# Linux Kernel 6.18.45

- Product: Linux Kernel (https://whatsnew.fyi/product/linux-kernel)
- Vendor: Linux Kernel Organization
- Date: 2026-08-19
- Version: 6.18.45
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.45
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.18.45
- Labels: longterm

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — netfilter: flowtable: ensure sufficient headroom in xmit path
- **fixed** — netfilter: always set route tuple out ifindex
- **fixed** — thunderbolt: Fix bandwidth group reservation indexing
- **fixed** — thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- **fixed** — sctp: clear new_transport when removing a peer
- **fixed** — sctp: fix use-after-free of cached ASCONF chunk
- **fixed** — sctp: keep chunk->transport in step with the list it is queued on
- **fixed** — scsi: scsi_debug: Negate wrapped memcmp() result
- **fixed** — bpf, sockmap: Fix sk_redir use-after-free in send verdict
- **fixed** — fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- **fixed** — fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- **fixed** — mm/filemap: __filemap_add_folio() restore index before retrying
- **fixed** — ima: Instantiate file_truncate and path_truncate hooks
- **fixed** — sched/psi: Create the psimon kthread outside of cgroup_mutex
- **fixed** — sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- **fixed** — fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- **fixed** — ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- **fixed** — ipv6: fix Route Information option length validation
- **fixed** — mm/ptdump: always stabilise against page table freeing using init_mm
- **fixed** — ring-buffer: Use current_context for safe per-CPU buffer swap

The 106 most recent commits in this release — the full changelog is longer:

- Linux 6.18.45
- netfilter: flowtable: ensure sufficient headroom in xmit path
- netfilter: always set route tuple out ifindex
- thunderbolt: Fix bandwidth group reservation indexing
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- sctp: clear new_transport when removing a peer
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: keep chunk->transport in step with the list it is queued on
- scsi: scsi_debug: Negate wrapped memcmp() result
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- mm/filemap: __filemap_add_folio() restore index before retrying
- ima: Instantiate file_truncate and path_truncate hooks
- sched/psi: Create the psimon kthread outside of cgroup_mutex
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- ipv6: fix Route Information option length validation
- mm/ptdump: always stabilise against page table freeing using init_mm
- ring-buffer: Use current_context for safe per-CPU buffer swap
- ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
- ptp: ocp: Fix board ID over-read
- Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- eventfs: Fix use-after-free in eventfs_remove_rec()
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
- smb: client: Fix use-after-free in cifs_try_adding_channels()
- tipc: read le->link under the node lock in tipc_node_link_down()
- tls: don't leave a full plaintext sk_msg ring unpushed
- tls: rx: restore msg_iter before TLS 1.3 optimistic retry
- vhost: reset the vring metadata cache on vring reconfiguration
- veth: fix skb length accounting after XDP frag adjustment
- vsock/virtio: avoid refilling the RX queue after teardown
- vsock/virtio: read virtqueues under worker locks
- vxlan: do not arm the ageing timer on a device that is down
- xdp: reject clones that overrun skb_shared_info tailroom
- x86/mce: Set up the polling timer before CMCI discovery
- x86/CPU: Add a tlbi= cmdline switch
- arm64: remove redundant concurrent ptdump UAF mitigation
- dibs: initialise dibs->lock in dibs_dev_alloc()
- Revert "drm/amdgpu: fix aperture mapping leak"
- binfmt_misc: don't warn when the mount is completed from another user namespace
- ovl: don't warn when the mount is completed from another user namespace
- net/sched: act_gact, act_police: range check the fallback control action
- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
- net: atlantic: free RX pages of consumed but not refilled buffers
- net: atlantic: free stranded TX buffers on ring deinit
- netfilter: nf_conntrack: defer invalid log until after unlock
- netfilter: bridge: release template ct on non-IP path
- net: devmem: prevent net-iov / page mixing
- net/x25: fix use-after-free of the socket by its timers
- net/dibs: Correct freeing of dmb_clientid_arr
- ipv6: prevent in6_dev_get() from resurrecting inet6_dev
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice
- net: phy: mediatek: fix TX blink masks using the RX bits
- mm/huge_memory: fix huge_zero_pfn race
- tracing: Fix NULL pointer dereference in module event cache removal
- ring-buffer: Prevent subbuf order change when resizing is disabled
- fbdev: bitblit: bound-check glyph index in bit_cursor()
- tracing: Fix race between update_event_fields and, event_define_fields
- perf/core: Fix group leader use-after-free after sibling detach
- drm/v3d: Serialize the scheduler timeout handlers
- ALSA: us144mkii: re-anchor capture URBs on resubmission
- ALSA: hda/tas2781: fix ACPI reference handling
- ALSA: FCP: fix OOB write in fcp_mete

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.45]_