks need BIT(20)/BIT(21). Corrected in gcc-eliza, gcc-hawi, and gcc-kaanapali.
Why it matters: Ensures PCIe-related RSCC clocks are enabled with the right bits on those platforms.
Qualcomm GPUCC: mark GPU CX GDSC as votable
The GPU CX power domain on Glymur and Kaanapali is votable, so polling for power-off status during disable was wrong. Added the VOTABLE flag and removed POLL_CFG_GDSCR.
Why it matters: Fixes GPU power-domain handling, matching other Qualcomm platforms.
TEE/OP-TEE: zero-size rejection, device registration, FF-A offsets
TEE shared memory now rejects zero-sized allocations that caused an invalid page order; OP-TEE registers /dev/tee devices only after full initialization to avoid races; FF-A support handles shared-memory offsets on large-page kernels.
Why it matters: Prevents boot-time warnings/panics on panic_on_warn kernels, closes a device-registration race, and makes OP-TEE work with 64 KiB kernel pages.
mm/mremap: fix locked_vm leaks with MREMAP_DONTUNMAP
Two fixes for the MREMAP_DONTUNMAP path: a self-merge could leak locked_vm accounting, and partial copies could also leak it. The series splits VMAs where needed.
Why it matters: Fixes memory lock accounting for processes using mremap with MREMAP_DONTUNMAP.
Misc kernel fixes: boot-time page-table freeing, /dev/zero mapping, SRCU warning
Deferred kernel page-table freeing is skipped while booting to avoid a panic with boot-time function tracing; read-only MAP_SHARED /dev/zero now behaves like anonymous memory; SRCU cleanup no longer falsely warns when a barrier callback is still running.
Why it matters: Fixes a boot crash with function tracing, corrects an unexpected /dev/zero mmap behavior, and removes a spurious SRCU warning.
Fix swiotlb DMA limit for Xen dom0 non-growable pools
default_swiotlb_limit() now respects the actual default pool limit when the pool cannot grow, instead of returning the highest possible physical address.
Why it matters: Fixes rejection of 32-bit DMA devices in Xen dom0 after the swiotlb dynamic-pool regression.
Skip PCIe error recovery on false AER alarms
PCIe AER now checks whether any unmasked error was actually signaled before triggering recovery, avoiding resets when firmware raises a fatal-error alarm with empty status registers.
Why it matters: Fixes amdgpu probe failures and unnecessary GPU/root-port resets on systems with false firmware error reports.
Fix ARM64 PMUv3p9 EL2 trap configuration
The boot code no longer sets PMUv3p9 FGT2 bits when a CPU has an implementation-defined PMU, because those bits are reserved and could cause trapping problems.
Why it matters: ARM64 systems with non-standard PMU implementations are less likely to encounter EL2 trap or boot issues.
Fix em28xx device unregister warning for radio interfaces
The em28xx driver now uses video_unregister_device() for radio devices instead of the videobuf2 variant that requires a queue, avoiding a WARNING during device removal.
Why it matters: Users with em28xx-based TV/radio tuners should no longer see kernel warnings when the device is unbound or disconnected.
Release runtime PM reference when set_rate fails
geni_i2c_xfer() took a runtime-PM reference and leaked it if the set_rate() callback failed, leaving the controller resumed indefinitely. The error now goes through the common cleanup path.
Why it matters: Fixes a runtime PM leak on Qualcomm Geni I2C set_rate failure.
Mask UMC chip select to the four implemented selects
The EDAC amd64 driver changed the UMC chip-select mask from 0x7 to 0x3. All Zen systems have at most four chip selects, and future systems redefine the field the same way.
Why it matters: Keeps EDAC UMC decoding correct on current and future AMD platforms.
RISC-V: close shadow-call-stack, ptrace, and futex tagged-pointer holes
The kernel shadow call stack reload is now gated on sstatus.SPP instead of the user-writable tp register, CFI regset access is rejected when Zicfilp/Zicfiss are absent, ptrace regset buffers are zeroed before partial copyin, and futex atomics untag user pointers before the atomic access.
Why it matters: Prevents stale shadow-stack pointers, misleading CFI regsets, uninitialized ptrace data, and tagged-address atomic access on RISC-V.
RISC-V: vector context save plus string and unaligned access fixes
Vector save/restore asm declares datap read-write and drops a wrong vcsr output; ZBB strnlen avoids boundary wrap-around on huge counts; load_unaligned_zeropad() fixup now handles 32-bit loads instead of assuming 8-byte loads.
Why it matters: Fixes corrupted per-task vector state, wrong strnlen results with FORTIFY, and incorrect zero-padding on RV32 efficient-unaligned-access builds.
RISC-V: SiFive/T-Head errata and HSTATUS.HU cleanup
HSTATUS.HU is cleared during CPU init so hypervisor load/store instructions are not usable from U-mode; a SiFive MAL-9092 workaround adds fence.rw around HLV/HLVX/HSV; THEAD ghostwrite mitigation now selects RISCV_ALTERNATIVE_EARLY so the vulnerable state is recorded before boot alternatives are patched.
Why it matters: Reduces unintended guest-memory access from U-mode and ensures ghostwrite mitigation actually runs on affected T-Head CPUs when MAE errata is disabled.
RISC-V: uapi, build-config, and BPF patching fixes
The hwprobe MIPS vendor UAPI header replaces kernel-only BIT() with _BITULL(); SiFive errata are limited to 64-bit builds to silence a clang tautological warning; NR_CPUS no longer leaks the 64-bit default into rv32_defconfig; patch_map() handles read-only BPF execmem in vmalloc space.
Why it matters: Fixes userspace hwprobe compilation, clang 32-bit allmodconfig, rv32 early-boot hangs from an oversized NR_CPUS, and BPF JIT text patching on RISC-V.
io_uring: restore memlock exemptions and fix restriction/cancel behavior
SQ/CQ rings and provided-buffer rings are no longer charged to RLIMIT_MEMLOCK, undoing a region-API regression; disabled rings inherited from task restrictions still have register opcodes checked; cancellation no longer spins forever on local work the exiting task cannot run.
Why it matters: Avoids ENOMEM for unprivileged ring setup, closes a restriction bypass with IORING_SETUP_R_DISABLED, and prevents a do_exit busy-loop on DEFER_TASKRUN rings.
io_uring: populate BPF connect filter fields for 24-byte IPv6 addresses
The connect filter now treats SIN6_LEN_RFC2133 (24-byte sockaddr_in6) as enough to fill port and address fields, instead of requiring the full 28-byte structure.
Why it matters: Stops filters from being bypassed by using the shorter accepted IPv6 sockaddr length.
NVMe: zone-state correction, multipath revalidate, target fixes, and revert
The ZRASF Full/Read Only values are swapped back to spec; multipath revalidates zones after unfreezing the head queue to avoid lock-order inversion; nvmet returns Invalid Field for reservation-notification masks on invalid NSIDs and cleans up P2P memory with the right device; a prior 'do not reset in NEW state' change is reverted because the Apple driver needs more work.
Why it matters: Fixes wrong Report Zones results, a potential multipath deadlock, spec non-compliance in nvmet, a P2P cleanup bug, and a reset regression on Apple hardware.
564e46d9f6e8b3ce7572130fd99bc5b456fd4aa9c0f377a45755f1bd0217
UFS/SCSI: probe, reset, and device-reference fixes
UFS holds a clock reference across probe, cleans up MediaTek mPHY power-on failures, avoids unsafe CQTPy MMIO reads and redundant whole-queue sweeps during MCQ host reset, initializes qedi callback state before registration, and stops the SCSI changer from keeping scsi_device references to removable elements.
Why it matters: Prevents clock-gating crashes, stuck mPHY state, reset-time MMIO hazards, recovery slowdowns, qedi callback races, and SCSI device leak/rebind failures.
02a31783196378e04810542d375f3a5691dd27c0f718d3b3469fa055664b85de8b3a5eaa
SPI: DLL lock, status-opcode, and SG2044 error/speed fixes
NXP FlexSPI leaves stop mode before waiting for DLL lock; Cadence QSPI no longer keeps the default 0x05 RDSR opcode when polling is disabled for octal DTR; SG2044 NOR returns transfer errors and computes divider from device/controller clock limits.
Why it matters: Avoids hangs/timeouts on octal DTR, wrong status polling, silent SPI transfer failures, and overclocking on SG2044.
Regulator: range overflow, bulk-array ownership, and write-only register exposure
TPS6594/TPS65224 BUCK2-4 descriptors now use ARRAY_SIZE for n_linear_ranges; of_regulator_bulk_get_all() fills supply names into its own allocation and documents the caller's ownership; LTC3676 no longer allows reading write-only HRST/CLIRQ command registers.
Why it matters: Prevents out-of-bounds linear-range reads, uninitialized/leaked regulator bulk arrays, and an accidental board reset from debugfs register dumps.
zloop: zero only unread tail on short reads
Short reads from a zone backing file now zero only the bytes beyond the returned data instead of the whole bio request.
Why it matters: Prevents valid zone data from being clobbered and fixes fio zone-test failures (e.g. 'bad magic header').
x86/AMD: work around TLBI erratum #1718
AMD CPUs affected by possible TLB invalidation failure during INVLPGB/TLBSYNC are detected, and a software workaround is applied when no microcode fix is present.
Why it matters: Prevents stale TLB entries after kernel TLB flushes on affected AMD systems.
Input: ATI remote2 attribute fix and new xpad controllers
ati_remote2 handlers now convert from usb_interface instead of usb_device after attributes moved to the interface device; xpad gains IDs for the Corsair Novablade Pro and the newer 8BitDo Pro 2 Wired Controller for Xbox.
Why it matters: Fixes invalid device pointers in sysfs attribute handlers and makes these controllers show up with the correct gamepad identity.
XFS: exchange-range reflink flag and TO_EOF size fixes
Exchange-range stops transferring reflink flags based on the assumption that all mappings were moved, and the TO_EOF variant no longer manipulates file sizes in a way that leaves shared blocks beyond EOF.
Why it matters: Prevents in-place overwrites of shared blocks and post-EOF shared-block corruption after XFS_IOC_EXCHANGE_RANGE.
Landlock: remove __counted_by causing false FORTIFY panic
Dropping __counted_by from handled_masks avoids a clang 22/FORTIFY_SOURCE bogus buffer-overflow report during the second landlock_restrict_self() call.
Why it matters: Allows repeated Landlock restriction with clang-built FORTIFY kernels.
Hardware support
bnxt_en DMA mapping overrun on small padded packets
Packets smaller than 52 bytes, such as untagged ARP frames, were padded but the DMA mapping length was not increased, causing DMA read faults on page boundaries, especially on VLAN/macvlan interfaces with Intel IOMMU.
Why it matters: Broadcom NetXtreme-E NICs could experience TX queue timeouts and DMA faults when sending small packets like ARP on VLAN interfaces.
bnxt_en driver init fixed in kdump kernels behind PCIe switches
When the NIC is behind a PCIe switch in smart mode, the switch may need to see BARs initialized before passing memory read/write TLPs, causing fatal AER errors during kdump kernel initialization.
Why it matters: Systems with Broadcom bnxt_en NICs behind certain PCIe switches could fail to initialize networking in kdump/crashdump kernels, hampering network-based crash recovery.
mlx5e completion-queue doorbell ordering fixed
The driver updated the ICOSQ consumer counter before the CQ doorbell record, violating an ordering requirement that can cause a CQ overrun. The doorbell is now updated first, with a dma_wmb() before the consumer counter.
Why it matters: Prevents rare completion-queue overruns that can disrupt receive processing on Mellanox/NVIDIA ConnectX NICs.
stmmac 802.1ad (QinQ) VLAN stripping fixed
vlan_rx_hw() hardcoded ETH_P_8021Q instead of using the actual packet protocol, causing QinQ packets to be misidentified. Separately, rx-vlan-stag-hw-parse was advertised as enabled even when VLAN stripping was disabled.
Why it matters: QinQ networking on stmmac-based interfaces now works correctly, and ethtool feature reporting is accurate.
Cadence MACB crash and corruption fixes (hits Raspberry Pi CM5)
The driver modified skbs before checking TX ring space, so a NETDEV_TX_BUSY requeue could handle an already-freed or grown skb; it also appended the FCS in place to shared skbs, making pktgen clone_skb traffic hit a BQL BUG_ON that killed a Raspberry Pi CM5 within seconds. The ring is now checked first and shared skbs are copied.
Why it matters: Fixes crashes and memory corruption on systems using Cadence GEM/MACB Ethernet, including the Raspberry Pi CM5 via RP1.
bcmgenet TX permanently disabled after WoL suspend/resume
When the PHY link was down and UMAC was held in reset with WoL enabled, the resume sequence left UMAC_TX never enabled again on link up, permanently disabling transmission.
Why it matters: Raspberry Pi and other bcmgenet users could lose TX capability entirely after suspend/resume when WoL was enabled with the link down.
ASIX ax88179/178A USB Ethernet delivered frames with extra trailing bytes
A previous fix replaced skb_clone() with a copy that included a 2-byte IP alignment pseudo header, delivering non-last packets in bulk transfers with two extra trailing bytes, breaking MACsec and other length-sensitive protocols.
Why it matters: USB Ethernet adapters using the ASIX ax88179/178A chipset could deliver frames with incorrect lengths, breaking MACsec.
Add native DSD playback for Cambridge Audio streamers
The USB audio driver now recognizes the Cambridge Audio streamer's DSD-capable raw-data altsetting and exposes it as DSD_U32_BE, enabling native DSD64/128/256 playback.
Why it matters: Owners of compatible Cambridge Audio network players can play DSD files directly instead of falling back to PCM conversion.
Add HDA and ACP audio quirks for ASRock, HP, Acer, and ASUS laptops
New quirks fix headphone jack detection on ASRock NUC BOX-358H, enable mute LED on HP Pavilion 15-eg3xxx, register PDM DMICs on Acer Aspire Go 15, and override the ACP audio flag on ASUS ExpertBook AM7406CKA.
Why it matters: Users of these systems get working headphone detection, mute-LED feedback, internal microphones, and audio.
Improve speaker calibration on Lenovo laptops using TAS2781 amps
The HDA TAS2781 driver now accepts valid V1 calibration data when the TimeStamp and CRC fields are zero, which some Lenovo BIOSes leave blank.
Why it matters: Affected Lenovo Legion laptops no longer run speakers with default parameters, improving audio quality.
Add Cirrus SoundWire match entries for AMD ACP7.0 platforms
New ACP7.0 SoundWire match entries support cs42l43b plus cs35l57 amplifier combinations.
Why it matters: Enables audio on newer AMD laptops using these Cirrus Logic codecs.
Fix Cirrus amplifier feedback DAI on SoundWire
CS35L56/57/62/63 amp feedback now uses the SDCA OT25 stream on DP4 instead of the DP3 companion-amp DAI, with a DAI added for CS35L56.
Why it matters: Fixes amplifier feedback/AEC capture on laptops with Cirrus SoundWire amps.
Fix ADAU1372 codec mux defaults and sleepy GPIO handling
The codec's output ASRC and DAC source muxes are now initialized from valid register values, and powerdown GPIOs can sleep.
Why it matters: Fixes missing or corrupt audio output on ADAU1372 hardware and removes warnings when using I2C GPIO expanders.
Fix Samsung I2S clock imbalance at probe/runtime PM
op_clk is now enabled during probe so the first runtime suspend doesn't disable an already-disabled clock.
Why it matters: Eliminates boot-time I2S clock warnings on Exynos5250 Arndale.
Fix memory leak in Sound Blaster X-Fi DAO mapper cleanup
The ctxfi driver now frees the DAO input mapper array after clearing entries, fixing a leak introduced by a simplification commit.
