# Linux Kernel changelog

> The kernel at the heart of every Linux distribution, Android phone, and cloud server.

- Vendor: Linux Kernel Organization
- Category: Operating Systems
- Official site: https://www.kernel.org
- Tracked by: What's New (https://whatsnew.fyi/product/linux-kernel)
- Harvested from: Release index (kernel)
- Entries below: 25 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: release facts (products, versions, dates, links, CVE ids and flags) are open data under CC BY 4.0, from the API at https://whatsnew.fyi/api/v1 or the nightly dataset at https://github.com/whatsnew-fyi/dataset. The summaries, labels and curation are © What's New: quote freely with attribution and a link back; wholesale republication of them is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 7.3-rc7

- Date: 2026-10-12
- Version: 7.3-rc7
- Original notes: https://git.kernel.org/torvalds/h/v7.3-rc7
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.3-rc7
- Labels: Pre-release; mainline

### 6.18.56

- Date: 2026-10-11
- Version: 6.18.56
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.56
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.18.56
- Labels: longterm

- **fixed** — ipv4: free inet_opt and ireq_opt after an RCU grace period
- **fixed** — iio: adc: adi-axi-adc: Initialize state mutex
- **fixed** — iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
- **fixed** — net: mana: Sync page pool RX frags for CPU
- **fixed** — net: mana: remove double CQ cleanup in mana_create_rxq error path
- **fixed** — xen/netfront: drop RX packets with a short Ethernet header
- **added** — net: usb: qmi_wwan: add Quectel EG120K-EA
- **fixed** — KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
- **fixed** — KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
- **fixed** — KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
- **fixed** — KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
- **fixed** — KVM: arm64: Always populate FGT masks at boot time
- **added** — arm64: errata: Add Cortex-A725 erratum 3821522 workaround
- **fixed** — arm64: mm: Fix the break-before-make flush range for erratum 2645198
- **security** — perf: Require kernel access for text poke events
- **security** — perf/core: Check kernel access when kernel callchains are requested
- **fixed** — tty: fix saved termios reset race
- **fixed** — tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2
- **fixed** — usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
- **fixed** — drm/amd/display: Fix fast updates on DCE 8.1
- **fixed** — drm/amd/display: Preserve eDP mode on initial ASSR failure

The 120 most recent commits in this release — the full changelog is longer:

- Linux 6.18.56
- ipv4: free inet_opt and ireq_opt after an RCU grace period
- iio: adc: adi-axi-adc: Initialize state mutex
- iio: adc: adi-axi-adc: Make use of dev_err_probe()
- iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
- net: mana: Sync page pool RX frags for CPU
- net: mana: remove double CQ cleanup in mana_create_rxq error path
- xen/netfront: drop RX packets with a short Ethernet header
- net: usb: qmi_wwan: add Quectel EG120K-EA
- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
- KVM: x86: Add static calls for nested virtualization ops
- KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
- KVM: move TSS constants from kvm_host.h to tss.h
- KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
- KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
- KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
- KVM: arm64: Always populate FGT masks at boot time
- KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h
- arm64: errata: Add Cortex-A725 erratum 3821522 workaround
- arm64: errata: Factor out broken AMU const counter cap
- arm64: mm: Fix the break-before-make flush range for erratum 2645198
- perf: Require kernel access for text poke events
- perf/core: Check kernel access when kernel callchains are requested
- perf: Replace perf_event_header__init_id with full header init
- unwind: Shorten lines
- tty: fix saved termios reset race
- usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
- tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2
- usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
- drm/amd/display: Fix fast updates on DCE 8.1
- drm/amdgpu: reset VI ASIC on MacBookPro14,3
- drm/amdgpu: reset VI ASIC on MacBookPro15,1
- drm/amd/display: Preserve eDP mode on initial ASSR failure
- drm/amd/display: Mark DCE 6.4 as not APU
- iio: adc: ad4030: fix invalid oversampling_ratio validation
- iio: adc: ad4030: Use BIT macro to improve code readability
- units: Add HZ_PER_GHZ
- smb: client: only require read lease for size-extending preallocate
- iio: adc: aspeed: propagate reset deassert errors
- iio: adc: aspeed: Simplify with dev_err_probe
- smb: client: distinguish real EOF from a stale remote_i_size on read
- smb: client: flush dirty data before zeroing a range
- thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
- wifi: mac80211: set info->band for 802.3 encap offload frames
- wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
- wifi: mac80211: count only matching reservations in reserved switch
- mtd: spinand: fix NULL pointer dereference with no ECC engine
- nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
- nvmet: copy the hostid into the ctrl before creating PR pc_refs
- nvmet-tcp: Don't error if TLS is enabed on a reset
- Bluetooth: Serialize SMP remote OOB data access
- fsverity: add dependency on 64K or smaller pages
- fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
- fs,fsverity: reject size changes on fsverity files in setattr_prepare
- rust: irq: pass RegistrationInner as cookie to request_irq
- rust: devres: ensure revocation is complete before device finishes unbinding
- rust: devres: fix race between concurrent revokers
- rust: devres: add 'static bound to Devres<T>
- rust: devres: fix race condition due to nesting
- mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc
- mm/vma: rename __mmap_prepare() function to avoid confusion
- netfs: clear post-EOF pagecache when extending a file via write
- pfcp: fix socket lifetime on netdevice registration failure
- mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
- svcrdma: Use svc_xprt_put to free listener on create failure
- mp

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.56]_

### 7.2.10

- Date: 2026-10-11
- Version: 7.2.10
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.10
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2.10
- Labels: stable

- **fixed** — ipv4: free inet_opt and ireq_opt after an RCU grace period
- **fixed** — iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
- **fixed** — xen/netfront: drop RX packets with a short Ethernet header
- **added** — net: usb: qmi_wwan: add Quectel EG120K-EA
- **fixed** — smb: client: only require read lease for size-extending preallocate
- **added** — arm64: errata: Add Cortex-A725 erratum 3821522 workaround
- **security** — perf: Require kernel access for text poke events
- **security** — perf/core: Check kernel access when kernel callchains are requested
- **fixed** — drm/amdgpu: reset VI ASIC on MacBookPro14,3
- **fixed** — drm/amdgpu: reset VI ASIC on MacBookPro15,1
- **fixed** — mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
- **fixed** — mptcp: fix msk->timer_ival reset
- **fixed** — thunderbolt: Fix NULL dereference in tb_remove_work()
- **fixed** — thunderbolt: Fix KASAN reported use-after-free when request is canceled
- **added** — USB: serial: option: add Compal EXC-T1 support
- **added** — USB: serial: option: add Quectel RG660QB
- **added** — USB: serial: option: add Compal EXM-G1x support
- **added** — USB: serial: option: add Quectel EG060W
- **added** — USB: serial: option: add support for SIMCom SIM8260C
- **added** — USB: serial: cp210x: add Corsair AX1500i Power Supply
- **fixed** — USB: serial: ssu100: fix baud rate overflow

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.2.10
- ipv4: free inet_opt and ireq_opt after an RCU grace period
- iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
- xen/netfront: drop RX packets with a short Ethernet header
- net: usb: qmi_wwan: add Quectel EG120K-EA
- smb: client: only require read lease for size-extending preallocate
- arm64: errata: Add Cortex-A725 erratum 3821522 workaround
- arm64: errata: Factor out broken AMU const counter cap
- perf: Require kernel access for text poke events
- perf/core: Check kernel access when kernel callchains are requested
- drm/amdgpu: reset VI ASIC on MacBookPro14,3
- drm/amdgpu: reset VI ASIC on MacBookPro15,1
- drm/amd/display: map PWM brightness through custom backlight curve
- rust: irq: pass RegistrationInner as cookie to request_irq
- mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
- mptcp: fix msk->timer_ival reset
- iio: trigger: cancel reenable_work before freeing trigger
- iio: proximity: vl53l0x-i2c: claim direct mode for raw reads
- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
- iio: proximity: sx9324: Correct proximity channel resolution
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
- iio: proximity: isl29501: Fix return type of isl29501_register_write
- iio: proximity: aw96103: validate firmware data length
- iio: pressure: rohm-bm1390: Return error when read fails
- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
- iio: light: rohm-bu27034: Fix infinite delay on error
- iio: light: gp2ap020a00f: drain irq_work after free_irq
- iio: imu: adis16480: fix unprotected debugfs reads
- iio: imu: adis16400: fix unprotected debugfs reads
- iio: health: max30102: fix NULL dereference in interrupt handler
- iio: gyro: adis16136: fix unprotected debugfs reads
- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()
- iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data
- iio: cdc: ad7150: fix OF matching and publish module aliases
- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
- iio: buffer: serialize buffer teardown with mode claims
- iio: admv1013: initialize callback mutex before registering notifier
- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
- iio: adc: stm32-adc: fix possible division by zero in processed channel
- iio: adc: stm32-adc: fix check on internal channel availability
- iio: adc: rohm-bd79124: Fix rising alarm
- iio: adc: rohm-bd79124: Fix GPIO mask check
- iio: adc: rohm-bd79124: Fix channel initialization
- iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop
- iio: adc: pac1934: check ACPI label duplication
- iio: adc: max1363: sign-extend bipolar differential channel reads
- iio: adc: axp288: Add TS bias override for Haier HV103H
- iio: adc: aspeed: propagate reset deassert errors
- iio: adc: adi-axi-adc: Initialize state mutex
- iio: adc: ade9000: request interrupts after powering the device
- iio: adc: ade9000: handle Phase C dip events in IRQ1 handler
- iio: adc: ade9000: fix overlapping scan_index for current and voltage channels
- iio: adc: ade9000: fix NULL pointer dereference in clkout registration
- iio: adc: ad_sigma_delta: fix use-after-free on unbind
- iio: adc: ad7173: Fix digital filter configuration
- iio: adc: ad4030: fix invalid oversampling_ratio validation
- iio: accel: sca3000: fix frequency divider condition check
- iio: accel: kxcjk-1013: reject duplicate event disable
- iio: accel: kionix-kx022a: Prevent memory leak and fix state
- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
- smb: client: require stable pages for signed connections
- smb: client: drain and invalidate before server

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.10]_

### 7.3-rc6

- Date: 2026-10-04
- Version: 7.3-rc6
- Original notes: https://git.kernel.org/torvalds/h/v7.3-rc6
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.3-rc6
- Labels: Pre-release; mainline

### 5.10.271

- Date: 2026-10-03
- Version: 5.10.271
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.271
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/5.10.271
- Labels: longterm

- **fixed** — can: ems_usb: validate CPC message lengths
- **fixed** — drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
- **changed** — lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- **changed** — lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
- **fixed** — Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- **fixed** — Bluetooth: L2CAP: validate frame length before control and FCS access
- **fixed** — Bluetooth: hci_sock: reject out-of-range OCF values
- **fixed** — Bluetooth: hci_sock: validate event length before filtering
- **fixed** — s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- **fixed** — pinctrl: single: free the IRQ on domain creation failure
- **fixed** — scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- **fixed** — nfc: port100: reject frames whose declared length exceeds the received data
- **fixed** — nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- **fixed** — nfc: fix use-after-free in nfc_get_local_general_bytes
- **fixed** — netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- **fixed** — netfilter: ip6t_rpfilter: reject routes without inet6_dev
- **fixed** — net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
- **fixed** — net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
- **fixed** — net: atl1c: fix soft lockup on out-of-range tpd_cons read
- **fixed** — net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

The 119 most recent commits in this release — the full changelog is longer:

