# Linux Kernel 5.15.216

- Product: Linux Kernel (https://whatsnew.fyi/product/linux-kernel)
- Vendor: Linux Kernel Organization
- Date: 2026-08-19
- Version: 5.15.216
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.216
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/5.15.216
- Labels: longterm

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- **fixed** — sctp: clear new_transport when removing a peer
- **fixed** — sctp: fix use-after-free of cached ASCONF chunk
- **fixed** — sctp: keep chunk->transport in step with the list it is queued on
- **fixed** — scsi: scsi_debug: Negate wrapped memcmp() result
- **fixed** — bpf, sockmap: Fix sk_redir use-after-free in send verdict
- **fixed** — ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- **fixed** — ipv6: fix Route Information option length validation
- **fixed** — tipc: read le->link under the node lock in tipc_node_link_down()
- **fixed** — vhost: reset the vring metadata cache on vring reconfiguration
- **fixed** — vsock/virtio: avoid refilling the RX queue after teardown
- **fixed** — vsock/virtio: read virtqueues under worker locks
- **fixed** — vxlan: do not arm the ageing timer on a device that is down
- **fixed** — xdp: reject clones that overrun skb_shared_info tailroom
- **fixed** — net/sched: act_gact, act_police: range check the fallback control action
- **fixed** — net: atlantic: free RX pages of consumed but not refilled buffers
- **fixed** — netfilter: bridge: release template ct on non-IP path
- **fixed** — ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- **fixed** — fbdev: bitblit: bound-check glyph index in bit_cursor()
- **fixed** — tracing: Fix race between update_event_fields and event_define_fields

The 113 most recent commits in this release — the full changelog is longer:

- Linux 5.15.216
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- sctp: clear new_transport when removing a peer
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: keep chunk->transport in step with the list it is queued on
- scsi: scsi_debug: Negate wrapped memcmp() result
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- ipv6: fix Route Information option length validation
- Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- tipc: read le->link under the node lock in tipc_node_link_down()
- vhost: reset the vring metadata cache on vring reconfiguration
- vsock/virtio: avoid refilling the RX queue after teardown
- vsock/virtio: read virtqueues under worker locks
- vxlan: do not arm the ageing timer on a device that is down
- xdp: reject clones that overrun skb_shared_info tailroom
- net/sched: act_gact, act_police: range check the fallback control action
- net: atlantic: free RX pages of consumed but not refilled buffers
- netfilter: bridge: release template ct on non-IP path
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- fbdev: bitblit: bound-check glyph index in bit_cursor()
- tracing: Fix race between update_event_fields and, event_define_fields
- ALSA: usx2y: bound the hwdep mmap fault offset
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
- misc: fastrpc: fix channel ctx ref leak when session alloc fails
- staging: rtl8723bs: validate monitor transmit frame lengths
- staging: rtl8723bs: fix missing shared-key auth challenge length check
- staging: rtl8723bs: fix OOB read in WMM_param_handler()
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
- serial: 8250_dma: Clear stale RX state on shutdown
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
- fscrypt: Replace mk_users keyring with simple list
- RDMA/rxe: Fix a use-after-free problem in rxe_mmap
- pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
- futex: Prevent robust futex exit race some more
- Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
- Input: evdev - fix information leak in evdev_pass_values()
- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
- vt: add permission check for KDSKBMETA ioctl
- net: bridge: mrp: fix uninitialised bytes on the wire
- netfilter: ebt_nflog: pin the NFLOG backend
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
- net: octeontx2-pf: Fix UB in shift operation
- net: openvswitch: reallocate update replies for mismatched IDs
- net/packet: reset the MAC header on the packet-socket transmit path
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors
- ipvs: properly update the overload flag on dest edit
- ipvs: add totalconns for dest
- ima: fix out-of-bounds read in xattr_verify()
- usb: gadget: f_ncm: Use unsigned int for ndp_index
- usb: cdnsp: fix incorrect endian conversions for APB timeout register
- thunderbolt: icm: Preserve USB4 proxy data-valid bit
- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
- ALSA: usb-audio: fix OOB write on Type II inbound URBs
- Input: evdev - sanitize event type index when fetching event masks
- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
- tls: don't abort the connection on signal-interrupted sends
- sctp: clear control chunk transport if it is being removed
- ata: pata_sl82c105: fix bridge revision use-after-free
- net: thunderbolt: Tear down DMA paths before stopping the rings
- net: qrtr: ns: Raise lookup limit to 128
- net/smc: fix TOCTOU race between smc_listen_out() and listener close
- net: remove WARN_ON_ONCE() from sk_mc_loop()
- net: prestera: validate firmware header le

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.216]_