Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1780 commits
Select commit Hold shift + click to select a range
1f7bdfb
Input: ims-pcu - fix firmware leak in async update
dtor May 22, 2026
20fbf3c
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
dtor May 22, 2026
b847f27
Input: ims-pcu - fix potential infinite loop in CDC union descriptor …
dtor May 23, 2026
54c2237
Input: ims-pcu - fix race condition in reset_device sysfs callback
dtor May 22, 2026
fa7f65c
Input: ims-pcu - fix type confusion in CDC union descriptor parsing
dtor May 22, 2026
4a5073b
net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
peaktwilight Jun 27, 2026
95400e7
tracing/user_events: Fix use-after-free in user_event_mm_dup()
mjbommar Jul 7, 2026
edf6bab
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
zhanxusheng1024-os Jun 16, 2026
b1ecaa3
selftests/ftrace: Drop invalid top-level local in test_ownership
RichardCao Apr 7, 2026
77d4fa8
cpu: hotplug: Preserve per instance callback errors
inc1de Jun 19, 2026
61a73a1
cpu: hotplug: Bound hotplug states sysfs output
inc1de Jun 19, 2026
cd17c5a
gpio: tegra: do not call pinctrl for GPIO direction
Jun 19, 2026
886fa1b
gpio-f7188x: Add support for NCT6126D version B
noctuelles Jun 29, 2026
dd9f4b4
gpios: palmas: add .get_direction() op
akemnade Jul 4, 2026
c0ea1ae
net: sit: require CAP_NET_ADMIN in the device netns for changelink
maoyixie Jun 18, 2026
ebd84cb
net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
Jun 21, 2026
ffba16e
net: ixp4xx_hss: fix duplicate HDLC netdev allocation
Jun 22, 2026
5c3ae5f
net/sched: act_ct: preserve tc_skb_cb across defragmentation
Jun 13, 2026
6773d6d
net: ena: clean up XDP TX queues when regular TX setup fails
Jun 16, 2026
b2b61c5
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
maoyixie Jun 12, 2026
6d8bc0d
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
maoyixie Jun 12, 2026
2654402
net: ipip: require CAP_NET_ADMIN in the device netns for changelink
maoyixie Jun 12, 2026
0caa9f3
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
maoyixie Jun 12, 2026
7a939b6
octeontx2-af: Free BPID bitmap on setup failure
Jun 23, 2026
09fd25c
ieee802154: admin-gate legacy LLSEC dump operations
mjbommar May 20, 2026
3d4b3c7
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
mjbommar May 20, 2026
d4a397f
ieee802154: ca8210: fix cas_ctl leak on spi_async failure
Apr 21, 2026
65dc342
ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
May 20, 2026
f16c319
platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
DanielGibson Jun 26, 2026
b026281
net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
jhsmt Jun 30, 2026
c9e0f15
s390: Revert support for DCACHE_WORD_ACCESS
hcahca Jul 20, 2026
2cefa51
batman-adv: retrieve ethhdr after potential skb realloc on RX
ecsv Jul 20, 2026
6b4f521
batman-adv: ensure minimal ethernet header on TX
ecsv Jul 20, 2026
c7235ba
rust: block: `allow(deprecated)` for `fetch_update` for Rust >= 1.99.0
ojeda Jul 18, 2026
f15ca62
batman-adv: clean untagged VLAN on netdev registration failure
ecsv Jul 20, 2026
39bb21a
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
Jun 25, 2026
14c0b42
espintcp: use sk_msg_free_partial to fix partial send
qsn Jun 12, 2026
7d8d454
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
Jun 20, 2026
104d48c
rtc: mpfs: fix counter upload completion condition
ConchuOD May 13, 2026
e9aa468
hwmon: (w83627hf) remove VID sysfs files on error and remove
neosys007 Jun 15, 2026
fc9a46c
hwmon: (w83793) remove vrm sysfs file on probe failure
neosys007 Jun 15, 2026
a221036
net: liquidio: fix BAR resource leak on PF number failure
Jun 24, 2026
2092952
hwmon: (occ) unregister sysfs devices outside occ lock
Jun 19, 2026
90ebfb2
fsl/fman: Free init resources on KeyGen failure in fman_init()
Jun 25, 2026
b6a93a4
net: lan743x: Initialize eth_syslock spinlock before use
arighi Jun 26, 2026
1b9cc25
net/sched: sch_multiq: Replace direct dequeue call with peek and qdis…
bryamzxz Jun 25, 2026
18d580c
net/sched: sch_taprio: Replace direct dequeue call with peek and qdis…
bryamzxz Jun 25, 2026
1510423
fhandle: reject detached mounts in capable_wrt_mount()
dslee2022 Jul 1, 2026
a9d3788
hwmon: (max1619) add missing 'select REGMAP' to Kconfig
cjd8 Jun 29, 2026
416aafa
tracing/probes: Fix double addition of offset for @+FOFFSET