- Linux 5.10.271
- can: ems_usb: validate CPC message lengths
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
- lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- Bluetooth: L2CAP: validate frame length before control and FCS access
- Bluetooth: hci_sock: reject out-of-range OCF values
- Bluetooth: hci_sock: validate event length before filtering
- s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- pinctrl: single: free the IRQ on domain creation failure
- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- nfc: port100: reject frames whose declared length exceeds the received data
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- nfc: fix use-after-free in nfc_get_local_general_bytes
- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- netfilter: ip6t_rpfilter: reject routes without inet6_dev
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
- net: atl1c: fix soft lockup on out-of-range tpd_cons read
- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
- net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
- net: arp: terminate device name before lookup
- net/sched: reject IDR error pointers when deleting actions
- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
- HID: alps: fix use-after-free on input2 registration failure
- drm/nouveau: Fix gem reference leak in validate_init()
- drm/nouveau: fix double-free in nvif_vmm_dtor
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
- drm/nouveau: fix autosuspend cleanup during teardown
- rds: ib: Clear the sg list when mapping an MR fails
- llc: reserve device headroom for allocated frames
- gpio: zynq: fix runtime PM leak on request error path
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end
- fsl/fman: Fix clk reference leak in read_dts_node()
- workqueue: Fix NULL current_pwq deref in flush dependency check
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
- sctp: discard the rest of the packet on a stale-cookie error
- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
- net: preserve skb_end_offset() in skb_unclone_keeptruesize()
- net: add skb_set_end_offset() helper
- net: add and use skb_unclone_keeptruesize() helper
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
- rculist: add list_splice_rcu() for private lists
- autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
- vlan: ensure sufficient headroom in vlan_dev_hard_header()
- net/sched: sch_teql: fix shadowed err in __teql_resolve()
- bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
- tipc: Fix a data race on mon->peer_cnt in mon_timeout()
- net: xps: reject an out of range traffic class
- ip_gre: Reject enabling collect metadata through changelink
- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
- net/sched: act_gate: budget the per-entry list in get_fill_size
- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
- nfc: llcp: fix sl

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.271]_

### 7.2.9

- Date: 2026-10-03
- Version: 7.2.9
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.9
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2.9
- Labels: stable

- **fixed** — i2c: qcom-geni: release DMA channels on probe error
- **changed** — accel/ivpu: Drop IRQF_ONESHOT to allow IPC IRQ threading on PREEMPT_RT
- **added** — KVM: x86: Add static calls for nested virtualization ops
- **fixed** — KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
- **changed** — KVM: move TSS constants from kvm_host.h to tss.h
- **changed** — KVM: x86/mmu: Move kvm_mmu_do_page_fault() from mmu_internal.h => mmu.c
- **changed** — KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h
- **fixed** — KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
- **fixed** — KVM: arm64: nv: Fix life cycle of the nested_mmus array
- **fixed** — net/sched: act_ct: avoid modifying shared unconfirmed ct entry
- **fixed** — net/sched: act_ct: fix helper UAF due to extensions realloc
- **fixed** — drm/amd/display: Relax DML frame limit with UBSAN
- **fixed** — super: make iterate_supers_type() deletion-safe
- **fixed** — super: take lock after last reference count
- **changed** — super: convert s_count to refcount_t s_passive
- **fixed** — i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
- **changed** — i2c: qcom-geni: Store of_device_id data in driver private struct
- **changed** — accel/ivpu: Use separate flag for job timeout
- **changed** — accel/ivpu: Use threaded IRQ for IPC callback processing
- **fixed** — landlock: Work around gcc-16 -Wuninitialized warning

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.2.9
- i2c: qcom-geni: release DMA channels on probe error
- accel/ivpu: Drop IRQF_ONESHOT to allow IPC IRQ threading on PREEMPT_RT
- KVM: x86: Add static calls for nested virtualization ops
- KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
- KVM: move TSS constants from kvm_host.h to tss.h
- KVM: x86/mmu: Move kvm_mmu_do_page_fault() from mmu_internal.h => mmu.c
- KVM: x86/mmu: Move kvm_arch_async_page_ready() below kvm_tdp_page_fault()
- KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h
- KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
- KVM: arm64: nv: Fix life cycle of the nested_mmus array
- net/sched: act_ct: avoid modifying shared unconfirmed ct entry
- net/sched: act_ct: fix helper UAF due to extensions realloc
- drm/amd/display: Relax DML frame limit with UBSAN
- super: make iterate_supers_type() deletion-safe
- super: take lock after last reference count
- super: convert s_count to refcount_t s_passive
- i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
- i2c: qcom-geni: Store of_device_id data in driver private struct
- i2c: qcom-geni: Move resource initialization to separate function
- i2c: qcom-geni: Isolate serial engine setup
- accel/ivpu: Use separate flag for job timeout
- accel/ivpu: Use threaded IRQ for IPC callback processing
- landlock: Work around gcc-16 -Wuninitialized warning
- drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platforms
- xfs: fix cursor and pointer handling when recovering iunlink buckets
- xfs: fix blockgc group quota scanning when usrquota isn't enforced
- xfs: drop dquot flush lock when we can't find a buffer to flush
- xfs: don't merge different file IO error types
- xfs: don't let memory failures leak blocks and kill repairs
- xfs: don't let hidden_space go negative in xfs_metafile_resv_init
- xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits
- xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
- xfs: fix rtgroup repair estimations
- xfs: check di_forkoff correctly in scrub
- xfs: use the correct reservations for rtrmap/refcount recovery
- xfs: only flag zero padding for dir3 data blocks, not dir3 block blocks
- xfs: don't call xfs_exchange_range_finish for a dry run
- xfs: check padding field in xfs_ioc_commit_range
- xfs: use correct jiffies comparison function in xchk_maybe_relax
- xfs: release orphanage dir inode if chown fails
- xfs: fix attr fork block count checks in xrep_inode_blockcounts
- xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
- smb: client: delete compound mids on send failure before unlock
- smb: client: close completed creates on compound wait errors
- smb: client: validate POSIX create context length
- smb: client: use finish_no_open() for non-regular inodes
- smb: client: preserve create-context parsing errors
- smb: client: clean up failed cached directory opens
- smb: client: close handle after create-context parsing failure
- smb: client: fix create context out-of-bounds reads
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- Bluetooth: mgmt: fix race in read_unconf_index_list()
- Bluetooth: L2CAP: validate frame length before control and FCS access
- Bluetooth: ISO: release unused CIS holds after channel attach
- Bluetooth: ISO: balance the parent hold in hci_bind_bis()
- Bluetooth: hci_sock: reject out-of-range OCF values
- Bluetooth: hci_sock: validate event length before filtering
- Bluetooth: hci_conn: fix CIS hold ownership on reuse
- sched/cache: Refresh LLC capacity across CPU hotplug, to fix capacity underestimation bug
- sched/cache: Decouple sched_cache_group from mm to fix UAF
- sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
- RISC-V: KVM: Fix HSM hart status error propagation
- RISC-V: KVM: Propagate interrupted G-stage faults
- RISC-V: KVM: Release unused pag

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.9]_

### 6.12.112

- Date: 2026-10-03
- Version: 6.12.112
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.112
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.12.112
- Labels: longterm

- **fixed** — Keep max_huge_pages when dissolving surplus folios
- **fixed** — Reject key-less BTF for hash maps
- **fixed** — Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
- **fixed** — Fix LPS0 and debugfs leaks when STB init fails
- **fixed** — Fix debug prints in mtd rawnand pl353
- **fixed** — Move d_max_latency out of CONFIG_FSNOTIFY protection
- **fixed** — Fix negative seeks on 32-bit with LFS enabled in bootconfig
- **fixed** — Revert the cross-controller atomic write size validation in nvme
- **fixed** — Cancel neighbour timers in rose_neigh_put() before freeing
- **fixed** — Drop CALL_REQUEST in loopback timer when device is not running in rose
- **fixed** — Fix netdev double-hold in rose_make_new()
- **fixed** — Fix notifier unregistered too early in rose_exit()
- **fixed** — Fix netdev double-hold in rose_rx_call_request()
- **fixed** — Guard rose_neigh_put() against NULL in timer expiry
- **fixed** — Clear neighbour pointer after rose_neigh_put() in state machines
- **fixed** — Fix race between loopback timer and module removal in rose
- **fixed** — Hold loopback neighbour reference across timer callback in rose
- **fixed** — Fix dev_put() leak in rose_loopback_timer()
- **fixed** — Serialize IMSIC attributes with vCPU migration in RISC-V KVM

The 110 most recent commits in this release — the full changelog is longer:

- Linux 6.12.112
- mm/hugetlb: keep max_huge_pages when dissolving surplus folios
- bpf: Reject key-less BTF for hash maps
- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
- platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
- mtd: rawnand: pl353: Fix debug prints
- tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
- bootconfig: Fix negative seeks on 32-bit with LFS enabled
- nvme: revert the cross-controller atomic write size validation
- rose: cancel neighbour timers in rose_neigh_put() before freeing
- rose: drop CALL_REQUEST in loopback timer when device is not running
- rose: fix netdev double-hold in rose_make_new()
- rose: fix notifier unregistered too early in rose_exit()
- rose: fix netdev double-hold in rose_rx_call_request()
- rose: guard rose_neigh_put() against NULL in timer expiry
- rose: clear neighbour pointer after rose_neigh_put() in state machines
- rose: fix race between loopback timer and module removal
- rose: hold loopback neighbour reference across timer callback
- rose: fix dev_put() leak in rose_loopback_timer()
- RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
- RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
- perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
- perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
- perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints
- perf/x86/intel: Update event constraints and cache_extra_regsfor LNL
- net: ena: fix MMIO read buffer leak on probe failure
- net: ena: Remove autopolling mode
- net: ipconfig: bound DHCP option construction
- net: ipconfig: Remove outdated comment and indent code block
- net/sched: act_ct: avoid modifying shared unconfirmed ct entry
- net/sched: act_ct: fix helper UAF due to extensions realloc
- HID: alps: unregister DualPoint Stick input device on remove
- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
- packet: use ubuf_info completion for TX_RING packets
- PCI: Fix BAR resize for devices on a root bus
- PCI: Fix Resizable BAR restore order
- super: make iterate_supers_type() deletion-safe
- mm/hugetlb: do not dissolve gigantic pages without runtime support
- mm/hugetlb: create hstate_is_gigantic_no_runtime helper
- mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
- mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
- drm/xe/vm: nuke PTs only after unlinking contested VMAs
- mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
- mm/rmap: allocate anon_vma_chain objects unlocked when possible
- drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
- drm/i915/mst: add mst sub-struct to struct intel_dp
- drm/client: fix restore of partially initialized client
- drm/client: Pass force parameter to client restore
- drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
- i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
- bna: prevent IOC timer rearm during teardown
- ipe: fix use-after-free when auditing a newly loaded policy
- gpio: cdev: fix kernel stack leak to user-space in error path
- vlan: require the MAC header to be present in __vlan_insert_inner_tag()
- arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
- smb/client: send lease break ACKs thru correct session for multiuser mounts
- smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
- drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
- drm: add drm_memory_stats_is_zero
- smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
- drm/amdgpu: fix rmmio iounmap skipped on device removal
- drm/amdgpu: use GFP_NOWAIT for memory allocations
- drm/amdgpu/umsch: remove vpe test from umsch
- drm/amdgpu: Failed to check various return code
- smb: client: fix use-after-free of iface

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.112]_

### 6.1.189

- Date: 2026-10-03
- Version: 6.1.189
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.189
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.1.189
- Labels: longterm

- **fixed** — ALSA: hda: Fix missing pointer check in hda_component_manager_init function
- **fixed** — drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
- **changed** — lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- **changed** — lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
- **fixed** — net: tls: fix silent data drop under pipe back-pressure
- **fixed** — xfs: fix blockgc group quota scanning when usrquota isn't enforced
- **fixed** — smb: client: validate POSIX create context length
- **fixed** — Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- **fixed** — Bluetooth: L2CAP: validate frame length before control and FCS access
- **fixed** — Bluetooth: hci_sock: reject out-of-range OCF values
- **fixed** — Bluetooth: hci_sock: validate event length before filtering
- **fixed** — RISC-V: KVM: Synchronize hrtimer callback during teardown
- **fixed** — s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- **fixed** — pinctrl: single: free the IRQ on domain creation failure
- **fixed** — scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- **fixed** — nfc: port100: reject frames whose declared length exceeds the received data
- **fixed** — nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- **fixed** — nfc: fix use-after-free in nfc_get_local_general_bytes
- **fixed** — netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- **fixed** — netfilter: ip6t_rpfilter: reject routes without inet6_dev

The 115 most recent commits in this release — the full changelog is longer:

- Linux 6.1.189
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
- lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
- tools/thermal/tmon: Fix compilation warning for wrong format
- perf test: Change all remaining #!/bin/sh to #!/bin/bash
- net: tls: fix silent data drop under pipe back-pressure
- xfs: fix blockgc group quota scanning when usrquota isn't enforced
- smb: client: validate POSIX create context length
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- Bluetooth: L2CAP: validate frame length before control and FCS access
- Bluetooth: hci_sock: reject out-of-range OCF values
- Bluetooth: hci_sock: validate event length before filtering
- RISC-V: KVM: Synchronize hrtimer callback during teardown
- s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- pinctrl: single: free the IRQ on domain creation failure
- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- nfc: port100: reject frames whose declared length exceeds the received data
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- nfc: fix use-after-free in nfc_get_local_general_bytes
- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- netfilter: ip6t_rpfilter: reject routes without inet6_dev
- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
- net: atl1c: fix soft lockup on out-of-range tpd_cons read
- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
- net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
- net: arp: terminate device name before lookup
- net/sched: reject IDR error pointers when deleting actions
- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
- HID: alps: fix use-after-free on input2 registration failure
- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
- drm/nouveau: Fix gem reference leak in validate_init()
- drm/nouveau: fix double-free in nvif_vmm_dtor
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
- drm/nouveau: fix autosuspend cleanup during teardown
- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
- drm/i915: fix incorrect RCU teardown order
- rds: ib: Clear the sg list when mapping an MR fails
- llc: reserve device headroom for allocated frames
- gpio: zynq: fix runtime PM leak on request error path
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end
- fsl/fman: Fix clk reference leak in read_dts_node()
- writeback: report a Tasks-RCU quiescent state per cgwb drain pass
- workqueue: Fix NULL current_pwq deref in flush dependency check
- writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
- sctp: discard the rest of the packet on a stale-cookie error
- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
- net: wwan: t7xx: validate the netif index in t7

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.189]_

### 6.18.55

- Date: 2026-10-03
- Version: 6.18.55
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.55
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.18.55
- Labels: longterm

- **fixed** — Reject key-less BTF for hash maps in BPF
- **fixed** — Don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in rose state 3
- **fixed** — Use timer_shutdown_sync() for t0timer teardown in rose
- **fixed** — Guard rose_transmit_link() against a NULL neighbour
- **fixed** — Keep the route needed for routing loop detection in rose
- **fixed** — Avoid double unload_nls() on mount failure in hfsplus
- **fixed** — Fix unconditionally skip last region in mm/damon/core
- **fixed** — Fix off-by-one bit positions in device status accessors in rust net phy
- **fixed** — Serialize IMSIC attributes with vCPU migration in RISC-V KVM
- **fixed** — Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
- **fixed** — Avoid modifying shared unconfirmed ct entry in net/sched act_ct
- **fixed** — Fix helper UAF due to extensions realloc in net/sched act_ct
- **fixed** — Make vTPM SVSM calls preemption-safe in x86/sev
- **fixed** — Remove incorrect LionCove PEBS data-source constraints in perf/x86/intel
- **fixed** — Fix GRT PEBS load/store direction for latency events in perf/x86/intel
- **fixed** — Bound DHCP option construction in net ipconfig
- **fixed** — Fix dma_alloc_coherent() leak on macb_alloc() error paths in net macb
- **fixed** — Unregister DualPoint Stick input device on remove in HID alps
- **fixed** — Fix BAR resize for devices on a root bus in PCI

The 116 most recent commits in this release — the full changelog is longer:

- Linux 6.18.55
- bpf: Reject key-less BTF for hash maps
- rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3
- rose: use timer_shutdown_sync() for t0timer teardown
- rose: guard rose_transmit_link() against a NULL neighbour
- rose: keep the route needed for routing loop detection
- sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
- hfsplus: avoid double unload_nls() on mount failure
- mm/damon/core: fix unconditionally skip last region
- rust: net: phy: fix off-by-one bit positions in device status accessors
- Revert "rust: net: phy: fix off-by-one bit positions in device status accessors"
- RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
- RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
- net/sched: act_ct: avoid modifying shared unconfirmed ct entry
- net/sched: act_ct: fix helper UAF due to extensions realloc
- x86/sev: Make vTPM SVSM calls preemption-safe
- x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()
- x86/sev: Carve out the SVSM code into a separate compilation unit
- x86/sev: Add internal header guards
- x86/sev: Move the internal header
- perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints
- perf/x86/intel: Update event constraints and cache_extra_regsfor LNL
- perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
- perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
- net: ipconfig: bound DHCP option construction
- net: ipconfig: Remove outdated comment and indent code block
- net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
- HID: alps: unregister DualPoint Stick input device on remove
- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
- PCI: Fix BAR resize for devices on a root bus
- super: make iterate_supers_type() deletion-safe
- mm/hugetlb: do not dissolve gigantic pages without runtime support
- mm/hugetlb: create hstate_is_gigantic_no_runtime helper
- mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
- mm/rmap: allocate anon_vma_chain objects unlocked when possible
- drm/client: fix restore of partially initialized client
- drm/client: Pass force parameter to client restore
- drm/client: Remove holds_console_lock parameter from suspend/resume
- drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
- drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1
- drm/i915/psr: Disable PSR2 on Xiaomi Book Pro 14 2026 as a quirk
- drm/i915/psr: Fixes for Dell XPS DA14260 quirk
- drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk
- i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
- vlan: require the MAC header to be present in __vlan_insert_inner_tag()
- cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict
- cgroup/cpuset: Ensure domain isolated CPUs stay in root or isolated partition
- cgroup/cpuset: Move up prstate_housekeeping_conflict() helper
- net: tls: fix silent data drop under pipe back-pressure
- xfs: fix cursor and pointer handling when recovering iunlink buckets
- xfs: fix blockgc group quota scanning when usrquota isn't enforced
- xfs: don't let hidden_space go negative in xfs_metafile_resv_init
- xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits
- xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
- xfs: fix rtgroup repair estimations
- xfs: check di_forkoff correctly in scrub
- xfs: use the correct reservations for rtrmap/refcount recovery
- xfs: don't call xfs_exchange_range_finish for a dry run
- xfs: check padding field in xfs_ioc_commit_range
- xfs: use correct jiffies comparison function in xchk_maybe_relax
- xfs: release orphanage dir inode if chown fails
- xfs: fix attr fork block count checks in xrep_inode_blockcounts
- xfs: don't assert when XFS_

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.55]_

### 5.15.222

- Date: 2026-10-03
- Version: 5.15.222
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.222
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/5.15.222
- Labels: longterm

- **fixed** — Check kcalloc() return value for WS buffer in amdgpu_atom_execute_table_locked()
- **changed** — Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- **changed** — Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
- **fixed** — Fix ep_remove struct eventpoll / struct file UAF in eventpoll
- **fixed** — Fix silent data drop under pipe back-pressure in net tls
- **fixed** — Fix blockgc group quota scanning when usrquota isn't enforced in xfs
- **fixed** — Fix NULL dereference of dlc->session in RFCOMM_CONNINFO in Bluetooth RFCOMM
- **fixed** — Validate frame length before control and FCS access in Bluetooth L2CAP
- **fixed** — Reject out-of-range OCF values in Bluetooth hci_sock
- **fixed** — Validate event length before filtering in Bluetooth hci_sock
- **fixed** — Fix NULL pointer dereference in ccw_device_get_util_str() on s390 cio
- **fixed** — Free the IRQ on domain creation failure in pinctrl single
- **fixed** — Check the data direction of a Data-In PDU in scsi libiscsi_tcp
- **fixed** — Reject frames whose declared length exceeds the received data in nfc port100
- **fixed** — Drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- **fixed** — Fix use-after-free in nfc_get_local_general_bytes
- **fixed** — Fix zero-address non-strict match out-of-bounds read in netfilter ip6t_rt
- **fixed** — Reject routes without inet6_dev in netfilter ip6t_rpfilter
- **fixed** — Fix soft lockup on out-of-range hw_next_to_clean read in net atl1e

The 117 most recent commits in this release — the full changelog is longer:

- Linux 5.15.222
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
- lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
- tools/thermal/tmon: Fix compilation warning for wrong format
- perf test: Change all remaining #!/bin/sh to #!/bin/bash
- eventpoll: fix ep_remove struct eventpoll / struct file UAF
- eventpoll: move epi_fget() up
- eventpoll: rename ep_remove_safe() back to ep_remove()
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
- eventpoll: kill __ep_remove()
- eventpoll: split __ep_remove()
- eventpoll: use hlist_is_singular_node() in __ep_remove()
- file: add fput() cleanup helper
- eventpoll: don't decrement ep refcount while still holding the ep mutex
- net: tls: fix silent data drop under pipe back-pressure
- xfs: fix blockgc group quota scanning when usrquota isn't enforced
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- Bluetooth: L2CAP: validate frame length before control and FCS access
- Bluetooth: hci_sock: reject out-of-range OCF values
- Bluetooth: hci_sock: validate event length before filtering
- s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- pinctrl: single: free the IRQ on domain creation failure
- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- nfc: port100: reject frames whose declared length exceeds the received data
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- nfc: fix use-after-free in nfc_get_local_general_bytes
- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- netfilter: ip6t_rpfilter: reject routes without inet6_dev
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
- net: atl1c: fix soft lockup on out-of-range tpd_cons read
- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
- net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
- net: arp: terminate device name before lookup
- net/sched: reject IDR error pointers when deleting actions
- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
- HID: alps: fix use-after-free on input2 registration failure
- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
- drm/nouveau: Fix gem reference leak in validate_init()
- drm/nouveau: fix double-free in nvif_vmm_dtor
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
- drm/nouveau: fix autosuspend cleanup during teardown
- rds: ib: Clear the sg list when mapping an MR fails
- llc: reserve device headroom for allocated frames
- gpio: zynq: fix runtime PM leak on request error path
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end
- fsl/fman: Fix clk reference leak in read_dts_node()
- writeback: report a Tasks-RCU quiescent state per cgwb drain pass
- workqueue: Fix NULL current_pwq deref in flush dependency check
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
- sctp: discard the rest of the packet on a stale-cookie error
- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
- x86/mm: Fix check/use ordering in switch_mm_irqs_off()
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
- KVM: x86: Fix shadow paging use-after-fre

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.222]_

### 6.6.158

- Date: 2026-10-03
- Version: 6.6.158
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.158
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.6.158
- Labels: longterm

