# XanMod Kernel: what changed from 6 to 7

- Product: XanMod Kernel (https://whatsnew.fyi/product/xanmod)
- Vendor: XanMod
- Range: changelog entries numbered after 6.18.49-xanmod1 up to and including 7.2.3-xanmod1, stable releases only
- Entries below: 13 releases (newest first)
- Resolved: 6 is 6.18.49-xanmod1 and 7 is 7.2.3-xanmod1, the newest stable release of each major we track
- Carrying security changes: 2 · CVEs mentioned: 0 · Mentioning breaking changes: 0 · Removing or deprecating something: 4
- Page: https://whatsnew.fyi/product/xanmod/compare/6...7

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (224 changes, grouped by kind)

### Added

#### 7.2.0-xanmod1 (2026-08-21)

- Add sysctl to disallow unprivileged CLONE_NEWUSER by default
- Enable overrides for missing ACS capabilities in PCI
- Export file_close_fd() for use by modules
- Allow __wake_up_pollfree() to be used from GPL modules
- Add debug mask file for binder_alloc
- Convert binder into a module
- Expose controller board power in sysfs for Steam Deck
- Add MFD core driver for Steam Deck
- Add support for Steam Deck LED
- Add support for max battery level and rate in Steam Deck hwmon
- Add driver for Steam Deck's EC sensors
- Add driver for Steam Deck extcon
- Add xt_FLOWOFFLOAD target for netfilter
- Add netfilter nf_tables fullcone support
- Add sysctl to skip tcp collapse processing when receive buffer is full

#### 7.1.8-xanmod1 (2026-08-10)

- media: chips-media: wave5: Support CBP profile

#### 7.1.5-xanmod1 (2026-07-25)

- Add cancel helper for async requests in firmware_loader

### Changed

#### 7.2.3-xanmod1 (2026-09-02)

- usb: core: Strengthen error handling in hub_hub_status() (also in 7.1.13-xanmod1)
- usb: core: Add lock to usb_wakeup_notification() (also in 7.1.13-xanmod1)
- crypto: krb5: use kfree_sensitive() for derived key buffers (also in 7.1.13-xanmod1)

#### 7.1.13-xanmod1 (2026-09-02)

- crypto: qcom-rng: Allow zero as a random number

#### 7.1.10-xanmod1 (2026-08-25)

- Set GT rp min frequency as 1.2GHz default for BMG/CRI in drm/xe

#### 7.2.0-xanmod1 (2026-08-21)

- Update TCP 'bbr' congestion control module to BBRv3 (also in 7.1.5-xanmod1)
- Disable workqueues for crypto ops in dm-crypt
- Use call_rcu when detaching client in input/evdev
- Initialize ata before graphics
- Improve rwsem spin performance
- Enable stateless firmware loading
- Accept connections in LIFO order for cache efficiency in sched/wait
- Add working set protection for anon and clean file pages
- Add 500Hz timer interrupt kernel config option
- Set wbt_default_latency_nsec() to 2msec
- Set rq_affinity to force complete I/O requests on same CPU
- Disable front_merges by default in block/mq-deadline
- Increase write priority in block/mq-deadline to improve responsiveness
- Set scheduler tunable latencies to unscaled

#### 7.1.8-xanmod1 (2026-08-10)

- drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
- drm/xe: Set TTM device beneficial_order to 9 (2M)
- drm/xe: Separate early xe_device initialization
- drm/xe: Move xe->info.devid|revid initialization
- drm/xe: Move xe->info.force_execlist initialization
- drm/xe: Drop unused param from xe_device_create()
- usb: typec: ucsi: split connector lock classes

#### 7.1.6-xanmod1 (2026-08-03)

- net: mana: Optimize irq affinity for low vcpu configs

#### 7.1.5-xanmod1 (2026-07-25)

- Wait for pre-firmware load in usb: atm: ueagle-atm .disconnect()
- Remove function entry/exit debug messages from usb: atm: ueagle-atm
- Use dev_dbg() for 'device found' message in usb: atm: ueagle-atm

### Fixed

#### 7.2.3-xanmod1 (2026-09-02)

- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (also in 7.1.13-xanmod1)
- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (also in 7.1.13-xanmod1)
- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (also in 7.1.13-xanmod1)
- USB: serial: option: fix slab OOB read in interrupt URB callback (also in 7.1.13-xanmod1)
- ALSA: usb-audio: Complete cleanup after system-resume errors (also in 7.1.13-xanmod1)
- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (also in 7.1.13-xanmod1)
- ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB (also in 7.1.13-xanmod1)
- KVM: s390: vsie: zero stale crypto bits (also in 7.1.13-xanmod1)
- crypto: mxs-dcp: fix source scatterlist length access (also in 7.1.13-xanmod1)
- crypto: iaa: fall back to software for multi-entry scatterlists (also in 7.1.13-xanmod1)
- crypto: qce: fix CCM AAD buffer underallocation (also in 7.1.13-xanmod1)
- crypto: atmel-tdes: use scatterlist length before DMA mapping (also in 7.1.13-xanmod1)

#### 7.2.1-xanmod1 (2026-08-27)

- ptp: vmclock: prevent read-only mappings from becoming writable (also in 7.1.11-xanmod1)
- futex: Fix might_sleep() warning in futex_pivot_pending()
- Bluetooth: hci_aml: validate firmware segment lengths (also in 7.1.11-xanmod1)
- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (also in 7.1.11-xanmod1)
- Bluetooth: ISO: zero the sockaddr before returning it in getname (also in 7.1.11-xanmod1)
- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (also in 7.1.11-xanmod1)
- Bluetooth: hci_sync: Fix accept list UAF during suspend (also in 7.1.11-xanmod1)
- Bluetooth: hci_event: validate LE Set CIG Parameters response (also in 7.1.11-xanmod1)
- Bluetooth: hci_event: fix LE list UAF on reset (also in 7.1.11-xanmod1)
- HID: input: read battery capacity from its actual report offset (also in 7.1.11-xanmod1)
- HID: hyperv: validate initial device info bounds (also in 7.1.11-xanmod1)
- HID: uclogic: fix use-after-free of inrange_timer on remove (also in 7.1.11-xanmod1)
- HID: sensor: custom: Fix use-after-free in enable_sensor (also in 7.1.11-xanmod1)
- HID: ft260: fix stack-use-after-return write in I2C read race (also in 7.1.11-xanmod1)
- HID: core: fix number/pointer type confusion on long items (also in 7.1.11-xanmod1)
- HID: rapoo: fix missing hid_is_usb() check (also in 7.1.11-xanmod1)
- HID: nintendo: stop device IO before hid_hw_stop on probe failure (also in 7.1.11-xanmod1)
- HID: nintendo: register input device after capabilities are set (also in 7.1.11-xanmod1)
- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (also in 7.1.11-xanmod1)
- HID: huawei: fix missing hid_is_usb() check (also in 7.1.11-xanmod1)

#### 7.1.11-xanmod1 (2026-08-27)

- futex: Avoid private hash use-after-free on final put

#### 7.1.10-xanmod1 (2026-08-25)

- Enable headset mic on F+ FLAPTOP r
- Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- Mark SPI virtio device ready before registering the controller
- Fix infinite loop when scale is too large for display in drm/log
- Fix out-of-bounds read on empty message length in drm/log
- Fix division by zero when scale module parameter is 0 in drm/log
- Fix bug in pc_adjust_freq_bounds() in drm/xe
- Check managed mutex initialization errors in drm/xe/oa
- Fix sync entry leak on OA config emit failure in drm/xe/oa
- Add termination on resume in drm/xe/pxp
- Fix NULL pointer dereference in ar_context_release in firewire ohci
- Fix tunnel and session refcount leak on seq_file release in l2tp
- Reject dev-bound BPF programs bound to a different device in cls_bpf
- Skip unmapped range in aie2_populate_range() in accel/amdxdna
- Fix port_id extraction from SRC TAG in am65-cpsw-nuss
- Don't call an unset readable_reg callback in regmap sdw-mbq
- Define NR_CPUS to 1 on m68k
- Reject allocations through dead ancestor pid namespaces
- Skip hash tables in u32_bind_class() in cls_u32

#### 7.1.9-xanmod1 (2026-08-19)

- thunderbolt: Fix bandwidth group reservation indexing
- thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- sctp: clear new_transport when removing a peer
- sctp: fix use-after-free of cached ASCONF chunk
- sctp: keep chunk->transport in step with the list it is queued on
- scsi: scsi_debug: Negate wrapped memcmp() result
- bpf, sockmap: Fix sk_redir use-after-free in send verdict
- fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- mm/filemap: __filemap_add_folio() restore index before retrying
- ima: Instantiate file_truncate and path_truncate hooks
- sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
- sched/psi: Create the psimon kthread outside of cgroup_mutex
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
- ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- ipv6: fix Route Information option length validation
- mm/ptdump: always stabilise against page table freeing using init_mm
- mm/page_table_check: skip special zero mappings

#### 7.1.8-xanmod1 (2026-08-10)

- usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
- drm/amd/display: Exit idle optimizations before programming
- drm/amd/display: check GRPH_FLIP status before sending event
- drm/xe: Wait on external BO kernel fences in exec IOCTL
- usb: typec: ucsi: Fix race condition and ordering in port unregistration
- drm/xe/rtp: Ensure locking/ref counting for OA whitelists
- drm/vmwgfx: validate external BO copy bounds for both stride paths
- drm/vmwgfx: enforce cursor size limits for MOB cursors
- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- drm/amdkfd: hold event_mutex while checkpointing CRIU events
- drm/amdkfd: fix QID bit leak in pqm_create_queue()

#### 7.1.6-xanmod1 (2026-08-03)

- cifs: fix time_last_write stamp placement in setattr/truncate paths
- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
- bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
- mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
- xfs: don't replace the wrong part of the cow fork
- fuse-uring: fix race between registration and connection abortion
- audit: fix recursive locking deadlock in audit_dupe_exe()
- drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
- ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
- drm/amdgpu: fix aperture mapping leak
- drm/amdgpu: reject mapping a reserved doorbell to a new queue
- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
- drm/amdgpu: fix resource leak on ACP reset timeout
- drm/amdgpu: Fix kernel panic during driver load failure
- drm/amdgpu: fix division by zero with invalid uvd dimensions
- vxlan: mdb: Fix source list corruption on a failed replace

