# Linux Kernel: what changed from 6 to 7

- Product: Linux Kernel (https://whatsnew.fyi/product/linux-kernel)
- Vendor: Linux Kernel Organization
- Range: changelog entries numbered after 6.18.49 up to and including 7.2.3, stable releases only
- Entries below: 14 releases (newest first)
- Resolved: 6 is 6.18.49 and 7 is 7.2.3, the newest stable release of each major we track
- Carrying security changes: 1 · CVEs mentioned: 0 · Mentioning breaking changes: 0 · Removing or deprecating something: 5
- Page: https://whatsnew.fyi/product/linux-kernel/compare/6...7

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (188 changes, grouped by kind)

### Added

#### 7.1.13 (2026-09-02)

- usb: core: Add lock to usb_wakeup_notification() (also in 7.2.3)

#### 7.1.10 (2026-08-23)

- drm/xe/pxp: add termination on resume

#### 7.1.9 (2026-08-19)

- ima: Instantiate file_truncate and path_truncate hooks

#### 7.1.8 (2026-08-09)

- media: chips-media: wave5: Support CBP profile

#### 7.1.5 (2026-07-24)

- exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
- firmware_loader: Add cancel helper for async requests

### Changed

#### 7.1.13 (2026-09-02)

- usb: core: Strengthen error handling in hub_hub_status() (also in 7.2.3)
- crypto: qcom-rng - Allow zero as a random number

#### 7.2.3 (2026-09-02)

- crypto: krb5 - use kfree_sensitive() for derived key buffers

#### 7.1.10 (2026-08-23)

- drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
- m68k: Define NR_CPUS to 1

#### 7.2 (2026-08-16)

- sched: Update time before requeueing delayed entities
- drm/xe/guc_ads: use uncached mapping for UM queue BO
- drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
- drm/xe/guc_ads: allocate UM queues in a separate BO

#### 7.1.8 (2026-08-09)

- drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
- drm/xe: Set TTM device beneficial_order to 9 (2M)
- drm/xe: Separate early xe_device initialization
- usb: typec: ucsi: split connector lock classes

#### 7.1.5 (2026-07-24)

- posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
- iomap: consolidate bio submission
- exfat: add balloc parameter to exfat_map_cluster() for iomap support
- exfat: replace unsafe macros with static inline functions
- usb: atm: ueagle-atm: use dev_dbg() for 'device found' message

#### 7.0.14 (2026-06-27)

- net: export netif_open for self_test usage

### Fixed

#### 7.1.13 (2026-09-02)

- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (also in 7.2.3)
- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (also in 7.2.3)
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (also in 7.2.3)
- USB: serial: option: fix slab OOB read in interrupt URB callback (also in 7.2.3)
- ALSA: usb-audio: Complete cleanup after system-resume errors (also in 7.2.3)
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (also in 7.2.3)
- ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB (also in 7.2.3)
- KVM: s390: vsie: zero stale crypto bits (also in 7.2.3)
- crypto: mxs-dcp - fix source scatterlist length access (also in 7.2.3)
- crypto: iaa - fall back to software for multi-entry scatterlists (also in 7.2.3)
- crypto: qce - fix CCM AAD buffer underallocation (also in 7.2.3)
- crypto: krb5 - use kfree_sensitive() for derived key buffers
- crypto: atmel-tdes - use scatterlist length before DMA mapping (also in 7.2.3)
- crypto: qcom-rng - Enable clock in hwrng case

#### 7.1.12 (2026-08-28)

- Strip GSO state from fragments before reassembly in inet frags (also in 7.2.2)

#### 7.1.11 (2026-08-27)

- ptp: vmclock: prevent read-only mappings from becoming writable
- futex: Avoid private hash use-after-free on final put
- Bluetooth: hci_aml: validate firmware segment lengths
- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- Bluetooth: ISO: zero the sockaddr before returning it in getname (also in 7.2.1)
- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (also in 7.2.1)
- Bluetooth: hci_sync: Fix accept list UAF during suspend
- Bluetooth: hci_event: validate LE Set CIG Parameters response
- Bluetooth: hci_event: fix LE list UAF on reset
- HID: input: read battery capacity from its actual report offset (also in 7.2.1)
- HID: hyperv: validate initial device info bounds
- HID: uclogic: fix use-after-free of inrange_timer on remove
- HID: sensor: custom: Fix use-after-free in enable_sensor
- HID: ft260: fix stack-use-after-return write in I2C read race
- HID: core: fix number/pointer type confusion on long items
- HID: rapoo: fix missing hid_is_usb() check
- HID: nintendo: stop device IO before hid_hw_stop on probe failure (also in 7.2.1)
- HID: nintendo: register input device after capabilities are set (also in 7.2.1)
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- HID: huawei: fix missing hid_is_usb() check

#### 7.2.1 (2026-08-27)

- futex: Fix might_sleep() warning in futex_pivot_pending()

#### 7.1.10 (2026-08-23)

- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP
- erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms (also in 7.2)
- spi: virtio: mark device ready before registering the controller (also in 7.2)
- drm/log: Fix infinite loop when scale is too large for display (also in 7.2)
- drm/log: Fix out-of-bounds read on empty message length (also in 7.2)
- drm/log: Fix division by zero when scale module parameter is 0 (also in 7.2)
- drm/xe: Fix a bug in pc_adjust_freq_bounds() (also in 7.2)
- drm/xe/oa: Check managed mutex initialization errors (also in 7.2)
- drm/xe/oa: Fix sync entry leak on OA config emit failure (also in 7.2)
- firewire: ohci: fix NULL pointer dereference in ar_context_release (also in 7.2)
- l2tp: fix tunnel and session refcount leak on seq_file release
- net/sched: cls_bpf: reject dev-bound programs bound to a different device
- accel/amdxdna: Skip unmapped range in aie2_populate_range()
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- regmap: sdw-mbq: don't call an unset readable_reg callback

#### 7.1.9 (2026-08-19)

- thunderbolt: Fix bandwidth group reservation indexing
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- sctp: clear new_transport when removing a peer
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: keep chunk->transport in step with the list it is queued on
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- mm/filemap: __filemap_add_folio() restore index before retrying
- sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
- sched/psi: Create the psimon kthread outside of cgroup_mutex
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- ipv6: fix Route Information option length validation
- mm/ptdump: always stabilise against page table freeing using init_mm
- mm/page_table_check: skip special zero mappings
- ring-buffer: Use current_context for safe per-CPU buffer swap

#### 7.2 (2026-08-16)

- wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
- drbd: don't leak the shared secret to unprivileged netlink dumps
- openrisc: signal: do not restore privileged SR bits on sigreturn
- tracing: Fix race between update_event_fields and event_define_fields
- tracing: Fix NULL pointer dereference in module event cache removal
- drm/xe: Fix xe_device_probe() failure
- drm/xe: Order ring writes before ring tail updates

#### 7.1.8 (2026-08-09)

- usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
- drm/amd/display: Exit idle optimizations before programming
- drm/amd/display: check GRPH_FLIP status before sending event
- drm/xe: Wait on external BO kernel fences in exec IOCTL
- usb: typec: ucsi: Fix race condition and ordering in port unregistration
- drm/vmwgfx: validate external BO copy bounds for both stride paths
- drm/vmwgfx: use check_add_overflow for shader size+offset bound
- drm/vmwgfx: enforce cursor size limits for MOB cursors
- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- drm/vmwgfx: bound DMA command body size against suffix pointer
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
- drm/vmwgfx: clamp dirty-page range with min, not max
- drm/vmwgfx: reject DX_BIND_QUERY without a DX context