- **fixed** — net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling
- **fixed** — crypto: atmel-ecc - avoid stale fallback key after set_secret failure
- **fixed** — netfilter: nf_tables: don't queue packet path object notifications
- **changed** — netfilter: nf_tables: place base_seq in struct net
- **fixed** — crypto: virtio - bound the akcipher result length
- **fixed** — vlan: fix skb_under_panic and races when toggling HW VLAN offload
- **changed** — vlan: defer real device state propagation to netdev_work
- **changed** — net/packet: defer vmalloc TX_RING free until skbs finish
- **fixed** — gtp: serialize PDP context updates
- **fixed** — usb: xhci: bail out of setup if the controller is inaccessible
- **changed** — usb: xhci: implement USB Port Register Set struct
- **fixed** — ALSA: hda: Fix missing pointer check in hda_component_manager_init function
- **fixed** — drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
- **changed** — lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- **fixed** — net: tls: fix silent data drop under pipe back-pressure
- **fixed** — bpf: Defer work in bpf_timer_cancel_and_free
- **fixed** — smb: client: validate POSIX create context length
- **fixed** — Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- **fixed** — Bluetooth: L2CAP: validate frame length before control and FCS access
- **fixed** — netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

The 101 most recent commits in this release — the full changelog is longer:

- Linux 6.6.158
- net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling
- crypto: atmel-ecc - avoid stale fallback key after set_secret failure
- netfilter: nf_tables: don't queue packet path object notifications
- netfilter: nf_tables: place base_seq in struct net
- netfilter: nft_set_rbtree: Remove unused variable nft_net
- crypto: virtio - bound the akcipher result length
- crypto: virtio - Drop superfluous [as]kcipher_req pointer
- crypto: virtio - Drop superfluous [as]kcipher_ctx pointer
- crypto: virtio - Drop sign/verify operations
- crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection
- vlan: fix skb_under_panic and races when toggling HW VLAN offload
- vlan: defer real device state propagation to netdev_work
- net/packet: defer vmalloc TX_RING free until skbs finish
- gtp: serialize PDP context updates
- usb: xhci: bail out of setup if the controller is inaccessible
- usb: xhci: simplify handling of Structural Parameters 1 values
- usb: xhci: use cached HCSPARAMS1 value
- usb: xhci: implement USB Port Register Set struct
- usb: xhci: add USB Port Register Set struct
- usb: xhci: add helper to read PORTSC register
- usb: xhci: add tracing for PORTSC register writes
- ALSA: hda: Fix missing pointer check in hda_component_manager_init function
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
- lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
- tools/thermal/tmon: Fix compilation warning for wrong format
- nvme-fabrics: use reserved tag for reg read/write command
- perf test: Change all remaining #!/bin/sh to #!/bin/bash
- drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()
- drm/amd/display: Validate function returns
- drm/amd/display: Check null pointers before using them
- drm/amd/display: Ensure array index tg_inst won't be -1
- drm/amd/display: Add a dc_state NULL check in dc_state_release
- wifi: ath12k: check M3 buffer size as well whey trying to reuse it
- wifi: ath12k: fix kernel crash during resume
- net: tls: fix silent data drop under pipe back-pressure
- cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
- bpf: Defer work in bpf_timer_cancel_and_free
- bpf: Fail verification for sign-extension of packet data/data_end/data_meta
- xfs: fix blockgc group quota scanning when usrquota isn't enforced
- smb: client: validate POSIX create context length
- smb: client: fix create context out-of-bounds reads
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- Bluetooth: mgmt: fix race in read_unconf_index_list()
- Bluetooth: L2CAP: validate frame length before control and FCS access
- Bluetooth: ISO: balance the parent hold in hci_bind_bis()
- Bluetooth: hci_sock: reject out-of-range OCF values
- Bluetooth: hci_sock: validate event length before filtering
- Bluetooth: hci_conn: fix CIS hold ownership on reuse
- RISC-V: KVM: Fix HSM hart status error propagation
- RISC-V: KVM: Synchronize hrtimer callback during teardown
- s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- pinctrl: single: free the IRQ on domain creation failure
- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- nfc: port100: reject frames whose declared length exceeds the received data
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- nfc: fix use-after-free in nfc_get_local_general_bytes
- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- netfilter: ip6t_rpfilter: reject routes without inet6_dev
- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
- net: atl1c: fix sof

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.158]_

### 7.3-rc5

- Date: 2026-09-27
- Version: 7.3-rc5
- Original notes: https://git.kernel.org/torvalds/h/v7.3-rc5
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.3-rc5
- Labels: Pre-release; mainline

### 7.2.8

- Date: 2026-09-25
- Version: 7.2.8
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.8
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2.8
- Labels: stable

- **fixed** — ksmbd: fix partial normalized name responses
- **fixed** — drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only
- **fixed** — drm/ttm: fix swapped-out resources never leaving their bulk_move range
- **fixed** — ntsync: reject wait ioctls with zero owner
- **fixed** — drm/amdgpu: Fix GPU PCIe link capability reporting
- **changed** — drm/amdgpu: reduce early full GPU access during SR-IOV init
- **fixed** — scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
- **changed** — scsi: fnic: Make debug logging protocol independent
- **fixed** — fs: fix missed removal of super_fs_objects_eligible()
- **fixed** — fs/super: skip non-memcg-aware nr_cached_objects in memcg slab shrink
- **fixed** — smb: client: fix missing iov bounds check in parse_posix_sids()
- **fixed** — smb: client: fix missing lower-bound check on DFS referral string offsets
- **fixed** — smb: client: fix server->total_read for compound encrypted PDUs
- **fixed** — smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
- **fixed** — smb: client: fix potential OOB read in smb3_enum_snapshots()
- **fixed** — smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
- **fixed** — smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
- **fixed** — smb: client: fix fattr leaking on wsl_to_fattr() failure
- **fixed** — smb: client: fix unaligned access in WSL reparse point parser
- **fixed** — smb: client: fix smbd_connection leak on cifs_get_tcp_session() error

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.2.8
- ksmbd: fix partial normalized name responses
- drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only
- drm/ttm: fix swapped-out resources never leaving their bulk_move range
- ntsync: reject wait ioctls with zero owner
- drm/amdgpu: Fix GPU PCIe link capability reporting
- drm/amdgpu: reduce early full GPU access during SR-IOV init
- scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
- scsi: fnic: Bump up version number
- scsi: fnic: Make debug logging protocol independent
- fs: fix missed removal of super_fs_objects_eligible()
- fs/super: skip non-memcg-aware nr_cached_objects in memcg slab shrink
- smb: client: fix missing iov bounds check in parse_posix_sids()
- smb: client: fix missing lower-bound check on DFS referral string offsets
- smb: client: fix server->total_read for compound encrypted PDUs
- smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
- smb: client: fix potential OOB read in smb3_enum_snapshots()
- smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
- smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
- smb: client: fix fattr leaking on wsl_to_fattr() failure
- smb: client: fix unaligned access in WSL reparse point parser
- smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
- smb: client: reject short Next offsets in parse_server_interfaces()
- smb: client: fix use-after-free of iface in cifs_try_adding_channels()
- smb: client: fix rlist race and missing initialization
- smb/client: send lease break ACKs thru correct session for multiuser mounts
- smb: client: cancel reconnect work in clean_demultiplex_info()
- drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1
- drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
- drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
- drm/amdgpu: Skip KFD mapping clear before initialization
- drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
- drm/amdgpu: fix rmmio iounmap skipped on device removal
- drm/sched: Fix virtual runtime race
- drm/msm: RCU-free the scheduler-containing ring and VM objects
- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
- drm/msm/dpu: clear pending peripheral flush state
- drm/msm/adreno: fix autosuspend cleanup during teardown
- drm/gud: Ignore damage clips in full update mode
- drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
- wifi: mac80211: refuse to make a monitor active when it has no queue
- wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
- wifi: mwifiex: validate action frame fixed fields
- wifi: mwifiex: prevent authentication frame length truncation
- wifi: mwifiex: validate scan response extents
- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
- wifi: p54: validate curve data length in the calibration curve converters
- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
- wifi: wilc1000: fix out-of-bounds read in P2P public action frames
- wifi: wlcore: release runtime PM ref on regdomain config failure
- wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
- wifi: rsi: fix heap OOB write on key removal
- wifi: libipw: reject TKIP frames without a full MIC
- wifi: libertas_tf: fix UAF in lbtf_free_adapter()
- wifi: iwlegacy: fix broadcast stations deallocation
- wifi: brcmsmac: fix UAF in brcms_free_timer()
- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
- watchdog: rzv2h: Avoid division by zero
- watchdog: rtd119x: Avoid division by zero
- watchdog: msc313e: Propagate error code in resume()
- watchdog: msc313e: Fix premature reset during timeout update
- watchdog: digi

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.8]_

### 6.18.54

- Date: 2026-09-25
- Version: 6.18.54
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.54
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.18.54
- Labels: longterm

- **fixed** — smb/client: send lease break ACKs thru correct session for multiuser mounts
- **fixed** — Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device
- **fixed** — ASoC: sdw_utils: subtract the endpoint that is not present
- **fixed** — wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor()
- **fixed** — ksmbd: fix partial normalized name responses
- **fixed** — smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
- **fixed** — wifi: libipw: reject TKIP frames without a full MIC
- **fixed** — wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211
- **fixed** — drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
- **fixed** — drm/amdgpu: lock bo before calling amdgpu_vm_bo_update_shared
- **fixed** — xfs: fix under-reservation of blocks when repairing sf directories
- **fixed** — xfs: remove the i_ino field in struct xfs_inode
- **fixed** — smb: client: fix cifsFileInfo reference leak in deferred close
- **fixed** — scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
- **fixed** — wifi: mac80211: refuse to make a monitor active when it has no queue
- **fixed** — wifi: mac80211: track MU-MIMO configuration on disabled interfaces
- **fixed** — mm/vma: correctly unaccount on mmap_prepare() failure
- **fixed** — 9p: Fix v9fs_issue_write() to update i_size and remote_i_size
- **fixed** — mm/huge_memory: bypass THP tuneables for huge pfnmap mappings
- **fixed** — xfrm: save input state data before secpath resets

The 120 most recent commits in this release — the full changelog is longer:

- Linux 6.18.54
- smb/client: send lease break ACKs thru correct session for multiuser mounts
- Revert "ksmbd: Fix to handle removal of rfc1002 header from smb_hdr"
- Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device
- ASoC: sdw_utils: subtract the endpoint that is not present
- wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor()
- ksmbd: fix partial normalized name responses
- smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
- wifi: libipw: reject TKIP frames without a full MIC
- wifi: ipw2x00: Use michael_mic() from cfg80211
- wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211
- wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic()
- drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
- drm/amdgpu: lock bo before calling amdgpu_vm_bo_update_shared
- xfs: fix under-reservation of blocks when repairing sf directories
- xfs: remove the i_ino field in struct xfs_inode
- xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt
- xfs: add a xfs_rmap_inode_owner helper
- smb: client: fix cifsFileInfo reference leak in deferred close
- scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
- scsi: fnic: Bump up version number again
- scsi: fnic: Make debug logging protocol independent
- scsi: fnic: Bump up version number
- scsi: fnic: Rename fnic_scsi_fcpio_reset()
- wifi: mac80211: refuse to make a monitor active when it has no queue
- wifi: mac80211: track MU-MIMO configuration on disabled interfaces
- mm/vma: correctly unaccount on mmap_prepare() failure
- 9p: Fix v9fs_issue_write() to update i_size and remote_i_size
- mm/huge_memory: bypass THP tuneables for huge pfnmap mappings
- xfrm: save input state data before secpath resets
- xfrm: Fix dev use-after-free in xfrm async resumption
- xfrm: Refactor xfrm_input lock to reduce contention with RSS
- signal: Prevent exec() race
- signal: Move MMCID exit out of sighand lock
- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling
- smb: client: fix busy dentry warning on unmount after DIO
- ntsync: reject wait ioctls with zero owner
- ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts
- time/namespace: Export init_time_ns and do_timens_ktime_to_host()
- HID: asus: fortify keyboard handshake
- smb: client: fix missing iov bounds check in parse_posix_sids()
- smb: client: fix missing lower-bound check on DFS referral string offsets
- smb: client: fix server->total_read for compound encrypted PDUs
- smb: client: fix potential OOB read in smb3_enum_snapshots()
- smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
- smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
- smb: client: fix unaligned access in WSL reparse point parser
- smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
- smb: client: reject short Next offsets in parse_server_interfaces()
- smb: client: fix use-after-free of iface in cifs_try_adding_channels()
- smb: client: fix rlist race and missing initialization
- smb: client: cancel reconnect work in clean_demultiplex_info()
- drm/amdgpu: fix rmmio iounmap skipped on device removal
- drm/msm: RCU-free the scheduler-containing ring and VM objects
- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
- drm/msm/dpu: clear pending peripheral flush state
- drm/msm/adreno: fix autosuspend cleanup during teardown
- drm/gud: Ignore damage clips in full update mode
- drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
- wifi: mwifiex: validate action frame fixed fields
- wifi: mwifiex: prevent authentication frame length truncation
- wifi: mwifiex: validate scan response extents
- wifi: mwifiex: bound the pairwis