Why it matters: Owners of Creative X-Fi sound cards will no longer leak kernel memory over time when using DAO features.
Fix error check on dw_hdmi_probe() return value
After dw_hdmi_probe(), the TH1520 bridge driver checked the hdmi pointer for IS_ERR() instead of the returned dw_hdmi. The patch checks the correct variable.
Why it matters: Correctly detects probe failure in the TH1520 HDMI bridge driver.
Fix remove() callback in th1520-dw-hdmi
The TH1520 remove callback read platform drvdata as a struct dw_hdmi * although it stores struct th1520_hdmi *, and then passed the wrong pointer to dw_hdmi_remove(). It now retrieves th1520_hdmi and passes hdmi->dw_hdmi.
Why it matters: Fixes teardown running on the wrong object in the TH1520 bridge driver.
Validate pitch from userspace in vmwgfx
vmwgfx cursor snooping now validates the pitch supplied by userspace along with the box dimensions before copying data from the underlying surface.
Why it matters: Fixes possible out-of-bounds reads with cursor snooping.
Add blend mode property to vmwgfx
vmwgfx adds support for the blend mode property so the core DRM code stops complaining about an unsupported property.
Why it matters: Stops log spam from the core DRM blend-mode check.
Fix unlocked list_del in drm_bridge_add()
drm_bridge_add() removed a bridge from the bridge_lingering_list without holding bridge_lock, even though other list operations and the debugfs walker use the lock. The empty/list_del sequence now runs under bridge_lock.
Why it matters: Fixes a potential list corruption when re-adding a bridge.
Fix unlocked list access in drm_bridge_attach()
drm_bridge_attach() inspected bridge->list without bridge_lock, which is a data race with concurrent list mutations. The check is now done under the lock.
Why it matters: Eliminates a data race in bridge attachment warnings.
Validate userspace queue count against initialized firmware slot count
Panthor validated the userspace queue count only against MAX_CS_PER_CSG, not the number of stream interfaces initialized from firmware data. If firmware reported fewer slots, unprivileged userspace could force access to an uninitialized stream interface.
Why it matters: Prevents a crash when requesting more queues than the firmware initialized.
Don't mark AUX backlight enabled when enabling failed
If drm_edp_backlight_enable() failed, dp_aux_backlight_update_status() still marked the backlight as enabled, so later brightness changes skipped the enable step. It now returns the error, allowing the next update to retry enabling.
Why it matters: Fixes a panel that stays dark after AUX backlight enable fails.
Check gsp->rm as well as gsp pointer before gcx ready
On Turing systems where GSP exists but is not used, the GCX-ready check now verifies gsp->rm as well as the gsp pointer.
Why it matters: Prevents a crash on GSP-but-unused Turing configurations.
Skip Turing CE workaround object for non-GR channels
The Turing CE workaround object was meant for the old Gallium driver, but it was being assigned to all channels. It now only applies to GR channels.
Why it matters: Fixes async copy engine (CE) operation on Turing.
Defer setup when fbdev_probe() fails, not just on -EAGAIN
fb_helper only deferred setup when the single-fb probe returned -EAGAIN. Any other fbdev_probe() failure left mode_sets with fb == NULL and no retry. All failures now set deferred_setup.
Why it matters: Lets fbdev emulation retry after transient probe failures.
Balance display clock enable on teardown
aspeed_gfx_load() enabled the display clock without disabling it on probe failure or removal. Using devm_clk_get_enabled() fixes error handling and automatic disable/unprepare.
Why it matters: Fixes unbalanced display clock enable on Aspeed GFX teardown.
Don't keep connector without a CRTC as connector_state
In gud_pipe_update(), if no connector in the new state had a CRTC, connector_state was left pointing at the last visited connector instead of NULL, skipping the fallback that finds the active connector.
Why it matters: Fixes active connector selection in the GUD USB display driver.
Fix reference and vm_bo handling in remap()
pvr_vm_gpuva_remap() took a GEM reference for each split part that was never dropped, and linked split parts to the new vm_bo instead of the original object's vm_bo. Both are fixed.
Why it matters: Fixes a memory leak and wrong vm_bo linkage during PVR mappings.
Size page table preallocation by device address
PVR page-table preallocation used device_addr plus sgt_offset with an exclusive end, which could allocate an extra table or underflow when mappings cross boundaries. Preallocation is now counted from device_addr with an inclusive end.
Why it matters: Fixes page-table preallocation sizing for device mappings.
Security and hardening
Network stack no longer transmits stale buffer memory
When skb_copy_and_csum_bits() hit unreadable frags it copied only the linear part and left the rest of the caller's buffer untouched, so uninitialized bytes could go out on the wire in ICMP error messages or driver TX bounce buffers. The unfilled portion is now zeroed.
Why it matters: Prevents uninitialized kernel memory from leaking onto the network via ICMP replies and transmit paths.
IPv4 validates checksum metadata before completing checksums
A packet with bad checksum metadata entering the IPv4 stack could cause skb_checksum_help to corrupt the network header. The stack now checks checksum_start before completing the checksum, as defence in depth until fuller input validation lands.
Why it matters: Hardens the kernel against packets with crafted checksum metadata, for example injected via tun or packet sockets, that could otherwise corrupt headers.
net/sched em_text no longer leaks stack bytes into module loader
em_text_change() passed a 16-byte algo array with no enforced NUL terminator to textsearch_prepare(), which on a TS_AUTOLOAD retry called request_module() with vsnprintf walking past the array into adjacent struct fields, feeding those bytes to the usermode helper command line.
Why it matters: A malicious netlink message could previously leak kernel stack contents into module-loading command lines.
Xen netfront hardened against malformed backend packets
Backend-controlled RX slot lengths shorter than an Ethernet header triggered a BUG() or an out-of-bounds read in eth_type_trans(); short packets are now dropped. A related fix frees the skb when a response chain overflows the frags array, which previously leaked the skb and its pages.
Why it matters: Xen guest kernels no longer crash or leak memory when a buggy or malicious backend sends malformed or oversized packet chains.
Fix mount namespace and automount locking bugs
Multiple fixes tighten mount locking: automounts can no longer be placed below mounts outside the caller's namespace, locked mounts cannot be expired by an ancestor's umount, and locks survive when propagated copies are moved beneath a cover.
Why it matters: Strengthens mount namespace isolation for containers and unprivileged user namespaces, preventing directory-reveal and namespace-confusion attacks.
Fix mount namespace and umount propagation races
Multiple fixes prevent busy or lazily-unmounted mounts from being silently unmounted, copied, or used to pin namespace resources, and close races that could expose files hidden by mounts.
Why it matters: Users who rely on bind mounts, mount namespaces, and umount in scripts or container runtimes should see fewer spurious EBUSY failures and avoid cases where an open file could outlive an unmounted filesystem or hidden files could be revealed.
6857e209015f7eb84d54fac58bacbf6be95932bf924166140febe278ec458189ab688f5a0b6f31a3c0b1b138e16fb1e8c640a01a78e4
Block reconfiguration of internal superblocks via fspick, remount, and umount
fspick(), mount(MS_REMOUNT), and umount() now refuse to target SB_NOUSER internal superblocks like the nullfs root of an empty mount namespace.
Why it matters: Prevents unprivileged namespace owners from changing global internal mount state, avoiding undefined behavior and potential isolation issues.
Prevent cross-user interference through shared nullfs roots
The nullfs root shared by kernel threads and empty mount namespaces is now read-only, cannot be watched, cannot take file locks, and readdir no longer holds its inode lock across page faults.
Why it matters: Avoids information leaks and denial-of-service where one process could observe or stall all other users of the shared kernel-thread directory.
Fix mount cycle leaks in UMOUNT_CONNECTED handling
Connected-mount handling was reworked so it no longer creates reference-count cycles between mounts, loop devices, and mount covers.
Why it matters: Prevents leaked mounts/loop devices and stale mount graphs for users doing namespace and loopback mount tricks.