#### 7.1.7 (2026-08-06)

- Make Safe-RET robust against interrupt injection

#### 7.1.6 (2026-08-03)

- cifs: fix time_last_write stamp placement in setattr/truncate paths
- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
- bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
- mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
- SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
- xfs: don't replace the wrong part of the cow fork
- fuse-uring: fix race between registration and connection abortion
- audit: fix recursive locking deadlock in audit_dupe_exe()
- ksmbd: validate ACE size against SID sub-authorities
- ksmbd: bound DACL dedup walk to copied ACEs
- drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
- drm/amd/pm: fix smu13 power limit range calculation
- drm/amdgpu: fix aperture mapping leak
- drm/amdgpu: reject mapping a reserved doorbell to a new queue
- drm/amdgpu: fix resource leak on ACP reset timeout
- drm/amdgpu: Fix kernel panic during driver load failure
- drm/amdgpu: fix division by zero with invalid uvd dimensions
- drm/amdgpu/vce: fix integer overflow in image size
- drm/amdgpu/mes11: set doorbell offset for suspending userq
- tcp: challenge ACK for non-exact RST in SYN-RECEIVED

#### 7.1.5 (2026-07-24)

- posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
- exfat: fix implicit declaration of brelse()
- liveupdate: validate session type before performing operation
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- ksmbd: use opener credentials for FSCTL mutations
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- binder: cache secctx size before release zeroes it
- ALSA: hda/tas2781: Cancel async firmware request at unbind
- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417

#### 7.0.14 (2026-06-27)

- virtiofs: fix UAF on submount umount
- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- ksmbd: reject non-VALID session in compound request branch
- drivers/base/memory: set mem->altmap after successful device registration
- serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- iio: adc: ti-ads1298: add bounds check to pga_settings index
- iio: light: veml6075: add bounds check to veml6075_it_ms index
- net: net_failover: Fix the deadlock in slave register
- rose: don't free fd-owned sockets when reaping in the heartbeat
- rose: clear neighbour pointer in rose_kill_by_device()
- rose: cancel neighbour timers in rose_neigh_put() before freeing
- rose: drop CALL_REQUEST in loopback timer when device is not running
- rose: release netdev ref and destroy orphaned incoming sockets
- rose: fix netdev double-hold in rose_make_new()
- rose: disconnect orphaned STATE_2 sockets when device is gone
- rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup

### Removed

#### 7.1.13 (2026-09-02)

- USB: serial: spcp8x5: drop broken carrier detect support (also in 7.2.3)
- crypto: qce - Remove unsafe/deprecated algorithms (also in 7.2.3)
- crypto: qcom-rng - Remove crypto_rng interface

#### 7.2.3 (2026-09-02)

- crypto: sun8i-ss - Remove crypto_rng interface
- crypto: sun8i-ce - Remove crypto_rng interface

#### 7.1.9 (2026-08-19)

- fs,fsverity: remove check for fsverity being enabled in setattr_prepare()

#### 7.1.5 (2026-07-24)

- crypto: xilinx-trng - Remove crypto_rng interface

#### 7.0.14 (2026-06-27)

- crypto: qat - remove unused character device and IOCTLs

### Security

#### 7.2.1 (2026-08-27)

- ptp: vmclock: prevent read-only mappings from becoming writable
- Bluetooth: hci_aml: validate firmware segment lengths
- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- Bluetooth: hci_sync: Fix accept list UAF during suspend
- Bluetooth: hci_event: validate LE Set CIG Parameters response
- Bluetooth: hci_event: fix LE list UAF on reset
- HID: hyperv: validate initial device info bounds
- HID: uclogic: fix use-after-free of inrange_timer on remove
- HID: sensor: custom: Fix use-after-free in enable_sensor
- HID: ft260: fix stack-use-after-return write in I2C read race
- HID: core: fix number/pointer type confusion on long items
- HID: rapoo: fix missing hid_is_usb() check
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- HID: huawei: fix missing hid_is_usb() check

## Release notes

### 7.1.13

- Date: 2026-09-02
- Version: 7.1.13
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.13
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.13
- Labels: stable

- **fixed** — usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- **fixed** — wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- **fixed** — USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- **removed** — USB: serial: spcp8x5: drop broken carrier detect support
- **fixed** — USB: serial: option: fix slab OOB read in interrupt URB callback
- **fixed** — ALSA: usb-audio: Complete cleanup after system-resume errors
- **fixed** — ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- **fixed** — ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
- **changed** — usb: core: Strengthen error handling in hub_hub_status()
- **added** — usb: core: Add lock to usb_wakeup_notification()
- **fixed** — KVM: s390: vsie: zero stale crypto bits
- **removed** — crypto: qce - Remove unsafe/deprecated algorithms
- **fixed** — crypto: mxs-dcp - fix source scatterlist length access
- **fixed** — crypto: iaa - fall back to software for multi-entry scatterlists
- **fixed** — crypto: qce - fix CCM AAD buffer underallocation
- **fixed** — crypto: krb5 - use kfree_sensitive() for derived key buffers
- **fixed** — crypto: atmel-tdes - use scatterlist length before DMA mapping
- **changed** — crypto: qcom-rng - Allow zero as a random number
- **removed** — crypto: qcom-rng - Remove crypto_rng interface
- **fixed** — crypto: qcom-rng - Enable clock in hwrng case

77 commits in this release:

- Linux 7.1.13
- usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- USB: serial: spcp8x5: drop broken carrier detect support
- USB: serial: option: fix slab OOB read in interrupt URB callback
- ALSA: usb-audio: Complete cleanup after system-resume errors
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
- usb: core: Strengthen error handling in hub_hub_status()
- usb: core: Add lock to usb_wakeup_notification()
- KVM: s390: vsie: zero stale crypto bits
- crypto: qce - Remove unsafe/deprecated algorithms
- crypto: mxs-dcp - fix source scatterlist length access
- crypto: iaa - fall back to software for multi-entry scatterlists
- crypto: qce - fix CCM AAD buffer underallocation
- crypto: krb5 - use kfree_sensitive() for derived key buffers
- crypto: atmel-tdes - use scatterlist length before DMA mapping
- crypto: qcom-rng - Allow zero as a random number
- crypto: qcom-rng - Remove crypto_rng interface
- crypto: qcom-rng - Enable clock in hwrng case
- crypto: virtio - bound the akcipher result length
- kunit: irq: Continue increasing hrtimer interval for longer
- mm/swap: reject swapon() on filesystem-level encrypted files
- netfilter: nf_tables: don't queue packet path object notifications
- netfilter: nft_set_pipapo_avx2: add missing vzeroupper
- vxlan: keep the last remote linked during FDB flush
- batman-adv: reject unrepresentable multicast TVLV offsets
- ipv6: seg6: clear IPv4 control block on IPIP decapsulation
- net/packet: defer vmalloc TX_RING free until skbs finish
- net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
- xfrm: bound nat keepalive state collection
- xfrm: fix xfrm_state_construct() auth-trunc leak
- xfrm: ah6: validate routing header segments_left
- xfrm: avoid lock inversion in nat keepalive work
- xfrm: drop ESP-in-TCP packets with no ingress device
- tcp: clamp route advmss to TCP_MIN_MSS
- xfrm: espintcp: fix UAF during close
- net: advertise TCP MSS from the configured MTU, not the learned PMTU
- net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
- tcp: fix AO info use-after-free in tcp_ao_connect_init()
- net/tcp: fix TCP-AO key deletion in VRFs
- gtp: serialize PDP context updates
- tls: device: fix out-of-bounds write in tls_append_frag()
- KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
- KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
- KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
- KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
- KVM: SEV: Drop FOLL_WRITE for encrypted region registration
- usb: gadget: f_tcm: keep port count until LUN teardown completes
- usb: usbtest: disable dynamic ID support
- fuse: fix invalidate lock leak on open O_TRUNC DAX failure
- fuse: fix invalidate lock leak on setattr writeback failure
- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
- xhci: dbgtty: Fix unregister on tty_register_driver() failure
- usb: xhci: bail out of setup if the controller is inaccessible
- usb: xhci: Handle USB3 port events when there is one roothub
- usb: xhci: Handle bogus TRB pointers in Missed Service Error events
- accessibility: speakup: unregister tty ldisc on later init failures
- fpga: dfl: fme: add error handling
- ext4: zero out whole block for clean edges in WRITE_ZEROES
- ext4: track partial-zero outcome per edge in ext4_zero_partial_blocks()
- ext4: write back partial-zeroed edges in WRITE_ZEROES
- ext4: move partial block zeroing earlier in ext4_zero_range()
- ext4: protect WRITE_ZEROES written extents with orphan list
- ext4: export converted block count from ext4_convert_unwritten_extents()
- selinux: switch two allocations to use kzalloc_objs()
- selinux: require a cla