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.54]_

### 6.18.53

- Date: 2026-09-21
- Version: 6.18.53
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.53
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.18.53
- Labels: longterm

- **fixed** — mptcp: fix bad accounting in __mptcp_subflow_push_pending()
- **fixed** — mptcp: close race between scheduler and state change
- **fixed** — mptcp: avoid unneeded actions on subflow reset
- **changed** — mptcp: move the stale logic out of retrans scheduler
- **fixed** — x86/mm: Fix and document DEBUG_PAGEALLOC
- **fixed** — misc: amd-sbi: Add null check for devm_kasprintf()
- **fixed** — drm/ttm: Fix bo resource use-after-free
- **changed** — drm/ttm: Drop tt->restore after successful restore
- **changed** — smb: client: use atomic_t for mnt_cifs_flags
- **fixed** — smb: client: fail DACL rewrite when the new DACL exceeds 64K
- **fixed** — smb/client: fix security flag calculation when setting security descriptors
- **changed** — smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl()
- **fixed** — mptcp: prevent race between disconnect() and rtx
- **changed** — mptcp: do not reschedule the RTX timer for fallback sockets
- **removed** — tcp: remove icsk->icsk_retransmit_timer
- **added** — tcp: introduce icsk->icsk_keepalive_timer
- **changed** — tcp: rename icsk_timeout() to tcp_timeout_expires()
- **fixed** — bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
- **fixed** — landlock: Fix use-after-free of the source's parent directory
- **fixed** — netfilter: cttimeout: prevent UAF during module unload

The 116 most recent commits in this release — the full changelog is longer:

- Linux 6.18.53
- mptcp: fix bad accounting in __mptcp_subflow_push_pending()
- mptcp: close race between scheduler and state change
- mptcp: avoid unneeded actions on subflow reset
- mptcp: move the stale logic out of retrans scheduler
- x86/mm: Fix and document DEBUG_PAGEALLOC
- misc: amd-sbi: Add null check for devm_kasprintf()
- drm/ttm: Fix bo resource use-after-free
- drm/ttm: Drop tt->restore after successful restore
- drm/ttm: Tidy usage of local variables a little bit
- smb: client: use atomic_t for mnt_cifs_flags
- smb: client: fail DACL rewrite when the new DACL exceeds 64K
- smb/client: fix security flag calculation when setting security descriptors
- smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl()
- mptcp: prevent race between disconnect() and rtx
- mptcp: do not reschedule the RTX timer for fallback sockets
- tcp: remove icsk->icsk_retransmit_timer
- tcp: introduce icsk->icsk_keepalive_timer
- tcp: rename icsk_timeout() to tcp_timeout_expires()
- bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
- Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path"
- fwctl/bnxt_en: Move common definitions to include/linux/bnxt/
- mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
- landlock: Fix use-after-free of the source's parent directory
- landlock: Use mem_is_zero() in is_layer_masks_allowed()
- landlock: Transpose the layer masks data structure
- landlock: Add access_mask_subset() helper
- landlock: Clarify documentation for the IOCTL access right
- idpf: disable DIM work before freeing q_vectors
- idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it
- idpf: introduce local idpf structure to store virtchnl queue chunks
- idpf: Fix kernel-doc descriptions to avoid warnings
- erofs: add sysfs feature entry for xattr prefixes
- erofs: separate plain and compressed filesystems formally
- net: macb: initialize PTP state before registering clock
- net: macb: unify device pointer naming convention
- net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI
- net: macb: Replace open-coded implementation with napi_schedule()
- exit: hold a reference to thread_pid across proc_flush_pid
- ns: rename to exit_nsproxy_namespaces()
- ns: add __ns_ref_read()
- netfilter: cttimeout: prevent UAF during module unload
- netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
- EDAC/altera: Use parent device for devres in altr_portb_setup()
- EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout
- tracing: Undo the registration when enabling the histogram trigger fails
- tracing: Take the reference before publishing the named histogram trigger
- tracing: Set the trace clock before registering the histogram trigger
- tracing: Merge struct event_trigger_ops into struct event_command
- tracing: Remove get_trigger_ops() and add count_func() from trigger ops
- xfs: initialise args->total for parent pointer updates
- drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()
- drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output
- drm/amd/display: Propagate HDMI RGB quantization selectability
- drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
- drm/amd/display: Rebuild InfoFrames on output color space changes
- io_uring/rw: end write accounting from ->ki_complete
- genetlink: pin family module during policy dump
- bootconfig: Fix integer overflow in initrd size check
- init/main: read bootconfig header with get_unaligned_le32()
- x86/mm/pat: Allocate split page tables as kernel page tables
- x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF
- x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()
- x86/mm/pat: Convert split_large_page() to use ptdescs
- configfs: unhash the dentry before dropping the item in rmdir
- ipmr: account multicast table and route memory
- drm/pagemap: dm

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.53]_

### 7.2.7

- Date: 2026-09-21
- Version: 7.2.7
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.7
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2.7
- Labels: stable

- **fixed** — mptcp: fix bad accounting in __mptcp_subflow_push_pending()
- **fixed** — mptcp: close race between scheduler and state change
- **fixed** — mptcp: avoid unneeded actions on subflow reset
- **changed** — mptcp: move the stale logic out of retrans scheduler
- **fixed** — x86/mm: Fix and document DEBUG_PAGEALLOC
- **fixed** — misc: amd-sbi: Add null check for devm_kasprintf()
- **fixed** — x86/mm/pat: Allocate split page tables as kernel page tables
- **added** — s390/pai: Support CPU hotplug for PMU PAI
- **changed** — s390/pai: Move locking to event init and delete
- **changed** — s390/pai: Use PAI PMU index as parameter replacing event
- **fixed** — drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output
- **changed** — drm/amd/display: Propagate HDMI RGB quantization selectability
- **fixed** — scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
- **fixed** — scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
- **fixed** — scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
- **fixed** — scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
- **fixed** — scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
- **fixed** — scsi: qla2xxx: Skip vport under deletion in report ID acquisition
- **fixed** — scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
- **fixed** — scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.2.7
- mptcp: fix bad accounting in __mptcp_subflow_push_pending()
- mptcp: close race between scheduler and state change
- mptcp: avoid unneeded actions on subflow reset
- mptcp: move the stale logic out of retrans scheduler
- x86/mm: Fix and document DEBUG_PAGEALLOC
- misc: amd-sbi: Add null check for devm_kasprintf()
- x86/mm/pat: Allocate split page tables as kernel page tables
- s390/pai: Support CPU hotplug for PMU PAI
- s390/pai: Move locking to event init and delete
- s390/pai: Use PAI PMU index as parameter replacing event
- drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output
- drm/amd/display: Propagate HDMI RGB quantization selectability
- scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
- scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
- scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
- scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
- scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
- scsi: qla2xxx: Skip vport under deletion in report ID acquisition
- scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
- scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
- EDAC/altera: Use parent device for devres in altr_portb_setup()
- x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF
- x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()
- platform/x86: hp-wmi: Fix board_params typo for 8DD6 board
- platform/x86: hp-wmi: Introduce board-specific feature data
- drm/xe/i2c: Fix the interrupt handling
- i2c: designware: Global register definitions
- accel/amdxdna: Disable device buffer exporting
- drm/i915/cdclk: Avoid spurious cdclk sanitization on PTL+
- f2fs: fix to reset all pinned status during fggc
- f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
- f2fs: accurately adjust free_sections during free_segment_range
- scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
- scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
- scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
- scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
- scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
- media: qcom: iris: fix runtime PM reference leaks
- media: remove conditional return with no effect
- hwmon: (asus_rog_ryujin) Synchronize HID command and report handling
- hwmon: (asus_rog_ryujin) Validate HID report lengths
- hwmon: (asus_rog_ryujin) Add per-device configuration
- usb: usbtmc: don't store usb_device_id
- usb: xusbatm: don't rely on id table pointer arithmetic
- net: usb: pegasus: don't rely on id table pointer arithmetic
- usb: serial: spcp8x5: don't store usb_device_id
- media: as102: do not rely on id table address comparison
- wifi: ath9k_htc: don't store usb_device_id
- ASoC: cs35l56: Fix race between kexec and snd_soc_register_component()
- xfs: actually check internal-rtdev fields in the superblock
- xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent
- xfs: advance the findparent inode scan cursor while holding ILOCK
- xfs: always set xfs_healthmon::first_event when inserting at front of list
- xfs: bail out on bitmap errors in xrep_agfl_fill
- xfs: bump lost_prev_errors if we lose even the healthmon lost event
- xfs: check healthmon outbuffer space correctly
- xfs: compute dquot checksum after resetting dd_lsn in repair
- xfs: count escaped corruption errors in scrub stats
- xfs: cross-reference the rtgroup superblock extent, not block
- xfs: destroy seen inode bitmap when we fail to add a dirpath
- xfs: don't leak dqacct if rhashtable insertion fails
- xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails
- xfs: don't modify file attributes or poke fsnotify for dry runs
- xfs: don't spin forever on zero-length dirents when salvaging them
- xfs: don't stash removename operations with

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.7]_

### 6.12.111

- Date: 2026-09-21
- Version: 6.12.111
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.111
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.12.111
- Labels: longterm

- **fixed** — mptcp: fix bad accounting in __mptcp_subflow_push_pending()
- **fixed** — mptcp: close race between scheduler and state change
- **fixed** — mptcp: avoid unneeded actions on subflow reset
- **fixed** — SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
- **changed** — workqueue: Update documentation as per system_percpu_wq naming
- **fixed** — mm, hugetlb: increment the number of pages to be reset on HVO
- **fixed** — ocfs2: validate directory-index entry counts when reading metadata
- **fixed** — ocfs2: validate dx_root extent list fields during block read
- **fixed** — sched_ext: Fix inverted ops.core_sched_before() invocation
- **fixed** — svcrdma: Reject Write/Reply chunks with segcount 0
- **fixed** — svcrdma: Adjust the number of entries in svc_rdma_recv_ctxt::rc_pages
- **added** — sunrpc: Add a helper to derive maxpages from sv_max_mesg
- **fixed** — svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
- **fixed** — svcrdma: Release transport resources synchronously
- **fixed** — rpcrdma: arm rn_done before publishing the notification
- **fixed** — sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
- **fixed** — rpc_pipe: don't overdo directory locking
- **fixed** — SUNRPC: fix gssx_dec_option_array error path bugs
- **fixed** — sunrpc: defer rq_argp and rq_resp free until after RCU grace period