Fix fsverity use-after-free during concurrent verification
struct fsverity_info is now freed after an RCU grace period, closing a race where two inodes doing fsverity lookups could access freed memory.
Why it matters: Users of fs-verity file integrity get a stability and security fix.
Source commits365 entries +
drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value
Felix Gu · Mar 20, 2026 · 1 files
drm/bridge: th1520-dw-hdmi: Fix remove() callback
Felix Gu · Mar 20, 2026 · 1 files
i40e: skip unnecessary VF reset when setting trust
Jose Ignacio Tornos Martinez · Apr 28, 2026 · 1 files
Revert "wifi: ath12k: add panic handler"
Yingying Tang · Jun 12, 2026 · 4 files
ice: skip unnecessary VF reset when setting trust
Jose Ignacio Tornos Martinez · Jun 15, 2026 · 1 files
iavf: send MAC change request synchronously
Jose Ignacio Tornos Martinez · Jun 22, 2026 · 3 files
clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable
Taniya Das · Aug 1, 2026 · 1 files
clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable
Taniya Das · Aug 1, 2026 · 1 files
drm/panthor: validate userspace queue count against initialized firmware slot count
Osama Abdelkader · Aug 4, 2026 · 1 files
clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks
Luca Weiss · Aug 7, 2026 · 1 files
clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks
Luca Weiss · Aug 7, 2026 · 1 files
clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks
Luca Weiss · Aug 7, 2026 · 1 files
wifi: nxpwifi: protect sta_list against concurrent add and delete
Linmao Li · Aug 7, 2026 · 2 files
wifi: nxpwifi: delete the station entry on the uAP deauth event
Linmao Li · Aug 7, 2026 · 1 files
drm/vmwgfx: validate pitch coming from userspace
Zack Rusin · Aug 9, 2026 · 1 files
wifi: mt76: mt7915: disable rx napi when removing device
Nicolas Cavallari · Aug 10, 2026 · 1 files
wifi: nxpwifi: wait for the wakeup timer before the adapter is freed
Linmao Li · Aug 13, 2026 · 1 files
wifi: nxpwifi: free the aggregation buffer when the RA list disappears
Linmao Li · Aug 13, 2026 · 1 files
wifi: nxpwifi: zero the channel statistics array
Linmao Li · Aug 13, 2026 · 2 files
wifi: mt76: mt7996: program a link again if the driver holds it
Felix Fietkau · Aug 18, 2026 · 1 files
wifi: mt76: mt7996: take over connection monitoring
Felix Fietkau · Aug 18, 2026 · 1 files
wifi: mt76: account non-AQL frames per peer rather than per link
Felix Fietkau · Aug 18, 2026 · 2 files
btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
Yang Xiuwei · Aug 19, 2026 · 1 files
btrfs: free iov when btrfs_uring_read_extent() fails
Yang Xiuwei · Aug 19, 2026 · 1 files
btrfs: unlock inode and extent in caller when io_uring read extent fails
Yang Xiuwei · Aug 19, 2026 · 1 files
btrfs: don't stash io_uring encoded data across -EAGAIN
Yang Xiuwei · Aug 19, 2026 · 1 files
riscv: ptrace: reject CFI regset access when extensions are absent
Chen Pei · Aug 20, 2026 · 1 files
wifi: nxpwifi: fix the authentication frame length handling
Linmao Li · Aug 20, 2026 · 1 files
wifi: nxpwifi: handle authentication frame allocation failures
Linmao Li · Aug 20, 2026 · 1 files
tee: qcomtee: fix kernel-doc warnings
Babanpreet Singh · Aug 21, 2026 · 3 files
wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
Tao Gong · Aug 23, 2026 · 1 files
usb: f81604: fix struct f81604_int_data size mismatch
Ji-Ze Hong (Peter Hong) · Aug 24, 2026 · 1 files
arm64: dts: lx2160a: fix incorrect pinmux
Vincent Jardin · Aug 24, 2026 · 1 files
arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
Vincent Jardin · Aug 24, 2026 · 1 files
arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
Vincent Jardin · Aug 24, 2026 · 1 files
wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion
David Carlier · Aug 25, 2026 · 1 files
wifi: nxpwifi: do not delete Rx reorder entries under RCU
David Carlier · Aug 25, 2026 · 1 files
wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
Aaron Ma · Aug 26, 2026 · 1 files
riscv: ptrace: Zero-initialize regset buffers before copyin
Zongmin Zhou · Aug 26, 2026 · 1 files
srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()
Sunho Park · Aug 30, 2026 · 1 files
arm64: dts: qcom: x1-denali: Fix microphone distortion
Dale Whinham · Aug 30, 2026 · 1 files
wifi: mt76: use ALTX queue for packets to disassociated stations
Felix Fietkau · Sep 1, 2026 · 3 files
drm/bridge: Fix unlocked list_del in drm_bridge_add()
Cristian Ciocaltea · Sep 1, 2026 · 1 files
drm/bridge: Fix unlocked list access in drm_bridge_attach()
Cristian Ciocaltea · Sep 1, 2026 · 1 files
regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
Abhishek Ojha · Sep 2, 2026 · 1 files
arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply
Stefano Radaelli · Sep 2, 2026 · 1 files
wifi: mt76: mt7603: initialize global station WCID
Cristian Papa · Sep 4, 2026 · 1 files
wifi: mt76: mt792x: pick the SAR table layout from the table itself
Devin Wittmayer · Sep 5, 2026 · 2 files
riscv: fix load_unaligned_zeropad() fixup for RV32
Karl Mehltretter · Sep 7, 2026 · 1 files
scsi: ufs: core: Hold a clock reference across the probe
Naomi Chu · Sep 9, 2026 · 1 files
wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
Junjie Cao · Sep 10, 2026 · 1 files
drm/i915/gt: Unmask interrupts only when ACTIVE is true
Krzysztof Karas · Sep 10, 2026 · 1 files
scsi: qedi: Initialize callback state before registration
Runyu Xiao · Sep 10, 2026 · 1 files
tee: optee: ffa: support shared memory offsets on large-page kernels
Mahantesh Salimath · Sep 10, 2026 · 2 files
wifi: mt76: mt7925: don't put the band auto marker in TGID
Devin Wittmayer · Sep 11, 2026 · 1 files
drm/i915/gem: Prevent overstepping exec array boundary
Krzysztof Karas · Sep 11, 2026 · 1 files
keys: finalize persistent keyring timeout after link attempt
Karl Mehltretter · Sep 12, 2026 · 1 files
drm/aspeed: Balance the display clock enable on teardown
Myeonghun Pak · Sep 13, 2026 · 1 files
dm-integrity: fix buffer overflow in inline mode with large tag size
Ben Cressey · Sep 15, 2026 · 1 files
dm-crypt: reject the lmk IV mode with AEAD ciphers
Ben Cressey · Sep 15, 2026 · 1 files
Bluetooth: RFCOMM: free the skb when the DLC has no owner
Maxim Skokov · Sep 15, 2026 · 1 files
drm/vc4: drain the hangcheck timer and works on V3D unbind
Fan Wu · Sep 15, 2026 · 1 files
mmc: mtk-sd: Cancel request timeout work on remove
Yibo Tan · Sep 15, 2026 · 1 files
mmc: cavium-octeon: destroy slot platform devices on remove
Guangshuo Li · Sep 15, 2026 · 1 files
mmc: cavium-thunderx: destroy slot platform devices on remove
Guangshuo Li · Sep 15, 2026 · 1 files
mmc: sdhci-sprd: disable runtime PM on remove
Guangshuo Li · Sep 15, 2026 · 1 files
zloop: zero out only the unread tail of short reads
Shin'ichiro Kawasaki · Sep 16, 2026 · 1 files
iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys
Peng Fan · Sep 16, 2026 · 1 files
drm/vc4: Fix firmware reference leak in vc4_drm_bind()
Wentao Liang · Sep 16, 2026 · 1 files
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
Wentao Liang · Sep 16, 2026 · 1 files
drm/vmwgfx: Add blend mode property
Ian Forbes · Sep 16, 2026 · 1 files