mhiramat Jun 24, 2026
fdf06a1
orangefs: keep the readdir entry size 64-bit in fill_from_part()
bryamzxz Jun 19, 2026
5a9733d
ata: pata_pxa: Fix DMA channel leak on probe error
ISCAS-Vulab Jun 25, 2026
55cfea8
net: wwan: iosm: bound device offsets in the MUX downlink decoder
maoyixie Jun 25, 2026
981a8a2
hwmon: (asus_atk0110) Check package count before accessing element
sammiee5311 Jun 19, 2026
c386e1c
riscv: probes: save original sp in rethook trampoline
martin-kaiser Jun 30, 2026
de8577d
mm/compaction: handle free_pages_prepare() properly in compaction_free()
x-y-z Jun 22, 2026
a27f17b
irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure
Jun 23, 2026
01f3ce4
s390/monwriter: Reject buffer reuse with different data length
gerald-schaefer Jun 23, 2026
c7c031b
mac802154: remove interfaces with RCU list deletion
Yousef13710 Jul 1, 2026
e4f3f41
selftests: net: make busywait timeout clock portable
nirmoy Jun 30, 2026
b2fc995
llc: fix SAP refcount leak in llc_ui_autobind()
shuangpeng-kernel Jun 30, 2026
a4a2d2e
ipvs: use parsed transport offset in SCTP state lookup
ArtisticFantasy Jul 6, 2026
d0eed71
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
ArtisticFantasy Jul 2, 2026
e17a421
macsec: don't read an unset MAC header in macsec_encrypt()
4ncientH Jul 3, 2026
33094c7
arm64: smp: Fix hot-unplug tearing by forcing unregistration
ruanjinjie-eng Jun 10, 2026
4d2686c
ata: libata-core: Skip HPA resize for locked drives
Jul 6, 2026
5f59a81
drbd: reject data replies with an out-of-range payload size
mjbommar Jul 10, 2026
6ad6954
riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
liutgnu Jul 5, 2026
3836614
tracing/osnoise: Call synchronize_rcu() when unregistering
crwood-rh Jun 9, 2026
a985da7
s390/mm: Fix type mismatch in get_align_mask().
gerald-schaefer Jun 30, 2026
fc680af
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
farhad-alemi Jul 6, 2026
b3358a4
pmdomain: imx: Fix i.MX8MP power notifier
MrVan Jun 10, 2026
c498928
pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
MrVan Jun 10, 2026
fb3258c
selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not av…
huth Jul 10, 2026
1fff8da
selftests/landlock: Fix screwed up pointers in the scoped_signal_test
huth Jul 9, 2026
2dafce2
powerpc/pseries: fix memory leak on krealloc failure in papr_init
toblux Jun 14, 2026
66bd9b1
wifi: rt2x00: avoid full teardown before work setup in probe
Jun 19, 2026
d51cafe
wifi: mwifiex: fix roaming to different channel in host_mlme mode
rbeims Jun 10, 2026
45e9ac5
wifi: mac80211: fix memory leak in ieee80211_register_hw()
Jul 6, 2026
49e75f7
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
abhishekojhasfl Jul 15, 2026
f1efff8
net: openvswitch: reject oversized nested action attrs
manizada Jul 6, 2026
8353489
Bluetooth: btrtl: validate firmware patch bounds
laxmanacharya8 Jul 10, 2026
121c6e1
llc: fix SAP refcount leak when creating incoming sockets
Jul 12, 2026
7228457
macsec: fix promiscuity refcount leak in macsec_dev_open()
jamestiotio Jul 5, 2026
b86666a
memstick: ms_block: reject a card that reports too many blocks
maoyixie Jul 2, 2026
7350eb7
ipvs: fix more places with wrong ipv6 transport offsets
Jul 8, 2026
e51687f
ipvs: reload ip header after head reallocation
Jul 8, 2026
01e43f4
reset: sunxi: fix memory region leak on ioremap failure
Jun 17, 2026
913feef
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
avasummer Jun 1, 2026
633b504
wifi: mac80211: free ack status frame on TX header build failure
rr00xxyy Jun 26, 2026
1bc55db
wifi: mwifiex: fix permanently busy scans after multiple roam iterations
rbeims Jun 12, 2026
d0f4a50
mtd: onenand: samsung: report DMA completion timeouts
neosys007 Jul 3, 2026
dbe2254
mtd: mchp23k256: use SPI match data for chip caps
neosys007 Jul 3, 2026
9f5e042
mmc: vub300: defer reset until cmd_mutex is unlocked
Jun 17, 2026
e46df9c
mtd: rawnand: fsl_ifc: return errors for failed page reads
neosys007 Jul 3, 2026
b06c099
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
neosys007 Jul 3, 2026
8f5c3ee
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
neosys007 Jul 3, 2026
0ca0f8c
mmc: block: fix RPMB device unregister ordering
Jul 6, 2026
5ca4519
mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() m…
Jun 1, 2026
d1dcaa5
