# Linux Kernel changelog

> The kernel at the heart of every Linux distribution, Android phone, and cloud server.

- Vendor: Linux Kernel Organization
- Category: Operating Systems
- Official site: https://www.kernel.org
- Tracked by: What's New (https://whatsnew.fyi/product/linux-kernel)
- Harvested from: Release index (kernel)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### 7.2-rc5

- Date: 2026-07-26
- Version: 7.2-rc5
- Original notes: https://git.kernel.org/torvalds/h/v7.2-rc5
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2-rc5
- Labels: Pre-release; mainline

### 6.12.98

- Date: 2026-07-25
- Version: 6.12.98
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.98
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.12.98
- Labels: longterm

- **fixed** — fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation

2 commits in this release:

- Linux 6.12.98
- ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation

### 7.1.5

- Date: 2026-07-24
- Version: 7.1.5
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.5
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.1.5
- Labels: stable

- **fixed** — posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- **changed** — posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
- **fixed** — drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
- **changed** — iomap: consolidate bio submission
- **fixed** — exfat: fix implicit declaration of brelse()
- **added** — exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
- **changed** — exfat: add balloc parameter to exfat_map_cluster() for iomap support
- **changed** — exfat: replace unsafe macros with static inline functions
- **removed** — crypto: xilinx-trng - Remove crypto_rng interface
- **fixed** — liveupdate: validate session type before performing operation
- **fixed** — usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- **changed** — usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- **fixed** — ksmbd: use opener credentials for FSCTL mutations
- **fixed** — Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- **fixed** — Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- **fixed** — binder: cache secctx size before release zeroes it
- **fixed** — ALSA: hda/tas2781: Cancel async firmware request at unbind
- **added** — firmware_loader: Add cancel helper for async requests
- **fixed** — ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417

The 120 most recent commits in this release — the full changelog is longer:

- Linux 7.1.5
- Revert "gpib: cb7210: Fix region leak when request_irq fails"
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
- drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
- iomap: consolidate bio submission
- exfat: fix implicit declaration of brelse()
- exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
- exfat: add balloc parameter to exfat_map_cluster() for iomap support
- exfat: replace unsafe macros with static inline functions
- crypto: xilinx-trng - Remove crypto_rng interface
- liveupdate: validate session type before performing operation
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- usb: atm: ueagle-atm: remove function entry/exit debug messages
- usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- xfs: add newly added RTGs to the free pool in growfs
- xfs: factor out a xfs_zone_mark_free helper
- ksmbd: use opener credentials for FSCTL mutations
- smb: move compression definitions into common/fscc.h
- ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- binder: cache secctx size before release zeroes it
- binder: Use LIST_HEAD() to initialize on stack list head
- ALSA: hda/tas2781: Cancel async firmware request at unbind
- firmware_loader: Add cancel helper for async requests
- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
- ALSA: scarlett2: Allow selecting config_set by firmware version
- iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
- f2fs: fix listxattr handling of corrupted xattr entries
- f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
- f2fs: fix potential deadlock in f2fs_balance_fs()
- device property: initialize the remaining fields of fwnode_handle in fwnode_init()
- samples/damon/mtier: fail early if address range parameters are invalid
- mm/damon/core: trace esz at first setup
- bpf: Reject negative const offsets for buffer pointers
- mmc: sdhci-esdhc-imx: fix resume error handling
- mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
- mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
- mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
- mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
- mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
- mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
- mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
- mmc: block: fix RPMB device unregister ordering
- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
- mtd: rawnand: fsl_ifc: return errors for failed page reads
- mmc: vub300: defer reset until cmd_mutex is unlocked
- mtd: mchp23k256: use SPI match data for chip caps
- mtd: onenand: samsung: report DMA completion timeouts
- mtd: virt-concat: free duplicate generated name
- wifi: mwifiex: fix permanently busy scans after multiple roam iterations
- wifi: mac80211: validate extension-frame layout before RX
- wifi: mac80211: free ack status frame on TX header build failure
- wifi: ieee80211: validate MLE common info length
- wifi: cfg80211: validate EHT MLE before MLD ID read
- powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()
- powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
- reset: sunxi: fix memory region leak on ioremap failure
- reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
- ipvs: reload ip header after head reallocation
- ipvs: fix more places w