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
Zongmin Zhou · Sep 17, 2026 · 1 files
can: dev: init_can_skb(): restore skb header initialization
zjamg · Sep 17, 2026 · 1 files
power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids
Hans de Goede · Sep 18, 2026 · 1 files
optee: register TEE devices only once fully initialized
Shao-Fu Chen · Sep 18, 2026 · 2 files
btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()
Filipe Manana · Sep 18, 2026 · 1 files
dm ioctl: don't let data_start run past the buffer
Palla Raghunath · Sep 18, 2026 · 1 files
nvmet: return Invalid Field for invalid NSIDs feature 82h
Guixin Liu · Sep 20, 2026 · 1 files
scsi: ufs: mediatek: Handle mPHY power-on failures
Pengpeng Hou · Sep 20, 2026 · 1 files
pmdomain: rockchip: propagate subdomain add errors
Shawn Lin · Sep 21, 2026 · 1 files
pmdomain: rockchip: fix clock leak on domain probe failure
Shawn Lin · Sep 21, 2026 · 1 files
pmdomain: rockchip: don't ignore clock lookup errors on attach
Shawn Lin · Sep 21, 2026 · 1 files
pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
Ming Qian · Sep 21, 2026 · 1 files
drm/gud: don't keep a connector without a CRTC as connector_state
Sajal Gupta · Sep 22, 2026 · 1 files
usb: mtu3: Fix double dereference in TP_printk
Vladimir Murzin · Sep 22, 2026 · 1 files
scsi: ch: Do not keep references to data transfer element devices
Ahmed Abdelhaleem Ahmed · Sep 22, 2026 · 1 files
media: em28xx: use video_unregister_device for radio_dev
Rohinthan P · Sep 23, 2026 · 1 files
mailmap: update addresses for John Garry
John Garry · Sep 23, 2026 · 1 files
selinux: fix data race on AVC latest_notif
Christian Göttsche · Sep 23, 2026 · 1 files
MAINTAINERS: name the ext4 dev branch
Matthias Goergens · Sep 23, 2026 · 1 files
dm: fix reading free memory in do_resume
Mikulas Patocka · Sep 23, 2026 · 1 files
gpio: xilinx: fix runtime PM leak on request error path
Ridham Khurana · Sep 23, 2026 · 1 files
mount: keep a copied mount unbindable
Christian Brauner · Sep 23, 2026 · 1 files
selftests/filesystems: check that a copied mount namespace keeps unbindable
Christian Brauner · Sep 23, 2026 · 3 files
mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount
Christian Brauner · Sep 23, 2026 · 1 files
selftests/move_mount_set_group: check that an unbindable target is refused
Christian Brauner · Sep 23, 2026 · 1 files
fs: don't silently unmount busy mounts
Christian Brauner · Sep 23, 2026 · 1 files
selftests/filesystems: check that a busy propagated copy blocks a synchronous umount
Christian Brauner · Sep 23, 2026 · 3 files
fs: don't let a migrating task hide its reference from do_umount()
Christian Brauner · Sep 23, 2026 · 2 files
docs: update the unmount propagation rule
Christian Brauner · Sep 23, 2026 · 1 files
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
Tejun Heo · Sep 23, 2026 · 4 files
drm/xe/sysctrl: Fix mailbox header handling
Mallesh Koujalagi · Sep 24, 2026 · 1 files
MAINTAINERS: update my email address
Imre Kaloz · Sep 24, 2026 · 2 files
mailmap: update entry for Andy Yan
Andy Yan · Sep 24, 2026 · 1 files
wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
Michele Dionisio · Sep 24, 2026 · 1 files
drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly
Lorenzo Stoakes (ARM) · Sep 24, 2026 · 1 files
ext4: mark data=journal as deprecated and will be removed in January 2028.
Theodore Ts'o · Sep 24, 2026 · 2 files
Bluetooth: MGMT: Fix status of pending commands flushed on power off
Iaroslav Voitovych · Sep 24, 2026 · 1 files
memstick: core: wait for request completion before freeing card
Raj Ojha · Sep 24, 2026 · 1 files
drm/amdkfd: align SDMA doorbell base for shader doorbell writes
Saleel Kudchadker · Sep 24, 2026 · 2 files
dm-snap: reject the transient exception store for snapshot-merge
Ma Xinmeng · Sep 25, 2026 · 1 files
mm: don't schedule deferred kernel page table freeing while booting
Mikhail Gavrilov · Sep 25, 2026 · 1 files
drm/amd/display: Don't replace a sink mode that shares the native totals
Adrian Betschart · Sep 25, 2026 · 2 files
drm/xe: Do not emit Wa_16010904313 twice
Tvrtko Ursulin · Sep 25, 2026 · 1 files
Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
Bihaan Sen · Sep 25, 2026 · 1 files
btrfs: fix xattr replace when multiple xattrs are packed in the same item
Filipe Manana · Sep 25, 2026 · 1 files
drm/amdgpu: make Mac FB workaround generic
Alex Deucher · Sep 25, 2026 · 1 files
drm/dp: don't mark the AUX backlight enabled when enabling failed
Oleg Keri · Sep 25, 2026 · 1 files
btrfs: fix lost error return value in btrfs_listxattr()
Filipe Manana · Sep 25, 2026 · 1 files
ibmveth: h_free logical LAN on open-fail after register
Mingming Cao · Sep 25, 2026 · 1 files
ibmveth: fix TX LTB and filter unwind on open-fail
Mingming Cao · Sep 25, 2026 · 1 files
drm/vc4: Disable the V3D interrupt across runtime suspend
Maíra Canal · Sep 25, 2026 · 2 files
namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
Christian Brauner · Sep 26, 2026 · 1 files
statmount: read the parent of an unmounted mount under mount_lock
Christian Brauner · Sep 26, 2026 · 1 files
namespace: don't inherit MNT_UMOUNT in clone_mnt()
Christian Brauner · Sep 26, 2026 · 2 files
namespace: don't copy an unmounted mount tree
Christian Brauner · Sep 26, 2026 · 1 files
namespace: check the target before walking it in do_mount_setattr()
Christian Brauner · Sep 26, 2026 · 1 files
fs: refuse fspick() on internal superblocks
Christian Brauner · Sep 26, 2026 · 1 files
fs: put the old fs_struct before the old namespaces in unshare()
Christian Brauner · Sep 26, 2026 · 1 files
namespace: drop the file's reference first in dissolve_on_fput()
Christian Brauner · Sep 26, 2026 · 2 files
selftests/filesystems: check that an unmounted mount tree isn't walked
Christian Brauner · Sep 26, 2026 · 4 files
selftests/filesystems: check that a dead mount's overmount isn't followed
Christian Brauner · Sep 26, 2026 · 3 files
net: bridge: avoid recursive multicast port cleanup
Zixuan Chai · Sep 26, 2026 · 1 files
arm64: irq: exclude the softirq stack switch from KCOV
Karl Mehltretter · Sep 26, 2026 · 1 files
Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
Aldo Ariel Panzardo · Sep 26, 2026 · 1 files
lib/dim: fix 32-bit overflow in dim_calc_stats() rates
Shashank Mohan Jain · Sep 27, 2026 · 1 files
lib/dim: add KUnit test for dim_calc_stats()
Shashank Mohan Jain · Sep 27, 2026 · 3 files
drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
Nguyen Ngoc Thang · Sep 27, 2026 · 1 files
selftests/mm: cleanup -Wformat issues in hugetlb-mmap
Carlos Llamas · Sep 27, 2026 · 1 files
workqueue: Fix NULL current_pwq deref in chained work check
Pavankumar Kondeti · Sep 28, 2026 · 1 files
scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
Stanley Jhu · Sep 28, 2026 · 1 files
scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
Stanley Jhu · Sep 28, 2026 · 1 files
tipc: destroy topsrv workqueues before closing connections
Yuqi Xu · Sep 28, 2026 · 1 files
net/packet: guard the ll header push in packet_rcv_spkt()
Quchaosheng · Sep 28, 2026 · 1 files
spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock
Haibo Chen · Sep 28, 2026 · 1 files
selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
Stephen Smalley · Sep 28, 2026 · 1 files
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
Georgiy Osokin · Sep 28, 2026 · 1 files
tipc: hold a reference to nodes found by link name
Chengfeng Ye · Sep 28, 2026 · 1 files
net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
Suraj Gupta · Sep 28, 2026 · 2 files
amt: send the relay's General Query directly from the receive path
Omar Ramadan · Sep 28, 2026 · 2 files
selftests: net: amt: check that the relay's queries bypass the amt device
Omar Ramadan · Sep 28, 2026 · 1 files
net: stmmac: Remove VLAN perfect matching dead code
Ovidiu Panait · Sep 28, 2026 · 3 files
net: stmmac: Stop toggling the EDVLP bit
Ovidiu Panait · Sep 28, 2026 · 1 files
net: stmmac: Rename double VLAN references to svlan
Ovidiu Panait · Sep 28, 2026 · 5 files
net: stmmac: Do not advertise S-VLAN stripping when it is disabled
Ovidiu Panait · Sep 28, 2026 · 1 files
net: stmmac: Disable S-Tag processing on dwmac4
Ovidiu Panait · Sep 28, 2026 · 1 files
ice: fix use-after-free in dynamic port cleanup
Xuanqiang Luo · Sep 28, 2026 · 1 files
ice: Restore Ordered MMIO Writes for Tx Doorbells
Bryan Fraschetti · Sep 28, 2026 · 1 files
ice: fix metadata_dst refcount handling on representor teardown
Tristan Madani · Sep 28, 2026 · 1 files
Bluetooth: btintel_pcie: Add shared HW reset for clean start
Sai Teja Aluvala · Sep 29, 2026 · 1 files
Bluetooth: btintel_pcie: fix TX descriptor bounds check
Ravindra · Sep 29, 2026 · 1 files
openvswitch: fix soft lockup in the netlink flow dump
Denis V. Lunev · Sep 29, 2026 · 1 files
gpio: mpsse: fix race when arming the IRQ poll worker
Fan Wu · Sep 29, 2026 · 1 files
Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
Mikhail Gavrilov · Sep 29, 2026 · 2 files
net: stmmac: propagate PTP addend and system time programming errors
Lorenzo Bianconi · Sep 29, 2026 · 2 files
nvme: fix swapped ZRASF zone state values for full and read only
Karl Bonde Torp · Sep 29, 2026 · 1 files
ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
Hengyu Liang · Sep 29, 2026 · 1 files
gpio: exar: initialize the ID before registering its cleanup
Sang-Hoon Choi · Sep 29, 2026 · 1 files
cxgb4/ch_ktls: disable softirqs around tid_list erases
Sang-Hoon Choi · Sep 29, 2026 · 1 files
net: allwinner: remove dmaengine_desc_free()
Frank Li · Sep 29, 2026 · 1 files
drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums
Alan Previn · Sep 29, 2026 · 1 files
drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
Leo Li · Sep 29, 2026 · 1 files
drm/amdgpu: serialize vblank counter reads against GPU reset
Vitaly Prosyak · Sep 30, 2026 · 1 files
cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
Waiman Long · Sep 30, 2026 · 1 files
KEYS: Fix add_key() race with keyring restriction
성병찬 · Sep 30, 2026 · 1 files
sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
Hui Peng · Sep 30, 2026 · 1 files
drm/amdgpu/userq: return the memdup_user() error for the user MQD
Jesse Zhang · Sep 30, 2026 · 1 files
drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
Jesse Zhang · Sep 30, 2026 · 1 files
nvme-multipath: revalidate head zones after unfreezing the head queue
Palla Raghunath · Sep 30, 2026 · 1 files
net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()
Leto Liu (刘涛) · Sep 30, 2026 · 2 files
nvmet: use the local P2P device on metadata allocation failure
Sang-Hoon Choi · Sep 30, 2026 · 1 files
net/sched: em_text: reject unterminated algo before autoload
Jamal Hadi Salim · Sep 30, 2026 · 1 files
nouveau: check gsp->rm as well as gsp pointer before gcx ready
Dave Airlie · Sep 30, 2026 · 1 files
Bluetooth: btintel_pcie: use managed IRQ teardown
Runyu Xiao · Sep 30, 2026 · 1 files
swiotlb: fix default_swiotlb_limit() for non-growable default pool
Marek Szyprowski · Sep 30, 2026 · 1 files
wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
Lu Huang · Sep 30, 2026 · 1 files
tcp: reject net_iov in zerocopy receive mapping hints
Daehyeon Ko · Sep 30, 2026 · 1 files
regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
Ridham Khurana · Sep 30, 2026 · 1 files
i2c: qcom-geni: release runtime PM reference when set_rate fails
Rahul Pon · Sep 30, 2026 · 1 files
arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
Fuad Tabba · Sep 30, 2026 · 1 files
pfcp: make sure the SEID is linear before reading it
Haishuang Yan · Sep 30, 2026 · 1 files
namespace: queue a mount only once for mount notifications
Christian Brauner · Sep 30, 2026 · 2 files
namespace: check a submount for references right before unmounting it
Christian Brauner · Sep 30, 2026 · 1 files
selftests/filesystems: check that a busy submount survives a synchronous umount
Christian Brauner · Sep 30, 2026 · 2 files
namespace: check a recursive bind mount for mount namespace loops
Christian Brauner · Sep 30, 2026 · 1 files
selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace
Christian Brauner · Sep 30, 2026 · 3 files
namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
Christian Brauner · Sep 30, 2026 · 1 files
selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered
Christian Brauner · Sep 30, 2026 · 3 files
namespace: look at the topmost mount for a mount namespace file
Christian Brauner · Sep 30, 2026 · 1 files
selftests/filesystems: check that a mount namespace file on top doesn't bury a mount
Christian Brauner · Sep 30, 2026 · 3 files
namespace: check the mounts before reading their parents in pivot_root()
Christian Brauner · Sep 30, 2026 · 1 files
namespace: don't reconfigure internal superblocks via remount and umount
Christian Brauner · Sep 30, 2026 · 2 files
selftests/filesystems: check that the nullfs root can't be reconfigured
Christian Brauner · Sep 30, 2026 · 3 files
namespace: remove the fsnotify marks of a mount namespace in process context
Christian Brauner · Sep 30, 2026 · 1 files
dcache: don't put a mountpoint on a dentry that's being removed
Christian Brauner · Sep 30, 2026 · 1 files
unshare: don't drop active namespace references that were never taken
Christian Brauner · Sep 30, 2026 · 3 files
namespace: don't let a pseudo dentry become the root of a mount
Christian Brauner · Sep 30, 2026 · 1 files
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
Nguyen Ngoc Thang · Sep 30, 2026 · 1 files
sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ
Kuba Piecuch · Sep 30, 2026 · 1 files
selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves
Kuba Piecuch · Sep 30, 2026 · 3 files
power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()
Alexey Charkov · Sep 30, 2026 · 1 files
regulator: of: fill in supply names in of_regulator_bulk_get_all()
Alexey Charkov · Sep 30, 2026 · 1 files
regulator: of: state who owns the array from of_regulator_bulk_get_all()
Alexey Charkov · Sep 30, 2026 · 1 files
drm/amd/display: disable self-refresh on tearing flips
Leo Li · Sep 30, 2026 · 1 files
dm-integrity: validate the superblock on resume
Mikulas Patocka · Sep 30, 2026 · 1 files
net/mlx5: Lag, split aggregate speed into oper and max helpers
Or Har-Toov · Sep 30, 2026 · 1 files