rust: block: fix GenDisk cleanup paths
royenheart Jul 10, 2026
df7c922
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
rafaeljw Jul 10, 2026
a9451bf
ACPI: driver: Check ACPI_COMPANION() against NULL during probe
rafaeljw Jul 10, 2026
aa4d4b3
ACPI: bus: Introduce devm_acpi_install_notify_handler()
rafaeljw Jul 10, 2026
2521ac6
ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
rafaeljw Jul 10, 2026
aec986f
ACPI: NFIT: core: Fix possible deadlock and missing notifications
rafaeljw Jul 10, 2026
4e54061
iio: hid-sensor-rotation: Fix stale or zero output when reading raw v…
lixuzha Jul 13, 2026
afb45d1
iio: adc: ad7380: select REGMAP
smoelius Jul 13, 2026
24cb734
iio: pressure: Remove redundant pm_runtime_mark_last_busy() calls
Jul 13, 2026
aab0fed
iio: pressure: mpl115: fix runtime PM leak on read error
birenpandya Jul 13, 2026
d73067e
ALSA: aoa: check snd_ctl_new1() return value
Jul 13, 2026
8947215
ALSA: hda/cs35l41: Fix firmware load work teardown
CassivsGabriellis Jul 13, 2026
dcf4bff
ALSA: scarlett2: Allow selecting config_set by firmware version
geoffreybennett Jul 14, 2026
083c1e8
ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417
geoffreybennett Jul 14, 2026
399d806
vfio/mlx5: Fix racy bitfields and tighten struct layout
Jul 14, 2026
0db9aa9
PCI: altera: Fix resource leaks on probe failure
maheshv1203 Jul 14, 2026
a44c473
PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
Jul 14, 2026
ba45c91
PCI: mediatek: Switch to msi_create_parent_irq_domain()
covanam Jul 14, 2026
bbc21aa
PCI: mediatek: Convert bool to single quirks entry and bitmap
Ansuel Jul 14, 2026
09b0115
PCI: mediatek: Use generic MACRO for TPVPERL delay
Ansuel Jul 14, 2026
ce52e49
PCI: mediatek: Fix IRQ domain leak when port fails to enable
Mani-Sadhasivam Jul 14, 2026
21a4b00
PCI: Use pbus_select_window() during BAR resize
ij-intel Jul 14, 2026
6ea04b2
PCI: Prevent resource tree corruption when BAR resize fails
ij-intel Jul 14, 2026
8fe9086
PCI: Free saved list without holding pci_bus_sem
ij-intel Jul 14, 2026
0d63176
PCI: Fix restoring BARs on BAR resize rollback path
ij-intel Jul 14, 2026
411135e
PCI: Move Resizable BAR code to rebar.c
ij-intel Jul 14, 2026
43d07b6
PCI: Skip Resizable BAR restore on read error
mnencia Jul 14, 2026
228f54c
staging: rtl8723bs: core: move constants to right side in comparison
Jul 15, 2026
ebe3939
staging: rtl8723bs: fix spaces around binary operators
nikolayof23 Jul 15, 2026
6ab1161
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_i…
ahossu Jul 15, 2026
5114403
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
gcabiddu Jul 15, 2026
0b0e2bf
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
melver Jul 15, 2026
a235cec
gpio: sch: use raw_spinlock_t in the irq startup path
Jul 15, 2026
aadd806
io_uring/rw: ensure reissue path is correctly handled for IOPOLL
axboe Jul 15, 2026
2e43ee8
io_uring/rw: preserve partial result for iopoll
Michael-Wigham Jul 15, 2026
b20f148
media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
nxpfrankli Jul 15, 2026
ba2aa5d
media: nxp: imx8-isi: Fix use-after-free on remove
xiaoleiwang123456 Jul 15, 2026
c86eae7
netfilter: ebtables: Use vmalloc_array() to improve code
qianfengrong Jul 15, 2026
29bf41a
netfilter: ebtables: zero chainstack array
Jul 15, 2026
9b24ad4
Bluetooth: L2CAP: Fix not tracking outstanding TX ident
Vudentz Jul 15, 2026
8de7b38
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
Jul 15, 2026
90d5770
Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
Vudentz Jul 15, 2026
bc9012c
Bluetooth: separate CIS_LINK and BIS_LINK link types
pv Jul 15, 2026
70c397b
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
fourdim Jul 15, 2026
7617920
Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
pv Jul 15, 2026
84e718b
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
fourdim Jul 15, 2026
818416f
mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless …
jfernandez Jul 15, 2026
112d1d8
smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
elfring Jul 16, 2026
945b4a4
smb: client: resolve SWN tcon from live registrations
mjbommar Jul 16, 2026
7274511
ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name
Jul 16, 2026
0fac683
vfs: make LAST_XXX private to fs/namei.c
LATENTBOUNCE Jul 16, 2026
489d1de
ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
