What changed in Linux Kernel from 6 to 7

77 commits in this release:

• Linux 7.1.13
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: iaa - fall back to software for multi-entry scatterlists
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: krb5 - use kfree_sensitive() for derived key buffers
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• crypto: qcom-rng - Allow zero as a random number
• crypto: qcom-rng - Remove crypto_rng interface
• crypto: qcom-rng - Enable clock in hwrng case
• crypto: virtio - bound the akcipher result length
• kunit: irq: Continue increasing hrtimer interval for longer
• mm/swap: reject swapon() on filesystem-level encrypted files
• netfilter: nf_tables: don't queue packet path object notifications
• netfilter: nft_set_pipapo_avx2: add missing vzeroupper
• vxlan: keep the last remote linked during FDB flush
• batman-adv: reject unrepresentable multicast TVLV offsets
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net/packet: defer vmalloc TX_RING free until skbs finish
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: bound nat keepalive state collection
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: avoid lock inversion in nat keepalive work
• xfrm: drop ESP-in-TCP packets with no ingress device
• tcp: clamp route advmss to TCP_MIN_MSS
• xfrm: espintcp: fix UAF during close
• net: advertise TCP MSS from the configured MTU, not the learned PMTU
• net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
• tcp: fix AO info use-after-free in tcp_ao_connect_init()
• net/tcp: fix TCP-AO key deletion in VRFs
• gtp: serialize PDP context updates
• tls: device: fix out-of-bounds write in tls_append_frag()
• KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
• KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
• KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
• KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
• KVM: SEV: Drop FOLL_WRITE for encrypted region registration
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• usb: xhci: bail out of setup if the controller is inaccessible
• usb: xhci: Handle USB3 port events when there is one roothub
• usb: xhci: Handle bogus TRB pointers in Missed Service Error events
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• ext4: zero out whole block for clean edges in WRITE_ZEROES
• ext4: track partial-zero outcome per edge in ext4_zero_partial_blocks()
• ext4: write back partial-zeroed edges in WRITE_ZEROES
• ext4: move partial block zeroing earlier in ext4_zero_range()
• ext4: protect WRITE_ZEROES written extents with orphan list
• ext4: export converted block count from ext4_convert_unwritten_extents()
• selinux: switch two allocations to use kzalloc_objs()
• selinux: require a class's permission values to cover its permission count
• selinux: reject a permission value exceeding the class permission count
• selinux: more strict policy parsing
• selinux: use u16 for security classes
• Revert "selinux: reject a permission value exceeding the class permission count"
• nvme-tcp: fix usage of page_frag_cache
• KVM: x86/mmu: Check write tracking in all address spaces
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()
• RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
• bpf: reject overlarge global subprog argument sizes

72 commits in this release:

• Linux 7.2.3
• usb: usbfs: fix use-after-free of usb_device in usbdev_release()
• wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
• USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
• USB: serial: spcp8x5: drop broken carrier detect support
• USB: serial: option: fix slab OOB read in interrupt URB callback
• ALSA: usb-audio: Complete cleanup after system-resume errors
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
• ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
• usb: core: Strengthen error handling in hub_hub_status()
• usb: core: Add lock to usb_wakeup_notification()
• KVM: s390: vsie: zero stale crypto bits
• crypto: qce - Remove unsafe/deprecated algorithms
• crypto: mxs-dcp - fix source scatterlist length access
• crypto: iaa - fall back to software for multi-entry scatterlists
• crypto: qce - fix CCM AAD buffer underallocation
• crypto: krb5 - use kfree_sensitive() for derived key buffers
• crypto: atmel-tdes - use scatterlist length before DMA mapping
• crypto: sun8i-ss - Remove crypto_rng interface
• crypto: sun8i-ce - Remove crypto_rng interface
• crypto: qcom-rng - Allow zero as a random number
• crypto: qcom-rng - Remove crypto_rng interface
• crypto: qcom-rng - Enable clock in hwrng case
• crypto: virtio - bound the akcipher result length
• kunit: irq: Continue increasing hrtimer interval for longer
• mm/swap: reject swapon() on filesystem-level encrypted files
• netfilter: nf_tables: don't queue packet path object notifications
• netfilter: nft_set_pipapo_avx2: add missing vzeroupper
• vxlan: keep the last remote linked during FDB flush
• batman-adv: reject unrepresentable multicast TVLV offsets
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation
• net/packet: defer vmalloc TX_RING free until skbs finish
• vlan: fix skb_under_panic and races when toggling HW VLAN offload
• net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
• xfrm: bound nat keepalive state collection
• xfrm: fix xfrm_state_construct() auth-trunc leak
• xfrm: ah6: validate routing header segments_left
• xfrm: avoid lock inversion in nat keepalive work
• xfrm: drop ESP-in-TCP packets with no ingress device
• tcp: clamp route advmss to TCP_MIN_MSS
• xfrm: espintcp: fix UAF during close
• net: advertise TCP MSS from the configured MTU, not the learned PMTU
• net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
• tcp: fix AO info use-after-free in tcp_ao_connect_init()
• net/tcp: fix TCP-AO key deletion in VRFs
• gtp: serialize PDP context updates
• tls: device: fix out-of-bounds write in tls_append_frag()
• KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
• KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
• KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
• KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
• KVM: SEV: Drop FOLL_WRITE for encrypted region registration
• KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts
• usb: gadget: f_tcm: keep port count until LUN teardown completes
• usb: usbtest: disable dynamic ID support
• fuse: fix invalidate lock leak on open O_TRUNC DAX failure
• fuse: fix invalidate lock leak on setattr writeback failure
• fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
• fuse: publish io-uring queues with release semantics
• fuse: fix missing barrier when checking io-uring readiness
• fuse: fix race between interrupt and resend
• xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
• xhci: dbgtty: Fix unregister on tty_register_driver() failure
• usb: xhci: bail out of setup if the controller is inaccessible
• usb: xhci: Handle USB3 port events when there is one roothub
• usb: xhci: Handle bogus TRB pointers in Missed Service Error events
• accessibility: speakup: unregister tty ldisc on later init failures
• fpga: dfl: fme: add error handling
• selftests/bpf: Fix test_maps sockmap failure
• nvme-tcp: fix usage of page_frag_cache
• RDMA/rxe: Fix OOB in free_rd_atomic_resources()
• RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

