Linux Kernel 6.18.45

The 106 most recent commits in this release — the full changelog is longer:

• Linux 6.18.45
• netfilter: flowtable: ensure sufficient headroom in xmit path
• netfilter: always set route tuple out ifindex
• thunderbolt: Fix bandwidth group reservation indexing
• thunderbolt: Bound the DROM dual link port number before indexing sw->ports
• sctp: clear new_transport when removing a peer
• sctp: fix use-after-free of cached ASCONF chunk
• sctp: keep chunk->transport in step with the list it is queued on
• scsi: scsi_debug: Negate wrapped memcmp() result
• bpf, sockmap: Fix sk_redir use-after-free in send verdict
• fsverity: Fix silent truncation in bpf_get_fsverity_digest()
• fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
• mm/filemap: __filemap_add_folio() restore index before retrying
• ima: Instantiate file_truncate and path_truncate hooks
• sched/psi: Create the psimon kthread outside of cgroup_mutex
• sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
• fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
• ipv6: fix Route Information option length validation
• mm/ptdump: always stabilise against page table freeing using init_mm
• ring-buffer: Use current_context for safe per-CPU buffer swap
• ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
• ptp: ocp: Fix board ID over-read
• Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
• eventfs: Fix use-after-free in eventfs_remove_rec()
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
• KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
• smb: client: Fix use-after-free in cifs_try_adding_channels()
• tipc: read le->link under the node lock in tipc_node_link_down()
• tls: don't leave a full plaintext sk_msg ring unpushed
• tls: rx: restore msg_iter before TLS 1.3 optimistic retry
• vhost: reset the vring metadata cache on vring reconfiguration
• veth: fix skb length accounting after XDP frag adjustment
• vsock/virtio: avoid refilling the RX queue after teardown
• vsock/virtio: read virtqueues under worker locks
• vxlan: do not arm the ageing timer on a device that is down
• xdp: reject clones that overrun skb_shared_info tailroom
• x86/mce: Set up the polling timer before CMCI discovery
• x86/CPU: Add a tlbi= cmdline switch
• arm64: remove redundant concurrent ptdump UAF mitigation
• dibs: initialise dibs->lock in dibs_dev_alloc()
• Revert "drm/amdgpu: fix aperture mapping leak"
• binfmt_misc: don't warn when the mount is completed from another user namespace
• ovl: don't warn when the mount is completed from another user namespace
• net/sched: act_gact, act_police: range check the fallback control action
• net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
• net: atlantic: free RX pages of consumed but not refilled buffers
• net: atlantic: free stranded TX buffers on ring deinit
• netfilter: nf_conntrack: defer invalid log until after unlock
• netfilter: bridge: release template ct on non-IP path
• net: devmem: prevent net-iov / page mixing
• net/x25: fix use-after-free of the socket by its timers
• net/dibs: Correct freeing of dmb_clientid_arr
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev
• net: smc: fix splice entry lifetime imbalance in smc_rx_splice
• net: phy: mediatek: fix TX blink masks using the RX bits
• mm/huge_memory: fix huge_zero_pfn race
• tracing: Fix NULL pointer dereference in module event cache removal
• ring-buffer: Prevent subbuf order change when resizing is disabled
• fbdev: bitblit: bound-check glyph index in bit_cursor()
• tracing: Fix race between update_event_fields and, event_define_fields
• perf/core: Fix group leader use-after-free after sibling detach
• drm/v3d: Serialize the scheduler timeout handlers
• ALSA: us144mkii: re-anchor capture URBs on resubmission
• ALSA: hda/tas2781: fix ACPI reference handling
• ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
• ALSA: usx2y: bound the hwdep mmap fault offset
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
• mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
• samples/damon/mtier: error out for zero quota goal target values
• mm/damon/ops-common: putback folios on invalid migrate nid
• ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
• misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
• misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
• misc: fastrpc: Remove buffer from list prior to unmap operation
• misc: fastrpc: fix channel ctx ref leak when session alloc fails
• misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
• staging: rtl8723bs: validate monitor transmit frame lengths
• staging: rtl8723bs: fix missing shared-key auth challenge length check
• staging: rtl8723bs: fix OOB read in WMM_param_handler()
• staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
• serial: amba-pl011: synchronize DMA teardown
• serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
• serial: amba-pl011: fix indefinite RS485 post-send delay
• serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
• serial: 8250_dma: Clear stale RX state on shutdown
• serial: qcom-geni: fix TX DMA buffer flush
• rust_binder: do not query current thread for all ioctls
• nvmem: layouts: Add fixed-layout driver
• nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
• mei: pull kvfree out of spinlock
• ipv4: fix use-after-free in fib_nhc_update_mtu()
• ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
• selftests/bpf: Adapt sockmap update error handling
• selftests/bpf: Ensure UDP sockets are bound
• Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
• Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
• netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate
• futex: Prevent robust futex exit race some more
• iommu/vt-d: Gather the unmapped range before freeing its page tables
• dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
• KVM: s390: pci: Fix aisb calculation
• blk-mq: reinsert cached request to the list
• blk-mq: pop cached request if it is usable
• Revert "drm/amd/display: Fix backlight max_brightness to match exported range"
• net: bridge: mrp: fix uninitialised bytes on the wire