Jul 16, 2026
fb1cae6
ksmbd: use opener credentials for FSCTL mutations
namjaejeon Jul 16, 2026
2248b30
ksmbd: centralize ksmbd_conn final release to plug transport leak
charsyam Jul 16, 2026
fe20d49
ksmbd: track the connection owning a byte-range lock
namjaejeon Jul 16, 2026
3a72bd4
proc: rename proc_setattr to proc_nochmod_setattr
Jul 16, 2026
83b1787
proc: protect ptrace_may_access() with exec_update_lock (FD links)
thejh Jul 16, 2026
5af78bf
perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
ZideChen0 Jul 16, 2026
ddf942c
HID: add haptics page defines
Jul 17, 2026
e24918e
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
everping Jul 17, 2026
5bde860
seqlock: Introduce scoped_seqlock_read()
Jul 17, 2026
21c0b84
seqlock: Change do_task_stat() to use scoped_seqlock_read()
oleg-nesterov Jul 17, 2026
4bfe8c4
proc: protect ptrace_may_access() with exec_update_lock (part 1)
thejh Jul 17, 2026
2513206
treewide: Switch/rename to timer_delete[_sync]()
KAGA-KOKO Jul 17, 2026
3755f6e
HID: appleir: fix UAF on pending key_up_timer in remove()
unamem Jul 17, 2026
25526a6
HID: pidff: Fix missing blank lines after declarations
Lawstorant Jul 17, 2026
cce3d25
HID: pidff: Add missing spaces
Lawstorant Jul 17, 2026
73342f3
HID: pidff: Rework pidff_upload_effect
Lawstorant Jul 17, 2026
7cf098b
HID: pidff: Use correct effect type in effect update
JacKeTUs Jul 17, 2026
3501833
hfs/hfsplus: prevent getting negative values of offset/length
dubeyko Jul 18, 2026
7399c3b
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
Jul 18, 2026
54e3905
bpf: Convert lpm_trie.c to rqspinlock
kkdwvd Jul 18, 2026
4b0b153
bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()
luisgerhorst Jul 18, 2026
f69f0cf
bpf: Consistently use bpf_rcu_lock_held() everywhere
anakryiko Jul 18, 2026
9bfdf4b
bpf: Allow LPM map access from sleepable BPF programs
vladwing Jul 18, 2026
5438ba7
usb: iowarrior: remove inherent race with minor number
oneukum Jul 19, 2026
3c0a7b2
USB: iowarrior: fix use-after-free on disconnect race
jhovold Jul 19, 2026
c581e30
usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
mfoliveira Jul 19, 2026
217d43a
crypto: atmel - Drop explicit initialization of struct i2c_device_id:…
ukleinek Jul 20, 2026
75dc891
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
toblux Jul 20, 2026
c36393b
usb: gadget: f_fs: initialize reset_work at allocation time
EmbeddedAndroid Jul 20, 2026
50bae79
crypto: atmel-sha204a - fail on hwrng registration error in probe path
toblux Jul 20, 2026
0aeda58
usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
nkapron Jul 20, 2026
2fb493b
btrfs: concentrate the error handling of submit_one_sector()
adam900710 Jul 20, 2026
adeade9
btrfs: replace for_each_set_bit() with for_each_set_bitmap()
adam900710 Jul 20, 2026
a404a72
btrfs: remove folio parameter from ordered io related functions
adam900710 Jul 20, 2026
443e9fe
btrfs: remove the COW fixup mechanism
adam900710 Jul 20, 2026
8a599f4
btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
adam900710 Jul 20, 2026
e6bef2d
crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown
ashkalra Jul 20, 2026
1d94489
crypto: ccp - Reset TMR size at SNP Shutdown
ashkalra Jul 20, 2026
8241b0f
crypto: ccp - Register SNP panic notifier only if SNP is enabled
ashkalra Jul 20, 2026
bb1c846
crypto: ccp - Move SEV/SNP Platform initialization to KVM
ashkalra Jul 20, 2026
f58d81b
crypto: ccp - Fix a case where SNP_SHUTDOWN is missed
tlendacky Jul 20, 2026
345a6e8
crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
tych0 Jul 20, 2026
ec68c58
crypto: qat - fix restarting state leak on allocation failure
Ahsan-Atta Jul 20, 2026
147b4ac
exfat: remove unnecessary read entry in __exfat_rename()
YuezhangMo Jul 21, 2026
326d88b
exfat: rename argument name for exfat_move_file and exfat_rename_file
YuezhangMo Jul 21, 2026
a96b9d5
exfat: add exfat_get_dentry_set_by_ei() helper
YuezhangMo Jul 21, 2026
53d8503
exfat: move exfat_chain_set() out of __exfat_resolve_path()
YuezhangMo Jul 21, 2026
eb24ce4
exfat: fix incorrect directory checksum after rename to shorter name
Jul 21, 2026
5b7e619
exfat: preserve benign secondary entries during rename and move
Rochan-A Jul 21, 2026
5032366
btrfs: fix false IO failure after falling back to buffered write
adam900710 Jul 20, 2026
ccd5c23
btrfs: fix incorrect buffered IO fallback for append direct writes
adam900710 Jul 20, 2026
5023006
slab: Introduce kmalloc_obj() and family
kees Jul 17, 2026
5be0cae
slab: Introduce kmalloc_flex() and family
kees Jul 17, 2026
62554fc
add default_gfp() helper macro and use it in the new *alloc_obj() hel…
torvalds Jul 17, 2026
9418329
default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
torvalds Jul 17, 2026
84c0fd0
slab: recognize @GFP parameter as optional in kernel-doc
rddunlap Jul 17, 2026
eff3932
fscrypt: Fix key setup in edge case with multiple data unit sizes
Jul 17, 2026
6f25c42
fscrypt: Replace mk_users keyring with simple list
Jul 17, 2026
9132c7e
selftests/fs/statmount: build with tools include dir
amir73il May 9, 2025
ea07e04
mm/damon/core: always put unsuccessfully committed target pids
sjp38 Jun 5, 2026
e01071e
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
Jun 27, 2026
490569e
KVM: arm64: Ensure level is always initialized when relaxing perms
Jul 1, 2026
fb20b22
KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax…
Jul 7, 2026
de984ea
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uniniti…
mattbobrowski Jun 28, 2026
90843d0
perf/x86/amd/brs: Fix kernel address leakage
sandip4n Jul 10, 2026
ee188a6
dibs: loopback: validate offset and size in move_data()
Jul 7, 2026
f79f4c6
seqlock: fix scoped_seqlock_read kernel-doc
rddunlap Jan 23, 2026
9bcf33a
ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
dhkts1 May 28, 2026
17677de
rtnetlink: Make per-netns RTNL dereference helpers to macro.
q2ven Oct 21, 2024
4c60634
net: airoha: Fix channel configuration for ETS Qdisc
LorenzoBianconi Jan 7, 2025
b17b73e
jiffies: Cast to unsigned long in secs_to_jiffies() conversion
easwarh Jan 30, 2025
fa9088f
afs: Fix afs_atcell_get_link() to check if ws_cell is unset first
dhowells Mar 18, 2025
6fcc6d6
afs: Fix afs_dynroot_readdir() to not use the RCU read lock
dhowells Apr 8, 2025
5296915
crypto: ccp - Fix __sev_snp_shutdown_locked
ashkalra Apr 9, 2025
26eb4fc
crypto: ccp - Fix dereferencing uninitialized error pointer
ashkalra May 28, 2025
a802a39
crypto: ccp - Fix SNP panic notifier unregistration
ashkalra Jun 16, 2025
bb144f3
udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv()
Jun 23, 2025
1f92fe6
Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_look…
Vudentz Jun 30, 2025
9afab16
Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
Vudentz Jul 3, 2025
fa30d62
crypto: ccp - Always pass in an error pointer to __sev_platform_shutd…
bp3tk0v Sep 6, 2025
d092d3e
i40e: drop udp_tunnel_get_rx_info() call from i40e_open()
mohammadheib Dec 28, 2025
ae66350
ice: drop udp_tunnel_get_rx_info() call from ndo_open()
mohammadheib Dec 28, 2025
9b109a9
crypto: ccp - Fix leaking the same page twice
groeck Mar 4, 2026
e749dc7
Bluetooth: L2CAP: Fix regressions caused by reusing ident
Vudentz Mar 17, 2026
c2159e5
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote n…
Vudentz Jun 12, 2026
bd1e011
Bluetooth: L2CAP: fix tx ident leak for commands without a response
hornang Jun 12, 2026
66fbe04
dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
ivecera Jul 10, 2026
2d1f28d
tools/testing: add linux/args.h header and fix radix, VMA tests
ljskernel Jul 23, 2026
a45b927
selftests/bpf: Add simple strscpy() implementation
theihor Jul 23, 2026
0fdd406
Linux 6.12.97
gregkh Jul 24, 2026
913e7b4
ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation
zhouyun1306 Jul 25, 2026
588b2d2
Linux 6.12.98
gregkh Jul 25, 2026
41fb1f3
mm: refactor mm_access() to not return NULL
ljskernel Sep 24, 2024
720e8bc
Linux 6.12.99
gregkh Jul 29, 2026
e74443f
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
Jul 25, 2026
52a355b
Linux 6.12.100
gregkh Jul 30, 2026
e6763b7
Merge remote-tracking branch 'stable/linux-6.12.y' into v6.12-rt
igaw Aug 1, 2026
124fe88
v6.12.100-rt20
igaw Aug 1, 2026
34b8410
Merge tag 'v6.12.100-rt20' into rt-kernel-upgrade
jatinjb444 Aug 11, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
6 changes: 3 additions & 3 deletions Documentation/admin-guide/pm/cpufreq.rst
Original file line number Diff line number Diff line change
Expand Up @@ -503,7 +503,7 @@ This governor exposes the following tunables:
of those tasks above 0 and set this attribute to 1.

