# Linux Kernel 6.18.46

- Product: Linux Kernel (https://whatsnew.fyi/product/linux-kernel)
- Vendor: Linux Kernel Organization
- Date: 2026-08-23
- Version: 6.18.46
- Original notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.46
- Permalink: https://whatsnew.fyi/product/linux-kernel/releases/6.18.46
- Labels: longterm

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Enable headset mic on F+ FLAPTOP r in ALSA hda realtek driver
- **fixed** — Initialize page array to use alloc_pages_bulk() correctly in firewire ohci
- **fixed** — Set surface-framebuffer GEM objects in drm vmwgfx
- **fixed** — Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms in erofs
- **changed** — Mark device ready before registering the controller in spi virtio
- **fixed** — Fix infinite loop when scale is too large for display in drm log
- **removed** — Remove drm_client_framebuffer_delete() from drm client
- **deprecated** — Deprecate struct drm_client_buffer.gem in drm client
- **changed** — Move dumb-buffer handling to drm_client_framebuffer_create() in drm client
- **removed** — Remove pitch from struct drm_client_buffer in drm client
- **fixed** — Fix out-of-bounds read on empty message length in drm log
- **fixed** — Fix sync entry leak on OA config emit failure in drm xe oa
- **fixed** — Fix NULL pointer dereference in ar_context_release in firewire ohci
- **fixed** — Reject dev-bound programs bound to a different device in net sched cls_bpf
- **fixed** — Skip unmapped range in aie2_populate_range() in accel amdxdna
- **fixed** — Fix port_id extraction from SRC TAG in net ethernet ti am65-cpsw-nuss
- **fixed** — Don't call an unset readable_reg callback in regmap sdw-mbq
- **fixed** — Define NR_CPUS to 1 in m68k
- **fixed** — Skip hash tables in u32_bind_class() in net sched cls_u32

The 120 most recent commits in this release — the full changelog is longer:

- Linux 6.18.46
- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
- firewire: ohci: initialize page array to use alloc_pages_bulk() correctly
- drm/vmwgfx: Set surface-framebuffer GEM objects
- erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- spi: virtio: mark device ready before registering the controller
- drm/log: Fix infinite loop when scale is too large for display
- drm/client: Remove drm_client_framebuffer_delete()
- drm/client: Deprecate struct drm_client_buffer.gem
- drm/client: Inline drm_client_buffer_addfb() and _rmfb()
- drm/client: Move dumb-buffer handling to drm_client_framebuffer_create()
- drm/client: Remove pitch from struct drm_client_buffer
- drm/log: Fix out-of-bounds read on empty message length
- drm/xe/oa: Fix sync entry leak on OA config emit failure
- firewire: ohci: fix NULL pointer dereference in ar_context_release
- firewire: ohci: split page allocation from dma mapping
- net/sched: cls_bpf: reject dev-bound programs bound to a different device
- accel/amdxdna: Skip unmapped range in aie2_populate_range()
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- regmap: sdw-mbq: don't call an unset readable_reg callback
- m68k: Define NR_CPUS to 1
- net/sched: cls_u32: skip hash tables in u32_bind_class()
- net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
- af_packet: Don't send zero-byte data in tpacket_snd().
- regmap: sdw-mbq: Fix swap of timeout and retry times
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
- net/tls: Fail tls_sw_splice_read() after a failed async decrypt
- net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
- net: tap: fix wrong transport_header when sending VLAN-tagged frame
- net: packet: fix wrong transport_header when sending VLAN-tagged frame
- net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
- tcp: fix icsk_ack.ato bitfield overflow
- veth: fix queue index used to wake the peer txq in veth_poll
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
- eth: bnxt: keep the aRFS rmap updated when TPH is enabled
- eth: bnxt: cancel IRQ notifier before freeing affinity mask
- netfilter: ipset: let destroy callbacks adjust ext mem size
- netfilter: ipset: fix list type element drift bug
- netfilter: flowtable: publish GC-visible tuple last
- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- netfilter: ipset: fix refcount race between list:set GC and swap
- ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
- gpio: ml-ioh: share the register lock across channels
- perf: Reject exited events as group leaders
- riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
- ovpn: finish crypto callback cleanup before peer release
- ovpn: fix NULL dereference when killing missing key
- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
- crypto: ccm - Set rfc4309 maxauthsize from child
- arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
- NTB: ntb_netdev: Preserve RX queue depth on allocation failure
- net: ntb_netdev: Introduce per-queue context
- ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
- drm/amd/pm: fix pptable use-after-free
- drm/amd/pm: adjust the visibility of pp_table sysfs node
- mm/page_table_check: skip special zero mappings
- ring-buffer: Prevent resizing of persistent ring buffer
- ring-buffer: Store bpage pointers into subbuf_ids
- ring-buffer: Add helper functions for allocations
- sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
- sched_ext: Reorganize enable/disable path for multi-scheduler support
- sched_ext: Update p->scx.disallow warning in scx_init_task()
- futex: Fix race in futex_pivot_pending() during private hash resize
- can: rcar_canfd: change the initial

_[Truncated at 4000 characters — full notes: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.46]_