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.5]_

### 5.10.261

- Date: 2026-07-24
- Version: 5.10.261
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.261
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/5.10.261
- Labels: longterm

- **fixed** — tools/resolve_btfids: Emit warnings and patch zero id for missing symbols
- **fixed** — tools/resolve_btfids: Fix some error messages
- **changed** — perf/x86/amd/core: Always use the NMI latency mitigation
- **fixed** — mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()
- **fixed** — ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
- **fixed** — ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
- **fixed** — net: mld: fix reference count leak in mld_{query | report}_work()
- **fixed** — ipv6: fix lockdep splat in in6_dump_addrs()
- **fixed** — ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
- **fixed** — net: ethernet: rmnet: Always subtract MAP header
- **fixed** — ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
- **changed** — mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist
- **fixed** — iio: imu: inv_icm42600: fix timestamp clock period by using lower value
- **fixed** — iio: invensense: fix odr switching to same value
- **fixed** — iio: imu: inv_mpu6050: fix frequency setting when chip is off
- **fixed** — Bluetooth: L2CAP: Fix regressions caused by reusing ident
- **changed** — KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
- **fixed** — posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
- **fixed** — audit: fix potential integer overflow in audit_log_n_hex()

The 120 most recent commits in this release — the full changelog is longer:

- Linux 5.10.261
- tools/resolve_btfids: Emit warnings and patch zero id for missing symbols
- tools/resolve_btfids: Fix some error messages
- perf/x86/amd/core: Always use the NMI latency mitigation
- mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()
- ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
- ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
- net: mld: fix reference count leak in mld_{query | report}_work()
- ipv6: fix lockdep splat in in6_dump_addrs()
- ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
- net: ethernet: rmnet: Always subtract MAP header
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
- mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist
- iio: imu: inv_icm42600: fix timestamp clock period by using lower value
- iio: invensense: fix odr switching to same value
- iio: imu: inv_mpu6050: fix frequency setting when chip is off
- Bluetooth: L2CAP: Fix regressions caused by reusing ident
- KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
- posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
- audit: fix potential integer overflow in audit_log_n_hex()
- audit: add audit_log_nf_skb helper function
- crypto: qat - validate RSA CRT component lengths
- crypto: qat - fix restarting state leak on allocation failure
- btrfs: do not trim a device which is not writeable
- usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
- crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
- crypto: atmel-sha204a - Mark OF related data as maybe unused
- usb: gadget: f_fs: initialize reset_work at allocation time
- usb: typec: tcpm: Fix VDM type for Enter Mode commands
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
- gpio: pca953x: Make platform teardown callback return void
- leds: lm3601x: Improve error reporting for problems during .remove()
- leds: lm3697: Remove duplicated error reporting in .remove()
- drm/i2c/sil164: Drop no-op remove function
- USB: serial: digi_acceleport: fix write buffer corruption
- usb: iowarrior: remove inherent race with minor number
- usb: free iso schedules on failed submit
- usb: gadget: f_printer: take kref only for successful open
- usb: gadget: function: Simplify diagnostic messaging in printer
- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- hfs/hfsplus: prevent getting negative values of offset/length
- xfs: use null daddr for unset first bad log block
- xfs: fix unreachable BIGTIME check in dquot flush validation
- xfs: reflect sb features in xfs_mount
- serial: 8250_mid: Disable DMA for selected platforms
- serial: 8250_mid: Remove 8250_pci usage
- HID: appleir: fix UAF on pending key_up_timer in remove()
- proc: protect ptrace_may_access() with exec_update_lock (part 1)
- cpufreq: intel_pstate: Sync policy->cur during CPU offline
- HID: multitouch: fix out-of-bounds bit access on mt_io_flags
- HID: add haptics page defines
- proc: protect ptrace_may_access() with exec_update_lock (FD links)
- proc: rename proc_setattr to proc_nochmod_setattr
- proc: use generic setattr() for /proc/$PID/net
- X.509: Fix validation of ASN.1 certificate header
- writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
- smb: client: harden POSIX SID length parsing
- smb: client: use unaligned reads in parse_posix_ctxt()
- smb: client: mask server-provided mode to 07777 in modefromsid
- smb: client: Fix next buffer leak in receive_encrypted_standard()
- Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
- Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
- Bluetooth: L2CAP: Fix not tracking outstanding TX ident
- netfilter: ebtables: zero chainstack array
- netfilter: ebtables: Use vmalloc_array