2 commits in this release:

• Linux 7.1.12
• inet: frags: strip GSO state from fragments before reassembly

2 commits in this release:

• Linux 7.2.2
• inet: frags: strip GSO state from fragments before reassembly

100 commits in this release:

• Linux 7.1.11
• ptp: vmclock: prevent read-only mappings from becoming writable
• futex: Avoid private hash use-after-free on final put
• Bluetooth: hci_aml: validate firmware segment lengths
• Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
• Bluetooth: ISO: zero the sockaddr before returning it in getname
• Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_event: fix LE list UAF on reset
• HID: input: read battery capacity from its actual report offset
• HID: hyperv: validate initial device info bounds
• HID: uclogic: fix use-after-free of inrange_timer on remove
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: core: fix number/pointer type confusion on long items
• HID: rapoo: fix missing hid_is_usb() check
• HID: nintendo: stop device IO before hid_hw_stop on probe failure
• HID: nintendo: register input device after capabilities are set
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
• HID: huawei: fix missing hid_is_usb() check
• HID: asus: fix missing hid_is_usb() check
• futex: Fix might_sleep() warning in futex_pivot_pending()
• futex: Fix race on the initial mm->futex.phash.ref allocation
• futex: Fix race in futex_pivot_pending() during private hash resize
• futex/pi: Plug private futex exec() race
• futex: Sanitize and document task_struct::futex::state transitions
• futex/pi: Reject cross-mm private futex owners
• net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
• HID: pidff: fix OOB write when hid->inputs is empty
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• HID: magicmouse: re-enable multitouch after reset-resume
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
• mptcp: pm: fix memory leak from alloc-during-teardown race
• mptcp: pm: uniform announced addresses helpers
• mptcp: pm: rename add_entry structure to add_addr
• drm/amdgpu: Allocate coredump ring buffers per ring
• drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
• fbdev: serialize mode sysfs access with lock_fb_info()
• fbdev: Wrap user-invoked calls to fb_set_var() in helper
• nvmet: pci-epf: put CQ ref on create_cq mapping failure
• nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvmet-fc: fix invalid free in LS IOD error path
• nvmet-auth: zero the AUTH_RECEIVE response buffer
• dmaengine: fsl-edma: Add error handling for devm_kasprintf
• mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: nci: add data_len bound checks to activation parameter extractors
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• drm/xe: Fix DPT allocation paths.
• drm/i915: Introduce struct intel_fb_pin_params
• drm/i915: Track fence region ID in plane state
• drm/i915/pin: s/dev_priv/i915/ and drop struct drm_device usage
• xfs: restore nofs context unconditionally in xfs_trans_roll
• xfs: validate attr entry pointer before field access
• ext4: fix incorrect function call when initializing s_resgid
• ext4: don't enable DAX on new encrypted files
• ext4: propagate errors from fast commit range replay
• ext4: avoid tail write_begin walk for uptodate folios
• ext4: clear error before retrying inode xattr space fallback
• nilfs2: reject invalid block index in GC ioctl
• ext4: stop retrying saturated xattr cache entries
• kcov: fix data corruption and race conditions on PREEMPT_RT
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• io_uring: defer eventfd signaling when queued from a wakeup handler
• io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
• io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• io_uring/cmd: fix iovec leak when the async cmd is not recycled
• ALSA: dummy: Check card index validity at probe
• io_uring/futex: only mark private futex waits as inflight
• io_uring/futex: don't mark futex wake requests as inflight
• nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
• rndis_host: add overflow check in rndis_rx_fixup()
• ALSA: scarlett2: Use a private URB for the notification endpoint
• ALSA: FCP: Use a private URB for the notification endpoint
• iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
• iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
• xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error
• xfs: add a xchk_ip_set_corrupt helper
• xfs: don't livelock in scrub on a circular unlinked list
• xfs: hoist per-bucket unlinked list check to helper

84 commits in this release:

• Linux 7.2.1
• ptp: vmclock: prevent read-only mappings from becoming writable
• futex: Fix might_sleep() warning in futex_pivot_pending()
• Bluetooth: hci_aml: validate firmware segment lengths
• Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
• Bluetooth: ISO: zero the sockaddr before returning it in getname
• Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_event: fix LE list UAF on reset
• HID: input: read battery capacity from its actual report offset
• HID: hyperv: validate initial device info bounds
• HID: uclogic: fix use-after-free of inrange_timer on remove
• HID: sensor: custom: Fix use-after-free in enable_sensor
• HID: ft260: fix stack-use-after-return write in I2C read race
• HID: core: fix number/pointer type confusion on long items
• HID: rapoo: fix missing hid_is_usb() check
• HID: nintendo: stop device IO before hid_hw_stop on probe failure
• HID: nintendo: register input device after capabilities are set
• HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
• HID: huawei: fix missing hid_is_usb() check
• HID: asus: fix missing hid_is_usb() check
• net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
• HID: pidff: fix OOB write when hid->inputs is empty
• HID: core: fix OOB read of field->usage in hid_set_field()
• HID: magicmouse: do not keep a stale msc->input if no input is claimed
• HID: magicmouse: re-enable multitouch after reset-resume
• HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
• HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
• nvmet: pci-epf: put CQ ref on create_cq mapping failure
• nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
• nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
• nvmet-tcp: bound SGL data length before allocating command buffers
• nvmet-fc: fix invalid free in LS IOD error path
• nvmet-auth: zero the AUTH_RECEIVE response buffer
• dmaengine: fsl-edma: Add error handling for devm_kasprintf
• mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
• ipv6: fix use-after-free in ip6_finish_output2()
• ipv4: reject undersized MTUs in ip_do_fragment()
• nfc: nci: free destination parameters when closing a connection
• nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
• nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
• nfc: nci: add data_len bound checks to activation parameter extractors
• nfc: st21nfca: validate ATR_REQ length against the received frame
• nfc: pn533: purge fragmented skbs during cleanup
• nfc: llcp: reject PDUs shorter than the LLCP header
• nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
• nfc: llcp: bound the connect_sn TLV walk to the skb
• nfc: microread: validate target discovery payload lengths
• nfc: fdp: bound the device-reported read length and fix an skb leak
• nfc: digital: clamp SENSF_RES length to the destination buffer
• xfs: restore nofs context unconditionally in xfs_trans_roll
• xfs: validate attr entry pointer before field access
• ext4: fix incorrect function call when initializing s_resgid
• ext4: don't enable DAX on new encrypted files
• ext4: propagate errors from fast commit range replay
• ext4: avoid tail write_begin walk for uptodate folios
• ext4: clear error before retrying inode xattr space fallback
• nilfs2: reject invalid block index in GC ioctl
• ext4: stop retrying saturated xattr cache entries
• kcov: fix data corruption and race conditions on PREEMPT_RT
• null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
• ocfs2: fix missing metadata reservation for large xattrs
• io_uring: defer eventfd signaling when queued from a wakeup handler
• io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
• io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
• io_uring/io-wq: fix worker accounting when canceling creation callbacks
• io_uring/cmd: fix iovec leak when the async cmd is not recycled
• ALSA: dummy: Check card index validity at probe
• io_uring/futex: only mark private futex waits as inflight
• io_uring/futex: don't mark futex wake requests as inflight
• futex: Fix race on the initial mm->futex.phash.ref allocation
• futex: Avoid private hash use-after-free on final put
• futex/pi: Plug private futex exec() race
• futex: Sanitize and document task_struct::futex::state transitions
• futex/pi: Reject cross-mm private futex owners
• nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
• rndis_host: add overflow check in rndis_rx_fixup()
• ALSA: scarlett2: Use a private URB for the notification endpoint
• ALSA: FCP: Use a private URB for the notification endpoint
• iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages
• iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

The 120 most recent commits in this release — the full changelog is longer:

• Linux 7.1.10
• ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• spi: virtio: mark device ready before registering the controller
• drm/log: Fix infinite loop when scale is too large for display
• drm/log: Fix out-of-bounds read on empty message length
• drm/log: Fix division by zero when scale module parameter is 0
• drm/xe: Fix a bug in pc_adjust_freq_bounds()
• drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
• drm/xe/oa: Check managed mutex initialization errors
• drm/xe/oa: Fix sync entry leak on OA config emit failure
• drm/xe/pxp: add termination on resume
• firewire: ohci: fix NULL pointer dereference in ar_context_release
• l2tp: fix tunnel and session refcount leak on seq_file release
• net/sched: cls_bpf: reject dev-bound programs bound to a different device
• accel/amdxdna: Skip unmapped range in aie2_populate_range()
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• regmap: sdw-mbq: don't call an unset readable_reg callback
• m68k: Define NR_CPUS to 1
• pid: reject allocations through dead ancestor pid namespaces
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
• af_packet: Don't send zero-byte data in tpacket_snd().
• regmap: sdw-mbq: Fix swap of timeout and retry times
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
• net: tap: fix wrong transport_header when sending VLAN-tagged frame
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
• tcp: fix icsk_ack.ato bitfield overflow
• veth: fix queue index used to wake the peer txq in veth_poll
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
• eth: bnxt: decrease indent in bnxt_request_irq()
• eth: bnxt: keep the aRFS rmap updated when TPH is enabled
• eth: bnxt: cancel IRQ notifier before freeing affinity mask
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• ipvs: revalidate ihl to prevent out-of-bounds access
• netfilter: ipset: fix refcount race between list:set GC and swap
• tick: Include ktime.h and jiffies.h in linux/tick.h
• ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
• gpio: ml-ioh: share the register lock across channels
• rseq: Prevent hard lockup on granted time slice extension
• ovpn: defer key slot crypto freeing to workqueue
• ovpn: run deferred work on a module-owned workqueue
• riscv: lib: Fix ZBB strnlen reading past count boundary
• ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
• sctp: validate cookie AUTH state before use
• perf: Reject exited events as group leaders
• scsi: core: pair EH runtime PM get and put
• riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
• ovpn: finish crypto callback cleanup before peer release
• ovpn: fix NULL dereference when killing missing key
• af_unix: Unlink scc_entry in unix_del_edge().
• regulator: fp9931: Fix VPOS/VNEG voltage selector table
• gpiolib: Check gc->get_direction() before calling gpiod_get_direction()
• rhashtable: fix false-positive lockdep splat on rhltable destruction
• crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• clk: spacemit: k3: set hdma clock as critical
• clk: spacemit: k3: fix USB2 bus clock
• optee: ffa: Add NULL check in optee_ffa_lend_protmem
• clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
• ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
• net: expect instance lock in netdev_queue_get_dma_dev()
• net: rename netdev_ops_assert_locked()
• drm/amdkfd: Add bounds check for CRAT subtype length
• drm/mediatek: mtk_dsi: Enable HS clock only at pre-enable
• drm/mediatek: Convert legacy DRM logging to drm_* helpers in mtk_dsi.c
• ASoC: tas2562: Validate values for volume writes
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: avoid fs reclaim while using current->journal_info
• xfs: check v5 superblock features early
• xfs: check xfarray iteration errors when committing unlinked inode lists
• xfs: don't ignore runtime errors in xrep_iunlink_reload_next
• xfs: don't swallow dquot recovery verification errors
• xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
• xfs: avoid UAF on sc->tempip in xrep_tempfile_create
• xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
• xfs: fix another iunlink infinite loop bug in online fsck
• xfs: fix allocated inodes that show up in the unlinked list
• xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
• xfs: don't zap the attr fork on repair when there are queued pptr updates
• xfs: fix ilock leak on error in xfs_dq_get_next_id
• xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
• xfs: nlink scrub must take IOLOCK before determining ILOCK state
• xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
• xfs: set the prev pointer when reinserting an inode on the unlinked list
• xfs: don't double-lock when deleting a self-referential directory
• xfs: only check mergeability of bnobt records
• xfs: zero i_nlink before repair puts inode on unlinked list
• xfs: fix transaction block reservation in xrep_rtbitmap
• xfs: check cowextsize in xrep_inode_cowextsize
• xfs: clear zapped attr fork state when bmap repair finds no attr fork
• xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
• xfs: bounds-check buffer log item's dirty bitmap
• xfs: fix off-by-one in rtrefcount btree root level validation
• xfs: propagate errors from xfs_rtginode_load
• drm/amdgpu: disallow multiple FENCE chunks in one submit
• drm/amdgpu: Fix UVD decode image min size calculation
• drm/amdgpu: Fix UVD dpb min size calculation for H264
• drm/amdgpu: Fix UVD min buffer sizes
• drm/amdgpu: Implement insert_end for VCE 3
• drm/amdgpu: Reject UVD message with dimensions above 4096
• drm/amdgpu: validate GEM_CREATE domain combinations
• drm/amdgpu: check ASPM on the dGPU host link
• drm/amdgpu: fix missing check in vm_flush()
• drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
• drm/amdgpu: Prefer default discovery offset
• drm/amdgpu: Reject UVD message with invalid number of h265 refs
• drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
• drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
• drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
• s390/zcrypt: Pad trailing CCA or EP11 message with zeros