``sampling_down_factor``
Temporary multiplier, between 1 (default) and 100 inclusive, to apply to
Temporary multiplier, between 1 (default) and 100000 inclusive, to apply to
the ``sampling_rate`` value if the CPU load goes above ``up_threshold``.

This causes the next execution of the governor's worker routine (after
Expand Down Expand Up @@ -573,8 +573,8 @@ This governor exposes the following tunables:
100 (5 by default).

This is how much the frequency is allowed to change in one go. Setting
it to 0 will cause the default frequency step (5 percent) to be used
and setting it to 100 effectively causes the governor to periodically
it to 0 disables frequency changes by the governor entirely and setting
it to 100 effectively causes the governor to periodically
switch the frequency between the ``scaling_min_freq`` and
``scaling_max_freq`` policy limits.

Expand Down
6 changes: 6 additions & 0 deletions Documentation/core-api/workqueue.rst
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,12 @@ resources, scheduled and executed.
BH work items cannot sleep. All other features such as delayed queueing,
flushing and canceling are supported.

``WQ_PERCPU``
Work items queued to a per-cpu wq are bound to a specific CPU.
This flag is the right choice when cpu locality is important.

This flag is the complement of ``WQ_UNBOUND``.

``WQ_UNBOUND``
Work items queued to an unbound wq are served by the special
worker-pools which host workers which are not bound to any
Expand Down
31 changes: 4 additions & 27 deletions Documentation/crypto/userspace-if.rst
Original file line number Diff line number Diff line change
Expand Up @@ -328,33 +328,10 @@ CRYPTO_USER_API_RNG_CAVP option:
Zero-Copy Interface
-------------------

In addition to the send/write/read/recv system call family, the AF_ALG
interface can be accessed with the zero-copy interface of
splice/vmsplice. As the name indicates, the kernel tries to avoid a copy
operation into kernel space.

The zero-copy operation requires data to be aligned at the page
boundary. Non-aligned data can be used as well, but may require more
operations of the kernel which would defeat the speed gains obtained
from the zero-copy interface.

The system-inherent limit for the size of one zero-copy operation is 16
pages. If more data is to be sent to AF_ALG, user space must slice the
input into segments with a maximum size of 16 pages.

Zero-copy can be used with the following code example (a complete
working example is provided with libkcapi):

::

int pipes[2];

pipe(pipes);
/* input data in iov */
vmsplice(pipes[1], iov, iovlen, SPLICE_F_GIFT);
/* opfd is the file descriptor returned from accept() system call */
splice(pipes[0], NULL, opfd, NULL, ret, 0);
read(opfd, out, outlen);
AF_ALG used to have zero-copy support, but it was removed due to it being a
frequent source of vulnerabilities. For backwards compatibility the splice()
and sendfile() system calls are still supported, but the kernel will make an
internal copy of the data before passing it to the crypto code.


Setsockopt Interface
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,16 @@ properties:
CMA pool to use for buffers allocation instead of the default
CMA pool.

# FIXME: This should be made required eventually once every SoC will
# have the MBUS declared.
interconnects:
maxItems: 1

# FIXME: This should be made required eventually once every SoC will
# have the MBUS declared.
interconnect-names:
const: dma-mem

required:
- compatible
- reg
Expand Down
3 changes: 1 addition & 2 deletions Documentation/devicetree/bindings/net/renesas,ether.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -118,8 +118,7 @@ examples:
#size-cells = <0>;

phy1: ethernet-phy@1 {
compatible = "ethernet-phy-id0022.1537",
"ethernet-phy-ieee802.3-c22";
compatible = "ethernet-phy-id0022.1537";
reg = <1>;
interrupt-parent = <&irqc0>;
interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,10 @@ patternProperties:
drive_soc_gpio27_pee6, drive_ao_retention_n_pee2,
drive_vcomp_alert_pee1, drive_hdmi_cec_pgg0 ]

required:
- compatible
- reg

unevaluatedProperties: false

examples:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,10 @@ patternProperties:
drive_sdmmc1_dat2_pj4, drive_sdmmc1_dat1_pj3,
drive_sdmmc1_dat0_pj2 ]

