Linux Kernel 6.18.50

The 114 most recent commits in this release — the full changelog is longer:

• Linux 6.18.50
• mm/rmap: use huge_ptep_get() in try_to_unmap_one()
• mm: avoid unnecessary use of is_swap_pmd()
• platform/chrome: sensorhub: Fix dropped timestamp events and log spam
• selftests/mm: fix on-fault-limit false failure under sudo-rs
• udf: Fix i_lenExtents truncation on 32-bit kernels
• timer: Keep debugobjects state consistent in migrate_timer_list()
• timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
• taskstats: fix cpumask parsing cutting off the last character
• smack: fix cred UAF in smack_file_send_sigiotask()
• signal: avoid shared siginfo namespace rewrites
• sticon/parisc: Detect default STI graphics card for console output
• sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
• tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
• zloop: truncate finished zones to zone capacity
• xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
• w1: ds28e17: reject an oversize length on an I2C block read
• vsock/virtio: flush works in dependency order
• wifi: mt76: mt7996: validate default EEPROM firmware size
• wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
• wifi: mt76: mt7925: cancel mlo_pm_work on stop
• wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
• wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
• wifi: rtw88: pci: fix resource leak on failed NAPI setup
• wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
• wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
• wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
• wifi: rtl818x: initialize eeprom_93cx6 struct to zero
• wifi: mwifiex: Detach sync cmd buffer on interrupted wait
• crypto: sun8i-ss - Remove crypto_rng interface
• crypto: sun8i-ce - Remove crypto_rng interface
• wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
• wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
• wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
• i3c: renesas: Reconfigure the DATBAS register on re-attach
• i3c: renesas: Clean DATBAS register on detach
• i3c: renesas: Check that the transfer is valid before accessing it
• i3c: master: svc: bound IBI payload to the requested max_payload_len
• i3c: master: Fix info leak and UAF in device unregister path
• i3c: master: adi: initialize the lock before enabling interrupts
• dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
• dm-pcache: fix implicit u8 truncation of gc_percent in message handler
• dm-pcache: only hand out initialized cache segments
• dm-pcache: detect a cycle in the last-kset chain during replay
• dm-pcache: clamp the tail kset read to the segment data region
• dm-pcache: bound the persisted tail-position offset
• dm-pcache: validate on-media seg_num against the cache device size
• dm-pcache: validate kset key_num and intra-segment bounds
• dm-pcache: validate geometry fields from on-disk cache_info
• dm-switch: use WRITE_ONCE() in switch_region_table_write()
• dm-stats: fix a crash if allocation of per-cpu data fails
• arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
• net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
• rust: rust_is_available: warn for bindgen < 0.72.1 && libclang >= 22
• ovpn: run deferred work on a module-owned workqueue
• ring-buffer: Fix subbuf resize race with ring buffer readers
• ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
• ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
• ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
• ALSA: virmidi: Check card index validity at probe
• ALSA: serial-u16550: Check card index validity at probe
• ALSA: portman2x4: Check card index validity at probe
• ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
• ALSA: mts64: Check card index validity at probe
• ALSA: mpu401: Check card index validity at probe
• ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
• ALSA: bcd2000: clear the URB pointers on disconnect
• ALSA: aloop: Check card index validity at probe
• ALSA: 6fire: bound the MIDI event length from the device
• mfd: sm501: Fix potential memory leaks during remove
• mfd: cgbc: Fix teardown ordering in cgbc_remove()
• hwrng: stm32 - Fix runtime PM cleanup on registration failure
• seg6: reset IP6CB after IPv6 decapsulation
• net: skbuff: don't touch shared zerocopy state in skb_tx_error()
• net: fix spurious TX timeout after dev_activate()
• net: cap advertised IP tunnel headroom
• net/smc: unregister the connection before draining the rx tasklet
• net/smc: stop killed, freed and out_of_sync sharing a byte
• net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
• net/smc: fix use-after-free in smc_rx_pipe_buf_release()
• net/smc: fix socket refcount leak in smc_switch_conns()
• net/smc: do not dereference an unset send buffer on the SMC-D teardown path
• net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
• net: ntb_netdev: Count packets dropped on RX refill failure
• net: ntb_netdev: Avoid double-accounting netif_rx() drops
• net: ntb_netdev: Fix TX busy and drop handling
• NTB: ntb_transport: Reject oversized TX buffers
• NTB: ntb_transport: Fail TX enqueue when the QP link is down
• NTB: ntb_transport: Recycle TX entries before client callbacks
• net: thunderbolt: Mark the connection down when bringing it up fails
• net: thunderbolt: Release the Rx HopID that was handed out on mismatch
• net: ravb: serialize PTP clock teardown
• net: ravb: avoid dereferencing an invalid PTP clock
• net: phylink: correctly validate returned PCS in phylink_inband_caps
• net: openvswitch: fix nf_connlabels leak in ovs_ct_init
• net: openvswitch: fix flow mask use-after-free on flow deletion
• net: l2tp: do not propagate multicast notification errors
• net: ipa: fix stalled modem TX queue after runtime resume
• net: ibm: emac: mal: fix NAPI locking
• net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
• net: tun: bound receive headroom
• net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
• slip: fix use-after-free in sl_sync()
• xdp: fix zero-copy frame layout
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device
• ipmi:msghandler: Cancel work cleanly on an error
• ipmi: si: Fix NULL pointer dereference after failed registration
• ipmi: Remove all sysfs files on registration failure
• ipmi: ipmb: validate write message length
• interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
• io_uring/query: cap user size passed to copy_struct_to_user
• platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
• platform/x86: hp-bioscfg: pass validated element count to package parsers
• platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed