# XanMod Kernel changelog

> Linux kernel built for desktop and gaming workloads, with a low-latency scheduler and current hardware support.

- Vendor: XanMod
- Category: Operating Systems
- Official site: https://xanmod.org
- Tracked by: What's New (https://whatsnew.fyi/product/xanmod)
- Harvested from: GitLab (gitlab.com/xanmod/linux)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### 6.18.41-rt-xanmod1

- Date: 2026-07-30
- Version: 6.18.41-rt-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/6.18.41-rt-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/6.18.41-rt-xanmod1

- **fixed** — Prevent UAF caused by non-leader exec() race in posix-cpu-timers
- **changed** — Expand timer_[re]arm() callbacks with a boolean return value
- **fixed** — Avoid repeated requests to allocate WC pages in RDMA/bnxt_re
- **fixed** — Initialize dpi variable to zero in RDMA/bnxt_re
- **fixed** — Fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
- **fixed** — Handle multiple address spaces in perf callchain
- **fixed** — Fix scoped_seqlock_read kernel-doc in seqlock
- **fixed** — Ignore the dummy event for dwarf stacks in perf inject --convert-callchain
- **fixed** — Fix Resizable BAR restore order in PCI
- **fixed** — Fix BAR resize rollback path overwriting ret in PCI
- **fixed** — Fix ENOENT case for filename__read_build_id in perf symbol
- **fixed** — Fix pinctrl function mismatch issue in airoha
- **fixed** — Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- **fixed** — Move vevent memory allocation outside spinlock in iommufd
- **fixed** — Propagate allocation failure in iommufd_veventq_deliver_fetch()
- **fixed** — Re-translate VNCR before injecting abort in KVM arm64 nv
- **fixed** — Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
- **fixed** — Ensure level is always initialized when relaxing perms in KVM arm64
- **fixed** — Fix incorrect buffered IO fallback for append direct writes in btrfs
- **fixed** — Fix false IO failure after falling back to buffered write in btrfs

- 93ee63dfc0db Linux 6.18.41-rt-xanmod1
- 3e27e81ebc48 Merge branch '6.18' into 6.18-rt
- 929ca27d531b Linux 6.18.41-xanmod1
- 1c784dbe2a35 Merge tag 'v6.18.41' into 6.18
- 2fe596715f84 Linux 6.18.41
- 6a7ecc25abe6 posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- 9f7268928ac0 posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
- 44db62f5aa97 Linux 6.18.40-xanmod1
- 8b49b49d26aa Merge tag 'v6.18.40' into 6.18
- 221fc2f4d0ed Linux 6.18.40
- 478c4d24193f RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
- b87cbd4d198a RDMA/bnxt_re: Initialize dpi variable to zero
- 81e6faa5b640 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
- 1badb6866482 perf callchain: Handle multiple address spaces
- 275eb3993094 seqlock: fix scoped_seqlock_read kernel-doc
- 453cb79a1564 perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
- 2764d031efd6 PCI: Fix Resizable BAR restore order
- 2fb74141ec54 PCI: Fix BAR resize rollback path overwriting ret
- 7425e7d82cb9 perf symbol: Fix ENOENT case for filename__read_build_id
- a888f3d5970f pinctrl: airoha: fix pinctrl function mismatch issue
- 267fdd9b6530 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- 779480ea7955 iommufd: Move vevent memory allocation outside spinlock
- 73b5d5cb1f5a iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
- ea7a76d7d614 KVM: arm64: nv: Re-translate VNCR before injecting abort
- 459adfc6cd35 KVM: arm64: Deduplicate ASID retrieval code
- 9d360fb820a3 samples/damon/mtier: fail early if address range parameters are invalid
- ec976851ad93 mm/damon/core: trace esz at first setup
- 3b91c35961fa mm/damon/core: always put unsuccessfully committed target pids
- ba37cd4d8a75 KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
- 19d9996435db KVM: arm64: Ensure level is always initialized when relaxing perms
- c3a3d3986719 btrfs: fix incorrect buffered IO fallback for append direct writes
- 998ee7f01ecf btrfs: fix false IO failure after falling back to buffered write
- a4497a122e27 crypto: qat - fix restarting state leak on allocation failure
- 6c78081d047c btrfs: remove folio parameter from ordered io related functions
- 1a648c50a505 btrfs: replace for_each_set_bit() with for_each_set_bitmap()
- 99d4ae3fbb5b btrfs: concentrate the error handling of submit_one_sector()
- 382fd8004cc6 crypto: atmel-sha204a - fail on hwrng registration error in probe path
- 952db4b985c7 usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- 69faa3779250 usb: gadget: f_fs: initialize reset_work at allocation time
- 8a2fdbf92cdc functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions
- 5fb0b09180a0 functionfs: switch to simple_remove_by_name()
- 4744f07f6bb7 functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}()
- 901c036cf625 functionfs: don't abuse ffs_data_closed() on fs shutdown
- c3e686025210 new helper: simple_remove_by_name()
- 509b51327320 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- b78826a65799 usb: atm: ueagle-atm: remove function entry/exit debug messages
- 6e5ef54b884f usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- 41a4e80d5af0 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
- e534790c4c27 usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation.
- bce232923aa9 xfs: use bio_reuse in the zone GC code
- adadb181ad42 xfs: only log freed extents for the current RTG in zoned growfs
- 47c0e0743302 xfs: add a xfs_groups_to_rfsbs helper
- 57454944737f bpf: Allow LPM map access from sleepable BPF programs
- 8fccaeeb9e9c bpf: Consistently use bpf_rcu_lock_held() everywhere
- 0b92ad64d6e4 bpf: Keep dynamic inner array lookups nullable
- c447be8d88c3 bpf: Introduce struct bpf_map_desc in verifier
- dccb3c557879 bpf: Consistently use reg_state() for register access in the verifier
- 60eed4467429 xfs: initialize iomap->flags earlier in xfs_b

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/6.18.41-rt-xanmod1]_

### 6.18.41-xanmod1

- Date: 2026-07-30
- Version: 6.18.41-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/6.18.41-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/6.18.41-xanmod1

- **fixed** — Prevent UAF caused by non-leader exec() race in posix-cpu-timers
- **changed** — Expand timer_[re]arm() callbacks with a boolean return value in posix-timers

- 929ca27d531b Linux 6.18.41-xanmod1
- 1c784dbe2a35 Merge tag 'v6.18.41' into 6.18
- 2fe596715f84 Linux 6.18.41
- 6a7ecc25abe6 posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- 9f7268928ac0 posix-timers: Expand timer_[re]arm() callbacks with a boolean return value

### 7.1.5-xanmod1

- Date: 2026-07-25
- Version: 7.1.5-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.5-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.5-xanmod1

- **changed** — Update TCP 'bbr' congestion control module to BBRv3
- **fixed** — Prevent UAF caused by non-leader exec() race in posix-cpu-timers
- **fixed** — Fix Color Manager (3DLUT, Shaper, Blend) in drm/amd/display
- **fixed** — Fix implicit declaration of brelse() in exfat
- **removed** — Remove crypto_rng interface from crypto: xilinx-trng
- **fixed** — Validate session type before performing operation in liveupdate
- **changed** — Wait for pre-firmware load in usb: atm: ueagle-atm .disconnect()
- **changed** — Remove function entry/exit debug messages from usb: atm: ueagle-atm
- **changed** — Use dev_dbg() for 'device found' message in usb: atm: ueagle-atm
- **fixed** — Add newly added RTGs to the free pool in xfs growfs
- **fixed** — Use opener credentials for FSCTL mutations in ksmbd
- **fixed** — Fix path resolution in ksmbd_vfs_kern_path_create
- **fixed** — Fix use-after-free in l2cap_sock_new_connection_cb() in Bluetooth L2CAP
- **fixed** — Fix cyclic locking warning on netdev unregister in Bluetooth 6lowpan
- **fixed** — Cache secctx size before release zeroes it in binder
- **fixed** — Cancel async firmware request at unbind in ALSA: hda/tas2781
- **added** — Add cancel helper for async requests in firmware_loader
- **fixed** — Update offsets for 2i2 Gen 4 firmware 2417 in ALSA: scarlett2
- **fixed** — Fix stale or zero output when reading raw values in iio: hid-sensor-rotation
- **fixed** — Fix listxattr handling of corrupted xattr entries in f2fs

- 2fb7a627a9c6 Linux 7.1.5-xanmod1
- 022aeb4a9152 tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3 [v7.1.5+]
- c50e105d5af1 Merge tag 'v7.1.5' into 7.1
- 8392dcae53e5 Revert "tcp_bbr: v3: update TCP 'bbr' congestion control module to BBRv3"
- 155b42bec9cb Linux 7.1.5
- 872380f930c9 Revert "gpib: cb7210: Fix region leak when request_irq fails"
- ad1cafa1bdaa posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- 60325bf5e2c1 posix-timers: Expand timer_[re]arm() callbacks with a boolean return value
- 5638dbfe9cf1 drm/amd/display: Fix Color Manager (3DLUT, Shaper, Blend)
- 570967e9c615 iomap: consolidate bio submission
- e2f0122bd566 exfat: fix implicit declaration of brelse()
- 8e4e884f1bef exfat: add data_start_bytes and exfat_cluster_to_phys_bytes() helper
- 390f1d72a478 exfat: add balloc parameter to exfat_map_cluster() for iomap support
- 69b31ef6f853 exfat: replace unsafe macros with static inline functions
- 9634db561e15 crypto: xilinx-trng - Remove crypto_rng interface
- 3dc8a46d08a8 liveupdate: validate session type before performing operation
- ddcdac47e1f2 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- 53430a3768b5 usb: atm: ueagle-atm: remove function entry/exit debug messages
- 10cfea5091f0 usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- 28f19c97eab4 xfs: add newly added RTGs to the free pool in growfs
- 615104cd66f8 xfs: factor out a xfs_zone_mark_free helper
- cfb2c6f71d61 ksmbd: use opener credentials for FSCTL mutations
- cba4ee1092b3 smb: move compression definitions into common/fscc.h
- 98185b3025be ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
- 733e76e74e40 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- a2a2f68c42e0 Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
- 4257f45ee1fd binder: cache secctx size before release zeroes it
- 3f54f2310de0 binder: Use LIST_HEAD() to initialize on stack list head
- da9e3be9cf31 ALSA: hda/tas2781: Cancel async firmware request at unbind
- cd992747d717 firmware_loader: Add cancel helper for async requests
- ac1328962db1 ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
- 53e3dcfa74b3 ALSA: scarlett2: Allow selecting config_set by firmware version
- b80d60249686 iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
- 3c0dbfecd859 f2fs: fix listxattr handling of corrupted xattr entries
- aa807064473a f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
- cf8b5937b7b2 f2fs: fix potential deadlock in f2fs_balance_fs()
- c81e2af41de6 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
- db20589d7b24 samples/damon/mtier: fail early if address range parameters are invalid
- 810c9ae71dad mm/damon/core: trace esz at first setup
- 314bd592085c bpf: Reject negative const offsets for buffer pointers
- a419421281fb mmc: sdhci-esdhc-imx: fix resume error handling
- 89b63cd133fe mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend
- 6355749aebf6 mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
- 9bf4ee05a110 mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
- bb72b2398c05 mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
- 24300decd8bd mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume
- 48188934d5d2 mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore
- 657e0acce5b8 mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
- f59d0244d90b mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion
- 0e93010b52bb mmc: block: fix RPMB device unregister ordering
- cb2031f8b226 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
- 791fc00d116e mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
- 1773c6e292b0 mtd: rawnand: fsl_ifc: return errors for failed page reads
- c2e1d3392956 mmc: vub300: defer reset un

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.5-xanmod1]_

### 6.18.40-xanmod1

- Date: 2026-07-25
- Version: 6.18.40-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/6.18.40-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/6.18.40-xanmod1

- **fixed** — RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
- **fixed** — RDMA/bnxt_re: Initialize dpi variable to zero
- **fixed** — ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
- **fixed** — perf callchain: Handle multiple address spaces
- **fixed** — seqlock: fix scoped_seqlock_read kernel-doc
- **fixed** — perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
- **fixed** — PCI: Fix Resizable BAR restore order
- **fixed** — PCI: Fix BAR resize rollback path overwriting ret
- **fixed** — perf symbol: Fix ENOENT case for filename__read_build_id
- **fixed** — pinctrl: airoha: fix pinctrl function mismatch issue
- **fixed** — bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- **fixed** — iommufd: Move vevent memory allocation outside spinlock
- **fixed** — iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
- **fixed** — KVM: arm64: nv: Re-translate VNCR before injecting abort
- **fixed** — KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
- **fixed** — KVM: arm64: Ensure level is always initialized when relaxing perms
- **fixed** — btrfs: fix incorrect buffered IO fallback for append direct writes
- **fixed** — btrfs: fix false IO failure after falling back to buffered write
- **fixed** — crypto: qat - fix restarting state leak on allocation failure
- **fixed** — crypto: atmel-sha204a - fail on hwrng registration error in probe path

- 44db62f5aa97 Linux 6.18.40-xanmod1
- 8b49b49d26aa Merge tag 'v6.18.40' into 6.18
- 221fc2f4d0ed Linux 6.18.40
- 478c4d24193f RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
- b87cbd4d198a RDMA/bnxt_re: Initialize dpi variable to zero
- 81e6faa5b640 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
- 1badb6866482 perf callchain: Handle multiple address spaces
- 275eb3993094 seqlock: fix scoped_seqlock_read kernel-doc
- 453cb79a1564 perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
- 2764d031efd6 PCI: Fix Resizable BAR restore order
- 2fb74141ec54 PCI: Fix BAR resize rollback path overwriting ret
- 7425e7d82cb9 perf symbol: Fix ENOENT case for filename__read_build_id
- a888f3d5970f pinctrl: airoha: fix pinctrl function mismatch issue
- 267fdd9b6530 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
- 779480ea7955 iommufd: Move vevent memory allocation outside spinlock
- 73b5d5cb1f5a iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
- ea7a76d7d614 KVM: arm64: nv: Re-translate VNCR before injecting abort
- 459adfc6cd35 KVM: arm64: Deduplicate ASID retrieval code
- 9d360fb820a3 samples/damon/mtier: fail early if address range parameters are invalid
- ec976851ad93 mm/damon/core: trace esz at first setup
- 3b91c35961fa mm/damon/core: always put unsuccessfully committed target pids
- ba37cd4d8a75 KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
- 19d9996435db KVM: arm64: Ensure level is always initialized when relaxing perms
- c3a3d3986719 btrfs: fix incorrect buffered IO fallback for append direct writes
- 998ee7f01ecf btrfs: fix false IO failure after falling back to buffered write
- a4497a122e27 crypto: qat - fix restarting state leak on allocation failure
- 6c78081d047c btrfs: remove folio parameter from ordered io related functions
- 1a648c50a505 btrfs: replace for_each_set_bit() with for_each_set_bitmap()
- 99d4ae3fbb5b btrfs: concentrate the error handling of submit_one_sector()
- 382fd8004cc6 crypto: atmel-sha204a - fail on hwrng registration error in probe path
- 952db4b985c7 usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- 69faa3779250 usb: gadget: f_fs: initialize reset_work at allocation time
- 8a2fdbf92cdc functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions
- 5fb0b09180a0 functionfs: switch to simple_remove_by_name()
- 4744f07f6bb7 functionfs: don't bother with ffs->ref in ffs_data_{opened,closed}()
- 901c036cf625 functionfs: don't abuse ffs_data_closed() on fs shutdown
- c3e686025210 new helper: simple_remove_by_name()
- 509b51327320 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- b78826a65799 usb: atm: ueagle-atm: remove function entry/exit debug messages
- 6e5ef54b884f usb: atm: ueagle-atm: use dev_dbg() for 'device found' message
- 41a4e80d5af0 usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
- e534790c4c27 usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation.
- bce232923aa9 xfs: use bio_reuse in the zone GC code
- adadb181ad42 xfs: only log freed extents for the current RTG in zoned growfs
- 47c0e0743302 xfs: add a xfs_groups_to_rfsbs helper
- 57454944737f bpf: Allow LPM map access from sleepable BPF programs
- 8fccaeeb9e9c bpf: Consistently use bpf_rcu_lock_held() everywhere
- 0b92ad64d6e4 bpf: Keep dynamic inner array lookups nullable
- c447be8d88c3 bpf: Introduce struct bpf_map_desc in verifier
- dccb3c557879 bpf: Consistently use reg_state() for register access in the verifier
- 60eed4467429 xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
- 607217f7ad41 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- 7676ea09beb5 hfs/hfsplus: prevent getting negative values of offset/length
- f9b4b03ccc9c proc: protect ptrace_may_access() with exec_update_lock (part 1)
- 07bf18dc63f7 seqlock: Change do_task_stat() to use scoped_seqlock_read()
- c897fd63762e seqlock: Introduce scoped

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/6.18.40-xanmod1]_

### 7.1.4-xanmod1

- Date: 2026-07-18
- Version: 7.1.4-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.4-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.4-xanmod1

- **fixed** — xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
- **fixed** — xfs: write the rg superblock when fixing it
- **fixed** — xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
- **fixed** — xfs: don't zap bmbt forks if they are MAXLEVELS tall
- **fixed** — xfs: fully check the parent handle when it points to the rootdir
- **fixed** — xfs: clamp timestamp nanoseconds correctly
- **fixed** — xfs: handle non-inode owners for rtrmap record checking
- **fixed** — xfs: set xfarray killable sort correctly
- **fixed** — xfs: use the rt version of the cow staging checker
- **fixed** — xfs: grab rtrmap btree when checking rgsuper
- **fixed** — xfs: don't wrap around quota ids in dqiterate
- **fixed** — xfs: resample the data fork mapping after cycling ILOCK
- **fixed** — xfs: fail recovery on a committed log item with no regions
- **fixed** — xfs: fix null pointer dereference in tracepoint
- **fixed** — smb: client: reject overlapping data areas in SMB2 responses
- **fixed** — Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- **fixed** — timekeeping: Register default clocksource before taking tk_core.lock
- **fixed** — fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
- **fixed** — fuse-uring: make a fuse_req on SQE commit only findable after memcpy
- **fixed** — fuse-uring: Avoid queue->stopped races and set/read that value under lock

- 967cc061f0dc Linux 7.1.4-xanmod1
- d3dc120f721d Merge tag 'v7.1.4' into 7.1
- 7a5cef0db479 Linux 7.1.4
- 63940a3adc7d xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
- 5394c215efde xfs: write the rg superblock when fixing it
- 4d281a74eed8 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
- 19fa8bc0df48 xfs: don't zap bmbt forks if they are MAXLEVELS tall
- 704a6ba079f0 xfs: fully check the parent handle when it points to the rootdir
- cb1f92cb29cc xfs: clamp timestamp nanoseconds correctly
- b7e9edbed705 xfs: handle non-inode owners for rtrmap record checking
- 261c7a32f637 xfs: set xfarray killable sort correctly
- 5da68d6c927a xfs: use the rt version of the cow staging checker
- b19e5b47424b xfs: grab rtrmap btree when checking rgsuper
- 2b14fe1e0924 xfs: don't wrap around quota ids in dqiterate
- 44f891bc0889 xfs: resample the data fork mapping after cycling ILOCK
- cccbabeb9a18 xfs: fail recovery on a committed log item with no regions
- 0bc4d4a97302 xfs: fix null pointer dereference in tracepoint
- 57cba95f0e97 smb: client: reject overlapping data areas in SMB2 responses
- 25e2ac320c3d Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- 07e454687b13 timekeeping: Register default clocksource before taking tk_core.lock
- ae8f855a28e0 ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY
- 0a7f33010c0e fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
- a635f427d57e fuse-uring: make a fuse_req on SQE commit only findable after memcpy
- 4021a3a79eee fuse-uring: Avoid queue->stopped races and set/read that value under lock
- 95d7f50aff2a fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
- 4f45f276d5b4 fuse-uring: end fuse_req on io-uring cancel task work
- e8afc85acdf3 fuse-uring: fix moving cancelled entry to ent_in_userspace list
- d01a09b442cb fuse-uring: fix data races on ring->ready
- fe604c08d874 fuse-uring: fix EFAULT clobber in fuse_uring_commit
- 893479015cb6 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
- 1ec674d3d0ed fuse: don't block in fuse_get_dev() for non-sync_init case
- 1f3f4060e656 fuse: fix io-uring background queue dispatch on request completion
- 65a1c2551f7e fuse: re-lock request before returning from fuse_ref_folio()
- 779b7f1fcdee fuse: do not use start_removing_noperm()
- 81b1045c401c fuse: fix device node leak in cuse_process_init_reply()
- a37a64ebc9d7 Revert "fuse: fix conversion of fuse_reverse_inval_entry() to start_removing()"
- c78c4b242299 fuse: avoid 32-bit prune notification count wrap
- 7ddcbd4dd85f fuse: back uncached readdir buffers with pages
- 75c93cd3c421 RDMA/siw: bound Read Response placement to the RREAD length
- 020700a2fdc4 RDMA/core: Fix broadcast address falsely detected as local
- da3e44add94b RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
- 2ffcdbfd1431 Input: maplecontrol - set driver data before registering input device
- 79e6fd106356 Input: maplemouse - set driver data before registering input device
- 2351e841951c Input: maple_keyb - set driver data before registering input device
- d5ab7e52e86e Input: mms114 - fix multi-touch slot corruption
- 2914e243ec9e Input: maplemouse - fix NULL pointer dereference in open()
- b75371bc87ae Input: gscps2 - advance receive buffer write index
- f3d5e77b27fd Input: mms114 - reject an oversized device packet size
- a8d87184576c Input: touchwin - reset the packet index on every complete packet
- 2691b68f9b03 Input: ads7846 - don't use scratch for tx_buf when clearing register
- a747c4eb0265 Input: mms114 - fix touch indexing for MMS134S and MMS136
- a40250f97c31 Input: iforce - bound the device-reported force-feedback effect index
- 2a6766869012 Input: goodix - clamp the device-reported contact count
- 6bac57d8fe2a Input: elan_i2c - prevent division by zero and arithmetic underflow
- bfe622efecd4 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
- 64fb0e1161cc Input: sy

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.4-xanmod1]_

### 6.18.39-xanmod1

- Date: 2026-07-18
- Version: 6.18.39-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/6.18.39-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/6.18.39-xanmod1

- **fixed** — xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
- **fixed** — xfs: write the rg superblock when fixing it
- **fixed** — xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
- **fixed** — xfs: don't zap bmbt forks if they are MAXLEVELS tall
- **fixed** — xfs: fully check the parent handle when it points to the rootdir
- **fixed** — xfs: clamp timestamp nanoseconds correctly
- **fixed** — xfs: handle non-inode owners for rtrmap record checking
- **fixed** — xfs: set xfarray killable sort correctly
- **fixed** — xfs: use the rt version of the cow staging checker
- **fixed** — xfs: grab rtrmap btree when checking rgsuper
- **fixed** — xfs: don't wrap around quota ids in dqiterate
- **fixed** — xfs: resample the data fork mapping after cycling ILOCK
- **fixed** — xfs: fail recovery on a committed log item with no regions
- **fixed** — xfs: fix null pointer dereference in tracepoint
- **security** — smb: client: reject overlapping data areas in SMB2 responses
- **fixed** — Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
- **fixed** — Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- **fixed** — timekeeping: Register default clocksource before taking tk_core.lock
- **fixed** — usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
- **fixed** — sched/fair: Only update stats for allowed CPUs when looking for dst group

- 27e97e554390 Linux 6.18.39-xanmod1
- a4b496b054d4 Merge tag 'v6.18.39' into 6.18
- f89c296854b7 Linux 6.18.39
- 06b1729436ef xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
- 457a93a233bd xfs: write the rg superblock when fixing it
- e696ef088f55 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
- 6403ef9a81e6 xfs: don't zap bmbt forks if they are MAXLEVELS tall
- 1ea0868a477b xfs: fully check the parent handle when it points to the rootdir
- c9662ffd62c4 xfs: clamp timestamp nanoseconds correctly
- 424be21ed8cd xfs: handle non-inode owners for rtrmap record checking
- d399b026a6b3 xfs: set xfarray killable sort correctly
- 08b191ae6465 xfs: use the rt version of the cow staging checker
- 104584477883 xfs: grab rtrmap btree when checking rgsuper
- d1c4c40599c3 xfs: don't wrap around quota ids in dqiterate
- 206c09b04dc5 xfs: resample the data fork mapping after cycling ILOCK
- d98f22d2e11e xfs: fail recovery on a committed log item with no regions
- dca861f2cc9e xfs: fix null pointer dereference in tracepoint
- fdafa1e68dc7 smb: client: reject overlapping data areas in SMB2 responses
- 1991d49433e9 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
- 1c56c4651935 Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
- e697df336662 timekeeping: Register default clocksource before taking tk_core.lock
- 9e04055ab5fc usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
- 75e1d2787005 sched/fair: Only update stats for allowed CPUs when looking for dst group
- 0b466cf1b96e fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
- e1711479e906 fuse-uring: make a fuse_req on SQE commit only findable after memcpy
- 39c8e925b207 fuse-uring: Avoid queue->stopped races and set/read that value under lock
- 23a356e0bd96 fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
- bb476ef8e102 fuse-uring: end fuse_req on io-uring cancel task work
- 50f3e03db823 fuse-uring: fix moving cancelled entry to ent_in_userspace list
- b156bb996697 fuse-uring: fix data races on ring->ready
- 0483fffdeeb3 fuse-uring: fix EFAULT clobber in fuse_uring_commit
- 7366e6f4d2b4 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
- 096cb2e58a6d fuse: fix io-uring background queue dispatch on request completion
- be353caffa86 fuse: re-lock request before returning from fuse_ref_folio()
- e6620208bdd3 fuse: fix device node leak in cuse_process_init_reply()
- 6e2d84fdeac0 fuse: avoid 32-bit prune notification count wrap
- 69cfae58b9a3 fuse: back uncached readdir buffers with pages
- 423a78ff7928 RDMA/siw: bound Read Response placement to the RREAD length
- ab45808c141a RDMA/core: Fix broadcast address falsely detected as local
- 5a45d0aa1fa5 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
- 95de76f6ad47 Input: maplecontrol - set driver data before registering input device
- 9376c744bea2 Input: maplemouse - set driver data before registering input device
- 699e3abac02d Input: maple_keyb - set driver data before registering input device
- d7f66fbab5d2 Input: mms114 - fix multi-touch slot corruption
- 1b4cb75f254f Input: maplemouse - fix NULL pointer dereference in open()
- 37fbe63bccf2 Input: gscps2 - advance receive buffer write index
- 8301c3353053 Input: mms114 - reject an oversized device packet size
- 3e6f007b43e2 Input: touchwin - reset the packet index on every complete packet
- 05dee4007cf3 Input: ads7846 - don't use scratch for tx_buf when clearing register
- 75b12874b417 Input: mms114 - fix touch indexing for MMS134S and MMS136
- 70019779325f Input: iforce - bound the device-reported force-feedback effect index
- 3b3230346015 Input: goodix - clamp the device-reported contact count
- 01e0317c256c Input: elan_i2c - prevent division by zero and arithmetic underflow
- e849c6f51e68 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
- 8db211aed837 Input: synaptics-rmi4 - bound

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/6.18.39-xanmod1]_

### 7.1.3-xanmod1

- Date: 2026-07-04
- Version: 7.1.3-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.3-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.3-xanmod1

- **fixed** — apparmor: advertise the tcp fast open fix is applied
- **fixed** — net/tcp-ao: fix use-after-free of key in del_async path
- **fixed** — ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- **fixed** — NFS: Prevent resource leak in nfs_alloc_server()
- **fixed** — NFSv4: clear exception state on successful mkdir retry
- **fixed** — NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- **fixed** — NFSv4/flexfiles: reject zero filehandle version count
- **fixed** — nfsd: reset write verifier on deferred writeback errors
- **fixed** — nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- **fixed** — nfsd: fix dead ACL conflict guard in nfsd4_create
- **fixed** — nfsd: check get_user() return when reading princhashlen
- **fixed** — nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
- **fixed** — nfsd: fix inverted cp_ttl check in async copy reaper
- **fixed** — nfsd: fix posix_acl leak on SETACL decode failure
- **fixed** — NFSD: Fix SECINFO_NO_NAME decode error cleanup
- **fixed** — nfsd: release layout stid on setlease failure
- **fixed** — i2c: core: fix adapter registration race
- **fixed** — fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- **fixed** — fbdev: modedb: fix a possible UAF in fb_find_mode()
- **fixed** — fbdev: omap2: fix use-after-free in omapfb_mmap

- ece066880fc5 Linux 7.1.3-xanmod1
- 2ddd8fb98217 Merge tag 'v7.1.3' into 7.1
- 199c9959d3a9 Linux 7.1.3
- 5b872b77bd35 apparmor: advertise the tcp fast open fix is applied
- 7ddc29a094d9 net/tcp-ao: fix use-after-free of key in del_async path
- e36e35660adb ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- 65b1bb5d24e5 NFS: Prevent resource leak in nfs_alloc_server()
- a2c8befd06a4 NFSv4: clear exception state on successful mkdir retry
- 30aae62e50b4 NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- 2131ed64b767 NFSv4/flexfiles: reject zero filehandle version count
- b027cca33c97 nfsd: reset write verifier on deferred writeback errors
- a10bf67fe064 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- 8371cc5c0a2c nfsd: fix dead ACL conflict guard in nfsd4_create
- ff3ecd17db74 nfsd: check get_user() return when reading princhashlen
- 18cf006a08ba nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
- 80866c84137e nfsd: fix inverted cp_ttl check in async copy reaper
- a5b42c1e4ff2 nfsd: fix posix_acl leak on SETACL decode failure
- 46eb17d45be6 NFSD: Fix SECINFO_NO_NAME decode error cleanup
- 83c2b7797742 nfsd: release layout stid on setlease failure
- a4c8094bbf4c i2c: core: fix adapter registration race
- 7e58653d4352 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- 13b6f0cdd5cd fbdev: modedb: fix a possible UAF in fb_find_mode()
- 6eb6ebcc8590 fbdev: omap2: fix use-after-free in omapfb_mmap
- 39815715cbcf fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
- 88913059c77e fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
- acd744019460 ntfs: serialize volume label accesses
- 7f7a9d6cb0ed riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
- d6d6051fd15a riscv: mm: Extract helper mark_new_valid_map()
- d109e72f3fbc power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
- 2753a097d1fe KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
- f636cf6a1e7b KVM: x86: hyper-v: Bound the bank index when querying sparse banks
- 9fef09df42df MIPS: smp: report dying CPU to RCU in stop_this_cpu()
- a7656d368265 9p: avoid putting oldfid in p9_client_walk() error path
- 99c21e726324 ocfs2: reject oversized group bitmap descriptors
- ff268cd9ccbc rpmsg: char: Fix use-after-free on probe error path
- 5e098e40e8ba fpga: region: fix use-after-free in child_regions_with_firmware()
- 0405a65e4ebd irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
- 8d32856fb72b sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
- 9645aaf689af pNFS: Fix use-after-free in pnfs_update_layout()
- 0833b2b84c2f LoongArch: Report dying CPU to RCU in stop_this_cpu()
- 1eea5e1820a2 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
- afebe44facc4 blk-cgroup: fix UAF in __blkcg_rstat_flush()
- a594debfd4e7 hdlc_ppp: sync per-proto timers before freeing hdlc state
- 73569a44fca2 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
- 9d0d5ba20cad gfs2: fix use-after-free in gfs2_qd_dealloc
- 833033e6e55a crypto: nx - fix nx_crypto_ctx_exit argument
- 5c87b4737468 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
- b2ae3245ea44 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
- 708b97e79294 exfat: fix potential use-after-free in exfat_find_dir_entry()
- 07c245bc39f9 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
- 70df4de46577 bpf: use kvfree() for replaced sysctl write buffer
- 717f721eb67d block: Avoid mounting the bdev pseudo-filesystem in userspace
- a92332f32a8d f2fs: read COW data with the original inode during atomic write
- d52dbbcad61d f2fs: keep atomic write retry from zeroing original data
- edf12cbeeeab f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
- 6e035dae4415 Revert "f2fs: remove non-uptodate folio from the page cache in m

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/7.1.3-xanmod1]_

### 6.18.38-rt-xanmod1

- Date: 2026-07-04
- Version: 6.18.38-rt-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/6.18.38-rt-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/6.18.38-rt-xanmod1

- **fixed** — Advertise the tcp fast open fix is applied in apparmor
- **fixed** — Fix use-after-free of key in del_async path in net/tcp-ao
- **fixed** — Unregister 8250 port if clk_notifier_register() fails in serial 8250_dw
- **fixed** — Fix out-of-bounds read in smb_check_perm_dacl() in ksmbd
- **fixed** — Prevent resource leak in nfs_alloc_server() in NFS
- **fixed** — Clear exception state on successful mkdir retry in NFSv4
- **fixed** — Reject zero-length r_addr in nfs4_decode_mp_ds_addr in NFSv4/pNFS
- **fixed** — Reject zero filehandle version count in NFSv4/flexfiles
- **fixed** — Reset write verifier on deferred writeback errors in nfsd
- **fixed** — Avoid leaking pre-allocated openowner on unconfirmed retry race in nfsd
- **fixed** — Check get_user() return when reading princhashlen in nfsd
- **fixed** — Fix inverted cp_ttl check in async copy reaper in nfsd
- **fixed** — Fix posix_acl leak on SETACL decode failure in nfsd
- **fixed** — Fix SECINFO_NO_NAME decode error cleanup in NFSD
- **fixed** — Fix adapter registration race in i2c core
- **fixed** — Fix misaligned fields in the 1920x1080-60 mode in fbdev modedb
- **fixed** — Fix a possible UAF in fb_find_mode() in fbdev modedb
- **fixed** — Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var in fbdev
- **fixed** — Fix use-after-free in linkstation_poweroff_init() in power reset linkstation-poweroff
- **fixed** — Fix page overflow in sev_dbg_crypt() for ENCRYPT path in KVM SVM

- 4b8d52e3d233 Linux 6.18.38-rt-xanmod1
- 0b987ae8e20a Merge branch '6.18' into 6.18-rt
- e67923a55781 Linux 6.18.38-xanmod1
- 82e2790add06 Merge tag 'v6.18.38' into 6.18
- e46dc0adfe39 Linux 6.18.38
- 92c63a5ef3c7 apparmor: advertise the tcp fast open fix is applied
- e77fbefd1269 net/tcp-ao: fix use-after-free of key in del_async path
- 3d205fe80f21 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- 7627ff8c4f99 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- 62c26720121b NFS: Prevent resource leak in nfs_alloc_server()
- 6919eb549e8f NFSv4: clear exception state on successful mkdir retry
- 012d37a568bf NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- d8c90c7cc061 NFSv4/flexfiles: reject zero filehandle version count
- 4367afc119c5 nfsd: reset write verifier on deferred writeback errors
- 017a6150106b nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- 0f28337f54cf nfsd: check get_user() return when reading princhashlen
- dba7da4835de nfsd: fix inverted cp_ttl check in async copy reaper
- 136b416593f1 nfsd: fix posix_acl leak on SETACL decode failure
- c8a24effd96d NFSD: Fix SECINFO_NO_NAME decode error cleanup
- 6a946038f2a5 i2c: core: fix adapter registration race
- fc6aa9bdbae6 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- 4d418cf8daf5 fbdev: modedb: fix a possible UAF in fb_find_mode()
- eea16b6f805c fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
- 7643e5622994 riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
- 3b33dbb43e21 riscv: mm: Extract helper mark_new_valid_map()
- 2205275be9be power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
- 720949ed666f KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
- e36095d8d922 KVM: x86: hyper-v: Bound the bank index when querying sparse banks
- f9b57a0015c2 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
- 6dbe9443d9f5 9p: avoid putting oldfid in p9_client_walk() error path
- 4cd57ebee395 ocfs2: reject oversized group bitmap descriptors
- 104d10021239 rpmsg: char: Fix use-after-free on probe error path
- 369496d885b4 fpga: region: fix use-after-free in child_regions_with_firmware()
- b3a3831b2eb8 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
- 200e7637f4d6 pNFS: Fix use-after-free in pnfs_update_layout()
- 90e254f18b8c LoongArch: Report dying CPU to RCU in stop_this_cpu()
- e18769616fd5 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
- 5e5b7f2ef854 blk-cgroup: fix UAF in __blkcg_rstat_flush()
- 5a84398101bf hdlc_ppp: sync per-proto timers before freeing hdlc state
- e91df6d27344 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
- b85ef03f726b gfs2: fix use-after-free in gfs2_qd_dealloc
- 8d8507a45766 crypto: nx - fix nx_crypto_ctx_exit argument
- 5da9b1a87ec7 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
- 18587f983161 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
- adfacfbaeae2 exfat: fix potential use-after-free in exfat_find_dir_entry()
- 6e61fc2e06e4 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
- 65bd0c0afb0e bpf: use kvfree() for replaced sysctl write buffer
- 3804e6de30ae block: Avoid mounting the bdev pseudo-filesystem in userspace
- db2c5b9fb908 f2fs: keep atomic write retry from zeroing original data
- 20190e498057 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
- ff83de56882c f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
- 888d94cc9afb f2fs: fix to round down start offset of fallocate for pin file
- 77f216ff9ce5 f2fs: validate compress cache inode only when enabled
- 8aad54746c25 f2fs: validate orphan inode entry count
- 1e48fefac682 f2fs: pass correct iostat type for single node writes
- 1de92789ce31 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
- b0b07e04f0c7 wifi: iwlwifi: mld: fix

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/6.18.38-rt-xanmod1]_

### 6.18.38-xanmod1

- Date: 2026-07-04
- Version: 6.18.38-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/6.18.38-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/6.18.38-xanmod1

- **fixed** — AppArmor: advertise the TCP fast open fix is applied
- **fixed** — Fix use-after-free of key in TCP-AO del_async path
- **fixed** — Serial 8250_dw: unregister 8250 port if clk_notifier_register() fails
- **fixed** — ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- **fixed** — NFS: prevent resource leak in nfs_alloc_server()
- **fixed** — NFSv4: clear exception state on successful mkdir retry
- **fixed** — NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- **fixed** — NFSv4/flexfiles: reject zero filehandle version count
- **fixed** — nfsd: reset write verifier on deferred writeback errors
- **fixed** — nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- **fixed** — nfsd: check get_user() return when reading princhashlen
- **fixed** — nfsd: fix inverted cp_ttl check in async copy reaper
- **fixed** — nfsd: fix posix_acl leak on SETACL decode failure
- **fixed** — NFSD: fix SECINFO_NO_NAME decode error cleanup
- **fixed** — i2c: core: fix adapter registration race
- **fixed** — fbdev: modedb: fix misaligned fields in the 1920x1080-60 mode
- **fixed** — fbdev: modedb: fix a possible UAF in fb_find_mode()
- **fixed** — fbdev: fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
- **fixed** — riscv: kfence: call mark_new_valid_map() for kfence_unprotect()
- **fixed** — riscv: mm: extract helper mark_new_valid_map()

- e67923a55781 Linux 6.18.38-xanmod1
- 82e2790add06 Merge tag 'v6.18.38' into 6.18
- e46dc0adfe39 Linux 6.18.38
- 92c63a5ef3c7 apparmor: advertise the tcp fast open fix is applied
- e77fbefd1269 net/tcp-ao: fix use-after-free of key in del_async path
- 3d205fe80f21 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- 7627ff8c4f99 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- 62c26720121b NFS: Prevent resource leak in nfs_alloc_server()
- 6919eb549e8f NFSv4: clear exception state on successful mkdir retry
- 012d37a568bf NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- d8c90c7cc061 NFSv4/flexfiles: reject zero filehandle version count
- 4367afc119c5 nfsd: reset write verifier on deferred writeback errors
- 017a6150106b nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- 0f28337f54cf nfsd: check get_user() return when reading princhashlen
- dba7da4835de nfsd: fix inverted cp_ttl check in async copy reaper
- 136b416593f1 nfsd: fix posix_acl leak on SETACL decode failure
- c8a24effd96d NFSD: Fix SECINFO_NO_NAME decode error cleanup
- 6a946038f2a5 i2c: core: fix adapter registration race
- fc6aa9bdbae6 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- 4d418cf8daf5 fbdev: modedb: fix a possible UAF in fb_find_mode()
- eea16b6f805c fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
- 7643e5622994 riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
- 3b33dbb43e21 riscv: mm: Extract helper mark_new_valid_map()
- 2205275be9be power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
- 720949ed666f KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
- e36095d8d922 KVM: x86: hyper-v: Bound the bank index when querying sparse banks
- f9b57a0015c2 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
- 6dbe9443d9f5 9p: avoid putting oldfid in p9_client_walk() error path
- 4cd57ebee395 ocfs2: reject oversized group bitmap descriptors
- 104d10021239 rpmsg: char: Fix use-after-free on probe error path
- 369496d885b4 fpga: region: fix use-after-free in child_regions_with_firmware()
- b3a3831b2eb8 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
- 200e7637f4d6 pNFS: Fix use-after-free in pnfs_update_layout()
- 90e254f18b8c LoongArch: Report dying CPU to RCU in stop_this_cpu()
- e18769616fd5 tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
- 5e5b7f2ef854 blk-cgroup: fix UAF in __blkcg_rstat_flush()
- 5a84398101bf hdlc_ppp: sync per-proto timers before freeing hdlc state
- e91df6d27344 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
- b85ef03f726b gfs2: fix use-after-free in gfs2_qd_dealloc
- 8d8507a45766 crypto: nx - fix nx_crypto_ctx_exit argument
- 5da9b1a87ec7 KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
- 18587f983161 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
- adfacfbaeae2 exfat: fix potential use-after-free in exfat_find_dir_entry()
- 6e61fc2e06e4 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
- 65bd0c0afb0e bpf: use kvfree() for replaced sysctl write buffer
- 3804e6de30ae block: Avoid mounting the bdev pseudo-filesystem in userspace
- db2c5b9fb908 f2fs: keep atomic write retry from zeroing original data
- 20190e498057 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
- ff83de56882c f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
- 888d94cc9afb f2fs: fix to round down start offset of fallocate for pin file
- 77f216ff9ce5 f2fs: validate compress cache inode only when enabled
- 8aad54746c25 f2fs: validate orphan inode entry count
- 1e48fefac682 f2fs: pass correct iostat type for single node writes
- 1de92789ce31 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
- b0b07e04f0c7 wifi: iwlwifi: mld: fix race condition in PTP removal
- df626f284cb9 wifi: iwlwifi: mvm: fix race condition in P

_[Truncated at 4000 characters — full notes: https://gitlab.com/xanmod/linux/-/releases/6.18.38-xanmod1]_

### 7.1.2-xanmod1

- Date: 2026-06-27
- Version: 7.1.2-xanmod1
- Original notes: https://gitlab.com/xanmod/linux/-/releases/7.1.2-xanmod1
- Permalink: https://whatsnew.fyi/product/xanmod/releases/7.1.2-xanmod1

- **fixed** — virtiofs: fix UAF on submount umount
- **fixed** — media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- **fixed** — ksmbd: reject non-VALID session in compound request branch
- **fixed** — drivers/base/memory: set mem->altmap after successful device registration
- **fixed** — serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- **fixed** — serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- **fixed** — vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- **removed** — crypto: qat - remove unused character device and IOCTLs
- **fixed** — iio: adc: ti-ads1298: add bounds check to pga_settings index
- **fixed** — iio: light: veml6075: add bounds check to veml6075_it_ms index
- **fixed** — agp/amd64: Fix broken error propagation in agp_amd64_probe()
- **fixed** — Revert NFSD: Defer sub-object cleanup in export put callbacks
- **fixed** — fuse: re-lock request before replacing page cache folio
- **fixed** — io_uring/net: Avoid msghdr on op_connect/op_bind async data

- 74edfbf88678 Linux 7.1.2-xanmod1
- 963a4a40216b Merge tag 'v7.1.2' into 7.1
- 03e2778d1f11 Linux 7.1.2
- e09412a714bc virtiofs: fix UAF on submount umount
- 232e4b313ea3 media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- 5f983b864d3d ksmbd: reject non-VALID session in compound request branch
- 059ac6252a63 drivers/base/memory: set mem->altmap after successful device registration
- 778b9dda4b24 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- ee6754f583a9 serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- 09a43e81279b vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- 3ae49dd04dbb crypto: qat - remove unused character device and IOCTLs
- abd776ded3e2 iio: adc: ti-ads1298: add bounds check to pga_settings index
- e545936e06f1 iio: light: veml6075: add bounds check to veml6075_it_ms index
- cefe535a60a2 agp/amd64: Fix broken error propagation in agp_amd64_probe()
- 613257f91906 Revert "NFSD: Defer sub-object cleanup in export put callbacks"
- e28db6ac4792 fuse: re-lock request before replacing page cache folio
- 7e00cafa33b5 io_uring/net: Avoid msghdr on op_connect/op_bind async data