required:
- compatible
- reg

unevaluatedProperties: false

examples:
Expand Down
43 changes: 0 additions & 43 deletions Documentation/devicetree/bindings/regulator/mt6359-regulator.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,84 +18,41 @@ patternProperties:
"^buck_v(s1|gpu11|modem|pu|core|s2|pa|proc2|proc1|core_sshub)$":
type: object
$ref: regulator.yaml#

properties:
regulator-name:
pattern: "^v(s1|gpu11|modem|pu|core|s2|pa|proc2|proc1|core_sshub)$"

unevaluatedProperties: false

"^ldo_v(ibr|rf12|usb|camio|efuse|xo22)$":
type: object
$ref: regulator.yaml#

properties:
regulator-name:
pattern: "^v(ibr|rf12|usb|camio|efuse|xo22)$"

unevaluatedProperties: false

"^ldo_v(rfck|emc|a12|a09|ufs|bbck)$":
type: object
$ref: regulator.yaml#

properties:
regulator-name:
pattern: "^v(rfck|emc|a12|a09|ufs|bbck)$"

unevaluatedProperties: false

"^ldo_vcn(18|13|33_1_bt|13_1_wifi|33_2_bt|33_2_wifi)$":
type: object
$ref: regulator.yaml#

properties:
regulator-name:
pattern: "^vcn(18|13|33_1_bt|13_1_wifi|33_2_bt|33_2_wifi)$"

unevaluatedProperties: false

"^ldo_vsram_(proc2|others|md|proc1|others_sshub)$":
type: object
$ref: regulator.yaml#

properties:
regulator-name:
pattern: "^vsram_(proc2|others|md|proc1|others_sshub)$"

unevaluatedProperties: false

"^ldo_v(fe|bif|io)28$":
type: object
$ref: regulator.yaml#

properties:
regulator-name:
pattern: "^v(fe|bif|io)28$"

unevaluatedProperties: false

"^ldo_v(aud|io|aux|rf|m)18$":
type: object
$ref: regulator.yaml#

properties:
regulator-name:
pattern: "^v(aud|io|aux|rf|m)18$"

unevaluatedProperties: false

"^ldo_vsim[12]$":
type: object
$ref: regulator.yaml#

properties:
regulator-name:
pattern: "^vsim[12]$"

required:
- regulator-name

unevaluatedProperties: false

additionalProperties: false
Expand Down
25 changes: 25 additions & 0 deletions Documentation/driver-api/dpll.rst
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,31 @@ the pin.
``DPLL_A_PIN_ESYNC_PULSE`` pulse type of Embedded SYNC
========================================= =================================

Reference SYNC
==============

The device may support the Reference SYNC feature, which allows the combination
of two inputs into a input pair. In this configuration, clock signals
from both inputs are used to synchronize the DPLL device. The higher frequency
signal is utilized for the loop bandwidth of the DPLL, while the lower frequency
signal is used to syntonize the output signal of the DPLL device. This feature
enables the provision of a high-quality loop bandwidth signal from an external
source.

A capable input provides a list of inputs that can be bound with to create
Reference SYNC. To control this feature, the user must request a desired
state for a target pin: use ``DPLL_PIN_STATE_CONNECTED`` to enable or
``DPLL_PIN_STATE_DISCONNECTED`` to disable the feature. An input pin can be
bound to only one other pin at any given time.

============================== ==========================================
``DPLL_A_PIN_REFERENCE_SYNC`` nested attribute for providing info or
requesting configuration of the Reference
SYNC feature
``DPLL_A_PIN_ID`` target pin id for Reference SYNC feature
``DPLL_A_PIN_STATE`` state of Reference SYNC connection
============================== ==========================================

Configuration commands group
============================

Expand Down
5 changes: 2 additions & 3 deletions Documentation/driver-api/nvdimm/btt.rst
Original file line number Diff line number Diff line change
Expand Up @@ -161,9 +161,8 @@ process::
nlanes = min(nfree, num_cpus)

A lane number is obtained at the start of any IO, and is used for indexing into
all the on-disk and in-memory data structures for the duration of the IO. If
there are more CPUs than the max number of available lanes, than lanes are
protected by spinlocks.
all the on-disk and in-memory data structures for the duration of the IO. Lanes
are protected by mutexes.


d. In-memory data structure: Read Tracking Table (RTT)
Expand Down
3 changes: 3 additions & 0 deletions Documentation/driver-api/pci/pci.rst
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ PCI Support Library
.. kernel-doc:: drivers/pci/slot.c
:export:

.. kernel-doc:: drivers/pci/rebar.c
:export:

.. kernel-doc:: drivers/pci/rom.c
:export:

Expand Down
14 changes: 7 additions & 7 deletions Documentation/filesystems/proc.rst
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,13 @@ fixes/update part 1.1 Stefani Seibold <stefani@seibold.net> June 9 2009
1 Collecting System Information
1.1 Process-Specific Subdirectories
1.2 Kernel data
1.3 IDE devices in /proc/ide
1.4 Networking info in /proc/net
1.5 SCSI info
1.6 Parallel port info in /proc/parport
1.7 TTY info in /proc/tty
1.8 Miscellaneous kernel statistics in /proc/stat
1.9 Ext4 file system parameters
1.3 Networking info in /proc/net
1.4 SCSI info
1.5 Parallel port info in /proc/parport
1.6 TTY info in /proc/tty
1.7 Miscellaneous kernel statistics in /proc/stat
1.8 Ext4 file system parameters
1.9 /proc/consoles - Shows registered system consoles

2 Modifying System Parameters

Expand Down
19 changes: 19 additions & 0 deletions Documentation/netlink/specs/dpll.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,15 @@ attribute-sets:
doc: |
A ratio of high to low state of a SYNC signal pulse embedded
into base clock frequency. Value is in percents.
-
name: reference-sync
type: nest
multi-attr: true
nested-attributes: reference-sync
doc: |
Capable pin provides list of pins that can be bound to create a
reference-sync pin pair.

-
name: pin-parent-device
subset-of: pin
Expand Down Expand Up @@ -395,6 +404,14 @@ attribute-sets:
name: frequency-min
-
name: frequency-max
-
name: reference-sync
subset-of: pin
attributes:
-
name: id
-
name: state

operations:
enum-name: dpll_cmd
Expand Down Expand Up @@ -535,6 +552,7 @@ operations:
- esync-frequency
- esync-frequency-supported
- esync-pulse
- reference-sync

dump:
request:
Expand Down Expand Up @@ -562,6 +580,7 @@ operations:
- parent-pin
- phase-adjust
- esync-frequency
- reference-sync
-
name: pin-create-ntf
doc: Notification about pin appearing
Expand Down
1 change: 1 addition & 0 deletions Documentation/netlink/specs/handshake.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@ operations:
name: done
doc: Handler reports handshake completion
attribute-set: done
flags: [admin-perm]
do:
request:
attributes:
Expand Down
15 changes: 15 additions & 0 deletions Documentation/networking/bonding.rst
Original file line number Diff line number Diff line change
Expand Up @@ -193,6 +193,15 @@ ad_actor_sys_prio
This parameter has effect only in 802.3ad mode and is available through
SysFs interface.

actor_port_prio

In an AD system, this specifies the port priority. The allowed range
is 1 - 65535. If the value is not specified, it takes 255 as the
default value.

This parameter has effect only in 802.3ad mode and is available through
netlink interface.

ad_actor_system

In an AD system, this specifies the mac-address for the actor in
Expand Down Expand Up @@ -562,6 +571,12 @@ lacp_rate

The default is slow.

broadcast_neighbor

Option specifying whether to broadcast ARP/ND packets to all
active slaves. This option has no effect in modes other than
802.3ad mode. The default is off (0).

max_bonds

Specifies the number of bonding devices to create for this
Expand Down
31 changes: 31 additions & 0 deletions Documentation/process/deprecated.rst
Original file line number Diff line number Diff line change
Expand Up @@ -372,3 +372,34 @@ The helper must be used::
DECLARE_FLEX_ARRAY(struct type2, two);
};
};

Open-coded kmalloc assignments for struct objects
-------------------------------------------------
Performing open-coded kmalloc()-family allocation assignments prevents
the kernel (and compiler) from being able to examine the type of the
variable being assigned, which limits any related introspection that
may help with alignment, wrap-around, or additional hardening. The
kmalloc_obj()-family of macros provide this introspection, which can be
used for the common code patterns for single, array, and flexible object
allocations. For example, these open coded assignments::

ptr = kmalloc(sizeof(*ptr), gfp);
ptr = kzalloc(sizeof(*ptr), gfp);
ptr = kmalloc_array(count, sizeof(*ptr), gfp);
ptr = kcalloc(count, sizeof(*ptr), gfp);
ptr = kmalloc(struct_size(ptr, flex_member, count), gfp);
ptr = kmalloc(sizeof(struct foo, gfp);

become, respectively::

ptr = kmalloc_obj(*ptr, gfp);
ptr = kzalloc_obj(*ptr, gfp);
ptr = kmalloc_objs(*ptr, count, gfp);
ptr = kzalloc_objs(*ptr, count, gfp);
ptr = kmalloc_flex(*ptr, flex_member, count, gfp);
__auto_type ptr = kmalloc_obj(struct foo, gfp);

If `ptr->flex_member` is annotated with __counted_by(), the allocation
will automatically fail if `count` is larger than the maximum
representable value that can be stored in the counter member associated
with `flex_member`.
Loading
Loading