The 107 most recent commits in this release — the full changelog is longer:

• Linux 7.1.9
• thunderbolt: Fix bandwidth group reservation indexing
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• fsverity: Fix silent truncation in bpf_get_fsverity_digest()
• fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
• mm/filemap: __filemap_add_folio() restore index before retrying
• ima: Instantiate file_truncate and path_truncate hooks
• sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
• sched/psi: Create the psimon kthread outside of cgroup_mutex
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
• fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• mm/ptdump: always stabilise against page table freeing using init_mm
• mm/page_table_check: skip special zero mappings
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
• ptp: ocp: Fix board ID over-read
• Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• ring-buffer: Prevent resizing of persistent ring buffer
• eventfs: Use children field for rcu head and add memory barriers
• eventfs: Fix use-after-free in eventfs_remove_rec()
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
• smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• tls: don't leave a full plaintext sk_msg ring unpushed
• tls: rx: restore msg_iter before TLS 1.3 optimistic retry
• vhost: reset the vring metadata cache on vring reconfiguration
• veth: fix skb length accounting after XDP frag adjustment
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• x86/mce: Set up the polling timer before CMCI discovery
• x86/CPU: Add a tlbi= cmdline switch
• arm64: remove redundant concurrent ptdump UAF mitigation
• dibs: initialise dibs->lock in dibs_dev_alloc()
• Revert "drm/amdgpu: fix aperture mapping leak"
• binfmt_misc: don't warn when the mount is completed from another user namespace
• ovl: don't warn when the mount is completed from another user namespace
• net/sched: act_gact, act_police: range check the fallback control action
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: bridge: release template ct on non-IP path
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• net: devmem: prevent net-iov / page mixing
• net/x25: fix use-after-free of the socket by its timers
• net/dibs: Correct freeing of dmb_clientid_arr
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• net: phy: mediatek: fix TX blink masks using the RX bits
• mm/huge_memory: fix huge_zero_pfn race
• mm/huge_memory: initialise workingset state before folio split
• tracing: Fix NULL pointer dereference in module event cache removal
• ring-buffer: Prevent subbuf order change when resizing is disabled
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• perf/core: Fix group leader use-after-free after sibling detach
• drm/v3d: Serialize the scheduler timeout handlers
• ALSA: us144mkii: re-anchor capture URBs on resubmission
• ALSA: hda/tas2781: fix ACPI reference handling
• ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
• mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
• samples/damon/mtier: error out for zero quota goal target values
• mm/damon/ops-common: putback folios on invalid migrate nid
• mm/damon/lru_sort: error out for >10000 active_mem_bp
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: amba-pl011: synchronize DMA teardown
• serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
• serial: amba-pl011: fix indefinite RS485 post-send delay
• serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
• serial: 8250_dma: Clear stale RX state on shutdown
• serial: sc16is7xx: enable THRI before filling TX FIFO
• serial: qcom-geni: fix TX DMA buffer flush
• rust_binder: do not query current thread for all ioctls
• nvmem: layouts: Add fixed-layout driver
• nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
• mei: pull kvfree out of spinlock
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Adapt sockmap update error handling
• selftests/bpf: Ensure UDP sockets are bound
• Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
• Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
• selftests/xsk: acc

