# Linux Kernel 6.12.104

- Product: Linux Kernel (https://whatsnew.fyi/product/linux-kernel)
- Vendor: Linux Kernel Organization
- Date: 2026-08-19
- Version: 6.12.104
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.12.104
- Labels: longterm

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — bpf: tcp: fix double sock release on batch realloc
- **fixed** — thunderbolt: Fix bandwidth group reservation indexing
- **fixed** — thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- **fixed** — sctp: clear new_transport when removing a peer
- **fixed** — sctp: fix use-after-free of cached ASCONF chunk
- **fixed** — sctp: keep chunk->transport in step with the list it is queued on
- **fixed** — scsi: scsi_debug: Negate wrapped memcmp() result
- **fixed** — bpf, sockmap: Fix sk_redir use-after-free in send verdict
- **fixed** — fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- **fixed** — fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- **fixed** — ima: Instantiate file_truncate and path_truncate hooks
- **fixed** — sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- **fixed** — fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- **fixed** — ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- **fixed** — ipv6: fix Route Information option length validation
- **fixed** — ptp: ocp: Fix board ID over-read
- **fixed** — eventfs: Fix use-after-free in eventfs_remove_rec()
- **fixed** — KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
- **fixed** — smb: client: Fix use-after-free in cifs_try_adding_channels()
- **fixed** — tipc: read le->link under the node lock in tipc_node_link_down()

The 113 most recent commits in this release — the full changelog is longer:

- Linux 6.12.104
- bpf: tcp: fix double sock release on batch realloc
- thunderbolt: Fix bandwidth group reservation indexing
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- sctp: clear new_transport when removing a peer
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: keep chunk->transport in step with the list it is queued on
- scsi: scsi_debug: Negate wrapped memcmp() result
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- ima: Instantiate file_truncate and path_truncate hooks
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- ipv6: fix Route Information option length validation
- ptp: ocp: Fix board ID over-read
- Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- eventfs: Fix use-after-free in eventfs_remove_rec()
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
- smb: client: Fix use-after-free in cifs_try_adding_channels()
- tipc: read le->link under the node lock in tipc_node_link_down()
- tls: don't leave a full plaintext sk_msg ring unpushed
- vhost: reset the vring metadata cache on vring reconfiguration
- veth: fix skb length accounting after XDP frag adjustment
- vsock/virtio: avoid refilling the RX queue after teardown
- vsock/virtio: read virtqueues under worker locks
- vxlan: do not arm the ageing timer on a device that is down
- xdp: reject clones that overrun skb_shared_info tailroom
- Revert "drm/amdgpu: fix aperture mapping leak"
- binfmt_misc: don't warn when the mount is completed from another user namespace
- ovl: don't warn when the mount is completed from another user namespace
- net/sched: act_gact, act_police: range check the fallback control action
- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
- net: atlantic: free RX pages of consumed but not refilled buffers
- net: atlantic: free stranded TX buffers on ring deinit
- netfilter: nf_conntrack: defer invalid log until after unlock
- netfilter: bridge: release template ct on non-IP path
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice
- mm/huge_memory: fix huge_zero_pfn race
- ring-buffer: Prevent subbuf order change when resizing is disabled
- fbdev: bitblit: bound-check glyph index in bit_cursor()
- tracing: Fix race between update_event_fields and, event_define_fields
- ALSA: usx2y: bound the hwdep mmap fault offset
- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
- ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
- misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
- misc: fastrpc: Remove buffer from list prior to unmap operation
- misc: fastrpc: fix channel ctx ref leak when session alloc fails
- staging: rtl8723bs: validate monitor transmit frame lengths
- staging: rtl8723bs: fix missing shared-key auth challenge length check
- staging: rtl8723bs: fix OOB read in WMM_param_handler()
- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
- serial: 8250_dma: Clear stale RX state on shutdown
- serial: qcom-geni: fix TX DMA buffer flush
- nvmem: layouts: Add fixed-layout driver
- mei: pull kvfree out of spinlock
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
- selftests/bpf: Adapt sockmap update error handling
- selftests/bpf: Ensure UDP sockets are bound
- pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
- kunit/fortify: Add back "volatile" for sizeof() constants
- kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()
- futex: Prevent robust futex exit race some m

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104]_