The 120 most recent commits in this release — the full changelog is longer:

- Linux 6.12.111
- mptcp: fix bad accounting in __mptcp_subflow_push_pending()
- mptcp: close race between scheduler and state change
- mptcp: avoid unneeded actions on subflow reset
- SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
- workqueue: Update documentation as per system_percpu_wq naming
- mm, hugetlb: increment the number of pages to be reset on HVO
- ocfs2: validate directory-index entry counts when reading metadata
- ocfs2: validate dx_root extent list fields during block read
- sched_ext: Fix inverted ops.core_sched_before() invocation
- svcrdma: Reject Write/Reply chunks with segcount 0
- svcrdma: Adjust the number of entries in svc_rdma_recv_ctxt::rc_pages
- sunrpc: Add a helper to derive maxpages from sv_max_mesg
- svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
- svcrdma: Release transport resources synchronously
- rpcrdma: arm rn_done before publishing the notification
- sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
- rpc_pipe: don't overdo directory locking
- rpc_mkpipe_dentry(): saner calling conventions
- rpc_populate(): lift cleanup into callers
- SUNRPC: fix gssx_dec_option_array error path bugs
- sunrpc: defer rq_argp and rq_resp free until after RCU grace period
- SUNRPC: Update svcxdr_init_decode() to call xdr_set_scratch_folio()
- SUNRPC: Introduce xdr_set_scratch_folio()
- ip: orphan prefetched skbs before multicast forwarding
- ipv6: ip6_mc_input() and ip6_mr_input() cleanups
- ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers
- ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
- ipv6: annotate data-races around devconf->rpl_seg_enabled
- cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
- ACPI: TAD: Add locking around AML evaluations
- ACPI: TAD: Split three functions to untangle runtime PM handling
- ACPI: TAD: Rearrange RT data validation checking
- bpf: Disable preemption in bpf_get_stackid
- bpf: Use stack id functions instead of __bpf_get_stackid
- bpf: Factor stackid_new_bucket from __bpf_get_stackid
- bpf: Factor stackid_fastpath function from __bpf_get_stackid
- bpf: Factor stackid_init function from __bpf_get_stackid
- cpufreq: apple-soc: Fix OPP table cleanup
- acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
- efi/cper, cxl: Make definitions and structures global
- efi/cper, cxl: Prefix protocol error struct and function names with cxl_
- erofs: skip sufficiently large global buffers when resizing
- NFSD: Prevent client use-after-free during close_lru reaping
- NFSD: Prevent client use-after-free during blocked-lock reaping
- NFSD: Consolidate the revocation-path client unpin
- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
- HID: mcp2221: fix OOB write in mcp2221_raw_event()
- HID: sony: clean up device list on probe failure
- HID: sony: use guard() and scoped_guard()
- HID: universal-pidff: stop the device when force-feedback init fails
- HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
- btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
- btrfs: fix extent map leak in NOCOW direct I/O write
- btrfs: rename extent map functions to get block start, end and check if in tree
- btrfs: add btrfs prefix to main lock, try lock and unlock extent functions
- btrfs: use BTRFS_PATH_AUTO_FREE in can_nocow_extent()
- btrfs: prepare btrfs_punch_hole_lock_range() for large data folios
- btrfs: pass struct btrfs_inode to btrfs_sync_inode_flags_to_i_flags()
- btrfs: parameter constification in ioctl.c
- btrfs: update include and forward declarations in headers
- btrfs: expose per-inode stable writes flag
- btrfs: move btrfs_alloc_write_mask() into fs.h
- btrfs: move BTRFS_BYTES_TO_BLKS() into fs.h
- btrfs: move btrfs_is_empty_uuid() from ioctl.c into fs.c
- HID: apple: preserve keyboard backlight across T2 resume
- ceph: properly decrypt filenames in vmalloc(

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.111]_

### 7.3-rc4

- Date: 2026-09-20
- Version: 7.3-rc4
- Original notes: https://git.kernel.org/torvalds/h/v7.3-rc4
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.3-rc4
- Labels: Pre-release; mainline

### 5.10.270

- Date: 2026-09-14
- Version: 5.10.270
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.270
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/5.10.270
- Labels: longterm

- **fixed** — Bluetooth L2CAP fix send LE flow credits in ACL link
- **fixed** — HID fix error code in hid_check_device_match()
- **fixed** — SCSI qla2xxx fix memory leak in __qlt_24xx_handle_abts()
- **fixed** — MM highmem take kmap_high_get() properly into account
- **fixed** — CLK qcom gdsc bump parent usage count when GDSC is found enabled
- **fixed** — Crypto testmgr fix initialization of secret_size
- **fixed** — Crypto ecdh fix ecdh-nist-p192's entry in testmgr
- **fixed** — Crypto ecdh fix ecdh_init
- **changed** — Crypto ecdh extend cra_driver_name with curve name
- **fixed** — Driver core platform don't oops in platform_shutdown() on unbound devices
- **fixed** — TCP fix corruption of urgent data on multi-segment retransmit
- **fixed** — USB atm usbatm fix invalid ci_range initialization
- **fixed** — Net fec only stop PTP if it was initialized
- **fixed** — Net sched bound qdisc_pkt_len to prevent qdisc soft lockup
- **fixed** — Netfilter x_tables replace pr_info and pr_err with pr_info_ratelimited
- **fixed** — Bluetooth RFCOMM validate MTU in rfcomm_apply_pn() to prevent infinite loop
- **fixed** — Bluetooth btmtksdio take exclusive ownership of the SKB before TX
- **fixed** — Bluetooth 6lowpan fix cyclic locking warning on netdev unregister
- **changed** — Bluetooth compute LE flow credits based on recvbuf space
- **fixed** — NFSv4.2 fix LAYOUTSTATS send buffer exhaustion

The 120 most recent commits in this release — the full changelog is longer:

- Linux 5.10.270
- Bluetooth: L2CAP: Fix send LE flow credits in ACL link
- HID: fix an error code in hid_check_device_match()
- scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()
- ACPI: utils: Document for_each_acpi_dev_match() macro
- mm/highmem: Take kmap_high_get() properly into account
- clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled
- crypto: testmgr - fix initialization of 'secret_size'
- crypto: ecdh - fix ecdh-nist-p192's entry in testmgr
- crypto: ecdh - fix 'ecdh_init'
- crypto: ecdh - extend 'cra_driver_name' with curve name
- driver core: platform: don't oops in platform_shutdown() on unbound devices
- tcp: fix corruption of urgent data on multi-segment retransmit
- usb: atm: usbatm: fix invalid ci_range initialization
- net: fec: only stop PTP if it was initialized
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- net: stmmac: selftests: Account for the UC filter list for filtering tests
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
- net: stmmac: selftests: Check multiple MMC counters
- selftests/arm64: Treat KSM merge_across_nodes as optional
- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
- netfilter: xt_HL: add pr_fmt and checkentry validation
- netfilter: xt_cgroup: Make it independent from net_cls
- netfilter: nf_tables: move hardware offload step after building the chain blob
- net: ethernet: sun4i-emac: Fix IRQ error handling
- ASoC: dapm: Fix off-by-one check on the second enum channel
- apparmor: policy_int make sure list heads are initialized before fail path
- apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
- tpm: st33zp24: Validate locality read result
- tpm: st33zp24: Return zero on status read failure
- net/sched: sch_teql: restore skb->dev on the slave failure path
- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
- net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
- net/sched: fq_pie: clamp default quantum to avoid signed overflow
- net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
- net/sched: fq_codel: clamp default quantum and mtu
- net_sched: export pfifo_fast prio2band[]
- net_sched: sch_fq: change how @inactive is tracked
- net_sched: sch_fq: struct sched_data reorg
- net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict()
- cifs: fix clearing stats for fastest execution of each smb2 command
- net/rds: use wq_has_sleeper() in rds_cong_map_updated()
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- bluetooth/l2cap: sync sock recv cb and release
- Bluetooth: compute LE flow credits based on recvbuf space
- scsi: qla2xxx: Fix an loop timeout test
- NFSv4/pnfs: key the data server cache on the NFS version
- nfs: move the nfs4_data_server_cache into struct nfs_net
- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
- net/smc: free pending qentry in smc_llc_flow_stop() before memset
- forcedeth: stop the tx_timeout register dump past the requested window
- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
- net: bridge: Reject descending VLAN tunnel ranges
- RDMA/ucma: Allow path records to exactly fit the output buffer
- prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
- rtc: pcf8563: fix clock provider leak on unbind
- vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
- virtio_balloon: disable indirect descriptors
- bondin

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.270]_

### 5.15.221

- Date: 2026-09-14
- Version: 5.15.221
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.221
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/5.15.221
- Labels: longterm

- **fixed** — clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled
- **fixed** — nvmet-rdma: fix queue leak when connect backlog is exceeded
- **fixed** — Bluetooth: L2CAP: Fix send LE flow credits in ACL link
- **fixed** — ALSA: control: Fix unannotated kfree() cleanup
- **fixed** — HID: fix an error code in hid_check_device_match()
- **fixed** — RDMA/nldev: Check stat attribute before accessing it
- **fixed** — nvme: target: rdma: fix ndev refcount leak on queue connect
- **fixed** — net/sched: sch_htb: limit htb_classify inner-class filter hops
- **fixed** — tcp: fix corruption of urgent data on multi-segment retransmit
- **fixed** — usb: atm: usbatm: fix invalid ci_range initialization
- **fixed** — net: fec: only stop PTP if it was initialized
- **fixed** — net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- **fixed** — net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
- **fixed** — net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
- **fixed** — net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
- **fixed** — netfilter: xt_cgroup: Make it independent from net_cls
- **fixed** — virtio-net: Ensure that TCP packets don't overflow gso_segs
- **fixed** — net: ethernet: sun4i-emac: Fix IRQ error handling
- **fixed** — libceph: validate banner payload length
- **fixed** — ASoC: dapm: Fix off-by-one check on the second enum channel

The 120 most recent commits in this release — the full changelog is longer:

- Linux 5.15.221
- clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled
- nvmet-rdma: fix queue leak when connect backlog is exceeded
- kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c
- kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings
- Bluetooth: L2CAP: Fix send LE flow credits in ACL link
- ALSA: control: Fix unannotated kfree() cleanup
- HID: fix an error code in hid_check_device_match()
- RDMA/nldev: Check stat attribute before accessing it
- clk: qcom: Drop mmcx gdsc supply for dispcc and videocc
- nvme: target: rdma: fix ndev refcount leak on queue connect
- net/sched: sch_htb: limit htb_classify inner-class filter hops
- tcp: fix corruption of urgent data on multi-segment retransmit
- usb: atm: usbatm: fix invalid ci_range initialization
- net: fec: only stop PTP if it was initialized
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- net: stmmac: selftests: Account for the UC filter list for filtering tests
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
- net: stmmac: selftests: Check multiple MMC counters
- selftests/arm64: Treat KSM merge_across_nodes as optional
- selftests/arm64: Print missing MTE TAP headers
- selftests: arm64: add hugetlb mte tests
- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
- netfilter: xt_HL: add pr_fmt and checkentry validation
- netfilter: xt_cgroup: Make it independent from net_cls
- netfilter: nf_tables: move hardware offload step after building the chain blob
- virtio-net: Ensure that TCP packets don't overflow gso_segs
- net: stmmac: selftests: Pass the IP proto mask in the TC selftest
- net: ethernet: sun4i-emac: Fix IRQ error handling
- libceph: validate banner payload length
- ASoC: dapm: Fix off-by-one check on the second enum channel
- apparmor: policy_int make sure list heads are initialized before fail path
- apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
- tpm: st33zp24: Validate locality read result
- tpm: st33zp24: Return zero on status read failure
- net/sched: sch_teql: restore skb->dev on the slave failure path
- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
- net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
- net/sched: fq_pie: clamp default quantum to avoid signed overflow
- net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
- net/sched: fq_codel: clamp default quantum and mtu
- net_sched: export pfifo_fast prio2band[]
- net_sched: sch_fq: change how @inactive is tracked
- net_sched: sch_fq: struct sched_data reorg
- net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict()
- net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
- cifs: fix clearing stats for fastest execution of each smb2 command
- net/rds: use wq_has_sleeper() in rds_cong_map_updated()
- octeontx2-af: Fix TL3/TL2 link config ENA clearing
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
- scsi: qla2xxx: Fix an loop timeout test
- NFSv4/pnfs: key the data server cache on the NFS version
- nfs: move the nfs4_data_server_cache into struct nfs_net
- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
- net/smc: free pending qentry in smc_llc_flow_stop() before memset
- net: ipa: balance runtime PM reference on remove error
- net: ipa: Convert to platform remove callback returning void
- net: ipa: report when the driver has been removed
- forcedeth: stop the tx_timeou

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.221]_

### 6.18.52

- Date: 2026-09-14
- Version: 6.18.52
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.52
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.18.52
- Labels: longterm

- **fixed** — wifi: mt76: fix airoha_npu dependency tracking
- **fixed** — staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
- **fixed** — staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
- **added** — pinctrl: airoha: an7583: add missed gpio22 pin group
- **fixed** — ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
- **changed** — cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
- **changed** — cpufreq/amd-pstate: Use epp_default_dc as default when dynamic_epp is disabled
- **added** — cpufreq/amd-pstate: Add support for raw EPP writes
- **fixed** — io_uring/waitid: fix KCSAN warning on io_waitid->head
- **fixed** — net/sched: fq: clamp quantum and initial_quantum in change path
- **fixed** — tcp: reject non zerocopy devmem tx
- **fixed** — erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
- **changed** — erofs: relax sanity check for tail pclusters due to ztailpacking
- **fixed** — block: fix merging data-less bios
- **fixed** — block: save page offset gaps in cloned bio
- **fixed** — tcp: fix corruption of urgent data on multi-segment retransmit
- **fixed** — slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
- **fixed** — net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- **fixed** — net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
- **fixed** — virtio-net: Ensure that TCP packets don't overflow gso_segs

The 120 most recent commits in this release — the full changelog is longer:

- Linux 6.18.52
- wifi: mt76: fix airoha_npu dependency tracking
- staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
- staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
- pinctrl: airoha: an7583: add missed gpio22 pin group
- ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
- ACPI: processor: idle: Remove redundant static variable and rename cstate check function
- ACPI: processor: idle: Move max_cstate update out of the loop
- ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
- cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
- cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled
- cpufreq/amd-pstate: Add support for raw EPP writes
- cpufreq/amd-pstate: Add static asserts for EPP indices
- cpufreq/amd-pstate: Fix some whitespace issues
- io_uring/waitid: fix KCSAN warning on io_waitid->head
- io_uring/waitid: use io_waitid_remove_wq() consistently
- net/sched: fq: clamp quantum and initial_quantum in change path
- Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
- tcp: reject non zerocopy devmem tx
- ipmr: Add __rcu to netns_ipv4.mrt.
- ipmr: Call ipmr_fib_lookup() under RCU.
- erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
- erofs: relax sanity check for tail pclusters due to ztailpacking
- block: fix merging data-less bios
- blk-mq-dma: always initialize dma state
- block: save page offset gaps in cloned bio
- integrity: Eliminate weak definition of arch_get_secureboot()
- apparmor: fix kernel-doc comments for inview
- pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
- pinctrl: airoha: Fix AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data
- pinctrl: airoha: an7583: add missed gpio32 pin group
- pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
- pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
- pinctrl: airoha: an7583: fix gpio21 pin group
- pinctrl: airoha: an7583: fix phy1_led1 pin function
- pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
- phy: renesas: rcar-gen3-usb2: add regulator dependency
- perf annotate: Fix build with NO_SLANG=1
- wifi: nl80211: fix UHR capability validation
- wifi: mt76: npu: Add missing rx_token_size initialization
- wifi: mt76: restrict NPU/PPE active checks to MMIO devices
- s390/kexec: Disable stack protector in s390_reset_system()
- selftests: vDSO: getrandom: Fix path to s390 chacha implementation
- cpufreq/amd-pstate: Fix setting EPP in performance mode
- cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP
- cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp
- cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name
- cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset
- cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
- usb: ucsi: huawei_gaokun: move typec_altmode off stack
- serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
- platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
- perf tests kvm: Avoid leaving perf.data.guest file around
- tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
- mtd: rawnand: pl353: Fix debug prints
- dm-integrity: fix buffer overflow with keyed discard
- net/sched: sch_htb: limit htb_classify inner-class filter hops
- tcp: fix corruption of urgent data on multi-segment retransmit
- usb: atm: usbatm: fix invalid ci_range initialization
- net: fec: only stop PTP if it was initialized
- slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
- net: stmmac: selftests: Account for the UC filter list for filtering tests
-

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.52]_

### 7.2.6

- Date: 2026-09-14
- Version: 7.2.6
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.6
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2.6
- Labels: stable

- **security** — Prevent out-of-bounds reads in ksmbd share config responses
- **fixed** — Fix dso_filter reference leak and exit zoom cleanup in perf ui hists
- **security** — Increase MAX_OPTIONS in perf hists browser to prevent stack buffer overflow
- **fixed** — Clamp quantum and initial_quantum in fq qdisc change path
- **security** — Reject non zerocopy devmem tx in TCP
- **fixed** — Fix buffer overflow with keyed discard in dm-integrity
- **fixed** — Limit htb_classify inner-class filter hops in sch_htb
- **fixed** — Fix corruption of urgent data on multi-segment retransmit in TCP
- **fixed** — Fix invalid ci_range initialization in usbatm
- **fixed** — Only stop PTP if it was initialized in fec driver
- **fixed** — Remove slip_hangup() to fix use-after-free in slip_receive_buf()
- **fixed** — Bound qdisc_pkt_len to prevent qdisc soft lockup in net/sched
- **changed** — Enable assisted learning on CPU port in mxl862xx
- **fixed** — Restore NET_IP_ALIGN in RX DMA offset in stmmac
- **changed** — Drop gso_enabled_types and rely on netdev features in stmmac
- **fixed** — Do not add invalid kcontrols to LED layer in ALSA control
- **fixed** — Skip double clone set expressions on element insert in nf_tables
- **security** — Validate banner payload length in libceph
- **fixed** — Revalidate ki_pos for O_APPEND writes after cap acquisition in ceph
- **fixed** — Fix ERR_PTR(0) in ceph_mkdir()

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.2.6
- ksmbd: prevent out-of-bounds reads in share config responses
- perf python: Add missed explicit dependencies
- perf ui hists: Fix dso_filter reference leak and exit zoom cleanup
- perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflow
- net/sched: fq: clamp quantum and initial_quantum in change path
- tcp: reject non zerocopy devmem tx
- Revert "esp: do not unref managed frag pages in esp_ssg_unref()"
- dm-integrity: fix buffer overflow with keyed discard
- net/sched: sch_htb: limit htb_classify inner-class filter hops
- tcp: fix corruption of urgent data on multi-segment retransmit
- usb: atm: usbatm: fix invalid ci_range initialization
- net: fec: only stop PTP if it was initialized
- slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- net: dsa: mxl862xx: enable assisted learning on CPU port
- net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
- net: stmmac: drop gso_enabled_types and rely on netdev features
- net: stmmac: selftests: Don't test flow control for small rx fifos
- net: stmmac: selftests: Account for the UC filter list for filtering tests
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
- net: stmmac: selftests: Check multiple MMC counters
- drm/xe/sysctrl: Read mailbox phase bit from hardware
- drm/xe/xe_ras: Add support to get error counter value
- drm/xe/uapi: Add additional error components to xe drm_ras
- net: airoha: npu: fix missing streaming DMA mask
- selftests/arm64: Fix MTE prctl TAP plan
- selftests/arm64: Treat KSM merge_across_nodes as optional
- selftests/arm64: Print missing MTE TAP headers
- ALSA: control: Don't add invalid kcontrols to LED layer
- netfilter: nf_tables: skip double clone set expressions on element insert
- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
- netfilter: nf_tables: move hardware offload step after building the chain blob
- virtio-net: Ensure that TCP packets don't overflow gso_segs
- drm/xe: Reject page faults from non-fault-mode scratch VMs
- drm/xe/xe_gt_idle: Add CCS to the powergating info print
- drm/xe: Do not apply WA 14025883347 to media 3503
- net: stmmac: selftests: Pass the IP proto mask in the TC selftest
- net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
- net: phy: air_en8811h: move LED GPIO configuration to config_init
- net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
- net: ethernet: sun4i-emac: Fix IRQ error handling
- ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants
- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
- libceph: validate banner payload length
- ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
- ceph: Fix ERR_PTR(0) in ceph_mkdir()
- ASoC: dapm: Fix off-by-one check on the second enum channel
- of/irq: Fix device node refcount leak in of_irq_get_affinity()
- apparmor: policy_int make sure list heads are initialized before fail path
- crypto: acomp - allocate async request context when cloning
- tpm: st33zp24: Validate locality read result
- tpm: st33zp24: Return zero on status read failure
- net/sched: sch_teql: restore skb->dev on the slave failure path
- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
- net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
- net/sched: fq_pie: clamp default quantum to avoid signed overflow
- net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
- net/sched: fq_codel: clamp default quantum and mtu
- net/sched: fq: add overflow bounds to quantum and initial quantum
- net: fix

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.6]_

### 6.6.157

- Date: 2026-09-14
- Version: 6.6.157
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.157
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.6.157
- Labels: longterm

- **fixed** — nvmet-rdma: fix queue leak when connect backlog is exceeded
- **fixed** — perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
- **fixed** — net: hsr: must allocate more bytes for RedBox support
- **fixed** — pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
- **fixed** — ALSA: control: Fix unannotated kfree() cleanup
- **changed** — net: hsr: init prune_proxy_timer sooner
- **changed** — net: hsr: Use the seqnr lock for frames received via interlink port
- **changed** — net: hsr: enable promiscuous mode on interlink port with fwd offload
- **fixed** — wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event()
- **fixed** — wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
- **fixed** — firmware: arm_scmi: Roll back partial protocol table registration
- **fixed** — irqdomain: Make build work for CONFIG_GENERIC_IRQ_CHIP=n
- **fixed** — nvme: target: rdma: fix ndev refcount leak on queue connect
- **fixed** — xsk: Fix offset calculation in unaligned mode
- **fixed** — nvme-apple: Reset q->sq_tail during queue init
- **fixed** — nvme-apple: Prevent shared tags across queues on Apple A11
- **fixed** — tcp: fix corruption of urgent data on multi-segment retransmit
- **fixed** — usb: atm: usbatm: fix invalid ci_range initialization
- **fixed** — net: fec: only stop PTP if it was initialized
- **fixed** — slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

The 120 most recent commits in this release — the full changelog is longer:

- Linux 6.6.157
- nvmet-rdma: fix queue leak when connect backlog is exceeded
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
- net: hsr: must allocate more bytes for RedBox support
- pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
- tools/build: Use SYSTEM_BPFTOOL for system bpftool
- ALSA: control: Fix unannotated kfree() cleanup
- net: hsr: init prune_proxy_timer sooner
- net: hsr: Use the seqnr lock for frames received via interlink port.
- net: hsr: enable promiscuous mode on interlink port with fwd offload
- wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event()
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
- firmware: arm_scmi: Roll back partial protocol table registration
- irqdomain: Make build work for CONFIG_GENERIC_IRQ_CHIP=n
- nvme: target: rdma: fix ndev refcount leak on queue connect
- kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c
- kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings
- xsk: Fix offset calculation in unaligned mode
- nvme-apple: Reset q->sq_tail during queue init
- nvme-apple: Prevent shared tags across queues on Apple A11
- ACPI: processor: Update cpuidle driver check in __acpi_processor_start()
- ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
- ACPI: processor: idle: Remove redundant static variable and rename cstate check function
- ACPI: processor: idle: Move max_cstate update out of the loop
- ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
- pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers
- pinctrl: mediatek: Fix new design debounce issue
- pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()
- net/sched: sch_htb: limit htb_classify inner-class filter hops
- tcp: fix corruption of urgent data on multi-segment retransmit
- usb: atm: usbatm: fix invalid ci_range initialization
- net: fec: only stop PTP if it was initialized
- slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- net: stmmac: selftests: Account for the UC filter list for filtering tests
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
- net: stmmac: selftests: Check multiple MMC counters
- selftests/arm64: Treat KSM merge_across_nodes as optional
- selftests/arm64: Print missing MTE TAP headers
- selftests: arm64: add hugetlb mte tests
- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
- netfilter: xt_HL: add pr_fmt and checkentry validation
- netfilter: xt_cgroup: Make it independent from net_cls
- netfilter: nf_tables: move hardware offload step after building the chain blob
- virtio-net: Ensure that TCP packets don't overflow gso_segs
- net: stmmac: selftests: Pass the IP proto mask in the TC selftest
- net: ethernet: sun4i-emac: Fix IRQ error handling
- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
- libceph: validate banner payload length
- ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
- ASoC: dapm: Fix off-by-one check on the second enum channel
- apparmor: policy_int make sure list heads are initialized before fail path
- apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
- tpm: st33zp24: Validate locality read result
- tpm: st33zp24: Return zero on status read failure
- net/sched: sch_teql: restore skb->dev on the slave failure path
- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
- net/sched: hhf: clamp quantum before hhf_change() to avoid overfl

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.157]_

### 6.1.188

- Date: 2026-09-14
- Version: 6.1.188
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.188
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.1.188
- Labels: longterm

- **fixed** — Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue
- **fixed** — nvmet-rdma: fix queue leak when connect backlog is exceeded
- **fixed** — net: hsr: must allocate more bytes for RedBox support
- **fixed** — pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
- **changed** — tools/build: Use SYSTEM_BPFTOOL for system bpftool
- **fixed** — net: hsr: init prune_proxy_timer sooner
- **fixed** — net: hsr: Use the seqnr lock for frames received via interlink port
- **fixed** — net: hsr: enable promiscuous mode on interlink port with fwd offload
- **fixed** — nvme-apple: Reset q->sq_tail during queue init
- **fixed** — nvme-apple: Prevent shared tags across queues on Apple A11
- **fixed** — Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters
- **fixed** — HID: fix an error code in hid_check_device_match()
- **fixed** — wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
- **fixed** — wifi: mt76: mt7915: fallback to non-wed mode if platform_get_resource fails in mt7915_mmio_wed_init()
- **fixed** — Bluetooth: coredump: fix building with coredump disabled
- **fixed** — nvme: target: rdma: fix ndev refcount leak on queue connect
- **fixed** — perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
- **fixed** — net/sched: sch_htb: limit htb_classify inner-class filter hops
- **fixed** — tcp: fix corruption of urgent data on multi-segment retransmit
- **fixed** — usb: atm: usbatm: fix invalid ci_range initialization

The 120 most recent commits in this release — the full changelog is longer:

- Linux 6.1.188
- Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue
- nvmet-rdma: fix queue leak when connect backlog is exceeded
- net: hsr: must allocate more bytes for RedBox support
- pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
- tools/build: Use SYSTEM_BPFTOOL for system bpftool
- kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c
- kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings
- net: hsr: init prune_proxy_timer sooner
- net: hsr: Use the seqnr lock for frames received via interlink port.
- net: hsr: enable promiscuous mode on interlink port with fwd offload
- nvme-apple: Reset q->sq_tail during queue init
- nvme-apple: Prevent shared tags across queues on Apple A11
- Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters
- HID: fix an error code in hid_check_device_match()
- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
- wifi: mt76: mt7915: fallback to non-wed mode if platform_get_resource fails in mt7915_mmio_wed_init()
- arm64: dts: qcom: sm8350: Fix the PCI I/O port range
- arm64: dts: qcom: sm8350: correct PCI phy unit address
- arm64: dts: qcom: sm8550: Fix the aoss_qmp node name
- arm64: dts: qcom: sm8550: fix qup_spi0_cs node
- arm64: dts: qcom: sm8550: correct pinctrl unit address
- arm64: dts: qcom: sm8550: Flush RSC sleep & wake votes
- arm64: dts: qcom: sm8550: Separate out X3 idle state
- arm64: dts: qcom: sm8550: Update idle state time requirements
- arm64: dts: qcom: sm8550: Fix SPMI channels size
- arm64: dts: qcom: sm8550: Mark QUPs and GPI dma-coherent
- arm64: dts: qcom: sm8550: Fix the PCI I/O port range
- arm64: dts: qcom: sm8550: Fix GIC_ITS range length
- arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller
- arm64: dts: qcom: sm8550: Mark UFS controller as cache coherent
- arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
- arm64: dts: qcom: sm8550: Fix UFS PHY clocks
- arm64: dts: qcom: sm8550: remove invalid interconnect property from cryptobam
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam
- clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
- clk: qcom: gcc-sm8550: use collapse-voting for PCIe GDSCs
- clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
- clk: qcom: gcc-sm8550: Mark the PCIe GDSCs votable
- clk: qcom: gcc-sm8550: Add the missing RETAIN_FF_ENABLE GDSC flag
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
- clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
- arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 boards
- arm64: dts: qcom: pm8998: don't use GIC_SPI for SPMI interrupts
- pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers
- pinctrl: mediatek: Fix new design debounce issue
- pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()
- s390/con3270: move condev definition
- Bluetooth: coredump: fix building with coredump disabled
- nvme: target: rdma: fix ndev refcount leak on queue connect
- perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
- net/sched: sch_htb: limit htb_classify inner-class filter hops
- tcp: fix corruption of urgent data on multi-segment retransmit
- usb: atm: usbatm: fix invalid ci_range initialization
- net: fec: only stop PTP if it was initialized
- slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- net: stmmac: selftests: Account for the UC filter list for filtering tests
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
- net: stmmac: selftests: Check multiple MMC counters
- selftests/arm

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.188]_

### 6.12.110

- Date: 2026-09-14
- Version: 6.12.110
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.110
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.12.110
- Labels: longterm

- **fixed** — ACPI processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
- **fixed** — integrity: Eliminate weak definition of arch_get_secureboot()
- **fixed** — slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
- **changed** — x86/Kconfig: Reenable PTDUMP on i386
- **fixed** — pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
- **changed** — tools/build: Use SYSTEM_BPFTOOL for system bpftool
- **fixed** — net_sched: add back BH safety to tcf_lock
- **changed** — net_sched: act_tunnel_key: use RCU in tunnel_key_dump()
- **changed** — net_sched: act_vlan: use RCU in tcf_vlan_dump()
- **changed** — net_sched: act_skbedit: use RCU in tcf_skbedit_dump()
- **changed** — net_sched: act_ctinfo: use RCU in tcf_ctinfo_dump()
- **changed** — net_sched: act_ct: use RCU in tcf_ct_dump()
- **fixed** — md: fix sync_action incorrect display during resync
- **added** — md: add helper rdev_needs_recovery()
- **fixed** — xsk: Fix offset calculation in unaligned mode
- **fixed** — erofs: fix managed cache race for unaligned extents
- **fixed** — cpuset: fix warning when disabling remote partition
- **fixed** — nvme-apple: Reset q->sq_tail during queue init
- **fixed** — nvme-apple: Prevent shared tags across queues on Apple A11
- **fixed** — phy: qcom: qmp-combo: Add missing PLL (VCO) configuration on SM8750

The 120 most recent commits in this release — the full changelog is longer:

- Linux 6.12.110
- ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
- integrity: Eliminate weak definition of arch_get_secureboot()
- slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
- x86/Kconfig: Reenable PTDUMP on i386
- pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
- tools/build: Use SYSTEM_BPFTOOL for system bpftool
- net_sched: add back BH safety to tcf_lock
- net_sched: act_tunnel_key: use RCU in tunnel_key_dump()
- net_sched: act_vlan: use RCU in tcf_vlan_dump()
- net_sched: act_skbedit: use RCU in tcf_skbedit_dump()
- net_sched: act_ctinfo: use RCU in tcf_ctinfo_dump()
- net_sched: act_ct: use RCU in tcf_ct_dump()
- md: fix sync_action incorrect display during resync
- md: add helper rdev_needs_recovery()
- kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c
- kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings
- net/sched: fq: clamp quantum and initial_quantum in change path
- Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
- xsk: Fix offset calculation in unaligned mode
- erofs: fix managed cache race for unaligned extents
- cpuset: fix warning when disabling remote partition
- nvme-apple: Reset q->sq_tail during queue init
- nvme-apple: Prevent shared tags across queues on Apple A11
- powerpc/vdso: Remove unused clockmode asm offsets
- phy: qcom: qmp-combo: Add missing PLL (VCO) configuration on SM8750
- perf test: Don't signal all processes on system when interrupting tests
- bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
- selftests/bpf: add verification for BPF_PROG_QUERY attr size boundaries
- fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT
- ACPI: processor: Update cpuidle driver check in __acpi_processor_start()
- slub: Don't call lockdep_unregister_key() for immature kmem_cache.
- md: keep recovery_cp in mdp_superblock_s
- pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers
- pinctrl: mediatek: Fix new design debounce issue
- pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()
- cpufreq/amd-pstate: Fix prefcore rankings
- platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
- net/sched: sch_htb: limit htb_classify inner-class filter hops
- tcp: fix corruption of urgent data on multi-segment retransmit
- usb: atm: usbatm: fix invalid ci_range initialization
- net: fec: only stop PTP if it was initialized
- slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- net: stmmac: selftests: Account for the UC filter list for filtering tests
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
- net: stmmac: selftests: Check multiple MMC counters
- selftests/arm64: Treat KSM merge_across_nodes as optional
- selftests/arm64: Print missing MTE TAP headers
- selftests: arm64: add hugetlb mte tests
- ALSA: control: Don't add invalid kcontrols to LED layer
- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
- netfilter: xt_HL: add pr_fmt and checkentry validation
- netfilter: xt_cgroup: Make it independent from net_cls
- netfilter: nf_tables: move hardware offload step after building the chain blob
- virtio-net: Ensure that TCP packets don't overflow gso_segs
- net: stmmac: selftests: Pass the IP proto mask in the TC selftest
- net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
- net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
- net: ethernet: sun4i-emac: Fix IRQ error handling
- samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
- samples/ftrace: Fix kthread_stop() on ERR_PT

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.110]_