The 119 most recent commits in this release — the full changelog is longer:

• Linux 7.2
• wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
• Revert "i2c: designware: defer probe if child GpioInt controllers are not bound"
• drbd: don't leak the shared secret to unprivileged netlink dumps
• openrisc: signal: do not restore privileged SR bits on sigreturn
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• sched: Update time before requeueing delayed entities
• tracing: Fix race between update_event_fields and, event_define_fields
• tracing: Fix NULL pointer dereference in module event cache removal
• spi: virtio: mark device ready before registering the controller
• Revert "wifi: mt76: Disable napi when removing device"
• drm/log: Fix infinite loop when scale is too large for display
• drm/log: Fix out-of-bounds read on empty message length
• drm/log: Fix division by zero when scale module parameter is 0
• drm/xe: Fix xe_device_probe() failure
• drm/xe: Fix a bug in pc_adjust_freq_bounds()
• drm/xe/oa: Check managed mutex initialization errors
• drm/xe/oa: Fix sync entry leak on OA config emit failure
• drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
• drm/xe/pxp: add termination on resume
• drm/xe: Order ring writes before ring tail updates
• drm/xe/guc_ads: use uncached mapping for UM queue BO
• drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
• drm/xe/guc_ads: allocate UM queues in a separate BO
• drm/xe: Fix DPT allocation paths.
• firewire: ohci: fix NULL pointer dereference in ar_context_release
• l2tp: fix tunnel and session refcount leak on seq_file release
• net/sched: cls_bpf: reject dev-bound programs bound to a different device
• accel/amdxdna: Skip unmapped range in aie2_populate_range()
• io_uring/rsrc: reject overflowing regvec bvec byte counts
• sctp: fix use-after-free of cached ASCONF chunk
• Input: sur40 - fix V4L error path cleanup
• Input: sur40 - fix input device registration ordering
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• sctp: clear new_transport when removing a peer
• net/dibs: Correct freeing of dmb_clientid_arr
• ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls
• ceph: fix MDS random selection readiness predicate
• libceph: Avoid using invalid osd indices from primary_temp
• libceph: fix OOB read in decode_watchers() via missing bounds check
• libceph: fix multiple unsafe decodes in decode_locker()
• libceph: tolerate addrvecs with multiple entries of the same type
• regmap: sdw-mbq: don't call an unset readable_reg callback
• clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer
• drm/amdgpu: Prefer default discovery offset
• drm/amdgpu: Reject UVD message with invalid number of h265 refs
• drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
• drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
• drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
• drm/amdgpu: Implement insert_end for VCE 3
• drm/amdgpu: Fix UVD min buffer sizes
• drm/amdgpu: Fix UVD decode image min size calculation
• drm/amdgpu: Fix UVD dpb min size calculation for H264
• drm/amdgpu: Reject UVD message with dimensions above 4096
• drm/amdgpu: check ASPM on the dGPU host link
• drm/radeon: fix autosuspend cleanup during teardown
• drm/amdgpu: fix missing check in vm_flush()
• drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
• drm/amdgpu: validate GEM_CREATE domain combinations
• drm/amdgpu: disallow multiple FENCE chunks in one submit
• m68k: Define NR_CPUS to 1
• pid: reject allocations through dead ancestor pid namespaces
• pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• gve: fix NULL dereference due to missing ptp adjfine
• gve: fix zero-length skb frag with header-split
• net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
• af_packet: Don't send zero-byte data in tpacket_snd().
• drm/sched: Mark fair policy as experimental
• Revert "drm/sched: Switch default policy to fair"
• Revert "drm/sched: Remove FIFO and RR and simplify to a single run queue"
• Revert "drm/sched: Embed run queue singleton into the scheduler"
• Revert "accel/amdxdna: Remove drm_sched_init_args->num_rqs usage"
• Revert "accel/rocket: Remove drm_sched_init_args->num_rqs usage"
• Revert "accel/ethosu: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/amdgpu: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/etnaviv: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/imagination: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/lima: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/msm: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/nouveau: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/panfrost: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/panthor: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/sched: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/v3d: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/xe: Remove drm_sched_init_args->num_rqs usage"
• Revert "drm/sched: Remove drm_sched_init_args->num_rqs"
• ASoC: Intel: NVL: Add entry for HDMI-In capture support to non-I2S codec boards.
• regmap: sdw-mbq: Fix swap of timeout and retry times
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
• tipc: read le->link under the node lock in tipc_node_link_down()
• ASoC: tac5xx2-sdw: select REGMAP_SOUNDWIRE_MBQ
• selftests: tls: cover splice after a failed decrypt
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
• net: tap: fix wrong transport_header when sending VLAN-tagged frame
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza
• vxlan: do not arm the ageing timer on a device that is down
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• selftests: tc-testing: add act_ct test for malformed header handling
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
• tcp: fix icsk_ack.ato bitfield overflow
• net/sched: act_gact, act_police: range check the fallback control action
• veth: fix queue index used to wake the peer txq in veth_poll
• net: expect instance lock in netdev_queue_get_dma_dev()
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
• eth: bnxt: decrease indent in bnxt_request_irq()
• eth: bnxt: keep the aRFS rmap updated when TPH is enabled
• eth: bnxt: cancel IRQ notifier before freeing affinity mask
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

The 120 most recent commits in this release — the full changelog is longer:

• Linux 7.1.8
• usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
• drm/amd/display: Exit idle optimizations before programming
• drm/amd/display: check GRPH_FLIP status before sending event
• media: chips-media: wave5: Support CBP profile
• drm/xe: Wait on external BO kernel fences in exec IOCTL
• drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
• drm/xe: Set TTM device beneficial_order to 9 (2M)
• drm/xe: Separate early xe_device initialization
• drm/xe: Move xe->info.devid|revid initialization
• drm/xe: Move xe->info.force_execlist initialization
• drm/xe: Drop unused param from xe_device_create()
• usb: typec: ucsi: Fix race condition and ordering in port unregistration
• usb: typec: ucsi: split connector lock classes
• drm/xe/rtp: Ensure locking/ref counting for OA whitelists
• drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
• drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
• drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
• drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
• drm/xe/rtp: Generalize whitelist_apply_to_hwe
• drm/xe/rtp: Keep track of non-OA nonpriv slots
• drm/xe/rtp: Maintain OA whitelists separately
• drm/vmwgfx: validate external BO copy bounds for both stride paths
• drm/vmwgfx: use check_add_overflow for shader size+offset bound
• drm/vmwgfx: enforce cursor size limits for MOB cursors
• drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
• drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
• drm/vmwgfx: clamp dirty-page range with min, not max
• drm/vmwgfx: reject DX_BIND_QUERY without a DX context
• drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
• drm/amdkfd: hold event_mutex while checkpointing CRIU events
• drm/amdkfd: Handle invalid event type in CRIU event restore
• drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
• drm/amdkfd: fix QID bit leak in pqm_create_queue()
• drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
• drm/amd/display: use proper context for logging
• drm/amd/display: Silence link_dpms I2C retimer failures
• drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
• drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
• drm/amd/display: check if dml21_add_phantom_plane() is successful
• drm/amd/pm: use milliwatts for GPU power sensors
• drm/amd/pm: hide pp_table sysfs on APUs
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: fix torn gpu metrics reads
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/amdgpu: restore UMD profile pstate after runtime resume
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
• drm/mediatek: ovl_adaptor: balance component registrations
• drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
• drm/panthor: validate firmware interface structure sizes
• drm/panthor: reject firmware sections with oversized data
• drm/bridge: display-connector: Fix I2C adapter resource leak
• drm/vc4: Zero the tile state data array before each BIN job
• drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
• drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
• can: ctucanfd: mark error-active controller status valid
• can: ctucanfd: handle bus error interrupts
• can: ctucanfd: unmap BAR0 using base address
• can: ctucanfd: use self-test mode for PRESUME_ACK
• can: ctucanfd: add missing MODULE_DEVICE_TABLE()
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: rcar_canfd: change the initializing flow for clocks and resets
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
• can: ems_usb: validate CPC message lengths
• can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
• i2c: imx: Cancel hrtimer before clearing slave pointer
• i2c: imx: Fix slave registration race and error handling
• i2c: imx: mark I2C adapter when hardware is powered down
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
• i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
• i2c: spacemit: request IRQ after controller initialization
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: fix VF interrupts cleanup
• ice: wait for reset completion in ice_resume()
• net: openvswitch: fix skb leak on flow key update failure during ct
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• net: openvswitch: fix potential UAF on meter attach failure
• phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
• phy: zynqmp: use read-modify-write for SERDES scrambler bypass
• phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
• s390/zcrypt: Validate length for CCA ECC private key requests
• s390/zcrypt: Validate length for CCA AES cipher key requests
• s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
• s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
• s390/zcrypt: Close speculative mem read possibility
• s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
• s390/dasd: Fix undersized format-check buffer
• s390/dasd: Fix potential NULL pointer dereference
• s390/qeth: Check CAP_NET_ADMIN for private ioctls
• s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
• power: supply: max17040: handle missing status supplier
• power: supply: macsmc: Support macOS 27 SMC firmware
• power: supply: bq25890: fix the -10 C NTC lookup entry
• cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
• cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
• cpufreq: cppc: Sanitize lockless policy limit snapshots
• cifs: add fscache_resize_cookie() to cifs_setsize()
• gpio: pch: use raw_spinlock_t for the register lock
• gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
• gpiolib: tolerate gpio-hogs lacking a hogging state
• i2c: amd-mp2: Unregister callback on adapter add failure
• hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
• hwmon: (npcm750-pwm-fan): stop fan timer on device detach
• sctp: prevent peer transport count overflow
• sctp: reject stale cookies with mismatched verification tags
• scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

2 commits in this release:

• Linux 7.1.7
• x86/bugs: Make Safe-RET robust against interrupt injection

The 116 most recent commits in this release — the full changelog is longer:

• Linux 7.1.6
• cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
• cifs: fix time_last_write stamp placement in setattr/truncate paths
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
• selftests: drv-net: so_txtime: relax variance bounds
• selftests: drv-net: cope with slow env in so_txtime.py test
• sched_ext: Preserve rq tracking across local DSQ dispatch
• sched_ext: Move shared helpers from ext.c into internal.h and cid.h
• bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
• bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
• net: mana: Optimize irq affinity for low vcpu configs
• mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
• mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths
• SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
• SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
• xfs: don't replace the wrong part of the cow fork
• fuse-uring: fix race between registration and connection abortion
• audit: fix recursive locking deadlock in audit_dupe_exe()
• audit: use 'unsigned int' instead of 'unsigned'
• drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
• ksmbd: validate ACE size against SID sub-authorities
• ksmbd: bound DACL dedup walk to copied ACEs
• ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
• ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
• selftests: drv-net: add missing kconfig for psp.py
• drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
• drm/amd/pm: fix smu13 power limit range calculation
• drm/amdgpu: fix aperture mapping leak
• drm/amdgpu: reject mapping a reserved doorbell to a new queue
• drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
• drm/amdgpu: fix resource leak on ACP reset timeout
• drm/amdgpu: Fix kernel panic during driver load failure
• drm/amdgpu: fix division by zero with invalid uvd dimensions
• drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
• drm/amdgpu/vcn4: avoid rereading IB param length
• drm/amdgpu/vce: fix integer overflow in image size
• drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
• drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
• drm/amdgpu/mes11: set doorbell offset for suspending userq
• drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
• drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
• drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
• drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
• drm/amdgpu/gfx8: drop unecessary BUG_ON()
• drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
• drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq
• drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
• drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
• drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
• drm/amd/pm: make pp_features read-only when scpm is enabled
• drm/amd/pm: fix amdgpu_pm_info power display units
• watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
• vxlan: mdb: Fix source list corruption on a failed replace
• vsock/virtio: collapse receive queue under memory pressure
• tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
• tcp: challenge ACK for non-exact RST in SYN-RECEIVED
• tcp: initialize standalone TCP-AO response padding
• rtase: Workaround for TX hang caused by hardware packet parsing
• pppoe: reload header pointer after dev_hard_header()
• ovpn: hold peer before scheduling keepalive work
• ovpn: fix peer refcount leak in TCP error paths
• openvswitch: fix GSO userspace truncation underflow
• mctp: serial: handle zero-length frames to prevent rx buffer overflow
• mac802154: llsec: reject frames shorter than the authentication tag
• mac802154: hold an interface reference across the scan worker
• ila: reload IPv6 header after pskb_may_pull in checksum adjust
• ice: use READ_ONCE() to access cached PHC time
• ice: reject out-of-range ptype in ice_parser_profile_init
• gve: fix Rx queue stall on alloc failure
• ksmbd: validate minimum PDU size for transform requests
• ksmbd: defer destroy_previous_session() until after NTLM authentication
• smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target
• rbd: Reset positive result codes to zero in object map update path
• super: fix emergency thaw deadlock on frozen block devices
• ice: fix PTP Call Trace during PTP release
• ptp: ptp_s390: Add missing facility check
• s390/ptff: Export ptff_function_mask[]
• proc: Fix broken error paths for namespace links
• net: qrtr: ns: Raise node count limit to 512
• net: pcs: xpcs: fix SGMII state reading
• net: hip04: fix RX buffer leak on build_skb failure
• net: gro: fix double aggregation of flush-marked skbs
• net/x25: fix use-after-free in x25_kill_by_neigh()
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• net/mlx5e: Use sender devcom for MPV master-up
• net/iucv: fix use-after-free of a severed iucv_path
• net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
• geneve: require CAP_NET_ADMIN in the device netns for changelink
• net: slip: serialize receive against buffer reallocation
• vxlan: require CAP_NET_ADMIN in the device netns for changelink
• phonet: pep: fix use-after-free in pep_get_sb()
• net: stmmac: intel: skip SerDes reconfig when rate is unchanged
• mm/slab: fix a memory leak due to bootstrapping sheaves twice
• mm/slub: fix lost local objects when bulk remote free batch fills
• iommu/vt-d: Disallow SVA if page walk is not coherent
• iomap: fix out-of-bounds bitmap_set() with zero-length range
• io_uring/rw: fix missing ERESTARTSYS conversion in read paths
• ftrace: Add global mutex to serialize trace_parser access
• fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
• fscrypt: Add missing superblock check in find_or_insert_direct_key()
• fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
• fs/super: fix emergency thaw double-unlock of s_umount
• binfmt_elf_fdpic: only honour the first PT_INTERP
• ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
• ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
• amt: fix use-after-free in AMT delayed works
• libceph: remove debugfs files before client teardown
• libceph: reject zero bucket types in crush_decode
• libceph: Reject monmaps advertising zero monitors
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update
• libceph: guard missing CRUSH type name lookup
• libceph: fix two unsafe bare decodes in decode_lockers()
• libceph: Fix multiplication overflow in decode_new_up_state_weight()
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: bound get_version reply decode to front len
• ceph: fix writeback_count leak in write_folio_nounlock()

The 120 most recent commits in this release — the full changelog is longer:

• Linux 7.1.5
• Revert "gpib: cb7210: Fix region leak when request_irq fails"
• posix-cpu-timers: Prevent UAF caused by non-leader exec() race
• posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
• drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
• iomap: consolidate bio submission
• exfat: fix implicit declaration of brelse()
• exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
• exfat: add balloc parameter to exfat_map_cluster() for iomap support
• exfat: replace unsafe macros with static inline functions
• crypto: xilinx-trng - Remove crypto_rng interface
• liveupdate: validate session type before performing operation
• usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
• usb: atm: ueagle-atm: remove function entry/exit debug messages
• usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
• xfs: add newly added RTGs to the free pool in growfs
• xfs: factor out a xfs_zone_mark_free helper
• ksmbd: use opener credentials for FSCTL mutations
• smb: move compression definitions into common/fscc.h
• ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
• Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
• binder: cache secctx size before release zeroes it
• binder: Use LIST_HEAD() to initialize on stack list head
• ALSA: hda/tas2781: Cancel async firmware request at unbind
• firmware_loader: Add cancel helper for async requests
• ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
• ALSA: scarlett2: Allow selecting config_set by firmware version
• iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
• f2fs: fix listxattr handling of corrupted xattr entries
• f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
• f2fs: fix potential deadlock in f2fs_balance_fs()
• device property: initialize the remaining fields of fwnode_handle in fwnode_init()
• samples/damon/mtier: fail early if address range parameters are invalid
• mm/damon/core: trace esz at first setup
• bpf: Reject negative const offsets for buffer pointers
• mmc: sdhci-esdhc-imx: fix resume error handling
• mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
• mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
• mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
• mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
• mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
• mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
• mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
• mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
• mmc: block: fix RPMB device unregister ordering
• mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
• mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
• mtd: rawnand: fsl_ifc: return errors for failed page reads
• mmc: vub300: defer reset until cmd_mutex is unlocked
• mtd: mchp23k256: use SPI match data for chip caps
• mtd: onenand: samsung: report DMA completion timeouts
• mtd: virt-concat: free duplicate generated name
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations
• wifi: mac80211: validate extension-frame layout before RX
• wifi: mac80211: free ack status frame on TX header build failure
• wifi: ieee80211: validate MLE common info length
• wifi: cfg80211: validate EHT MLE before MLD ID read
• powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()
• powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
• reset: sunxi: fix memory region leak on ioremap failure
• reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
• ipvs: reload ip header after head reallocation
• ipvs: fix more places with wrong ipv6 transport offsets
• memstick: ms_block: reject a card that reports too many blocks
• macsec: fix promiscuity refcount leak in macsec_dev_open()
• llc: fix SAP refcount leak when creating incoming sockets
• crypto: aes - Fix conditions for selecting MAC dependencies
• Bluetooth: btrtl: validate firmware patch bounds
• net: openvswitch: reject oversized nested action attrs
• regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
• arch/riscv: vdso: remove CFI landing pad from rt_sigreturn
• riscv: vdso: Do not use LTO for the vDSO
• wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
• wifi: mac80211: fix memory leak in ieee80211_register_hw()
• wifi: mwifiex: fix roaming to different channel in host_mlme mode
• wifi: rt2x00: avoid full teardown before work setup in probe
• net/mlx5: free mlx5_st_idx_data on final dealloc
• powerpc/pseries: fix memory leak on krealloc failure in papr_init
• mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
• selftests/landlock: Fix screwed up pointers in the scoped_signal_test
• selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available
• pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
• pmdomain: imx: Fix i.MX8MP power notifier
• pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
• pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
• cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
• selftests/rseq: Fix a building error for riscv arch
• s390/mm: Fix type mismatch in get_align_mask().
• s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()
• tracing/osnoise: Call synchronize_rcu() when unregistering
• riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
• drbd: reject data replies with an out-of-range payload size
• ata: libata-core: Allow capacity transition to zero for locked drives
• ata: libata-core: Skip HPA resize for locked drives
• fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
• fs/resctrl: Free mon_data structures on rdt_get_tree() failure
• cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
• arm64: smp: Fix hot-unplug tearing by forcing unregistration
• amdkfd: properly free secondary context id
• net: macb: drop in-flight Tx SKBs on close
• dibs: loopback: validate offset and size in move_data()
• macsec: don't read an unset MAC header in macsec_encrypt()
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
• ipvs: use parsed transport offset in SCTP state lookup
• llc: fix SAP refcount leak in llc_ui_autobind()
• selftests: net: make busywait timeout clock portable
• octeontx2-pf: fix SQB pointer leak on init failure
• mac802154: remove interfaces with RCU list deletion
• s390/monwriter: Reject buffer reuse with different data length
• irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
• mm/compaction: handle free_pages_prepare() properly in compaction_free()
• riscv: probes: save original sp in rethook trampoline
• hwmon: (asus_atk0110) Check package count before accessing element
• net: ipa: fix SMEM state handle leaks in SMP2P init
• net: wwan: iosm: bound device offsets in the MUX downlink decoder
• ata: libata-core: Reject an invalid concurrent positioning ranges count
• ata: pata_pxa: Fix DMA channel leak on probe error
• ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
• net/mlx5: HWS, fix matcher leak on resize target setup failure

43 commits in this release:

• Linux 7.0.14
• virtiofs: fix UAF on submount umount
• media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
• ksmbd: reject non-VALID session in compound request branch
• drivers/base/memory: set mem->altmap after successful device registration
• serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
• serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
• vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
• crypto: qat - remove unused character device and IOCTLs
• iio: adc: ti-ads1298: add bounds check to pga_settings index
• iio: light: veml6075: add bounds check to veml6075_it_ms index
• net: net_failover: Fix the deadlock in slave register
• net: export netif_open for self_test usage
• rose: don't free fd-owned sockets when reaping in the heartbeat
• rose: clear neighbour pointer in rose_kill_by_device()
• rose: cancel neighbour timers in rose_neigh_put() before freeing
• rose: drop CALL_REQUEST in loopback timer when device is not running
• rose: release netdev ref and destroy orphaned incoming sockets
• rose: fix netdev double-hold in rose_make_new()
• rose: disconnect orphaned STATE_2 sockets when device is gone
• rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
• rose: fix notifier unregistered too early in rose_exit()
• rose: fix netdev double-hold in rose_rx_call_request()
• rose: guard rose_neigh_put() against NULL in timer expiry
• rose: clear neighbour pointer after rose_neigh_put() in state machines
• rose: fix race between loopback timer and module removal
• rose: hold loopback neighbour reference across timer callback
• rose: fix dev_put() leak in rose_loopback_timer()
• agp/amd64: Fix broken error propagation in agp_amd64_probe()
• net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
• i2c: stub: Reject I2C block transfers with invalid length
• bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
• RDMA/bnxt_re: zero shared page before exposing to userspace
• Revert "NFSD: Defer sub-object cleanup in export put callbacks"
• fuse: re-lock request before replacing page cache folio
• firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
• firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
• firmware: samsung: acpm: Fix cross-thread RX length corruption
• firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
• firmware: exynos-acpm: Count number of commands in acpm_xfer
• lockd: fix TEST handling when not all permissions are available.
• arm64/entry: Fix arm64-specific rseq brokenness
• io_uring/net: Avoid msghdr on op_connect/op_bind async data