drm/vc4: Fix binner slot allocation failing on an idle GPU
Maíra Canal · Sep 30, 2026 · 5 files
spi: sg2044-nor: Return transfer errors
Han Gao · Sep 30, 2026 · 1 files
spi: sg2044-nor: Honor SPI clock limits
Han Gao · Sep 30, 2026 · 1 files
mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
Lorenzo Stoakes (ARM) · Sep 30, 2026 · 4 files
mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
Lorenzo Stoakes (ARM) · Sep 30, 2026 · 3 files
drm/vc4: Free the BO cache size list on teardown
Maíra Canal · Sep 30, 2026 · 1 files
drm/vc4: Use kvmalloc_objs() for the BO cache size list
Maíra Canal · Sep 30, 2026 · 1 files
gve: fix XSK buffer leak when rings are stopped
Joshua Washington · Sep 30, 2026 · 1 files
gve: fix XSK buffer leak on error descriptor
Joshua Washington · Sep 30, 2026 · 1 files
gve: fix napi_disable deadlock when attempting to disable XSK pools
Joshua Washington · Sep 30, 2026 · 1 files
net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET
Justin Chen · Sep 30, 2026 · 1 files
net: make dev_xdp_sb_prog_count() see programs attached through a link
Jakub Kicinski · Oct 1, 2026 · 1 files
bonding: fix the program leak when XDP is replaced
Jakub Kicinski · Oct 1, 2026 · 1 files
devlink: fix devlink_rel reference leak when notify work is pending
Haishuang Yan · Oct 1, 2026 · 1 files
ALSA: hda/tas2781: Accept V1 calibration data without CRC
Mohamed Yassine Jebabli · Oct 1, 2026 · 1 files
can: fix unique skb identifier regression under RPS
Oliver Hartkopp · Oct 1, 2026 · 8 files
drm/imagination: Fix reference and vm_bo handling in remap()
Gyeyoung Baek · Oct 1, 2026 · 1 files
drm/imagination: Size page table preallocation by device address
Gyeyoung Baek · Oct 1, 2026 · 1 files
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
Ziyi Guo · Oct 1, 2026 · 2 files
braille: nbcon: Allow to use a serial console with NBCON API as Braille console
Petr Mladek · Oct 1, 2026 · 7 files
ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
Harin Lee · Oct 1, 2026 · 1 files
vsock/virtio: account only unread bytes in read_skb()
Daehyeon Ko · Oct 1, 2026 · 1 files
spi: cadence-qspi: Fix status polling with octal DTR chips
Miquel Raynal · Oct 1, 2026 · 1 files
net/sched: cls_route: reject change with no routing attribute
Victor Nogueira · Oct 1, 2026 · 1 files
selftests: tc-testing: add cls_route no-routing-attribute change tests
Victor Nogueira · Oct 1, 2026 · 1 files
drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
Mikhail Gavrilov · Oct 1, 2026 · 1 files
fsverity: RCU-delay the freeing of struct fsverity_info
Eric Biggers · Oct 1, 2026 · 2 files
net: team: stop reusing skb after queue override
Weiming Shi · Oct 1, 2026 · 1 files
net: team: free skb when broadcast has no txable port
Weiming Shi · Oct 1, 2026 · 1 files
ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H
Eckhart Mohr · Oct 1, 2026 · 1 files
flow_dissector: avoid u16 truncation of skb->len when computing thoff
Eric Dumazet · Oct 1, 2026 · 1 files
net: always dissect GSO packets in __virtio_net_hdr_to_skb()
Eric Dumazet · Oct 1, 2026 · 4 files
selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM
Eric Dumazet · Oct 1, 2026 · 1 files
ipv4: free inet_opt and ireq_opt after an RCU grace period
Eric Dumazet · Oct 1, 2026 · 2 files
e1000e: add system to disable K1 list
Tony Nguyen · Oct 1, 2026 · 1 files
drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
Haojie Li · Oct 2, 2026 · 1 files
ip6_gre: remove obsolete ERSPAN PMTU update
Daehyeon Ko · Oct 2, 2026 · 1 files
ipv4: stop PMTU walk when nexthop group shrinks
Daehyeon Ko · Oct 2, 2026 · 1 files
ipv4: stop exception dump when nexthop group shrinks
Daehyeon Ko · Oct 2, 2026 · 1 files
ipv4: stop route notification sizing when nexthop group shrinks
Daehyeon Ko · Oct 2, 2026 · 1 files
Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
Palla Raghunath · Oct 2, 2026 · 1 files
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
Marek Szyprowski · Oct 2, 2026 · 1 files
drm/xe: Fix shrinker accounting double-subtraction on nested external pins
Thomas Hellström · Oct 2, 2026 · 3 files
drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
Thomas Hellström · Oct 2, 2026 · 1 files
EDAC/amd64: Mask UMC chip select to the four implemented selects
Vishal Badole · Oct 2, 2026 · 1 files
net: usb: ax88179_178a: fix rx frame length for non-last packets
Fredrik Nyberg · Oct 2, 2026 · 1 files
ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers
Matus Gajdos · Oct 2, 2026 · 1 files
namespace: unhash a dentry before detaching the mounts on it
Christian Brauner · Oct 2, 2026 · 1 files
namei: don't reveal overmounted entries in refwalk
Christian Brauner · Oct 2, 2026 · 1 files
fcntl: refuse F_SET_RW_HINT on an immutable inode
Christian Brauner · Oct 2, 2026 · 1 files
selftests/filesystems: check that an immutable inode takes no write hint
Christian Brauner · Oct 2, 2026 · 3 files
namespace: refuse an automount below a mount that is in no namespace
Christian Brauner · Oct 2, 2026 · 1 files
namespace: handle mount locking for automounts correctly
Christian Brauner · Oct 2, 2026 · 1 files
nullfs: don't update the access time
Christian Brauner · Oct 2, 2026 · 1 files
namespace: never expire a locked mount
Christian Brauner · Oct 2, 2026 · 1 files
namespace: keep the lock on a mount that a propagated copy is moved beneath
Christian Brauner · Oct 2, 2026 · 1 files
selftests/filesystems: check that a lock lands on the right mount and stays
Christian Brauner · Oct 2, 2026 · 2 files
selftests/filesystems: check the atime of the empty mount namespace root
Christian Brauner · Oct 2, 2026 · 3 files
selftests/filesystems: check that an automount below an overlay layer is refused
Christian Brauner · Oct 2, 2026 · 3 files
fhandle: decide the subtree check under mount_lock
Christian Brauner · Oct 2, 2026 · 2 files
namespace: keep the private nullfs instance in knullfs
Christian Brauner · Oct 2, 2026 · 2 files
namespace: nothing is mounted on or written through knullfs
Christian Brauner · Oct 2, 2026 · 1 files
fsnotify: let a filesystem refuse marks on its objects
Christian Brauner · Oct 2, 2026 · 3 files
nullfs: refuse file locks
Christian Brauner · Oct 2, 2026 · 1 files
readdir: take no inode lock on an immutable directory
Christian Brauner · Oct 2, 2026 · 3 files
selftests/filesystems: add a helper that holds a readdir in a page fault
Christian Brauner · Oct 2, 2026 · 1 files
selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody
Christian Brauner · Oct 2, 2026 · 3 files
nullfs: add an empty immutable regular file
Christian Brauner · Oct 2, 2026 · 3 files
namespace: rework connected mounts
Christian Brauner · Oct 2, 2026 · 4 files
selftests/filesystems: test covered mounts
Christian Brauner · Oct 2, 2026 · 7 files
bareudp: set the inner protocol to the protocol of the packet
Haishuang Yan · Oct 2, 2026 · 1 files
cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
Waiman Long · Oct 2, 2026 · 1 files
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)
Jaidheer Sirigineedi · Oct 2, 2026 · 1 files
x86/CPU/AMD: Fix AMD TLBI Erratum #1718
Borislav Petkov (AMD) · Oct 2, 2026 · 3 files