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.261]_

### 5.15.212

- Date: 2026-07-24
- Version: 5.15.212
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.212
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/5.15.212
- Labels: longterm

- **fixed** — perf/x86/amd/core: Always use the NMI latency mitigation
- **fixed** — ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
- **fixed** — iio: imu: inv_icm42600: fix timestamp clock period by using lower value
- **fixed** — ALSA: seq: Check UMP support for midi_version change
- **fixed** — ALSA: seq: Skip event type filtering for UMP events
- **fixed** — iio: invensense: fix odr switching to same value
- **fixed** — iio: imu: inv_mpu6050: fix frequency setting when chip is off
- **fixed** — ALSA: seq: Avoid confusion of aligned read size
- **fixed** — Bluetooth: L2CAP: Fix regressions caused by reusing ident
- **fixed** — posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
- **fixed** — regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
- **fixed** — audit: fix potential integer overflow in audit_log_n_hex()
- **fixed** — btrfs: fix incorrect buffered IO fallback for append direct writes
- **fixed** — crypto: qat - validate RSA CRT component lengths
- **fixed** — btrfs: fix false IO failure after falling back to buffered write
- **fixed** — crypto: qat - fix restarting state leak on allocation failure
- **fixed** — X.509: Fix validation of ASN.1 certificate header
- **security** — staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
- **security** — staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

The 120 most recent commits in this release — the full changelog is longer:

- Linux 5.15.212
- perf/x86/amd/core: Always use the NMI latency mitigation
- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
- iio: imu: inv_icm42600: fix timestamp clock period by using lower value
- ALSA: seq: Check UMP support for midi_version change
- ALSA: seq: Skip event type filtering for UMP events
- iio: invensense: fix odr switching to same value
- iio: imu: inv_mpu6050: fix frequency setting when chip is off
- ALSA: seq: Avoid confusion of aligned read size
- Bluetooth: L2CAP: Fix regressions caused by reusing ident
- KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
- posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
- audit: fix potential integer overflow in audit_log_n_hex()
- audit: add audit_log_nf_skb helper function
- btrfs: fix incorrect buffered IO fallback for append direct writes
- crypto: qat - validate RSA CRT component lengths
- btrfs: fix false IO failure after falling back to buffered write
- crypto: qat - fix restarting state leak on allocation failure
- btrfs: do not trim a device which is not writeable
- usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
- crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
- crypto: atmel-sha204a - Mark OF related data as maybe unused
- usb: gadget: f_fs: initialize reset_work at allocation time
- usb: typec: tcpm: Fix VDM type for Enter Mode commands
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
- gpio: pca953x: Make platform teardown callback return void
- leds: lm3601x: Improve error reporting for problems during .remove()
- leds: lm3697: Remove duplicated error reporting in .remove()
- drm/i2c/sil164: Drop no-op remove function
- usb: iowarrior: remove inherent race with minor number
- bpf: Allow LPM map access from sleepable BPF programs
- bpf: Consistently use bpf_rcu_lock_held() everywhere
- bpf: Convert lpm_trie.c to rqspinlock
- bpf: Reject fragmented frames in devmap
- xdp: introduce flags field in xdp_buff/xdp_frame
- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- hfs/hfsplus: prevent getting negative values of offset/length
- xfs: use null daddr for unset first bad log block
- xfs: Remove dead code
- xfs: Remove redundant assignment of mp
- serial: 8250_mid: Disable DMA for selected platforms
- serial: 8250_mid: Remove 8250_pci usage
- HID: appleir: fix UAF on pending key_up_timer in remove()
- treewide: Switch/rename to timer_delete[_sync]()
- proc: protect ptrace_may_access() with exec_update_lock (part 1)
- HID: multitouch: fix out-of-bounds bit access on mt_io_flags
- HID: add haptics page defines
- proc: protect ptrace_may_access() with exec_update_lock (FD links)
- proc: rename proc_setattr to proc_nochmod_setattr
- proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation
- proc: use generic setattr() for /proc/$PID/net
- X.509: Fix validation of ASN.1 certificate header
- ksmbd: track the connection owning a byte-range lock
- ksmbd: centralize ksmbd_conn final release to plug transport leak
- ksmbd: destroy async_ida in ksmbd_conn_free()
- ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
- ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
- smb: client: harden POSIX SID length parsing
- smb: client: use unaligned reads in parse_posix_ctxt()
- smb: client: mask server-provided mode to 07777 in modefromsid
- smb: client: resolve SWN tcon from live registrations
- cifs: Add tracing for the cifs_tcon struct refcounting
- smb: client: Fix next buffer leak in receive_encrypted_standard()
- Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
- Bluetooth: L2CAP: Fix deadlock

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.212]_

### 6.18.40

- Date: 2026-07-24
- Version: 6.18.40
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.40
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.18.40
- Labels: longterm

- **fixed** — RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
- **fixed** — RDMA/bnxt_re: Initialize dpi variable to zero
- **fixed** — ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
- **fixed** — perf callchain: Handle multiple address spaces
- **fixed** — perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
- **fixed** — PCI: Fix Resizable BAR restore order
- **fixed** — PCI: Fix BAR resize rollback path overwriting ret
- **fixed** — perf symbol: Fix ENOENT case for filename__read_build_id
- **fixed** — pinctrl: airoha: fix pinctrl function mismatch issue
- **fixed** — bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- **fixed** — iommufd: Move vevent memory allocation outside spinlock
- **fixed** — iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
- **fixed** — KVM: arm64: nv: Re-translate VNCR before injecting abort
- **fixed** — KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
- **fixed** — KVM: arm64: Ensure level is always initialized when relaxing perms
- **fixed** — btrfs: fix incorrect buffered IO fallback for append direct writes
- **fixed** — btrfs: fix false IO failure after falling back to buffered write
- **fixed** — crypto: qat - fix restarting state leak on allocation failure
- **fixed** — crypto: atmel-sha204a - fail on hwrng registration error in probe path
- **fixed** — usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile

The 118 most recent commits in this release — the full changelog is longer:

- Linux 6.18.40
- RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
- RDMA/bnxt_re: Initialize dpi variable to zero
- ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
- perf callchain: Handle multiple address spaces
- seqlock: fix scoped_seqlock_read kernel-doc
- perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
- PCI: Fix Resizable BAR restore order
- PCI: Fix BAR resize rollback path overwriting ret
- perf symbol: Fix ENOENT case for filename__read_build_id
- pinctrl: airoha: fix pinctrl function mismatch issue
- bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- iommufd: Move vevent memory allocation outside spinlock
- iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
- KVM: arm64: nv: Re-translate VNCR before injecting abort
- KVM: arm64: Deduplicate ASID retrieval code
- samples/damon/mtier: fail early if address range parameters are invalid
- mm/damon/core: trace esz at first setup
- mm/damon/core: always put unsuccessfully committed target pids
- KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
- KVM: arm64: Ensure level is always initialized when relaxing perms
- btrfs: fix incorrect buffered IO fallback for append direct writes
- btrfs: fix false IO failure after falling back to buffered write
- crypto: qat - fix restarting state leak on allocation failure
- btrfs: remove folio parameter from ordered io related functions
- btrfs: replace for_each_set_bit() with for_each_set_bitmap()
- btrfs: concentrate the error handling of submit_one_sector()
- crypto: atmel-sha204a - fail on hwrng registration error in probe path
- usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- usb: gadget: f_fs: initialize reset_work at allocation time
- functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions
- functionfs: switch to simple_remove_by_name()
- functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}()
- functionfs: don't abuse ffs_data_closed() on fs shutdown
- new helper: simple_remove_by_name()
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- usb: atm: ueagle-atm: remove function entry/exit debug messages
- usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
- usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation.
- xfs: use bio_reuse in the zone GC code
- xfs: only log freed extents for the current RTG in zoned growfs
- xfs: add a xfs_groups_to_rfsbs helper
- bpf: Allow LPM map access from sleepable BPF programs
- bpf: Consistently use bpf_rcu_lock_held() everywhere
- bpf: Keep dynamic inner array lookups nullable
- bpf: Introduce struct bpf_map_desc in verifier
- bpf: Consistently use reg_state() for register access in the verifier
- xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- hfs/hfsplus: prevent getting negative values of offset/length
- proc: protect ptrace_may_access() with exec_update_lock (part 1)
- seqlock: Change do_task_stat() to use scoped_seqlock_read()
- seqlock: Introduce scoped_seqlock_read()
- proc: protect ptrace_may_access() with exec_update_lock (FD links)
- proc: rename proc_setattr to proc_nochmod_setattr
- ksmbd: validate NTLMv2 response before updating session key
- ksmbd: Use HMAC-MD5 library for NTLMv2
- ksmbd: Use HMAC-SHA256 library for message signing and key generation
- ksmbd: Use SHA-512 library for SMB3.1.1 preauth hash
- ksmbd: track the connection owning a byte-range lock
- ksmbd: centralize ksmbd_conn final release to plug transport leak
- ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
- ksmbd: use opener credentials for FSCTL mutations
- cifs: SMB1 split: Add some #includes
- cifs: SMB1 split: Rename cifstransport.c
- Bluetooth: L2CAP: Fix u

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.40]_

### 6.1.178

- Date: 2026-07-24
- Version: 6.1.178
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.178
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.1.178
- Labels: longterm

- **fixed** — ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
- **fixed** — iio: imu: inv_icm42600: fix timestamp clock period by using lower value
- **fixed** — iio: invensense: fix odr switching to same value
- **fixed** — iio: imu: inv_mpu6050: fix frequency setting when chip is off
- **fixed** — virtio_ring: fix syncs DMA memory with different direction
- **fixed** — cifs: fix lock ordering while disabling multichannel
- **fixed** — driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
- **fixed** — writeback: Fix use after free in inode_switch_wbs_work_fn()
- **fixed** — Bluetooth: L2CAP: fix tx ident leak for commands without a response
- **fixed** — Bluetooth: L2CAP: Fix regressions caused by reusing ident
- **fixed** — btrfs: fix incorrect buffered IO fallback for append direct writes
- **fixed** — btrfs: fix false IO failure after falling back to buffered write
- **fixed** — regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
- **fixed** — audit: fix potential integer overflow in audit_log_n_hex()
- **fixed** — crypto: qat - validate RSA CRT component lengths
- **fixed** — crypto: qat - fix restarting state leak on allocation failure
- **fixed** — usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- **fixed** — usb: typec: tcpm: Fix VDM type for Enter Mode commands
- **fixed** — usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- **fixed** — usb: iowarrior: remove inherent race with minor number