#### 7.1.5-xanmod1 (2026-07-25)

- Prevent UAF caused by non-leader exec() race in posix-cpu-timers
- Fix Color Manager (3DLUT, Shaper, Blend) in drm/amd/display
- Fix implicit declaration of brelse() in exfat
- Validate session type before performing operation in liveupdate
- Add newly added RTGs to the free pool in xfs growfs
- Use opener credentials for FSCTL mutations in ksmbd
- Fix path resolution in ksmbd_vfs_kern_path_create
- Fix use-after-free in l2cap_sock_new_connection_cb() in Bluetooth L2CAP
- Fix cyclic locking warning on netdev unregister in Bluetooth 6lowpan
- Cache secctx size before release zeroes it in binder
- Cancel async firmware request at unbind in ALSA: hda/tas2781
- Update offsets for 2i2 Gen 4 firmware 2417 in ALSA: scarlett2
- Fix stale or zero output when reading raw values in iio: hid-sensor-rotation
- Fix listxattr handling of corrupted xattr entries in f2fs

#### 7.1.4-xanmod1 (2026-07-18)

- xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
- xfs: write the rg superblock when fixing it
- xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
- xfs: don't zap bmbt forks if they are MAXLEVELS tall
- xfs: fully check the parent handle when it points to the rootdir
- xfs: clamp timestamp nanoseconds correctly
- xfs: handle non-inode owners for rtrmap record checking
- xfs: set xfarray killable sort correctly
- xfs: use the rt version of the cow staging checker
- xfs: grab rtrmap btree when checking rgsuper
- xfs: don't wrap around quota ids in dqiterate
- xfs: resample the data fork mapping after cycling ILOCK
- xfs: fail recovery on a committed log item with no regions
- xfs: fix null pointer dereference in tracepoint
- smb: client: reject overlapping data areas in SMB2 responses
- Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- timekeeping: Register default clocksource before taking tk_core.lock
- fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
- fuse-uring: make a fuse_req on SQE commit only findable after memcpy
- fuse-uring: Avoid queue->stopped races and set/read that value under lock

#### 7.1.3-xanmod1 (2026-07-04)

- apparmor: advertise the tcp fast open fix is applied
- net/tcp-ao: fix use-after-free of key in del_async path
- ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- NFS: Prevent resource leak in nfs_alloc_server()
- NFSv4: clear exception state on successful mkdir retry
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- NFSv4/flexfiles: reject zero filehandle version count
- nfsd: reset write verifier on deferred writeback errors
- nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- nfsd: fix dead ACL conflict guard in nfsd4_create
- nfsd: check get_user() return when reading princhashlen
- nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
- nfsd: fix inverted cp_ttl check in async copy reaper
- nfsd: fix posix_acl leak on SETACL decode failure
- NFSD: Fix SECINFO_NO_NAME decode error cleanup
- nfsd: release layout stid on setlease failure
- i2c: core: fix adapter registration race
- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- fbdev: modedb: fix a possible UAF in fb_find_mode()
- fbdev: omap2: fix use-after-free in omapfb_mmap

#### 7.1.2-xanmod1 (2026-06-27)

- virtiofs: fix UAF on submount umount
- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- ksmbd: reject non-VALID session in compound request branch
- drivers/base/memory: set mem->altmap after successful device registration
- serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- iio: adc: ti-ads1298: add bounds check to pga_settings index
- iio: light: veml6075: add bounds check to veml6075_it_ms index
- agp/amd64: Fix broken error propagation in agp_amd64_probe()
- Revert NFSD: Defer sub-object cleanup in export put callbacks
- fuse: re-lock request before replacing page cache folio
- io_uring/net: Avoid msghdr on op_connect/op_bind async data

### Removed

#### 7.2.3-xanmod1 (2026-09-02)

- USB: serial: spcp8x5: drop broken carrier detect support (also in 7.1.13-xanmod1)
- crypto: qce: Remove unsafe/deprecated algorithms (also in 7.1.13-xanmod1)
- crypto: sun8i-ss: Remove crypto_rng interface
- crypto: sun8i-ce: Remove crypto_rng interface

#### 7.1.13-xanmod1 (2026-09-02)

- crypto: qcom-rng: Remove crypto_rng interface

#### 7.1.5-xanmod1 (2026-07-25)

- Remove crypto_rng interface from crypto: xilinx-trng

#### 7.1.2-xanmod1 (2026-06-27)

- crypto: qat - remove unused character device and IOCTLs

### Security

#### 7.1.8-xanmod1 (2026-08-10)

- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE

#### 7.1.6-xanmod1 (2026-08-03)

- ksmbd: validate ACE size against SID sub-authorities
- ksmbd: bound DACL dedup walk to copied ACEs
- ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

## Release notes

### 7.2.3-xanmod1

- Date: 2026-09-02
- Version: 7.2.3-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.2.3-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.2.3-xanmod1

- **fixed** — usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- **fixed** — wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- **fixed** — USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- **removed** — USB: serial: spcp8x5: drop broken carrier detect support
- **fixed** — USB: serial: option: fix slab OOB read in interrupt URB callback
- **fixed** — ALSA: usb-audio: Complete cleanup after system-resume errors
- **fixed** — ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- **fixed** — ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
- **changed** — usb: core: Strengthen error handling in hub_hub_status()
- **changed** — usb: core: Add lock to usb_wakeup_notification()
- **fixed** — KVM: s390: vsie: zero stale crypto bits
- **removed** — crypto: qce: Remove unsafe/deprecated algorithms
- **fixed** — crypto: mxs-dcp: fix source scatterlist length access
- **fixed** — crypto: iaa: fall back to software for multi-entry scatterlists
- **fixed** — crypto: qce: fix CCM AAD buffer underallocation
- **changed** — crypto: krb5: use kfree_sensitive() for derived key buffers
- **fixed** — crypto: atmel-tdes: use scatterlist length before DMA mapping
- **removed** — crypto: sun8i-ss: Remove crypto_rng interface
- **removed** — crypto: sun8i-ce: Remove crypto_rng interface

- 3b1e0e296cd6 Linux 7.2.3-xanmod1
- a981f4bbb87f Merge tag 'v7.2.3' into 7.2
- 58e7295cfeca Linux 7.2.3
- 47a7f98fbb50 usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- e5e8fc11a7ac wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- f24dcc61bd0e USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- 3720311fa519 USB: serial: spcp8x5: drop broken carrier detect support
- d762aef4eba3 USB: serial: option: fix slab OOB read in interrupt URB callback
- d1f643b1c025 ALSA: usb-audio: Complete cleanup after system-resume errors
- 1074c2306901 ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- 8bf1cdb6d05c ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
- b471594da637 usb: core: Strengthen error handling in hub_hub_status()
- 7c48aa0c1e79 usb: core: Add lock to usb_wakeup_notification()
- 29b4f7bc2991 KVM: s390: vsie: zero stale crypto bits
- 8cbd1539e00d crypto: qce - Remove unsafe/deprecated algorithms
- 6ef9a4afb52c crypto: mxs-dcp - fix source scatterlist length access
- 516a830e2f47 crypto: iaa - fall back to software for multi-entry scatterlists
- 4839f4c21f9c crypto: qce - fix CCM AAD buffer underallocation
- a1bf79365794 crypto: krb5 - use kfree_sensitive() for derived key buffers
- 0dd2f638877a crypto: atmel-tdes - use scatterlist length before DMA mapping
- 8ab58786b4c6 crypto: sun8i-ss - Remove crypto_rng interface
- 1017f987c5f0 crypto: sun8i-ce - Remove crypto_rng interface
- 3c7101cfc52e crypto: qcom-rng - Allow zero as a random number
- 669d940351ed crypto: qcom-rng - Remove crypto_rng interface
- b1d62624a13c crypto: qcom-rng - Enable clock in hwrng case
- 1f9f877b1ef1 crypto: virtio - bound the akcipher result length
- 8b9a857fcf32 kunit: irq: Continue increasing hrtimer interval for longer
- 9b74e5633687 mm/swap: reject swapon() on filesystem-level encrypted files
- 68de7f3a38ac netfilter: nf_tables: don't queue packet path object notifications
- fbfa5944d221 netfilter: nft_set_pipapo_avx2: add missing vzeroupper
- 4bbc76ee1b21 vxlan: keep the last remote linked during FDB flush
- 2b46baa591d0 batman-adv: reject unrepresentable multicast TVLV offsets
- f4be3b391265 ipv6: seg6: clear IPv4 control block on IPIP decapsulation
- 550d00aa5819 net/packet: defer vmalloc TX_RING free until skbs finish
- a29f3b884ba5 vlan: fix skb_under_panic and races when toggling HW VLAN offload
- 57f94d3f4dee net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
- 3921c573d1ca xfrm: bound nat keepalive state collection
- be19d20e53a2 xfrm: fix xfrm_state_construct() auth-trunc leak
- 46640c814f25 xfrm: ah6: validate routing header segments_left
- a9fa05b7a124 xfrm: avoid lock inversion in nat keepalive work
- 943d95233b8b xfrm: drop ESP-in-TCP packets with no ingress device
- 31cf23493619 tcp: clamp route advmss to TCP_MIN_MSS
- 54b41ad14da9 xfrm: espintcp: fix UAF during close
- 713ed6ce111e net: advertise TCP MSS from the configured MTU, not the learned PMTU
- 2857dcbd03cf net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
- d17e88b6b60f tcp: fix AO info use-after-free in tcp_ao_connect_init()
- a742178889f9 net/tcp: fix TCP-AO key deletion in VRFs
- 1e995498d297 gtp: serialize PDP context updates
- 7e1208c13561 tls: device: fix out-of-bounds write in tls_append_frag()
- 60e5acbffcd4 KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
- 6d989a0e2df2 KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
- 68a34115a423 KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
- 7813da74c6d3 KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
- c79c113b299b KVM: SEV: Drop FOLL_WRITE for encrypted region registration
- 97f6402f5950 KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts
- eaa96a8458f5 usb: gadget: f_tcm: keep port count until LUN teardown completes
- c6e90336ed7d usb: usbtest: disable dynamic ID support
- e981474d7bf1 fuse: f

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.2.3-xanmod1]_

### 7.1.13-xanmod1

- Date: 2026-09-02
- Version: 7.1.13-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.13-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.13-xanmod1

- **fixed** — usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- **fixed** — wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- **fixed** — USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- **removed** — USB: serial: spcp8x5: drop broken carrier detect support
- **fixed** — USB: serial: option: fix slab OOB read in interrupt URB callback
- **fixed** — ALSA: usb-audio: Complete cleanup after system-resume errors
- **fixed** — ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- **fixed** — ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
- **changed** — usb: core: Strengthen error handling in hub_hub_status()
- **changed** — usb: core: Add lock to usb_wakeup_notification()
- **fixed** — KVM: s390: vsie: zero stale crypto bits
- **removed** — crypto: qce: Remove unsafe/deprecated algorithms
- **fixed** — crypto: mxs-dcp: fix source scatterlist length access
- **fixed** — crypto: iaa: fall back to software for multi-entry scatterlists
- **fixed** — crypto: qce: fix CCM AAD buffer underallocation
- **changed** — crypto: krb5: use kfree_sensitive() for derived key buffers
- **fixed** — crypto: atmel-tdes: use scatterlist length before DMA mapping
- **changed** — crypto: qcom-rng: Allow zero as a random number
- **removed** — crypto: qcom-rng: Remove crypto_rng interface

- b553b3542801 Linux 7.1.13-xanmod1
- 43ca95d8926c Merge tag 'v7.1.13' into 7.1
- 81d3924095fd Linux 7.1.13
- 7f0278e474c4 usb: usbfs: fix use-after-free of usb_device in usbdev_release()
- 8d481f935889 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
- 7983daa15998 USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
- 6bfa6c003d16 USB: serial: spcp8x5: drop broken carrier detect support
- a72a13c83a65 USB: serial: option: fix slab OOB read in interrupt URB callback
- 6c94877b6bab ALSA: usb-audio: Complete cleanup after system-resume errors
- 7f00dbddb51f ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
- b7c47225d4e2 ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USB
- 3a607bf79f86 usb: core: Strengthen error handling in hub_hub_status()
- 960ca456faf6 usb: core: Add lock to usb_wakeup_notification()
- d4bcd2df6d0d KVM: s390: vsie: zero stale crypto bits
- 14f8bdfc7ac9 crypto: qce - Remove unsafe/deprecated algorithms
- 0e9edb108a63 crypto: mxs-dcp - fix source scatterlist length access
- cec32be0dcbf crypto: iaa - fall back to software for multi-entry scatterlists
- 46a84efe2dba crypto: qce - fix CCM AAD buffer underallocation
- 91b96dc9cc25 crypto: krb5 - use kfree_sensitive() for derived key buffers
- cd4dd09c3d2d crypto: atmel-tdes - use scatterlist length before DMA mapping
- 143c74034a1c crypto: qcom-rng - Allow zero as a random number
- 843e2bdaf8de crypto: qcom-rng - Remove crypto_rng interface
- c3f6dd7ee8b2 crypto: qcom-rng - Enable clock in hwrng case
- 3fda114a42f1 crypto: virtio - bound the akcipher result length
- 4df26c3684a0 kunit: irq: Continue increasing hrtimer interval for longer
- 1b0303ff6ec4 mm/swap: reject swapon() on filesystem-level encrypted files
- e97e2d6d0b15 netfilter: nf_tables: don't queue packet path object notifications
- d1893ebc5c85 netfilter: nft_set_pipapo_avx2: add missing vzeroupper
- 8ba68fd6cdd1 vxlan: keep the last remote linked during FDB flush
- 1b466746fe10 batman-adv: reject unrepresentable multicast TVLV offsets
- bf1c1151560d ipv6: seg6: clear IPv4 control block on IPIP decapsulation
- 0189dce07db2 net/packet: defer vmalloc TX_RING free until skbs finish
- 3f4752996735 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
- 505ac032a97c xfrm: bound nat keepalive state collection
- 37426395cb90 xfrm: fix xfrm_state_construct() auth-trunc leak
- 0bf11081ad37 xfrm: ah6: validate routing header segments_left
- 89ef3a2e1e46 xfrm: avoid lock inversion in nat keepalive work
- 7911e0236616 xfrm: drop ESP-in-TCP packets with no ingress device
- 6b8c20bf6192 tcp: clamp route advmss to TCP_MIN_MSS
- eb3bbf29c723 xfrm: espintcp: fix UAF during close
- f19186bb71d0 net: advertise TCP MSS from the configured MTU, not the learned PMTU
- e54ad693eddb net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
- 284d7fd0eec8 tcp: fix AO info use-after-free in tcp_ao_connect_init()
- 38a28d5053a4 net/tcp: fix TCP-AO key deletion in VRFs
- 6df4f05bc299 gtp: serialize PDP context updates
- cd7e875b8959 tls: device: fix out-of-bounds write in tls_append_frag()
- 8ee84f9b64fd KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y
- 9e2de3ee5720 KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
- 66c01137350b KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
- f24ff526fe1b KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
- 1c0bc4321d29 KVM: SEV: Drop FOLL_WRITE for encrypted region registration
- bbd6aa311a9f usb: gadget: f_tcm: keep port count until LUN teardown completes
- d2e0f9c96551 usb: usbtest: disable dynamic ID support
- 1d3e701cda2f fuse: fix invalidate lock leak on open O_TRUNC DAX failure
- dd278d954c0e fuse: fix invalidate lock leak on setattr writeback failure
- e15f8bcaa5fa xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
- 33ed35ca6294 xhci: dbgtty: Fix unregister on tty_register_driver() failure
- bf84c6b02

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.13-xanmod1]_

### 7.2.1-xanmod1

- Date: 2026-08-27
- Version: 7.2.1-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.2.1-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.2.1-xanmod1

- **fixed** — ptp: vmclock: prevent read-only mappings from becoming writable
- **fixed** — futex: Fix might_sleep() warning in futex_pivot_pending()
- **fixed** — Bluetooth: hci_aml: validate firmware segment lengths
- **fixed** — Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- **fixed** — Bluetooth: ISO: zero the sockaddr before returning it in getname
- **fixed** — Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- **fixed** — Bluetooth: hci_sync: Fix accept list UAF during suspend
- **fixed** — Bluetooth: hci_event: validate LE Set CIG Parameters response
- **fixed** — Bluetooth: hci_event: fix LE list UAF on reset
- **fixed** — HID: input: read battery capacity from its actual report offset
- **fixed** — HID: hyperv: validate initial device info bounds
- **fixed** — HID: uclogic: fix use-after-free of inrange_timer on remove
- **fixed** — HID: sensor: custom: Fix use-after-free in enable_sensor
- **fixed** — HID: ft260: fix stack-use-after-return write in I2C read race
- **fixed** — HID: core: fix number/pointer type confusion on long items
- **fixed** — HID: rapoo: fix missing hid_is_usb() check
- **fixed** — HID: nintendo: stop device IO before hid_hw_stop on probe failure
- **fixed** — HID: nintendo: register input device after capabilities are set
- **fixed** — HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- **fixed** — HID: huawei: fix missing hid_is_usb() check

- 87d7e154ade4 Linux 7.2.1-xanmod1
- 2112ca3bf8a8 Merge tag 'v7.2.1' into 7.2
- 458fbaaefba2 Linux 7.2.1
- 2e596e7814ba ptp: vmclock: prevent read-only mappings from becoming writable
- 33b959876913 futex: Fix might_sleep() warning in futex_pivot_pending()
- 2763b8bcb504 Bluetooth: hci_aml: validate firmware segment lengths
- 6e1c44878aa3 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- 190b719b787e Bluetooth: ISO: zero the sockaddr before returning it in getname
- 9f59f461dcae Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- 29c59212a507 Bluetooth: hci_sync: Fix accept list UAF during suspend
- 6fc540e835dd Bluetooth: hci_event: validate LE Set CIG Parameters response
- 25b05e3ce31d Bluetooth: hci_event: fix LE list UAF on reset
- bf05f17b8439 HID: input: read battery capacity from its actual report offset
- c894143c508a HID: hyperv: validate initial device info bounds
- f13d0a00204b HID: uclogic: fix use-after-free of inrange_timer on remove
- 7bb79a3cf45e HID: sensor: custom: Fix use-after-free in enable_sensor
- 77832d8f1c81 HID: ft260: fix stack-use-after-return write in I2C read race
- e542edada3f7 HID: core: fix number/pointer type confusion on long items
- 49b6fd28fbcc HID: rapoo: fix missing hid_is_usb() check
- 2e0d98dc8a6d HID: nintendo: stop device IO before hid_hw_stop on probe failure
- 27dc4b8eadac HID: nintendo: register input device after capabilities are set
- 34725ed4719d HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- 9acc2463991c HID: huawei: fix missing hid_is_usb() check
- ee883906cf66 HID: asus: fix missing hid_is_usb() check
- ea081b443551 net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
- 86b63adfa5e1 HID: pidff: fix OOB write when hid->inputs is empty
- cbcc0e8dea49 HID: core: fix OOB read of field->usage in hid_set_field()
- 2ef16934e069 HID: magicmouse: do not keep a stale msc->input if no input is claimed
- 753786a7e6f9 HID: magicmouse: re-enable multitouch after reset-resume
- d095de37f78c HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
- 8384a2e1a9ab HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
- 56a7b6a6880d nvmet: pci-epf: put CQ ref on create_cq mapping failure
- cede8d285257 nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
- 9b770e40bc00 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
- d895e66628f9 nvmet-tcp: bound SGL data length before allocating command buffers
- 94334ea92f4d nvmet-fc: fix invalid free in LS IOD error path
- 1d6837d98bf9 nvmet-auth: zero the AUTH_RECEIVE response buffer
- 3256d648211e dmaengine: fsl-edma: Add error handling for devm_kasprintf
- b233e7836d98 mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
- 73a187384a8c ipv6: fix use-after-free in ip6_finish_output2()
- c8a74adccaf0 ipv4: reject undersized MTUs in ip_do_fragment()
- 7b079b904691 nfc: nci: free destination parameters when closing a connection
- d6f743d3d388 nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
- 129032c0616d nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
- f5c534b53f8c nfc: nci: add data_len bound checks to activation parameter extractors
- f33cecf69095 nfc: st21nfca: validate ATR_REQ length against the received frame
- e95beff58b38 nfc: pn533: purge fragmented skbs during cleanup
- d3d90243393c nfc: llcp: reject PDUs shorter than the LLCP header
- 875285a165fd nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
- 0cfbdb0e13ab nfc: llcp: bound the connect_sn TLV walk to the skb
- 953963b9ac5e nfc: microread: validate target discovery payload lengths
- 1aa3fc769b0c nfc: fdp: bound the device-reported read length and fix an skb leak
- 31aa28ed732f nfc: digital: clamp SENSF_RES length to the destination buffer
- 4d00a39c6762 xfs: restore nofs context unconditionally in xfs_trans_roll
- c35da2bac6f7 xfs: validate attr entry pointer before field access
- 2207f26ce715 ext4: fix incorrect function ca

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.2.1-xanmod1]_

### 7.1.11-xanmod1

- Date: 2026-08-27
- Version: 7.1.11-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.11-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.11-xanmod1

- **fixed** — ptp: vmclock: prevent read-only mappings from becoming writable
- **fixed** — futex: Avoid private hash use-after-free on final put
- **fixed** — Bluetooth: hci_aml: validate firmware segment lengths
- **fixed** — Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- **fixed** — Bluetooth: ISO: zero the sockaddr before returning it in getname
- **fixed** — Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- **fixed** — Bluetooth: hci_sync: Fix accept list UAF during suspend
- **fixed** — Bluetooth: hci_event: validate LE Set CIG Parameters response
- **fixed** — Bluetooth: hci_event: fix LE list UAF on reset
- **fixed** — HID: input: read battery capacity from its actual report offset
- **fixed** — HID: hyperv: validate initial device info bounds
- **fixed** — HID: uclogic: fix use-after-free of inrange_timer on remove
- **fixed** — HID: sensor: custom: Fix use-after-free in enable_sensor
- **fixed** — HID: ft260: fix stack-use-after-return write in I2C read race
- **fixed** — HID: core: fix number/pointer type confusion on long items
- **fixed** — HID: rapoo: fix missing hid_is_usb() check
- **fixed** — HID: nintendo: stop device IO before hid_hw_stop on probe failure
- **fixed** — HID: nintendo: register input device after capabilities are set
- **fixed** — HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- **fixed** — HID: huawei: fix missing hid_is_usb() check

- 15d529e612cf Linux 7.1.11-xanmod1
- 11c2a2475860 Merge tag 'v7.1.11' into 7.1
- 843fd19fe9a2 Linux 7.1.11
- 2496e1418271 ptp: vmclock: prevent read-only mappings from becoming writable
- 12cd315a7b6a futex: Avoid private hash use-after-free on final put
- 6c7025346290 Bluetooth: hci_aml: validate firmware segment lengths
- 0bd0195ce257 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
- 9069be87c67f Bluetooth: ISO: zero the sockaddr before returning it in getname
- 2941716c753a Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
- 95bb57bc11a9 Bluetooth: hci_sync: Fix accept list UAF during suspend
- d83ecb7b9610 Bluetooth: hci_event: validate LE Set CIG Parameters response
- b55e83a4ba31 Bluetooth: hci_event: fix LE list UAF on reset
- b81edc5df6b6 HID: input: read battery capacity from its actual report offset
- 2529737763cb HID: hyperv: validate initial device info bounds
- f1b3ca063805 HID: uclogic: fix use-after-free of inrange_timer on remove
- c0757f106105 HID: sensor: custom: Fix use-after-free in enable_sensor
- d7ffbdc07667 HID: ft260: fix stack-use-after-return write in I2C read race
- e60159f5ea60 HID: core: fix number/pointer type confusion on long items
- 99ed3febafe0 HID: rapoo: fix missing hid_is_usb() check
- 13a3edf96568 HID: nintendo: stop device IO before hid_hw_stop on probe failure
- a9fc7547f911 HID: nintendo: register input device after capabilities are set
- d4cabd4089ad HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
- 66805454c01f HID: huawei: fix missing hid_is_usb() check
- 1ddc2f5913be HID: asus: fix missing hid_is_usb() check
- 36e6dc9f9cae futex: Fix might_sleep() warning in futex_pivot_pending()
- ff252ed45c82 futex: Fix race on the initial mm->futex.phash.ref allocation
- 19b4be0717fa futex: Fix race in futex_pivot_pending() during private hash resize
- 0478bc6bf197 futex/pi: Plug private futex exec() race
- 19702d0396ee futex: Sanitize and document task_struct::futex::state transitions
- f7fb3e077526 futex/pi: Reject cross-mm private futex owners
- f3868046e8e2 net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
- d416eeb7d016 HID: pidff: fix OOB write when hid->inputs is empty
- 5215ea00a747 HID: core: fix OOB read of field->usage in hid_set_field()
- 0bf253e9ac99 HID: magicmouse: do not keep a stale msc->input if no input is claimed
- a8bdd9e22a84 HID: magicmouse: re-enable multitouch after reset-resume
- a33a596d3ad8 HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
- dcc8cf9414d1 HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
- 6c290915a03f mptcp: pm: fix memory leak from alloc-during-teardown race
- ab8bae2403a7 mptcp: pm: uniform announced addresses helpers
- 2c5fca4da0a5 mptcp: pm: rename add_entry structure to add_addr
- 480560491a72 drm/amdgpu: Allocate coredump ring buffers per ring
- 4e9b4dee0777 drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
- 26135631ed8e fbdev: serialize mode sysfs access with lock_fb_info()
- 07f7e46833f7 fbdev: Wrap user-invoked calls to fb_set_var() in helper
- b5f97fae2503 nvmet: pci-epf: put CQ ref on create_cq mapping failure
- 1ed1eeaef55c nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
- 7fd6da0f2893 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
- 14dbe37681a6 nvmet-tcp: bound SGL data length before allocating command buffers
- bb9489f0dce5 nvmet-fc: fix invalid free in LS IOD error path
- 2dcc9226203d nvmet-auth: zero the AUTH_RECEIVE response buffer
- 7494a167b958 dmaengine: fsl-edma: Add error handling for devm_kasprintf
- df5c9816986b mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
- 99219c82804f ipv6: fix use-after-free in ip6_finish_output2()
- 3556beb8ca86 ipv4: reject undersized MTUs in ip_do_fragment()
- 7eae53335dba nfc: nci: free destination parameters when closing a connection
- 5bd00c0e1470 nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
- d7083f41c2

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.11-xanmod1]_

### 7.1.10-xanmod1

- Date: 2026-08-25
- Version: 7.1.10-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.10-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.10-xanmod1

- **fixed** — Enable headset mic on F+ FLAPTOP r
- **fixed** — Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- **fixed** — Mark SPI virtio device ready before registering the controller
- **fixed** — Fix infinite loop when scale is too large for display in drm/log
- **fixed** — Fix out-of-bounds read on empty message length in drm/log
- **fixed** — Fix division by zero when scale module parameter is 0 in drm/log
- **fixed** — Fix bug in pc_adjust_freq_bounds() in drm/xe
- **changed** — Set GT rp min frequency as 1.2GHz default for BMG/CRI in drm/xe
- **fixed** — Check managed mutex initialization errors in drm/xe/oa
- **fixed** — Fix sync entry leak on OA config emit failure in drm/xe/oa
- **fixed** — Add termination on resume in drm/xe/pxp
- **fixed** — Fix NULL pointer dereference in ar_context_release in firewire ohci
- **fixed** — Fix tunnel and session refcount leak on seq_file release in l2tp
- **fixed** — Reject dev-bound BPF programs bound to a different device in cls_bpf
- **fixed** — Skip unmapped range in aie2_populate_range() in accel/amdxdna
- **fixed** — Fix port_id extraction from SRC TAG in am65-cpsw-nuss
- **fixed** — Don't call an unset readable_reg callback in regmap sdw-mbq
- **fixed** — Define NR_CPUS to 1 on m68k
- **fixed** — Reject allocations through dead ancestor pid namespaces
- **fixed** — Skip hash tables in u32_bind_class() in cls_u32

- 0f1ac59df670 Linux 7.1.10-xanmod1
- fc11d50c4815 Merge tag 'v7.1.10' into 7.1
- 8d4e6356173a Linux 7.1.10
- 93f4d99b7e06 ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
- d31639e0dd88 erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
- f07ab9771db5 spi: virtio: mark device ready before registering the controller
- 50ca4dbbaf3e drm/log: Fix infinite loop when scale is too large for display
- 16bcea56f420 drm/log: Fix out-of-bounds read on empty message length
- 71ba3938cd57 drm/log: Fix division by zero when scale module parameter is 0
- 1eea17a9184c drm/xe: Fix a bug in pc_adjust_freq_bounds()
- e75b29f1d31c drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
- b3991da6ea98 drm/xe/oa: Check managed mutex initialization errors
- 027150e24e17 drm/xe/oa: Fix sync entry leak on OA config emit failure
- 24026a295e03 drm/xe/pxp: add termination on resume
- 7d228ba43279 firewire: ohci: fix NULL pointer dereference in ar_context_release
- ebe2774e9564 l2tp: fix tunnel and session refcount leak on seq_file release
- 5685bbbd3cbf net/sched: cls_bpf: reject dev-bound programs bound to a different device
- 499227ca8edc accel/amdxdna: Skip unmapped range in aie2_populate_range()
- 914e0100df34 net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
- 5bd8e897ecf5 regmap: sdw-mbq: don't call an unset readable_reg callback
- eb5ad008574d m68k: Define NR_CPUS to 1
- d7c413bd421c pid: reject allocations through dead ancestor pid namespaces
- e71f8e9ed6f3 net/sched: cls_u32: skip hash tables in u32_bind_class()
- 6b70886ebc42 net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
- f09ac5682f1b af_packet: Don't send zero-byte data in tpacket_snd().
- cc90447a7f79 regmap: sdw-mbq: Fix swap of timeout and retry times
- 09e4c486348e ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
- 4b177911eb9f net/tls: Fail tls_sw_splice_read() after a failed async decrypt
- 0ab482b2195e net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
- 88b79ac89ecc net: tap: fix wrong transport_header when sending VLAN-tagged frame
- 6386a6ffa2ef net: packet: fix wrong transport_header when sending VLAN-tagged frame
- fa8ceaae52d3 net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
- 29633de25773 tcp: fix icsk_ack.ato bitfield overflow
- 90bb11fb29d3 veth: fix queue index used to wake the peer txq in veth_poll
- bc9a00fb78e3 macvlan: inherit needed_headroom and needed_tailroom from lowerdev
- 5c2ca77212eb ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
- 8b1118fc5a5d eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
- ae2e1c26082c eth: bnxt: decrease indent in bnxt_request_irq()
- 2a64e5e75879 eth: bnxt: keep the aRFS rmap updated when TPH is enabled
- 5f451cdb3f4e eth: bnxt: cancel IRQ notifier before freeing affinity mask
- 0c60f26caca4 netfilter: ipset: let destroy callbacks adjust ext mem size
- b88250102549 netfilter: ipset: fix list type element drift bug
- d16b71231e65 netfilter: flowtable: publish GC-visible tuple last
- c23620a0fa5b netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- 5365f012451f ipvs: revalidate ihl to prevent out-of-bounds access
- 24ffcb1e1688 netfilter: ipset: fix refcount race between list:set GC and swap
- 8bfb93a35c9f tick: Include ktime.h and jiffies.h in linux/tick.h
- f5bde482b242 ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
- 1eee6a92739a gpio: ml-ioh: share the register lock across channels
- 8bbf4405050b rseq: Prevent hard lockup on granted time slice extension
- 0f77ed5ee919 ovpn: defer key slot crypto freeing to workqueue
- bbe81f40582d ovpn: run deferred work on a module-owned workqueue
- e697e30f3dd2 riscv: lib: Fix ZBB strnlen reading past count boundary
- 0663d1df8d28 ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
- 88619b117be1 sctp: validate cookie AUTH state before use
- 7ce010275c53 perf: Reject exited events

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.10-xanmod1]_

### 7.2.0-xanmod1

- Date: 2026-08-21
- Version: 7.2.0-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.2.0-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.2.0-xanmod1

- **added** — Add sysctl to disallow unprivileged CLONE_NEWUSER by default
- **added** — Enable overrides for missing ACS capabilities in PCI
- **added** — Export file_close_fd() for use by modules
- **added** — Allow __wake_up_pollfree() to be used from GPL modules
- **added** — Add debug mask file for binder_alloc
- **added** — Convert binder into a module
- **added** — Expose controller board power in sysfs for Steam Deck
- **added** — Add MFD core driver for Steam Deck
- **added** — Add support for Steam Deck LED
- **added** — Add support for max battery level and rate in Steam Deck hwmon
- **added** — Add driver for Steam Deck's EC sensors
- **added** — Add driver for Steam Deck extcon
- **added** — Add xt_FLOWOFFLOAD target for netfilter
- **added** — Add netfilter nf_tables fullcone support
- **added** — Add sysctl to skip tcp collapse processing when receive buffer is full
- **changed** — Update TCP 'bbr' congestion control module to BBRv3
- **changed** — Disable workqueues for crypto ops in dm-crypt
- **changed** — Use call_rcu when detaching client in input/evdev
- **changed** — Initialize ata before graphics
- **changed** — Improve rwsem spin performance
- **changed** — Enable stateless firmware loading
- **changed** — Accept connections in LIFO order for cache efficiency in sched/wait
- **changed** — Add working set protection for anon and clean file pages
- **changed** — Add 500Hz timer interrupt kernel config option
- **changed** — Set wbt_default_latency_nsec() to 2msec
- **changed** — Set rq_affinity to force complete I/O requests on same CPU
- **changed** — Disable front_merges by default in block/mq-deadline
- **changed** — Increase write priority in block/mq-deadline to improve responsiveness
- **changed** — Set scheduler tunable latencies to unscaled

- 275555fa1bf1 Linux 7.2.0-xanmod1
- 29d92d1b92fb XANMOD: .gitlab-ci: Add gitlab-ci.yml file
- f67bfad06094 XANMOD: Add GPLv2 license file
- 020afb98da2e sysctl: add sysctl to disallow unprivileged CLONE_NEWUSER by default
- 84598b0cf5c4 PCI: Enable overrides for missing ACS capabilities
- a4c71e364327 file: export file_close_fd() instead of close_fd_get_file()
- 049ff525581a wait: allow to use __wake_up_pollfree() from GPL modules
- d72d6bc52918 binder: give binder_alloc its own debug mask file
- 2b656afd62ec binder: turn into module
- 8cba03efea37 mfd: steamdeck: Expose controller board power in sysfs
- 53f4492f17e1 mfd: Add MFD core driver for Steam Deck
- 92b109106b84 leds: steamdeck: Add support for Steam Deck LED
- 4d95534fadd3 hwmon: steamdeck-hwmon: Add support for max battery level/rate
- 824ae407514e hwmon: Add driver for Steam Deck's EC sensors
- 8e799663139b extcon: Add driver for Steam Deck
- 3b4d00f3a7bb netfilter: add xt_FLOWOFFLOAD target
- 04edf698d915 netfilter: Add netfilter nf_tables fullcone support
- 2bc6b0895f5c tcp: Add a sysctl to skip tcp collapse processing when the receive buffer is full
- d50171100f3c tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3
- 9c594ca6d407 ZEN: dm-crypt: Disable workqueues for crypto ops
- c1f19aa98e54 ZEN: input/evdev: Use call_rcu when detaching client
- 66b54cff5cba drivers: initialize ata before graphics
- 1c4833ae5add locking: rwsem: spin faster
- dce6a5fdd743 firmware: Enable stateless firmware loading
- 7c6a92846009 sched/wait: Do accept() in LIFO order for cache efficiency
- 80af49bc67fa mm: Add working set protection for anon and clean file pages
- 36d9622e03e8 XANMOD: Makefile: Move x86 instruction set selection to kernel-wide build
- 4bc30ce6728f x86/kconfig: more x86-64 ISA levels and uarches
- 231777ac25f3 XANMOD: x86/build: Prevent generating avx2 floating-point code
- 0283427a0a31 XANMOD: scripts/setlocalversion: Move localversion* files to the end
- 517afee9bc92 XANMOD: scripts/setlocalversion: remove '+' tag for git repo short version
- f2ef9a46d11b XANMOD: lib/kconfig.debug: disable default SYMBOLIC_ERRNAME and DEBUG_BUGVERBOSE
- ccc0f7ec88e3 XANMOD: cpufreq: tunes ondemand and conservative governor for performance
- 5b4df09b709a XANMOD: mm/vmscan: Reduce amount of swapping
- ed2a9eca2135 XANMOD: mm: Raise max_map_count default value
- 7ac91c5588e7 XANMOD: vfs: Decrease rate at which vfs caches are reclaimed
- 0988dbc5822a XANMOD: kconfig: add 500Hz timer interrupt kernel config option
- 89d0ae046966 XANMOD: blk-wbt: Set wbt_default_latency_nsec() to 2msec
- bae2948f36c9 XANMOD: block: Set rq_affinity to force complete I/O requests on same CPU
- fd699380cd6a XANMOD: block/mq-deadline: Disable front_merges by default
- 3868ed8dbd88 XANMOD: block/mq-deadline: Increase write priority to improve responsiveness
- b746821c0765 XANMOD: fair: Set scheduler tunable latencies to unscaled
- 19e5ebe24766 kbuild: Re-add .config file required to sign external modules
- c9d752c21d51 XANMOD: kbuild: deb-pkg: Create -dbg when make DEB_DEBUG_PKG=1
- 1d39a03d3382 XANMOD: kbuild: Add SMS-based software pipelining flags
- 3b40b2850e79 XANMOD: kbuild: Add LLVM polyhedral loop optimizer flags
- dd21db2d9881 XANMOD: x86/build: Add more CFLAGS optimizations
- 8d3ae59288f1 Linux 7.2

### 7.1.9-xanmod1

- Date: 2026-08-19
- Version: 7.1.9-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.9-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.9-xanmod1

- **fixed** — thunderbolt: Fix bandwidth group reservation indexing
- **fixed** — thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- **fixed** — sctp: clear new_transport when removing a peer
- **fixed** — sctp: fix use-after-free of cached ASCONF chunk
- **fixed** — sctp: keep chunk->transport in step with the list it is queued on
- **fixed** — scsi: scsi_debug: Negate wrapped memcmp() result
- **fixed** — bpf, sockmap: Fix sk_redir use-after-free in send verdict
- **fixed** — fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- **fixed** — fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- **fixed** — mm/filemap: __filemap_add_folio() restore index before retrying
- **fixed** — ima: Instantiate file_truncate and path_truncate hooks
- **fixed** — sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
- **fixed** — sched/psi: Create the psimon kthread outside of cgroup_mutex
- **fixed** — sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- **fixed** — fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- **fixed** — fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
- **fixed** — ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- **fixed** — ipv6: fix Route Information option length validation
- **fixed** — mm/ptdump: always stabilise against page table freeing using init_mm
- **fixed** — mm/page_table_check: skip special zero mappings

- 762461b8ceec Linux 7.1.9-xanmod1
- 75350514d3f8 Merge tag 'v7.1.9' into 7.1
- ffc82ed66531 Linux 7.1.9
- 0a8c9ed4f166 thunderbolt: Fix bandwidth group reservation indexing
- f32c3a9a77cf thunderbolt: Bound the DROM dual link port number before indexing sw->ports
- 163847552a57 sctp: clear new_transport when removing a peer
- d949992bc3f0 sctp: fix use-after-free of cached ASCONF chunk
- 5ccf35ef0ed6 sctp: keep chunk->transport in step with the list it is queued on
- 65a740633570 scsi: scsi_debug: Negate wrapped memcmp() result
- 1cec526cf0a2 bpf, sockmap: Fix sk_redir use-after-free in send verdict
- 911d5c32a54c fsverity: Fix silent truncation in bpf_get_fsverity_digest()
- 5bd63cad9df4 fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
- 267ecd2eb775 mm/filemap: __filemap_add_folio() restore index before retrying
- 0baed1fa2184 ima: Instantiate file_truncate and path_truncate hooks
- a054c9ffa9b7 sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
- d217d851f0a2 sched/psi: Create the psimon kthread outside of cgroup_mutex
- 611e7821c4f8 sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
- 98516ba8b817 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
- 2d2b2ed7bdcc fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
- fbf40faa0414 ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
- da64ed1f346b ipv6: fix Route Information option length validation
- 4adc4c9a9a43 mm/ptdump: always stabilise against page table freeing using init_mm
- b726eb3c94d2 mm/page_table_check: skip special zero mappings
- 5e6e2a18c20e ring-buffer: Use current_context for safe per-CPU buffer swap
- 3b3e0a6ee5bb ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
- f8d7e5751267 ptp: ocp: Fix board ID over-read
- 2004172036ec Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
- 6b446d335ba1 Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
- c4d0c93d2469 ring-buffer: Prevent resizing of persistent ring buffer
- 004f7232e497 eventfs: Use children field for rcu head and add memory barriers
- 74bb1eaf72d1 eventfs: Fix use-after-free in eventfs_remove_rec()
- 9f7760a2e962 KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
- d728baba0f20 KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
- 79748c9f9b2f smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
- 1305eadc6a7d smb: client: Fix use-after-free in cifs_try_adding_channels()
- 5558a8312452 tipc: read le->link under the node lock in tipc_node_link_down()
- 3c5f8f2aa57c tls: don't leave a full plaintext sk_msg ring unpushed
- 3c837266a734 tls: rx: restore msg_iter before TLS 1.3 optimistic retry
- b70ebe0bba25 vhost: reset the vring metadata cache on vring reconfiguration
- 3205b0652a37 veth: fix skb length accounting after XDP frag adjustment
- e82a5faea2e3 vsock/virtio: avoid refilling the RX queue after teardown
- 1cecb4202afd vsock/virtio: read virtqueues under worker locks
- 6b4119af5449 vxlan: do not arm the ageing timer on a device that is down
- f463b6f4957c xdp: reject clones that overrun skb_shared_info tailroom
- 4f4cba3947d2 x86/mce: Set up the polling timer before CMCI discovery
- da6acd11d2f2 x86/CPU: Add a tlbi= cmdline switch
- eb0a9fabb924 arm64: remove redundant concurrent ptdump UAF mitigation
- 2926031acba1 dibs: initialise dibs->lock in dibs_dev_alloc()
- 496846a94111 Revert "drm/amdgpu: fix aperture mapping leak"
- 047f927f54c6 binfmt_misc: don't warn when the mount is completed from another user namespace
- 42d99fcd8006 ovl: don't warn when the mount is completed from another user namespace
- 2e8df8c91903 net/sched: act_gact, act_police: range check the fallback control action
- 439d3e404f9d net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
- 24d87dc28ddd net: atlantic: free RX pages of consumed but not refilled buffers
- dd633280de7f net: atlantic: free stranded TX buffers on ring d

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.9-xanmod1]_

### 7.1.8-xanmod1

- Date: 2026-08-10
- Version: 7.1.8-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.8-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.8-xanmod1

- **fixed** — usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
- **fixed** — drm/amd/display: Exit idle optimizations before programming
- **fixed** — drm/amd/display: check GRPH_FLIP status before sending event
- **added** — media: chips-media: wave5: Support CBP profile
- **fixed** — drm/xe: Wait on external BO kernel fences in exec IOCTL
- **changed** — drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
- **changed** — drm/xe: Set TTM device beneficial_order to 9 (2M)
- **changed** — drm/xe: Separate early xe_device initialization
- **changed** — drm/xe: Move xe->info.devid|revid initialization
- **changed** — drm/xe: Move xe->info.force_execlist initialization
- **changed** — drm/xe: Drop unused param from xe_device_create()
- **fixed** — usb: typec: ucsi: Fix race condition and ordering in port unregistration
- **changed** — usb: typec: ucsi: split connector lock classes
- **fixed** — drm/xe/rtp: Ensure locking/ref counting for OA whitelists
- **fixed** — drm/vmwgfx: validate external BO copy bounds for both stride paths
- **fixed** — drm/vmwgfx: enforce cursor size limits for MOB cursors
- **fixed** — drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- **fixed** — drm/amdkfd: hold event_mutex while checkpointing CRIU events
- **fixed** — drm/amdkfd: fix QID bit leak in pqm_create_queue()
- **security** — drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE

- a8992243188e Linux 7.1.8-xanmod1
- 5dea5c12fecb Merge tag 'v7.1.8' into 7.1
- 25c76bea853d Linux 7.1.8
- bed97cd6f0ea usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
- 971962e96618 drm/amd/display: Exit idle optimizations before programming
- be5c6ca1924a drm/amd/display: check GRPH_FLIP status before sending event
- c1a029cb1aeb media: chips-media: wave5: Support CBP profile
- 5d363d00bc97 drm/xe: Wait on external BO kernel fences in exec IOCTL
- 1366bf0496c2 drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
- 3e891bfe08b4 drm/xe: Set TTM device beneficial_order to 9 (2M)
- 15dfb66b557a drm/xe: Separate early xe_device initialization
- 805dcf380590 drm/xe: Move xe->info.devid|revid initialization
- d4c139fe4548 drm/xe: Move xe->info.force_execlist initialization
- f571c2616e58 drm/xe: Drop unused param from xe_device_create()
- bc7a0f721123 usb: typec: ucsi: Fix race condition and ordering in port unregistration
- 30df04e2d569 usb: typec: ucsi: split connector lock classes
- 2c55034e53c5 drm/xe/rtp: Ensure locking/ref counting for OA whitelists
- 3be72ad315db drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
- 43114690b12f drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
- e8d1f040eb15 drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
- ddcc9e4a8ebe drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
- 339bc3ab303e drm/xe/rtp: Generalize whitelist_apply_to_hwe
- cc6b3f0c82b2 drm/xe/rtp: Keep track of non-OA nonpriv slots
- 16449f284fa4 drm/xe/rtp: Maintain OA whitelists separately
- 5e4a2d15637a drm/vmwgfx: validate external BO copy bounds for both stride paths
- 5c725901908e drm/vmwgfx: use check_add_overflow for shader size+offset bound
- 9109b7935b9c drm/vmwgfx: enforce cursor size limits for MOB cursors
- 0ee0532f1d40 drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
- 9759da60e38d drm/vmwgfx: bound DMA command body size against suffix pointer
- c77cf8edae2b drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
- 4df39eb99bb4 drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- bacbdc0be793 drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
- 2c10e2271a08 drm/vmwgfx: clamp dirty-page range with min, not max
- 6b1eb0b63cc1 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
- 3b2bb16a5b62 drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
- bed80be08c0b drm/amdkfd: hold event_mutex while checkpointing CRIU events
- 46c6041c7b02 drm/amdkfd: Handle invalid event type in CRIU event restore
- 7c54bd225d83 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
- 7c35bf94150d drm/amdkfd: fix QID bit leak in pqm_create_queue()
- 4070909ac042 drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
- f556bc844cc4 drm/amd/display: use proper context for logging
- 1c0b90e44768 drm/amd/display: Silence link_dpms I2C retimer failures
- 3fc61f526ffa drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
- 1f93537881fd drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
- 062cfd6c678f drm/amd/display: check if dml21_add_phantom_plane() is successful
- 221d2766fefa drm/amd/pm: use milliwatts for GPU power sensors
- dfc5d288c7c9 drm/amd/pm: hide pp_table sysfs on APUs
- b628f2c6feb3 drm/amd/pm: fix pptable use-after-free
- 219eed1a041e drm/amd/pm: fix torn gpu metrics reads
- 30e7e004bef7 drm/amdgpu: cap GTT size to physical RAM on APUs
- 3529c9b1e4e7 drm/amdgpu: restore UMD profile pstate after runtime resume
- a0062a4653e4 drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
- 4296fd8fe37a drm/mediatek: ovl_adaptor: balance component registrations
- 2faeaaf28f92 drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
- ca41d9f3a215 drm/panthor: validate firmware interface structure sizes
- 7f4674d986c1 drm/panthor: reject firmware sections with oversized data
- f32aeba8e9ef drm/bridge: display-co

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.8-xanmod1]_

### 7.1.6-xanmod1

- Date: 2026-08-03
- Version: 7.1.6-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.6-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.6-xanmod1

- **fixed** — cifs: fix time_last_write stamp placement in setattr/truncate paths
- **fixed** — KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
- **fixed** — bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
- **changed** — net: mana: Optimize irq affinity for low vcpu configs
- **fixed** — mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
- **fixed** — xfs: don't replace the wrong part of the cow fork
- **fixed** — fuse-uring: fix race between registration and connection abortion
- **fixed** — audit: fix recursive locking deadlock in audit_dupe_exe()
- **fixed** — drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
- **security** — ksmbd: validate ACE size against SID sub-authorities
- **security** — ksmbd: bound DACL dedup walk to copied ACEs
- **fixed** — ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
- **security** — ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
- **fixed** — drm/amdgpu: fix aperture mapping leak
- **fixed** — drm/amdgpu: reject mapping a reserved doorbell to a new queue
- **fixed** — drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
- **fixed** — drm/amdgpu: fix resource leak on ACP reset timeout
- **fixed** — drm/amdgpu: Fix kernel panic during driver load failure
- **fixed** — drm/amdgpu: fix division by zero with invalid uvd dimensions
- **fixed** — vxlan: mdb: Fix source list corruption on a failed replace

- 6db734bb161f Linux 7.1.6-xanmod1
- ba65783d88c0 Merge tag 'v7.1.6' into 7.1
- 2609d60e2f6d Linux 7.1.6
- 96f1a2309bd4 cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
- edfc6bf57524 cifs: fix time_last_write stamp placement in setattr/truncate paths
- 6b542d116ace KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
- a86ceb3291ec selftests: drv-net: so_txtime: relax variance bounds
- ea2e0c28609a selftests: drv-net: cope with slow env in so_txtime.py test
- 97c09c9f5739 sched_ext: Preserve rq tracking across local DSQ dispatch
- 046899bcfc2d sched_ext: Move shared helpers from ext.c into internal.h and cid.h
- 1e37f12b040e bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
- 18c946a3b7b0 bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
- 63ba393d279c net: mana: Optimize irq affinity for low vcpu configs
- 760c47bce6f5 mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
- 9ea8940dec3d mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths
- 390187672abf SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
- ee055a047290 SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
- 8fe8da8edc45 xfs: don't replace the wrong part of the cow fork
- 2cd945492bc5 fuse-uring: fix race between registration and connection abortion
- 3b601938314c audit: fix recursive locking deadlock in audit_dupe_exe()
- ea5ded52bd08 audit: use 'unsigned int' instead of 'unsigned'
- e528ff627fde drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
- 61fd3559199f ksmbd: validate ACE size against SID sub-authorities
- a0ebdaa79e10 ksmbd: bound DACL dedup walk to copied ACEs
- bc90144ce8bb ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
- 5acbd3012fd4 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
- a75b4f3fe9cd selftests: drv-net: add missing kconfig for psp.py
- be354ea7261c drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
- caf4f872eec3 drm/amd/pm: fix smu13 power limit range calculation
- f5988b5c300a drm/amdgpu: fix aperture mapping leak
- 1050d258c7c5 drm/amdgpu: reject mapping a reserved doorbell to a new queue
- 930a5dc3df4a drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
- 92789e28b08f drm/amdgpu: fix resource leak on ACP reset timeout
- 5bc93f907bad drm/amdgpu: Fix kernel panic during driver load failure
- be725ab23aa4 drm/amdgpu: fix division by zero with invalid uvd dimensions
- afdff9103818 drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
- c309626bf91f drm/amdgpu/vcn4: avoid rereading IB param length
- 00c311a13d22 drm/amdgpu/vce: fix integer overflow in image size
- 253b1401862b drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
- cbe3b293d0ee drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
- 6423b44b2e0b drm/amdgpu/mes11: set doorbell offset for suspending userq
- 301f39acf779 drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
- 6b4e19378d94 drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
- 43768ad42b8f drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
- ac89ea915e8b drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
- db85aa861b82 drm/amdgpu/gfx8: drop unecessary BUG_ON()
- 81597685c0d7 drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
- 4fbcd92047ff drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq
- 51f67bd8a71a drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
- 1c27e889fa16 drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
- 2929a932b0d7 drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
- 69a2c5be437b drm/amd/pm: make pp_features read-only when scpm is enabled
- 1c2a60c187ec drm/amd/pm: fix amdgpu_pm_info power display units
- 9423c88cde9a watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
- 54a3c27b357d vxlan: mdb: Fix source list corruption on a failed replace
- 23b44803112a vsock/virtio: collapse receive queue under memory pressure
- f9596b156661 tipc: clear sock->sk

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.6-xanmod1]_

### 7.1.5-xanmod1

- Date: 2026-07-25
- Version: 7.1.5-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.5-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.5-xanmod1

- **changed** — Update TCP 'bbr' congestion control module to BBRv3
- **fixed** — Prevent UAF caused by non-leader exec() race in posix-cpu-timers
- **fixed** — Fix Color Manager (3DLUT, Shaper, Blend) in drm/amd/display
- **fixed** — Fix implicit declaration of brelse() in exfat
- **removed** — Remove crypto_rng interface from crypto: xilinx-trng
- **fixed** — Validate session type before performing operation in liveupdate
- **changed** — Wait for pre-firmware load in usb: atm: ueagle-atm .disconnect()
- **changed** — Remove function entry/exit debug messages from usb: atm: ueagle-atm
- **changed** — Use dev_dbg() for 'device found' message in usb: atm: ueagle-atm
- **fixed** — Add newly added RTGs to the free pool in xfs growfs
- **fixed** — Use opener credentials for FSCTL mutations in ksmbd
- **fixed** — Fix path resolution in ksmbd_vfs_kern_path_create
- **fixed** — Fix use-after-free in l2cap_sock_new_connection_cb() in Bluetooth L2CAP
- **fixed** — Fix cyclic locking warning on netdev unregister in Bluetooth 6lowpan
- **fixed** — Cache secctx size before release zeroes it in binder
- **fixed** — Cancel async firmware request at unbind in ALSA: hda/tas2781
- **added** — Add cancel helper for async requests in firmware_loader
- **fixed** — Update offsets for 2i2 Gen 4 firmware 2417 in ALSA: scarlett2
- **fixed** — Fix stale or zero output when reading raw values in iio: hid-sensor-rotation
- **fixed** — Fix listxattr handling of corrupted xattr entries in f2fs

- 2fb7a627a9c6 Linux 7.1.5-xanmod1
- 022aeb4a9152 tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3 [v7.1.5+]
- c50e105d5af1 Merge tag 'v7.1.5' into 7.1
- 8392dcae53e5 Revert "tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3"
- 155b42bec9cb Linux 7.1.5
- 872380f930c9 Revert "gpib: cb7210: Fix region leak when request_irq fails"
- ad1cafa1bdaa posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- 60325bf5e2c1 posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
- 5638dbfe9cf1 drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
- 570967e9c615 iomap: consolidate bio submission
- e2f0122bd566 exfat: fix implicit declaration of brelse()
- 8e4e884f1bef exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
- 390f1d72a478 exfat: add balloc parameter to exfat_map_cluster() for iomap support
- 69b31ef6f853 exfat: replace unsafe macros with static inline functions
- 9634db561e15 crypto: xilinx-trng - Remove crypto_rng interface
- 3dc8a46d08a8 liveupdate: validate session type before performing operation
- ddcdac47e1f2 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- 53430a3768b5 usb: atm: ueagle-atm: remove function entry/exit debug messages
- 10cfea5091f0 usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- 28f19c97eab4 xfs: add newly added RTGs to the free pool in growfs
- 615104cd66f8 xfs: factor out a xfs_zone_mark_free helper
- cfb2c6f71d61 ksmbd: use opener credentials for FSCTL mutations
- cba4ee1092b3 smb: move compression definitions into common/fscc.h
- 98185b3025be ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
- 733e76e74e40 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- a2a2f68c42e0 Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- 4257f45ee1fd binder: cache secctx size before release zeroes it
- 3f54f2310de0 binder: Use LIST_HEAD() to initialize on stack list head
- da9e3be9cf31 ALSA: hda/tas2781: Cancel async firmware request at unbind
- cd992747d717 firmware_loader: Add cancel helper for async requests
- ac1328962db1 ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
- 53e3dcfa74b3 ALSA: scarlett2: Allow selecting config_set by firmware version
- b80d60249686 iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
- 3c0dbfecd859 f2fs: fix listxattr handling of corrupted xattr entries
- aa807064473a f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
- cf8b5937b7b2 f2fs: fix potential deadlock in f2fs_balance_fs()
- c81e2af41de6 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
- db20589d7b24 samples/damon/mtier: fail early if address range parameters are invalid
- 810c9ae71dad mm/damon/core: trace esz at first setup
- 314bd592085c bpf: Reject negative const offsets for buffer pointers
- a419421281fb mmc: sdhci-esdhc-imx: fix resume error handling
- 89b63cd133fe mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
- 6355749aebf6 mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
- 9bf4ee05a110 mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
- bb72b2398c05 mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
- 24300decd8bd mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
- 48188934d5d2 mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
- 657e0acce5b8 mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
- f59d0244d90b mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
- 0e93010b52bb mmc: block: fix RPMB device unregister ordering
- cb2031f8b226 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
- 791fc00d116e mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
- 1773c6e292b0 mtd: rawnand: fsl_ifc: return errors for failed page reads
- c2e1d3392956 mmc: vub300: defer reset un

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.5-xanmod1]_

### 7.1.4-xanmod1

- Date: 2026-07-18
- Version: 7.1.4-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.4-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.4-xanmod1

- **fixed** — xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
- **fixed** — xfs: write the rg superblock when fixing it
- **fixed** — xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
- **fixed** — xfs: don't zap bmbt forks if they are MAXLEVELS tall
- **fixed** — xfs: fully check the parent handle when it points to the rootdir
- **fixed** — xfs: clamp timestamp nanoseconds correctly
- **fixed** — xfs: handle non-inode owners for rtrmap record checking
- **fixed** — xfs: set xfarray killable sort correctly
- **fixed** — xfs: use the rt version of the cow staging checker
- **fixed** — xfs: grab rtrmap btree when checking rgsuper
- **fixed** — xfs: don't wrap around quota ids in dqiterate
- **fixed** — xfs: resample the data fork mapping after cycling ILOCK
- **fixed** — xfs: fail recovery on a committed log item with no regions
- **fixed** — xfs: fix null pointer dereference in tracepoint
- **fixed** — smb: client: reject overlapping data areas in SMB2 responses
- **fixed** — Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- **fixed** — timekeeping: Register default clocksource before taking tk_core.lock
- **fixed** — fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
- **fixed** — fuse-uring: make a fuse_req on SQE commit only findable after memcpy
- **fixed** — fuse-uring: Avoid queue->stopped races and set/read that value under lock

- 967cc061f0dc Linux 7.1.4-xanmod1
- d3dc120f721d Merge tag 'v7.1.4' into 7.1
- 7a5cef0db479 Linux 7.1.4
- 63940a3adc7d xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
- 5394c215efde xfs: write the rg superblock when fixing it
- 4d281a74eed8 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
- 19fa8bc0df48 xfs: don't zap bmbt forks if they are MAXLEVELS tall
- 704a6ba079f0 xfs: fully check the parent handle when it points to the rootdir
- cb1f92cb29cc xfs: clamp timestamp nanoseconds correctly
- b7e9edbed705 xfs: handle non-inode owners for rtrmap record checking
- 261c7a32f637 xfs: set xfarray killable sort correctly
- 5da68d6c927a xfs: use the rt version of the cow staging checker
- b19e5b47424b xfs: grab rtrmap btree when checking rgsuper
- 2b14fe1e0924 xfs: don't wrap around quota ids in dqiterate
- 44f891bc0889 xfs: resample the data fork mapping after cycling ILOCK
- cccbabeb9a18 xfs: fail recovery on a committed log item with no regions
- 0bc4d4a97302 xfs: fix null pointer dereference in tracepoint
- 57cba95f0e97 smb: client: reject overlapping data areas in SMB2 responses
- 25e2ac320c3d Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- 07e454687b13 timekeeping: Register default clocksource before taking tk_core.lock
- ae8f855a28e0 ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY
- 0a7f33010c0e fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
- a635f427d57e fuse-uring: make a fuse_req on SQE commit only findable after memcpy
- 4021a3a79eee fuse-uring: Avoid queue->stopped races and set/read that value under lock
- 95d7f50aff2a fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
- 4f45f276d5b4 fuse-uring: end fuse_req on io-uring cancel task work
- e8afc85acdf3 fuse-uring: fix moving cancelled entry to ent_in_userspace list
- d01a09b442cb fuse-uring: fix data races on ring->ready
- fe604c08d874 fuse-uring: fix EFAULT clobber in fuse_uring_commit
- 893479015cb6 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
- 1ec674d3d0ed fuse: don't block in fuse_get_dev() for non-sync_init case
- 1f3f4060e656 fuse: fix io-uring background queue dispatch on request completion
- 65a1c2551f7e fuse: re-lock request before returning from fuse_ref_folio()
- 779b7f1fcdee fuse: do not use start_removing_noperm()
- 81b1045c401c fuse: fix device node leak in cuse_process_init_reply()
- a37a64ebc9d7 Revert "fuse: fix conversion of fuse_reverse_inval_entry() to start_removing()"
- c78c4b242299 fuse: avoid 32-bit prune notification count wrap
- 7ddcbd4dd85f fuse: back uncached readdir buffers with pages
- 75c93cd3c421 RDMA/siw: bound Read Response placement to the RREAD length
- 020700a2fdc4 RDMA/core: Fix broadcast address falsely detected as local
- da3e44add94b RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
- 2ffcdbfd1431 Input: maplecontrol - set driver data before registering input device
- 79e6fd106356 Input: maplemouse - set driver data before registering input device
- 2351e841951c Input: maple_keyb - set driver data before registering input device
- d5ab7e52e86e Input: mms114 - fix multi-touch slot corruption
- 2914e243ec9e Input: maplemouse - fix NULL pointer dereference in open()
- b75371bc87ae Input: gscps2 - advance receive buffer write index
- f3d5e77b27fd Input: mms114 - reject an oversized device packet size
- a8d87184576c Input: touchwin - reset the packet index on every complete packet
- 2691b68f9b03 Input: ads7846 - don't use scratch for tx_buf when clearing register
- a747c4eb0265 Input: mms114 - fix touch indexing for MMS134S and MMS136
- a40250f97c31 Input: iforce - bound the device-reported force-feedback effect index
- 2a6766869012 Input: goodix - clamp the device-reported contact count
- 6bac57d8fe2a Input: elan_i2c - prevent division by zero and arithmetic underflow
- bfe622efecd4 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
- 64fb0e1161cc Input: sy

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.4-xanmod1]_

### 7.1.3-xanmod1

- Date: 2026-07-04
- Version: 7.1.3-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.3-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.3-xanmod1

- **fixed** — apparmor: advertise the tcp fast open fix is applied
- **fixed** — net/tcp-ao: fix use-after-free of key in del_async path
- **fixed** — ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- **fixed** — NFS: Prevent resource leak in nfs_alloc_server()
- **fixed** — NFSv4: clear exception state on successful mkdir retry
- **fixed** — NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- **fixed** — NFSv4/flexfiles: reject zero filehandle version count
- **fixed** — nfsd: reset write verifier on deferred writeback errors
- **fixed** — nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- **fixed** — nfsd: fix dead ACL conflict guard in nfsd4_create
- **fixed** — nfsd: check get_user() return when reading princhashlen
- **fixed** — nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
- **fixed** — nfsd: fix inverted cp_ttl check in async copy reaper
- **fixed** — nfsd: fix posix_acl leak on SETACL decode failure
- **fixed** — NFSD: Fix SECINFO_NO_NAME decode error cleanup
- **fixed** — nfsd: release layout stid on setlease failure
- **fixed** — i2c: core: fix adapter registration race
- **fixed** — fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- **fixed** — fbdev: modedb: fix a possible UAF in fb_find_mode()
- **fixed** — fbdev: omap2: fix use-after-free in omapfb_mmap

- ece066880fc5 Linux 7.1.3-xanmod1
- 2ddd8fb98217 Merge tag 'v7.1.3' into 7.1
- 199c9959d3a9 Linux 7.1.3
- 5b872b77bd35 apparmor: advertise the tcp fast open fix is applied
- 7ddc29a094d9 net/tcp-ao: fix use-after-free of key in del_async path
- e36e35660adb ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- 65b1bb5d24e5 NFS: Prevent resource leak in nfs_alloc_server()
- a2c8befd06a4 NFSv4: clear exception state on successful mkdir retry
- 30aae62e50b4 NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- 2131ed64b767 NFSv4/flexfiles: reject zero filehandle version count
- b027cca33c97 nfsd: reset write verifier on deferred writeback errors
- a10bf67fe064 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- 8371cc5c0a2c nfsd: fix dead ACL conflict guard in nfsd4_create
- ff3ecd17db74 nfsd: check get_user() return when reading princhashlen
- 18cf006a08ba nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
- 80866c84137e nfsd: fix inverted cp_ttl check in async copy reaper
- a5b42c1e4ff2 nfsd: fix posix_acl leak on SETACL decode failure
- 46eb17d45be6 NFSD: Fix SECINFO_NO_NAME decode error cleanup
- 83c2b7797742 nfsd: release layout stid on setlease failure
- a4c8094bbf4c i2c: core: fix adapter registration race
- 7e58653d4352 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- 13b6f0cdd5cd fbdev: modedb: fix a possible UAF in fb_find_mode()
- 6eb6ebcc8590 fbdev: omap2: fix use-after-free in omapfb_mmap
- 39815715cbcf fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
- 88913059c77e fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
- acd744019460 ntfs: serialize volume label accesses
- 7f7a9d6cb0ed riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
- d6d6051fd15a riscv: mm: Extract helper mark_new_valid_map()
- d109e72f3fbc power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
- 2753a097d1fe KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
- f636cf6a1e7b KVM: x86: hyper-v: Bound the bank index when querying sparse banks
- 9fef09df42df MIPS: smp: report dying CPU to RCU in stop_this_cpu()
- a7656d368265 9p: avoid putting oldfid in p9_client_walk() error path
- 99c21e726324 ocfs2: reject oversized group bitmap descriptors
- ff268cd9ccbc rpmsg: char: Fix use-after-free on probe error path
- 5e098e40e8ba fpga: region: fix use-after-free in child_regions_with_firmware()
- 0405a65e4ebd irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
- 8d32856fb72b sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
- 9645aaf689af pNFS: Fix use-after-free in pnfs_update_layout()
- 0833b2b84c2f LoongArch: Report dying CPU to RCU in stop_this_cpu()
- 1eea5e1820a2 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
- afebe44facc4 blk-cgroup: fix UAF in __blkcg_rstat_flush()
- a594debfd4e7 hdlc_ppp: sync per-proto timers before freeing hdlc state
- 73569a44fca2 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
- 9d0d5ba20cad gfs2: fix use-after-free in gfs2_qd_dealloc
- 833033e6e55a crypto: nx - fix nx_crypto_ctx_exit argument
- 5c87b4737468 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
- b2ae3245ea44 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
- 708b97e79294 exfat: fix potential use-after-free in exfat_find_dir_entry()
- 07c245bc39f9 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
- 70df4de46577 bpf: use kvfree() for replaced sysctl write buffer
- 717f721eb67d block: Avoid mounting the bdev pseudo-filesystem in userspace
- a92332f32a8d f2fs: read COW data with the original inode during atomic write
- d52dbbcad61d f2fs: keep atomic write retry from zeroing original data
- edf12cbeeeab f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
- 6e035dae4415 Revert "f2fs: remove non-uptodate folio from the page cache in m

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.3-xanmod1]_

### 7.1.2-xanmod1

- Date: 2026-06-27
- Version: 7.1.2-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.2-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.2-xanmod1

- **fixed** — virtiofs: fix UAF on submount umount
- **fixed** — media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- **fixed** — ksmbd: reject non-VALID session in compound request branch
- **fixed** — drivers/base/memory: set mem->altmap after successful device registration
- **fixed** — serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- **fixed** — serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- **fixed** — vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- **removed** — crypto: qat - remove unused character device and IOCTLs
- **fixed** — iio: adc: ti-ads1298: add bounds check to pga_settings index
- **fixed** — iio: light: veml6075: add bounds check to veml6075_it_ms index
- **fixed** — agp/amd64: Fix broken error propagation in agp_amd64_probe()
- **fixed** — Revert NFSD: Defer sub-object cleanup in export put callbacks
- **fixed** — fuse: re-lock request before replacing page cache folio
- **fixed** — io_uring/net: Avoid msghdr on op_connect/op_bind async data

- 74edfbf88678 Linux 7.1.2-xanmod1
- 963a4a40216b Merge tag 'v7.1.2' into 7.1
- 03e2778d1f11 Linux 7.1.2
- e09412a714bc virtiofs: fix UAF on submount umount
- 232e4b313ea3 media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- 5f983b864d3d ksmbd: reject non-VALID session in compound request branch
- 059ac6252a63 drivers/base/memory: set mem->altmap after successful device registration
- 778b9dda4b24 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- ee6754f583a9 serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- 09a43e81279b vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- 3ae49dd04dbb crypto: qat - remove unused character device and IOCTLs
- abd776ded3e2 iio: adc: ti-ads1298: add bounds check to pga_settings index
- e545936e06f1 iio: light: veml6075: add bounds check to veml6075_it_ms index
- cefe535a60a2 agp/amd64: Fix broken error propagation in agp_amd64_probe()
- 613257f91906 Revert "NFSD: Defer sub-object cleanup in export put callbacks"
- e28db6ac4792 fuse: re-lock request before replacing page cache folio
- 7e00cafa33b5 io_uring/net: Avoid msghdr on op_connect/op_bind async data