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.13]_

### 7.2.3

- Date: 2026-09-02
- Version: 7.2.3
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.3
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2.3
- Labels: stable

- **fixed** — usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- **fixed** — wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- **fixed** — USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- **removed** — USB: serial: spcp8x5: drop broken carrier detect support
- **fixed** — USB: serial: option: fix slab OOB read in interrupt URB callback
- **fixed** — ALSA: usb-audio: Complete cleanup after system-resume errors
- **fixed** — ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- **fixed** — ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
- **changed** — usb: core: Strengthen error handling in hub_hub_status()
- **added** — usb: core: Add lock to usb_wakeup_notification()
- **fixed** — KVM: s390: vsie: zero stale crypto bits
- **removed** — crypto: qce - Remove unsafe/deprecated algorithms
- **fixed** — crypto: mxs-dcp - fix source scatterlist length access
- **fixed** — crypto: iaa - fall back to software for multi-entry scatterlists
- **fixed** — crypto: qce - fix CCM AAD buffer underallocation
- **changed** — crypto: krb5 - use kfree_sensitive() for derived key buffers
- **fixed** — crypto: atmel-tdes - use scatterlist length before DMA mapping
- **removed** — crypto: sun8i-ss - Remove crypto_rng interface
- **removed** — crypto: sun8i-ce - Remove crypto_rng interface

72 commits in this release:

- Linux 7.2.3
- usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- USB: serial: spcp8x5: drop broken carrier detect support
- USB: serial: option: fix slab OOB read in interrupt URB callback
- ALSA: usb-audio: Complete cleanup after system-resume errors
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
- usb: core: Strengthen error handling in hub_hub_status()
- usb: core: Add lock to usb_wakeup_notification()
- KVM: s390: vsie: zero stale crypto bits
- crypto: qce - Remove unsafe/deprecated algorithms
- crypto: mxs-dcp - fix source scatterlist length access
- crypto: iaa - fall back to software for multi-entry scatterlists
- crypto: qce - fix CCM AAD buffer underallocation
- crypto: krb5 - use kfree_sensitive() for derived key buffers
- crypto: atmel-tdes - use scatterlist length before DMA mapping
- crypto: sun8i-ss - Remove crypto_rng interface
- crypto: sun8i-ce - Remove crypto_rng interface
- crypto: qcom-rng - Allow zero as a random number
- crypto: qcom-rng - Remove crypto_rng interface
- crypto: qcom-rng - Enable clock in hwrng case
- crypto: virtio - bound the akcipher result length
- kunit: irq: Continue increasing hrtimer interval for longer
- mm/swap: reject swapon() on filesystem-level encrypted files
- netfilter: nf_tables: don't queue packet path object notifications
- netfilter: nft_set_pipapo_avx2: add missing vzeroupper
- vxlan: keep the last remote linked during FDB flush
- batman-adv: reject unrepresentable multicast TVLV offsets
- ipv6: seg6: clear IPv4 control block on IPIP decapsulation
- net/packet: defer vmalloc TX_RING free until skbs finish
- vlan: fix skb_under_panic and races when toggling HW VLAN offload
- net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
- xfrm: bound nat keepalive state collection
- xfrm: fix xfrm_state_construct() auth-trunc leak
- xfrm: ah6: validate routing header segments_left
- xfrm: avoid lock inversion in nat keepalive work
- xfrm: drop ESP-in-TCP packets with no ingress device
- tcp: clamp route advmss to TCP_MIN_MSS
- xfrm: espintcp: fix UAF during close
- net: advertise TCP MSS from the configured MTU, not the learned PMTU
- net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
- tcp: fix AO info use-after-free in tcp_ao_connect_init()
- net/tcp: fix TCP-AO key deletion in VRFs
- gtp: serialize PDP context updates
- tls: device: fix out-of-bounds write in tls_append_frag()
- KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
- KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
- KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
- KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
- KVM: SEV: Drop FOLL_WRITE for encrypted region registration
- KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts
- usb: gadget: f_tcm: keep port count until LUN teardown completes
- usb: usbtest: disable dynamic ID support
- fuse: fix invalidate lock leak on open O_TRUNC DAX failure
- fuse: fix invalidate lock leak on setattr writeback failure
- fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
- fuse: publish io-uring queues with release semantics
- fuse: fix missing barrier when checking io-uring readiness
- fuse: fix race between interrupt and resend
- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
- xhci: dbgtty: Fix unregister on tty_register_driver() failure
- usb: xhci: bail out of setup if the controller is inaccessible
- usb: xhci: Handle USB3 port events when there is one roothub
- usb: xhci: Handle bogus TRB pointers in Missed Service Error events
- accessibility: speakup: unregister tty ldisc on later init failures
- fpga: dfl: fme: add error handling

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.3]_

### 7.1.12

- Date: 2026-08-28
- Version: 7.1.12
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.12
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.12
- Labels: stable

- **fixed** — Strip GSO state from fragments before reassembly in inet frags

2 commits in this release:

- Linux 7.1.12
- inet: frags: strip GSO state from fragments before reassembly

### 7.2.2

- Date: 2026-08-28
- Version: 7.2.2
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.2
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2.2
- Labels: stable

- **fixed** — Strip GSO state from fragments before reassembly in inet frags

2 commits in this release:

- Linux 7.2.2
- inet: frags: strip GSO state from fragments before reassembly

### 7.1.11

- Date: 2026-08-27
- Version: 7.1.11
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.11
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.11
- Labels: stable

- **fixed** — ptp: vmclock: prevent read-only mappings from becoming writable
- **fixed** — futex: Avoid private hash use-after-free on final put
- **fixed** — Bluetooth: hci_aml: validate firmware segment lengths
- **fixed** — Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- **fixed** — Bluetooth: ISO: zero the sockaddr before returning it in getname
- **fixed** — Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- **fixed** — Bluetooth: hci_sync: Fix accept list UAF during suspend
- **fixed** — Bluetooth: hci_event: validate LE Set CIG Parameters response
- **fixed** — Bluetooth: hci_event: fix LE list UAF on reset
- **fixed** — HID: input: read battery capacity from its actual report offset
- **fixed** — HID: hyperv: validate initial device info bounds
- **fixed** — HID: uclogic: fix use-after-free of inrange_timer on remove
- **fixed** — HID: sensor: custom: Fix use-after-free in enable_sensor
- **fixed** — HID: ft260: fix stack-use-after-return write in I2C read race
- **fixed** — HID: core: fix number/pointer type confusion on long items
- **fixed** — HID: rapoo: fix missing hid_is_usb() check
- **fixed** — HID: nintendo: stop device IO before hid_hw_stop on probe failure
- **fixed** — HID: nintendo: register input device after capabilities are set
- **fixed** — HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- **fixed** — HID: huawei: fix missing hid_is_usb() check