The 113 most recent commits in this release — the full changelog is longer:

- Linux 6.1.178
- perf/x86/amd/core: Always use the NMI latency mitigation
- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
- iio: imu: inv_icm42600: fix timestamp clock period by using lower value
- ALSA: seq: Check UMP support for midi_version change
- ALSA: seq: Skip event type filtering for UMP events
- bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
- Bluetooth: Ignore too large handle values in BIG
- iio: invensense: fix odr switching to same value
- iio: imu: inv_mpu6050: fix frequency setting when chip is off
- virtio_ring: fix syncs DMA memory with different direction
- cifs: fix lock ordering while disabling multichannel
- tools/virtio: Add dma sync api for virtio test
- ALSA: seq: Avoid confusion of aligned read size
- driver core: Guard deferred probe timeout extension with delayed_work_pending()
- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion
- jiffies: Define secs_to_jiffies()
- writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
- writeback: Fix use after free in inode_switch_wbs_work_fn()
- Bluetooth: L2CAP: fix tx ident leak for commands without a response
- Bluetooth: L2CAP: Fix regressions caused by reusing ident
- seqlock: fix scoped_seqlock_read kernel-doc
- KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
- mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
- mm/damon/core: make charge_addr_from aware of end-address exclusivity
- btrfs: fix incorrect buffered IO fallback for append direct writes
- btrfs: fix false IO failure after falling back to buffered write
- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
- regulator: scmi: Simplify with scoped for each OF child loop
- audit: fix potential integer overflow in audit_log_n_hex()
- audit: add audit_log_nf_skb helper function
- crypto: qat - validate RSA CRT component lengths
- btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
- crypto: qat - fix restarting state leak on allocation failure
- usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- nvmet: remove superfluous initialization
- crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
- crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
- crypto: atmel-sha204a - Mark OF related data as maybe unused
- usb: gadget: f_fs: initialize reset_work at allocation time
- usb: typec: tcpm: Fix VDM type for Enter Mode commands
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- usb: iowarrior: remove inherent race with minor number
- bpf: Allow LPM map access from sleepable BPF programs
- bpf: Consistently use bpf_rcu_lock_held() everywhere
- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- hfs/hfsplus: prevent getting negative values of offset/length
- serial: 8250_mid: Disable DMA for selected platforms
- serial: 8250_mid: Remove 8250_pci usage
- HID: appleir: fix UAF on pending key_up_timer in remove()
- treewide: Switch/rename to timer_delete[_sync]()
- proc: protect ptrace_may_access() with exec_update_lock (part 1)
- seqlock: Change do_task_stat() to use scoped_seqlock_read()
- seqlock: Introduce scoped_seqlock_read()
- HID: multitouch: fix out-of-bounds bit access on mt_io_flags
- HID: add haptics page defines
- proc: protect ptrace_may_access() with exec_update_lock (FD links)
- proc: rename proc_setattr to proc_nochmod_setattr
- proc: Move fdinfo PTRACE_MODE_READ check into the inode .permission operation
- proc: use generic setattr() for /proc/$PID/net
- writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
- writeback: Avoid contention on wb->list_lock when switching inodes
- ksmbd: track the connection owning a byte-range lock
- ksmbd: centralize ksmbd_conn final release

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.178]_

### 6.6.145

- Date: 2026-07-24
- Version: 6.6.145
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.145
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.6.145
- Labels: longterm