net: mana: reserve RX buffer headroom to fix forwarding performance
Hamza Mahfooz · Oct 3, 2026 · 4 files
sched_ext: Generate qseq from a per-task counter
Kuba Piecuch · Oct 3, 2026 · 4 files
Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification"
Or Har-Toov · Oct 4, 2026 · 2 files
namespace: simplify disconnect_mount()
Christian Brauner · Oct 4, 2026 · 1 files
Bluetooth: hci_sock: Serialize dead-device detachment
Chengfeng Ye · Oct 4, 2026 · 1 files
Bluetooth: ISO: Reject concurrent BIS listener setup
Chengfeng Ye · Oct 4, 2026 · 1 files
Bluetooth: hci_sync: Fix command skb lifetime during scan setup
Chengfeng Ye · Oct 4, 2026 · 2 files
net: sparx5: start the TOD counters on non-PTP lan969x variants
Quentin Freimanis · Oct 5, 2026 · 1 files
ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
Michael Garland · Oct 5, 2026 · 1 files
Bluetooth: ISO: Serialize concurrent connect calls
Chengfeng Ye · Oct 5, 2026 · 1 files
cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()
Waiman Long · Oct 5, 2026 · 1 files
Revert "nvme: do not reset controllers in NVME_CTRL_NEW state"
Keith Busch · Oct 5, 2026 · 1 files
strparser: make sure __strp_recv isn't running before tearing down the parser
Sabrina Dubroca · Oct 5, 2026 · 3 files
ASoC: cs35l56: Add DAI for SDCA OT25 stream
Richard Fitzgerald · Oct 5, 2026 · 3 files
ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI
Richard Fitzgerald · Oct 5, 2026 · 1 files
bnxt_en: Add bnxt_clear_bars() helper
Michael Chan · Oct 5, 2026 · 1 files
bnxt_en: Fix driver init in kdump kernel
Michael Chan · Oct 5, 2026 · 1 files
bnxt_en: Re-write the BARs following any type of PCIe errors
Pavan Chebbi · Oct 5, 2026 · 2 files
drm/xe/i2c: cancel the client work on remove
Fan Wu · Oct 6, 2026 · 1 files
riscv: vector: Fix output operands in context save
Aurelien Jarno · Oct 6, 2026 · 1 files
riscv: vector: Fix data pointer constraints in context save/restore
Troy Mitchell · Oct 6, 2026 · 1 files
riscv: limit sifive errata to CONFIG_64BIT
Arnd Bergmann · Oct 6, 2026 · 2 files
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
Zongmin Zhou · Oct 6, 2026 · 1 files
RISC-V: errata: Add SiFive MAL-9092 workaround
Yong-Xuan Wang · Oct 6, 2026 · 4 files
riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
Shao Mingyin · Oct 6, 2026 · 1 files
RISC-V: Clear HSTATUS.HU on CPU initialization
Yong-Xuan Wang · Oct 6, 2026 · 5 files
riscv: patch: fix handling of bpf-jit execmem addresses
Wei-Jie Hung · Oct 6, 2026 · 1 files
Revert "net: stmmac: propagate PTP addend and system time programming errors"
Jakub Kicinski · Oct 6, 2026 · 2 files
cipso: adjust cached option offsets when removing CIPSO
Daehyeon Ko · Oct 6, 2026 · 1 files
net: macb: check TX ring before modifying skb
Nicolai Buchwitz · Oct 6, 2026 · 1 files
net: macb: copy shared skbs before appending the FCS
Nicolai Buchwitz · Oct 6, 2026 · 1 files
wifi: mac80211: don't estimate airtime for unsupported rate widths
François Roux · Oct 6, 2026 · 1 files
net/mlx5e: Order ICOSQ cc update after CQ doorbell
Li RongQing · Oct 6, 2026 · 1 files
ASoC: adau1372: allow sleepy powerdown GPIOs
Alvin Šipraga · Oct 6, 2026 · 1 files
ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
Alvin Šipraga · Oct 6, 2026 · 1 files
io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
Hengyu Liang · Oct 6, 2026 · 6 files
riscv: futex: untag the user pointer before the atomic access
Ziyi Guo · Oct 6, 2026 · 1 files
mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
Petr Machata · Oct 6, 2026 · 3 files
selftests: mlxsw: Test port range occupancy on template create
Petr Machata · Oct 6, 2026 · 1 files
veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
Tianyi Gao · Oct 6, 2026 · 1 files
selftests: net: veth: test peer ndo-xmit after GRO toggle while down
Tianyi Gao · Oct 6, 2026 · 1 files
riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
Leo Yu-Chi Liang · Oct 7, 2026 · 1 files
flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
Eric Dumazet · Oct 7, 2026 · 1 files
bnxt_en: fix DMA mapping length for padded small packets
Eric Dumazet · Oct 7, 2026 · 1 files
net: dsa: microchip: fix KSZ8765 fiber detection
Sebastien Royen · Oct 7, 2026 · 1 files
ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA
Simon Trimmer · Oct 7, 2026 · 1 files
ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts
Simon Trimmer · Oct 7, 2026 · 1 files
drm/nouveau: Skip the Turing CE workaround object for non-GR channels
Mary Guillemard · Oct 7, 2026 · 1 files
xfs: stop exchanging reflink flags when exchanging mappings
Norbert Szetei · Oct 7, 2026 · 3 files
net: sparx5: free the matchall entry on destroy
Daniel Machon · Oct 7, 2026 · 1 files
xfs: fix exchange-range-to-eof file size exchange
Darrick J. Wong · Oct 7, 2026 · 2 files
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
Josef Bacik · Oct 7, 2026 · 1 files
xen/netfront: drop RX packets with a short Ethernet header
Josef Bacik · Oct 7, 2026 · 1 files
net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
Willem de Bruijn · Oct 7, 2026 · 1 files
xen/netfront: don't leak the skb when xennet_fill_frags() fails
Josef Bacik · Oct 7, 2026 · 1 files
ptp: ocp: fix PCIe delay estimation calculation
Vadim Fedorenko · Oct 7, 2026 · 1 files
Revert "wifi: libertas: reject short monitor TX frames"
Johannes Berg · Oct 7, 2026 · 1 files
ipv4: validate checksum_start before completing checksum
Michael S. Tsirkin · Oct 7, 2026 · 6 files
spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi
Jisheng Zhang · Oct 8, 2026 · 1 files
ipv4: do not warn on route notification size race
Daehyeon Ko · Oct 8, 2026 · 1 files
ipv6: do not warn on route notification size race
Daehyeon Ko · Oct 8, 2026 · 1 files
net/smc: protect clcsock lifetime in smc_getname
Chengfeng Ye · Oct 8, 2026 · 1 files
net: openvswitch: validate transport header presence in set_ipv6_addr
Fernando Fernandez Mancera · Oct 8, 2026 · 1 files
PCI/AER: Skip error recovery on false alarms
Lukas Wunner · Oct 8, 2026 · 1 files
wireguard: queueing: preserve tstamp_type when encapsulating packet
Ramses de Norre · Oct 8, 2026 · 1 files
wireguard: noise: reject response consumption after intermediate initiation
Jason A. Donenfeld · Oct 8, 2026 · 1 files
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
Ilia Gavrilov · Oct 8, 2026 · 1 files
io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
Jens Axboe · Oct 8, 2026 · 1 files
io_uring/cancel: don't spin on local work the task can't run
Cen Zhang (Microsoft Security FORGE Labs) · Oct 8, 2026 · 1 files
io_uring/register: don't exempt disabled rings from task restrictions
Eugene Gvozdetsky · Oct 8, 2026 · 3 files
io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
Natasha Klaus · Oct 9, 2026 · 1 files
Input: xpad - add support for Corsair Novablade Pro
Krzysztof Furman · Oct 9, 2026 · 1 files
Input: ati_remote2 - fix type confusion in device attribute handlers
Haotian Zhang · Oct 9, 2026 · 1 files
landlock: Drop __counted_by from landlock_domain.handled_masks
Nguyen Ngoc Thang · Oct 10, 2026 · 1 files
Linux 7.3-rc7
Linus Torvalds · Oct 12, 2026 · 1 files