100 commits in this release:

- Linux 7.1.11
- ptp: vmclock: prevent read-only mappings from becoming writable
- futex: Avoid private hash use-after-free on final put
- Bluetooth: hci_aml: validate firmware segment lengths
- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- Bluetooth: ISO: zero the sockaddr before returning it in getname
- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- Bluetooth: hci_sync: Fix accept list UAF during suspend
- Bluetooth: hci_event: validate LE Set CIG Parameters response
- Bluetooth: hci_event: fix LE list UAF on reset
- HID: input: read battery capacity from its actual report offset
- HID: hyperv: validate initial device info bounds
- HID: uclogic: fix use-after-free of inrange_timer on remove
- HID: sensor: custom: Fix use-after-free in enable_sensor
- HID: ft260: fix stack-use-after-return write in I2C read race
- HID: core: fix number/pointer type confusion on long items
- HID: rapoo: fix missing hid_is_usb() check
- HID: nintendo: stop device IO before hid_hw_stop on probe failure
- HID: nintendo: register input device after capabilities are set
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- HID: huawei: fix missing hid_is_usb() check
- HID: asus: fix missing hid_is_usb() check
- futex: Fix might_sleep() warning in futex_pivot_pending()
- futex: Fix race on the initial mm->futex.phash.ref allocation
- futex: Fix race in futex_pivot_pending() during private hash resize
- futex/pi: Plug private futex exec() race
- futex: Sanitize and document task_struct::futex::state transitions
- futex/pi: Reject cross-mm private futex owners
- net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
- HID: pidff: fix OOB write when hid->inputs is empty
- HID: core: fix OOB read of field->usage in hid_set_field()
- HID: magicmouse: do not keep a stale msc->input if no input is claimed
- HID: magicmouse: re-enable multitouch after reset-resume
- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
- mptcp: pm: fix memory leak from alloc-during-teardown race
- mptcp: pm: uniform announced addresses helpers
- mptcp: pm: rename add_entry structure to add_addr
- drm/amdgpu: Allocate coredump ring buffers per ring
- drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
- fbdev: serialize mode sysfs access with lock_fb_info()
- fbdev: Wrap user-invoked calls to fb_set_var() in helper
- nvmet: pci-epf: put CQ ref on create_cq mapping failure
- nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
- nvmet-tcp: bound SGL data length before allocating command buffers
- nvmet-fc: fix invalid free in LS IOD error path
- nvmet-auth: zero the AUTH_RECEIVE response buffer
- dmaengine: fsl-edma: Add error handling for devm_kasprintf
- mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
- ipv6: fix use-after-free in ip6_finish_output2()
- ipv4: reject undersized MTUs in ip_do_fragment()
- nfc: nci: free destination parameters when closing a connection
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
- nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
- nfc: nci: add data_len bound checks to activation parameter extractors
- nfc: st21nfca: validate ATR_REQ length against the received frame
- nfc: pn533: purge fragmented skbs during cleanup
- nfc: llcp: reject PDUs shorter than the LLCP header
- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
- nfc: llcp: bound the connect_sn TLV walk to the skb
- nfc: microread: validate target discovery payload lengths
- nfc: fdp: bound the device-reported read length and fix an skb leak
- nfc: digital: clamp SENSF_RES length to the destination buffer
- drm/xe: Fix DPT allocation paths.
- drm/i915: Introduce struct intel_fb_pin_params
- drm/i915: Track fence region ID in plane state
- drm/i9

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.11]_

### 7.2.1

- Date: 2026-08-27
- Version: 7.2.1
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.1
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2.1
- Labels: stable

- **security** — ptp: vmclock: prevent read-only mappings from becoming writable
- **fixed** — futex: Fix might_sleep() warning in futex_pivot_pending()
- **security** — Bluetooth: hci_aml: validate firmware segment lengths
- **security** — Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- **fixed** — Bluetooth: ISO: zero the sockaddr before returning it in getname
- **fixed** — Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- **security** — Bluetooth: hci_sync: Fix accept list UAF during suspend
- **security** — Bluetooth: hci_event: validate LE Set CIG Parameters response
- **security** — Bluetooth: hci_event: fix LE list UAF on reset
- **fixed** — HID: input: read battery capacity from its actual report offset
- **security** — HID: hyperv: validate initial device info bounds
- **security** — HID: uclogic: fix use-after-free of inrange_timer on remove
- **security** — HID: sensor: custom: Fix use-after-free in enable_sensor
- **security** — HID: ft260: fix stack-use-after-return write in I2C read race
- **security** — HID: core: fix number/pointer type confusion on long items
- **security** — HID: rapoo: fix missing hid_is_usb() check
- **fixed** — HID: nintendo: stop device IO before hid_hw_stop on probe failure
- **fixed** — HID: nintendo: register input device after capabilities are set
- **security** — HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- **security** — HID: huawei: fix missing hid_is_usb() check

84 commits in this release:

- Linux 7.2.1
- ptp: vmclock: prevent read-only mappings from becoming writable
- futex: Fix might_sleep() warning in futex_pivot_pending()
- Bluetooth: hci_aml: validate firmware segment lengths
- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- Bluetooth: ISO: zero the sockaddr before returning it in getname
- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- Bluetooth: hci_sync: Fix accept list UAF during suspend
- Bluetooth: hci_event: validate LE Set CIG Parameters response
- Bluetooth: hci_event: fix LE list UAF on reset
- HID: input: read battery capacity from its actual report offset
- HID: hyperv: validate initial device info bounds
- HID: uclogic: fix use-after-free of inrange_timer on remove
- HID: sensor: custom: Fix use-after-free in enable_sensor
- HID: ft260: fix stack-use-after-return write in I2C read race
- HID: core: fix number/pointer type confusion on long items
- HID: rapoo: fix missing hid_is_usb() check
- HID: nintendo: stop device IO before hid_hw_stop on probe failure
- HID: nintendo: register input device after capabilities are set
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- HID: huawei: fix missing hid_is_usb() check
- HID: asus: fix missing hid_is_usb() check
- net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
- HID: pidff: fix OOB write when hid->inputs is empty
- HID: core: fix OOB read of field->usage in hid_set_field()
- HID: magicmouse: do not keep a stale msc->input if no input is claimed
- HID: magicmouse: re-enable multitouch after reset-resume
- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
- nvmet: pci-epf: put CQ ref on create_cq mapping failure
- nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
- nvmet-tcp: bound SGL data length before allocating command buffers
- nvmet-fc: fix invalid free in LS IOD error path
- nvmet-auth: zero the AUTH_RECEIVE response buffer
- dmaengine: fsl-edma: Add error handling for devm_kasprintf
- mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
- ipv6: fix use-after-free in ip6_finish_output2()
- ipv4: reject undersized MTUs in ip_do_fragment()
- nfc: nci: free destination parameters when closing a connection
- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
- nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
- nfc: nci: add data_len bound checks to activation parameter extractors
- nfc: st21nfca: validate ATR_REQ length against the received frame
- nfc: pn533: purge fragmented skbs during cleanup
- nfc: llcp: reject PDUs shorter than the LLCP header
- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
- nfc: llcp: bound the connect_sn TLV walk to the skb
- nfc: microread: validate target discovery payload lengths
- nfc: fdp: bound the device-reported read length and fix an skb leak
- nfc: digital: clamp SENSF_RES length to the destination buffer
- xfs: restore nofs context unconditionally in xfs_trans_roll
- xfs: validate attr entry pointer before field access
- ext4: fix incorrect function call when initializing s_resgid
- ext4: don't enable DAX on new encrypted files
- ext4: propagate errors from fast commit range replay
- ext4: avoid tail write_begin walk for uptodate folios
- ext4: clear error before retrying inode xattr space fallback
- nilfs2: reject invalid block index in GC ioctl
- ext4: stop retrying saturated xattr cache entries
- kcov: fix data corruption and race conditions on PREEMPT_RT
- null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
- ocfs2: fix missing metadata reservation for large xattrs
- io_uring: defer eventfd signaling when queued from a wakeup handler
- io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
- io_uring/rsrc: fix folio size overflow in io_vec_fill_