- **fixed** — Fix missing jiffies conversion in deferred_probe_extend_timeout()
- **added** — Define secs_to_jiffies() for time conversion
- **fixed** — Fix use after free in inode_switch_wbs_work_fn()
- **fixed** — Fix Bluetooth btmtk undefined reference build error
- **fixed** — Fix Bluetooth 6lowpan using chan->conn as indication to no remote netdev
- **fixed** — Fix Bluetooth hci_sync attempting to send HCI_Disconnect to BIS handle
- **fixed** — Fix null pointer dereference in hci_abort_conn()
- **changed** — Bluetooth separate CIS_LINK and BIS_LINK link types
- **changed** — Enable buffer flow control for Bluetooth SCO/eSCO
- **fixed** — Fix incorrect buffered IO fallback for append direct writes in btrfs
- **fixed** — Fix false IO failure after falling back to buffered write in btrfs
- **fixed** — Fix potential integer overflow in audit_log_n_hex()
- **fixed** — Fix restarting state leak on allocation failure in crypto qat
- **fixed** — Fix u32 overflow in check_and_correct_requested_length in hfs/hfsplus
- **fixed** — Prevent getting negative values of offset/length in hfs/hfsplus
- **fixed** — Fix out-of-bounds bit access on mt_io_flags in HID multitouch
- **fixed** — Fix use-after-free in l2cap_sock_new_connection_cb()
- **fixed** — Fix cyclic locking warning on netdev unregister in Bluetooth 6lowpan
- **fixed** — Fix OOB reads in rtl8723bs rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
- **fixed** — Fix resource tree corruption when BAR resize fails in PCI

The 110 most recent commits in this release — the full changelog is longer:

- Linux 6.6.145
- selftests/bpf: Add simple strscpy() implementation
- tools/testing: add linux/args.h header and fix radix, VMA tests
- driver core: Guard deferred probe timeout extension with delayed_work_pending()
- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion
- jiffies: Define secs_to_jiffies()
- writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
- writeback: Fix use after free in inode_switch_wbs_work_fn()
- xfs: fix stupid compiler warning
- Bluetooth: btmtk: remove #ifdef around declarations
- Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder
- selftests/hid: ensure CKI can compile our new tests on old kernels
- Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
- Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state
- ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
- seqlock: fix scoped_seqlock_read kernel-doc
- KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
- Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
- Bluetooth: hci_sync: annotate data-races around hdev->req_status
- Bluetooth: separate CIS_LINK and BIS_LINK link types
- Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
- btrfs: fix incorrect buffered IO fallback for append direct writes
- btrfs: fix false IO failure after falling back to buffered write
- exfat: preserve benign secondary entries during rename and move
- exfat: move exfat_chain_set() out of __exfat_resolve_path()
- exfat: add exfat_get_dentry_set_by_ei() helper
- exfat: rename argument name for exfat_move_file and exfat_rename_file
- exfat: remove unnecessary read entry in __exfat_rename()
- exfat: move free cluster out of exfat_init_ext_entry()
- mm: do file ownership checks with the proper mount idmap
- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
- regulator: scmi: Simplify with scoped for each OF child loop
- audit: fix potential integer overflow in audit_log_n_hex()
- audit: add audit_log_nf_skb helper function
- crypto: qat - fix restarting state leak on allocation failure
- btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
- usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- nvmet-auth: validate reply message payload bounds against transfer length
- nvmet: return DHCHAP status codes from nvmet_setup_auth()
- nvmet: remove superfluous initialization
- usb: gadget: f_fs: initialize reset_work at allocation time
- crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
- crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
- usb: typec: tcpm: Fix VDM type for Enter Mode commands
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- usb: iowarrior: remove inherent race with minor number
- bpf: Allow LPM map access from sleepable BPF programs
- bpf: Consistently use bpf_rcu_lock_held() everywhere
- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- hfs/hfsplus: prevent getting negative values of offset/length
- serial: 8250_mid: Disable DMA for selected platforms
- serial: 8250_mid: Remove 8250_pci usage
- HID: appleir: fix UAF on pending key_up_timer in remove()
- treewide: Switch/rename to timer_delete[_sync]()
- proc: protect ptrace_may_access() with exec_update_lock (part 1)
- seqlock: Change do_task_stat() to use scoped_seqlock_read()
- seqlock: Introduce scoped_seqlock_read()
- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
- HID: multitouch: fix out-of-bounds bit access on mt_io_flags
- HID: add haptics page defines
- perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
- writeback: fix race between cgrou

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.145]_

### 7.2-rc4

- Date: 2026-07-19
- Version: 7.2-rc4
- Original notes: https://git.kernel.org/torvalds/h/v7.2-rc4
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.2-rc4
- Labels: Pre-release; mainline

### 7.0.14

- Date: 2026-06-27
- Version: 7.0.14
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.14
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/7.0.14
- Labels: stable

- **fixed** — virtiofs: fix UAF on submount umount
- **fixed** — media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- **fixed** — ksmbd: reject non-VALID session in compound request branch
- **fixed** — drivers/base/memory: set mem->altmap after successful device registration
- **fixed** — serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- **fixed** — serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- **fixed** — vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- **removed** — crypto: qat - remove unused character device and IOCTLs
- **fixed** — iio: adc: ti-ads1298: add bounds check to pga_settings index
- **fixed** — iio: light: veml6075: add bounds check to veml6075_it_ms index
- **fixed** — net: net_failover: Fix the deadlock in slave register
- **changed** — net: export netif_open for self_test usage
- **fixed** — rose: don't free fd-owned sockets when reaping in the heartbeat
- **fixed** — rose: clear neighbour pointer in rose_kill_by_device()
- **fixed** — rose: cancel neighbour timers in rose_neigh_put() before freeing
- **fixed** — rose: drop CALL_REQUEST in loopback timer when device is not running
- **fixed** — rose: release netdev ref and destroy orphaned incoming sockets
- **fixed** — rose: fix netdev double-hold in rose_make_new()
- **fixed** — rose: disconnect orphaned STATE_2 sockets when device is gone
- **fixed** — rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup

43 commits in this release:

- Linux 7.0.14
- virtiofs: fix UAF on submount umount
- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- ksmbd: reject non-VALID session in compound request branch
- drivers/base/memory: set mem->altmap after successful device registration
- serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- crypto: qat - remove unused character device and IOCTLs
- iio: adc: ti-ads1298: add bounds check to pga_settings index
- iio: light: veml6075: add bounds check to veml6075_it_ms index
- net: net_failover: Fix the deadlock in slave register
- net: export netif_open for self_test usage
- rose: don't free fd-owned sockets when reaping in the heartbeat
- rose: clear neighbour pointer in rose_kill_by_device()
- rose: cancel neighbour timers in rose_neigh_put() before freeing
- rose: drop CALL_REQUEST in loopback timer when device is not running
- rose: release netdev ref and destroy orphaned incoming sockets
- rose: fix netdev double-hold in rose_make_new()
- rose: disconnect orphaned STATE_2 sockets when device is gone
- rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
- rose: fix notifier unregistered too early in rose_exit()
- rose: fix netdev double-hold in rose_rx_call_request()
- rose: guard rose_neigh_put() against NULL in timer expiry
- rose: clear neighbour pointer after rose_neigh_put() in state machines
- rose: fix race between loopback timer and module removal
- rose: hold loopback neighbour reference across timer callback
- rose: fix dev_put() leak in rose_loopback_timer()
- agp/amd64: Fix broken error propagation in agp_amd64_probe()
- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
- i2c: stub: Reject I2C block transfers with invalid length
- bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
- RDMA/bnxt_re: zero shared page before exposing to userspace
- Revert "NFSD: Defer sub-object cleanup in export put callbacks"
- fuse: re-lock request before replacing page cache folio
- firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
- firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
- firmware: samsung: acpm: Fix cross-thread RX length corruption
- firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
- firmware: exynos-acpm: Count number of commands in acpm_xfer
- lockd: fix TEST handling when not all permissions are available.
- arm64/entry: Fix arm64-specific rseq brokenness
- io_uring/net: Avoid msghdr on op_connect/op_bind async data