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.1]_

### 7.1.10

- Date: 2026-08-23
- Version: 7.1.10
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.10
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.10
- Labels: stable

- **fixed** — ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP
- **fixed** — erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- **fixed** — spi: virtio: mark device ready before registering the controller
- **fixed** — drm/log: Fix infinite loop when scale is too large for display
- **fixed** — drm/log: Fix out-of-bounds read on empty message length
- **fixed** — drm/log: Fix division by zero when scale module parameter is 0
- **fixed** — drm/xe: Fix a bug in pc_adjust_freq_bounds()
- **changed** — drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
- **fixed** — drm/xe/oa: Check managed mutex initialization errors
- **fixed** — drm/xe/oa: Fix sync entry leak on OA config emit failure
- **added** — drm/xe/pxp: add termination on resume
- **fixed** — firewire: ohci: fix NULL pointer dereference in ar_context_release
- **fixed** — l2tp: fix tunnel and session refcount leak on seq_file release
- **fixed** — net/sched: cls_bpf: reject dev-bound programs bound to a different device
- **fixed** — accel/amdxdna: Skip unmapped range in aie2_populate_range()
- **fixed** — net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- **fixed** — regmap: sdw-mbq: don't call an unset readable_reg callback
- **changed** — m68k: Define NR_CPUS to 1

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.1.10
- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
- erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- spi: virtio: mark device ready before registering the controller
- drm/log: Fix infinite loop when scale is too large for display
- drm/log: Fix out-of-bounds read on empty message length
- drm/log: Fix division by zero when scale module parameter is 0
- drm/xe: Fix a bug in pc_adjust_freq_bounds()
- drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
- drm/xe/oa: Check managed mutex initialization errors
- drm/xe/oa: Fix sync entry leak on OA config emit failure
- drm/xe/pxp: add termination on resume
- firewire: ohci: fix NULL pointer dereference in ar_context_release
- l2tp: fix tunnel and session refcount leak on seq_file release
- net/sched: cls_bpf: reject dev-bound programs bound to a different device
- accel/amdxdna: Skip unmapped range in aie2_populate_range()
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- regmap: sdw-mbq: don't call an unset readable_reg callback
- m68k: Define NR_CPUS to 1
- pid: reject allocations through dead ancestor pid namespaces
- net/sched: cls_u32: skip hash tables in u32_bind_class()
- net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
- af_packet: Don't send zero-byte data in tpacket_snd().
- regmap: sdw-mbq: Fix swap of timeout and retry times
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
- net/tls: Fail tls_sw_splice_read() after a failed async decrypt
- net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
- net: tap: fix wrong transport_header when sending VLAN-tagged frame
- net: packet: fix wrong transport_header when sending VLAN-tagged frame
- net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
- tcp: fix icsk_ack.ato bitfield overflow
- veth: fix queue index used to wake the peer txq in veth_poll
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
- eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
- eth: bnxt: decrease indent in bnxt_request_irq()
- eth: bnxt: keep the aRFS rmap updated when TPH is enabled
- eth: bnxt: cancel IRQ notifier before freeing affinity mask
- netfilter: ipset: let destroy callbacks adjust ext mem size
- netfilter: ipset: fix list type element drift bug
- netfilter: flowtable: publish GC-visible tuple last
- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- ipvs: revalidate ihl to prevent out-of-bounds access
- netfilter: ipset: fix refcount race between list:set GC and swap
- tick: Include ktime.h and jiffies.h in linux/tick.h
- ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
- gpio: ml-ioh: share the register lock across channels
- rseq: Prevent hard lockup on granted time slice extension
- ovpn: defer key slot crypto freeing to workqueue
- ovpn: run deferred work on a module-owned workqueue
- riscv: lib: Fix ZBB strnlen reading past count boundary
- ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
- sctp: validate cookie AUTH state before use
- perf: Reject exited events as group leaders
- scsi: core: pair EH runtime PM get and put
- riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
- ovpn: finish crypto callback cleanup before peer release
- ovpn: fix NULL dereference when killing missing key
- af_unix: Unlink scc_entry in unix_del_edge().
- regulator: fp9931: Fix VPOS/VNEG voltage selector table
- gpiolib: Check gc->get_direction() before calling gpiod_get_direction()
- rhashtable: fix false-positive lockdep splat on rhltable destruction
- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
- crypto: ccm - Set rfc4309 maxauthsize from child
- arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
- clk: spacemit: k3: se

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.10]_

### 7.1.9

- Date: 2026-08-19
- Version: 7.1.9
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.9
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.9
- Labels: stable

- **fixed** — thunderbolt: Fix bandwidth group reservation indexing
- **fixed** — thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- **fixed** — sctp: clear new_transport when removing a peer
- **fixed** — sctp: fix use-after-free of cached ASCONF chunk
- **fixed** — sctp: keep chunk->transport in step with the list it is queued on
- **fixed** — bpf, sockmap: Fix sk_redir use-after-free in send verdict
- **fixed** — fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- **fixed** — fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- **fixed** — mm/filemap: __filemap_add_folio() restore index before retrying
- **added** — ima: Instantiate file_truncate and path_truncate hooks
- **fixed** — sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
- **fixed** — sched/psi: Create the psimon kthread outside of cgroup_mutex
- **fixed** — sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- **fixed** — fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- **removed** — fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
- **fixed** — ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- **fixed** — ipv6: fix Route Information option length validation
- **fixed** — mm/ptdump: always stabilise against page table freeing using init_mm
- **fixed** — mm/page_table_check: skip special zero mappings
- **fixed** — ring-buffer: Use current_context for safe per-CPU buffer swap

The 107 most recent commits in this release — the full changelog is longer:

- Linux 7.1.9
- thunderbolt: Fix bandwidth group reservation indexing
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- sctp: clear new_transport when removing a peer
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: keep chunk->transport in step with the list it is queued on
- scsi: scsi_debug: Negate wrapped memcmp() result
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- mm/filemap: __filemap_add_folio() restore index before retrying
- ima: Instantiate file_truncate and path_truncate hooks
- sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
- sched/psi: Create the psimon kthread outside of cgroup_mutex
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- ipv6: fix Route Information option length validation
- mm/ptdump: always stabilise against page table freeing using init_mm
- mm/page_table_check: skip special zero mappings
- ring-buffer: Use current_context for safe per-CPU buffer swap
- ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
- ptp: ocp: Fix board ID over-read
- Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
- Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- ring-buffer: Prevent resizing of persistent ring buffer
- eventfs: Use children field for rcu head and add memory barriers
- eventfs: Fix use-after-free in eventfs_remove_rec()
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
- smb: client: Fix use-after-free in cifs_try_adding_channels()
- tipc: read le->link under the node lock in tipc_node_link_down()
- tls: don't leave a full plaintext sk_msg ring unpushed
- tls: rx: restore msg_iter before TLS 1.3 optimistic retry
- vhost: reset the vring metadata cache on vring reconfiguration
- veth: fix skb length accounting after XDP frag adjustment
- vsock/virtio: avoid refilling the RX queue after teardown
- vsock/virtio: read virtqueues under worker locks
- vxlan: do not arm the ageing timer on a device that is down
- xdp: reject clones that overrun skb_shared_info tailroom
- x86/mce: Set up the polling timer before CMCI discovery
- x86/CPU: Add a tlbi= cmdline switch
- arm64: remove redundant concurrent ptdump UAF mitigation
- dibs: initialise dibs->lock in dibs_dev_alloc()
- Revert "drm/amdgpu: fix aperture mapping leak"
- binfmt_misc: don't warn when the mount is completed from another user namespace
- ovl: don't warn when the mount is completed from another user namespace
- net/sched: act_gact, act_police: range check the fallback control action
- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
- net: atlantic: free RX pages of consumed but not refilled buffers
- net: atlantic: free stranded TX buffers on ring deinit
- netfilter: nf_conntrack: defer invalid log until after unlock
- netfilter: bridge: release template ct on non-IP path
- NTB: ntb_netdev: Preserve RX queue depth on allocation failure
- net: devmem: prevent net-iov / page mixing
- net/x25: fix use-after-free of the socket by its timers
- net/dibs: Correct freeing of dmb_clientid_arr
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice
- net: phy: mediatek: fix TX blink masks using the RX bits
- mm/huge_memory: fix huge_zero_pfn race
- mm/huge_memory: initialise workingset state before folio split
- tracing: Fix NULL pointer dereference in module event cach

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.9]_

### 7.2

- Date: 2026-08-16
- Version: 7.2
- Original notes: https://git.kernel.org/torvalds/h/v7.2
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2
- Labels: mainline

- **fixed** — wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
- **fixed** — drbd: don't leak the shared secret to unprivileged netlink dumps
- **fixed** — openrisc: signal: do not restore privileged SR bits on sigreturn
- **fixed** — erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- **changed** — sched: Update time before requeueing delayed entities
- **fixed** — tracing: Fix race between update_event_fields and event_define_fields
- **fixed** — tracing: Fix NULL pointer dereference in module event cache removal
- **fixed** — spi: virtio: mark device ready before registering the controller
- **fixed** — drm/log: Fix infinite loop when scale is too large for display
- **fixed** — drm/log: Fix out-of-bounds read on empty message length
- **fixed** — drm/log: Fix division by zero when scale module parameter is 0
- **fixed** — drm/xe: Fix xe_device_probe() failure
- **fixed** — drm/xe: Fix a bug in pc_adjust_freq_bounds()
- **fixed** — drm/xe/oa: Check managed mutex initialization errors
- **fixed** — drm/xe/oa: Fix sync entry leak on OA config emit failure
- **fixed** — drm/xe: Order ring writes before ring tail updates
- **changed** — drm/xe/guc_ads: use uncached mapping for UM queue BO
- **changed** — drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
- **changed** — drm/xe/guc_ads: allocate UM queues in a separate BO
- **fixed** — firewire: ohci: fix NULL pointer dereference in ar_context_release

The 119 most recent commits in this release — the full changelog is longer:

- Linux 7.2
- wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
- Revert "i2c: designware: defer probe if child GpioInt controllers are not bound"
- drbd: don't leak the shared secret to unprivileged netlink dumps
- openrisc: signal: do not restore privileged SR bits on sigreturn
- erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- sched: Update time before requeueing delayed entities
- tracing: Fix race between update_event_fields and, event_define_fields
- tracing: Fix NULL pointer dereference in module event cache removal
- spi: virtio: mark device ready before registering the controller
- Revert "wifi: mt76: Disable napi when removing device"
- drm/log: Fix infinite loop when scale is too large for display
- drm/log: Fix out-of-bounds read on empty message length
- drm/log: Fix division by zero when scale module parameter is 0
- drm/xe: Fix xe_device_probe() failure
- drm/xe: Fix a bug in pc_adjust_freq_bounds()
- drm/xe/oa: Check managed mutex initialization errors
- drm/xe/oa: Fix sync entry leak on OA config emit failure
- drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
- drm/xe/pxp: add termination on resume
- drm/xe: Order ring writes before ring tail updates
- drm/xe/guc_ads: use uncached mapping for UM queue BO
- drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
- drm/xe/guc_ads: allocate UM queues in a separate BO
- drm/xe: Fix DPT allocation paths.
- firewire: ohci: fix NULL pointer dereference in ar_context_release
- l2tp: fix tunnel and session refcount leak on seq_file release
- net/sched: cls_bpf: reject dev-bound programs bound to a different device
- accel/amdxdna: Skip unmapped range in aie2_populate_range()
- io_uring/rsrc: reject overflowing regvec bvec byte counts
- sctp: fix use-after-free of cached ASCONF chunk
- Input: sur40 - fix V4L error path cleanup
- Input: sur40 - fix input device registration ordering
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- sctp: clear new_transport when removing a peer
- net/dibs: Correct freeing of dmb_clientid_arr
- ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls
- ceph: fix MDS random selection readiness predicate
- libceph: Avoid using invalid osd indices from primary_temp
- libceph: fix OOB read in decode_watchers() via missing bounds check
- libceph: fix multiple unsafe decodes in decode_locker()
- libceph: tolerate addrvecs with multiple entries of the same type
- regmap: sdw-mbq: don't call an unset readable_reg callback
- clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer
- drm/amdgpu: Prefer default discovery offset
- drm/amdgpu: Reject UVD message with invalid number of h265 refs
- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
- drm/amdgpu: Implement insert_end for VCE 3
- drm/amdgpu: Fix UVD min buffer sizes
- drm/amdgpu: Fix UVD decode image min size calculation
- drm/amdgpu: Fix UVD dpb min size calculation for H264
- drm/amdgpu: Reject UVD message with dimensions above 4096
- drm/amdgpu: check ASPM on the dGPU host link
- drm/radeon: fix autosuspend cleanup during teardown
- drm/amdgpu: fix missing check in vm_flush()
- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
- drm/amdgpu: validate GEM_CREATE domain combinations
- drm/amdgpu: disallow multiple FENCE chunks in one submit
- m68k: Define NR_CPUS to 1
- pid: reject allocations through dead ancestor pid namespaces
- pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
- net/sched: cls_u32: skip hash tables in u32_bind_class()
- gve: fix NULL dereference due to missing ptp adjfine
- gve: fix zero-length skb frag with header-split
- net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
- af_packet: Don

_[Truncated at 4000 characters — full notes: https://git.kernel.org/torvalds/h/v7.2]_

### 7.1.8

- Date: 2026-08-09
- Version: 7.1.8
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.8
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.8
- Labels: stable

- **fixed** — usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
- **fixed** — drm/amd/display: Exit idle optimizations before programming
- **fixed** — drm/amd/display: check GRPH_FLIP status before sending event
- **added** — media: chips-media: wave5: Support CBP profile
- **fixed** — drm/xe: Wait on external BO kernel fences in exec IOCTL
- **changed** — drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
- **changed** — drm/xe: Set TTM device beneficial_order to 9 (2M)
- **changed** — drm/xe: Separate early xe_device initialization
- **fixed** — usb: typec: ucsi: Fix race condition and ordering in port unregistration
- **changed** — usb: typec: ucsi: split connector lock classes
- **fixed** — drm/vmwgfx: validate external BO copy bounds for both stride paths
- **fixed** — drm/vmwgfx: use check_add_overflow for shader size+offset bound
- **fixed** — drm/vmwgfx: enforce cursor size limits for MOB cursors
- **fixed** — drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- **fixed** — drm/vmwgfx: bound DMA command body size against suffix pointer
- **fixed** — drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- **fixed** — drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- **fixed** — drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
- **fixed** — drm/vmwgfx: clamp dirty-page range with min, not max
- **fixed** — drm/vmwgfx: reject DX_BIND_QUERY without a DX context

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.1.8
- usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
- drm/amd/display: Exit idle optimizations before programming
- drm/amd/display: check GRPH_FLIP status before sending event
- media: chips-media: wave5: Support CBP profile
- drm/xe: Wait on external BO kernel fences in exec IOCTL
- drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
- drm/xe: Set TTM device beneficial_order to 9 (2M)
- drm/xe: Separate early xe_device initialization
- drm/xe: Move xe->info.devid|revid initialization
- drm/xe: Move xe->info.force_execlist initialization
- drm/xe: Drop unused param from xe_device_create()
- usb: typec: ucsi: Fix race condition and ordering in port unregistration
- usb: typec: ucsi: split connector lock classes
- drm/xe/rtp: Ensure locking/ref counting for OA whitelists
- drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
- drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
- drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
- drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
- drm/xe/rtp: Generalize whitelist_apply_to_hwe
- drm/xe/rtp: Keep track of non-OA nonpriv slots
- drm/xe/rtp: Maintain OA whitelists separately
- drm/vmwgfx: validate external BO copy bounds for both stride paths
- drm/vmwgfx: use check_add_overflow for shader size+offset bound
- drm/vmwgfx: enforce cursor size limits for MOB cursors
- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- drm/vmwgfx: bound DMA command body size against suffix pointer
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
- drm/vmwgfx: clamp dirty-page range with min, not max
- drm/vmwgfx: reject DX_BIND_QUERY without a DX context
- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
- drm/amdkfd: hold event_mutex while checkpointing CRIU events
- drm/amdkfd: Handle invalid event type in CRIU event restore
- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
- drm/amdkfd: fix QID bit leak in pqm_create_queue()
- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
- drm/amd/display: use proper context for logging
- drm/amd/display: Silence link_dpms I2C retimer failures
- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
- drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
- drm/amd/display: check if dml21_add_phantom_plane() is successful
- drm/amd/pm: use milliwatts for GPU power sensors
- drm/amd/pm: hide pp_table sysfs on APUs
- drm/amd/pm: fix pptable use-after-free
- drm/amd/pm: fix torn gpu metrics reads
- drm/amdgpu: cap GTT size to physical RAM on APUs
- drm/amdgpu: restore UMD profile pstate after runtime resume
- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
- drm/mediatek: ovl_adaptor: balance component registrations
- drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
- drm/panthor: validate firmware interface structure sizes
- drm/panthor: reject firmware sections with oversized data
- drm/bridge: display-connector: Fix I2C adapter resource leak
- drm/vc4: Zero the tile state data array before each BIN job
- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
- can: ctucanfd: mark error-active controller status valid
- can: ctucanfd: handle bus error interrupts
- can: ctucanfd: unmap BAR0 using base address
- can: ctucanfd: use self-test mode for PRESUME_ACK
- can: ctucanfd: add missing MODULE_DEVICE_TABLE()
- can: peak_usb: validate uCAN receive record lengths
- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
- can: peak_usb: add bounds check for USB channel index
- can: softing: fw_parse

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.8]_

### 7.1.7

- Date: 2026-08-06
- Version: 7.1.7
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.7
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.7
- Labels: stable

- **fixed** — Make Safe-RET robust against interrupt injection

2 commits in this release:

- Linux 7.1.7
- x86/bugs: Make Safe-RET robust against interrupt injection

### 7.1.6

- Date: 2026-08-03
- Version: 7.1.6
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.6
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.6
- Labels: stable

- **fixed** — cifs: fix time_last_write stamp placement in setattr/truncate paths
- **fixed** — KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
- **fixed** — bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
- **fixed** — mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
- **fixed** — SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
- **fixed** — xfs: don't replace the wrong part of the cow fork
- **fixed** — fuse-uring: fix race between registration and connection abortion
- **fixed** — audit: fix recursive locking deadlock in audit_dupe_exe()
- **fixed** — ksmbd: validate ACE size against SID sub-authorities
- **fixed** — ksmbd: bound DACL dedup walk to copied ACEs
- **fixed** — drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
- **fixed** — drm/amd/pm: fix smu13 power limit range calculation
- **fixed** — drm/amdgpu: fix aperture mapping leak
- **fixed** — drm/amdgpu: reject mapping a reserved doorbell to a new queue
- **fixed** — drm/amdgpu: fix resource leak on ACP reset timeout
- **fixed** — drm/amdgpu: Fix kernel panic during driver load failure
- **fixed** — drm/amdgpu: fix division by zero with invalid uvd dimensions
- **fixed** — drm/amdgpu/vce: fix integer overflow in image size
- **fixed** — drm/amdgpu/mes11: set doorbell offset for suspending userq
- **fixed** — tcp: challenge ACK for non-exact RST in SYN-RECEIVED

The 116 most recent commits in this release — the full changelog is longer:

- Linux 7.1.6
- cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
- cifs: fix time_last_write stamp placement in setattr/truncate paths
- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
- selftests: drv-net: so_txtime: relax variance bounds
- selftests: drv-net: cope with slow env in so_txtime.py test
- sched_ext: Preserve rq tracking across local DSQ dispatch
- sched_ext: Move shared helpers from ext.c into internal.h and cid.h
- bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
- bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
- net: mana: Optimize irq affinity for low vcpu configs
- mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
- mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths
- SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
- SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
- xfs: don't replace the wrong part of the cow fork
- fuse-uring: fix race between registration and connection abortion
- audit: fix recursive locking deadlock in audit_dupe_exe()
- audit: use 'unsigned int' instead of 'unsigned'
- drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
- ksmbd: validate ACE size against SID sub-authorities
- ksmbd: bound DACL dedup walk to copied ACEs
- ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
- ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
- selftests: drv-net: add missing kconfig for psp.py
- drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
- drm/amd/pm: fix smu13 power limit range calculation
- drm/amdgpu: fix aperture mapping leak
- drm/amdgpu: reject mapping a reserved doorbell to a new queue
- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
- drm/amdgpu: fix resource leak on ACP reset timeout
- drm/amdgpu: Fix kernel panic during driver load failure
- drm/amdgpu: fix division by zero with invalid uvd dimensions
- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
- drm/amdgpu/vcn4: avoid rereading IB param length
- drm/amdgpu/vce: fix integer overflow in image size
- drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
- drm/amdgpu/mes11: set doorbell offset for suspending userq
- drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
- drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
- drm/amdgpu/gfx8: drop unecessary BUG_ON()
- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
- drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq
- drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
- drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
- drm/amd/pm: make pp_features read-only when scpm is enabled
- drm/amd/pm: fix amdgpu_pm_info power display units
- watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
- vxlan: mdb: Fix source list corruption on a failed replace
- vsock/virtio: collapse receive queue under memory pressure
- tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
- tcp: challenge ACK for non-exact RST in SYN-RECEIVED
- tcp: initialize standalone TCP-AO response padding
- rtase: Workaround for TX hang caused by hardware packet parsing
- pppoe: reload header pointer after dev_hard_header()
- ovpn: hold peer before scheduling keepalive work
- ovpn: fix peer refcount leak in TCP error paths
- openvswitch: fix GSO userspace truncation underflow
- mctp: serial: handle zero-length frames to prevent rx buffer overflow
- mac802154: llsec: reject frames shorter than the authentication tag
- mac802154: hold an interface reference across the scan worker
- ila: reload IPv6 header after pskb_may_pull in checksum adjust
- ice: use REA

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.6]_

### 7.1.5

- Date: 2026-07-24
- Version: 7.1.5
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.5
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.5
- Labels: stable

- **fixed** — posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- **changed** — posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
- **fixed** — drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
- **changed** — iomap: consolidate bio submission
- **fixed** — exfat: fix implicit declaration of brelse()
- **added** — exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
- **changed** — exfat: add balloc parameter to exfat_map_cluster() for iomap support
- **changed** — exfat: replace unsafe macros with static inline functions
- **removed** — crypto: xilinx-trng - Remove crypto_rng interface
- **fixed** — liveupdate: validate session type before performing operation
- **fixed** — usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- **changed** — usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- **fixed** — ksmbd: use opener credentials for FSCTL mutations
- **fixed** — Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- **fixed** — Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- **fixed** — binder: cache secctx size before release zeroes it
- **fixed** — ALSA: hda/tas2781: Cancel async firmware request at unbind
- **added** — firmware_loader: Add cancel helper for async requests
- **fixed** — ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.1.5
- Revert "gpib: cb7210: Fix region leak when request_irq fails"
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
- drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
- iomap: consolidate bio submission
- exfat: fix implicit declaration of brelse()
- exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
- exfat: add balloc parameter to exfat_map_cluster() for iomap support
- exfat: replace unsafe macros with static inline functions
- crypto: xilinx-trng - Remove crypto_rng interface
- liveupdate: validate session type before performing operation
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- usb: atm: ueagle-atm: remove function entry/exit debug messages
- usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- xfs: add newly added RTGs to the free pool in growfs
- xfs: factor out a xfs_zone_mark_free helper
- ksmbd: use opener credentials for FSCTL mutations
- smb: move compression definitions into common/fscc.h
- ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- binder: cache secctx size before release zeroes it
- binder: Use LIST_HEAD() to initialize on stack list head
- ALSA: hda/tas2781: Cancel async firmware request at unbind
- firmware_loader: Add cancel helper for async requests
- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
- ALSA: scarlett2: Allow selecting config_set by firmware version
- iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
- f2fs: fix listxattr handling of corrupted xattr entries
- f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
- f2fs: fix potential deadlock in f2fs_balance_fs()
- device property: initialize the remaining fields of fwnode_handle in fwnode_init()
- samples/damon/mtier: fail early if address range parameters are invalid
- mm/damon/core: trace esz at first setup
- bpf: Reject negative const offsets for buffer pointers
- mmc: sdhci-esdhc-imx: fix resume error handling
- mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
- mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
- mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
- mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
- mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
- mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
- mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
- mmc: block: fix RPMB device unregister ordering
- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
- mtd: rawnand: fsl_ifc: return errors for failed page reads
- mmc: vub300: defer reset until cmd_mutex is unlocked
- mtd: mchp23k256: use SPI match data for chip caps
- mtd: onenand: samsung: report DMA completion timeouts
- mtd: virt-concat: free duplicate generated name
- wifi: mwifiex: fix permanently busy scans after multiple roam iterations
- wifi: mac80211: validate extension-frame layout before RX
- wifi: mac80211: free ack status frame on TX header build failure
- wifi: ieee80211: validate MLE common info length
- wifi: cfg80211: validate EHT MLE before MLD ID read
- powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()
- powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
- reset: sunxi: fix memory region leak on ioremap failure
- reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
- ipvs: reload ip header after head reallocation
- ipvs: fix more places w

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.5]_

### 7.0.14

- Date: 2026-06-27
- Version: 7.0.14
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.14
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.0.14
- Labels: stable

- **fixed** — virtiofs: fix UAF on submount umount
- **fixed** — media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- **fixed** — ksmbd: reject non-VALID session in compound request branch
- **fixed** — drivers/base/memory: set mem->altmap after successful device registration
- **fixed** — serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- **fixed** — serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- **fixed** — vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- **removed** — crypto: qat - remove unused character device and IOCTLs
- **fixed** — iio: adc: ti-ads1298: add bounds check to pga_settings index
- **fixed** — iio: light: veml6075: add bounds check to veml6075_it_ms index
- **fixed** — net: net_failover: Fix the deadlock in slave register
- **changed** — net: export netif_open for self_test usage
- **fixed** — rose: don't free fd-owned sockets when reaping in the heartbeat
- **fixed** — rose: clear neighbour pointer in rose_kill_by_device()
- **fixed** — rose: cancel neighbour timers in rose_neigh_put() before freeing
- **fixed** — rose: drop CALL_REQUEST in loopback timer when device is not running
- **fixed** — rose: release netdev ref and destroy orphaned incoming sockets
- **fixed** — rose: fix netdev double-hold in rose_make_new()
- **fixed** — rose: disconnect orphaned STATE_2 sockets when device is gone
- **fixed** — rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup

43 commits in this release:

- Linux 7.0.14
- virtiofs: fix UAF on submount umount
- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- ksmbd: reject non-VALID session in compound request branch
- drivers/base/memory: set mem->altmap after successful device registration
- serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- crypto: qat - remove unused character device and IOCTLs
- iio: adc: ti-ads1298: add bounds check to pga_settings index
- iio: light: veml6075: add bounds check to veml6075_it_ms index
- net: net_failover: Fix the deadlock in slave register
- net: export netif_open for self_test usage
- rose: don't free fd-owned sockets when reaping in the heartbeat
- rose: clear neighbour pointer in rose_kill_by_device()
- rose: cancel neighbour timers in rose_neigh_put() before freeing
- rose: drop CALL_REQUEST in loopback timer when device is not running
- rose: release netdev ref and destroy orphaned incoming sockets
- rose: fix netdev double-hold in rose_make_new()
- rose: disconnect orphaned STATE_2 sockets when device is gone
- rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
- rose: fix notifier unregistered too early in rose_exit()
- rose: fix netdev double-hold in rose_rx_call_request()
- rose: guard rose_neigh_put() against NULL in timer expiry
- rose: clear neighbour pointer after rose_neigh_put() in state machines
- rose: fix race between loopback timer and module removal
- rose: hold loopback neighbour reference across timer callback
- rose: fix dev_put() leak in rose_loopback_timer()
- agp/amd64: Fix broken error propagation in agp_amd64_probe()
- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
- i2c: stub: Reject I2C block transfers with invalid length
- bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
- RDMA/bnxt_re: zero shared page before exposing to userspace
- Revert "NFSD: Defer sub-object cleanup in export put callbacks"
- fuse: re-lock request before replacing page cache folio
- firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
- firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
- firmware: samsung: acpm: Fix cross-thread RX length corruption
- firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
- firmware: exynos-acpm: Count number of commands in acpm_xfer
- lockd: fix TEST handling when not all permissions are available.
- arm64/entry: Fix arm64-specific rseq brokenness
- io_uring/net: Avoid msghdr on op_connect/op_bind async data