From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, akpm@linux-foundation.org,
torvalds@linux-foundation.org, stable@vger.kernel.org
Cc: lwn@lwn.net, jslaby@suse.cz,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: Linux 7.3.2
Date: Fri, 6 Nov 2026 12:17:45 -0500 [thread overview]
Message-ID: <2026110646-extruding-blitz-b2bc@gregkh> (raw)
I'm announcing the release of the 7.3.2 kernel.
All users of the 7.3 kernel series must upgrade.
The updated 7.3.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-7.3.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/devicetree/bindings/interrupt-controller/arm,gic-v5.yaml | 9
Documentation/networking/rxrpc.rst | 21
Makefile | 2
arch/arm/mm/mmap.c | 11
arch/powerpc/kvm/book3s_hv.c | 76
arch/powerpc/kvm/book3s_paired_singles.c | 7
arch/s390/kernel/kprobes.c | 3
arch/s390/kernel/perf_cpum_cf.c | 3
arch/s390/kernel/process.c | 12
arch/s390/kernel/signal.c | 6
arch/s390/lib/probes.c | 2
arch/s390/mm/extable.c | 4
arch/s390/pci/pci_irq.c | 93 -
arch/x86/include/asm/cpufeatures.h | 1
arch/x86/include/asm/cpuid/api.h | 1
arch/x86/include/asm/kvm-x86-ops.h | 1
arch/x86/include/asm/kvm_host.h | 7
arch/x86/include/asm/vmx.h | 8
arch/x86/kernel/cpu/bugs.c | 18
arch/x86/kernel/cpu/scattered.c | 1
arch/x86/kvm/hyperv.c | 2
arch/x86/kvm/mmu/mmu.c | 5
arch/x86/kvm/mmu/paging_tmpl.h | 13
arch/x86/kvm/svm/nested.c | 6
arch/x86/kvm/svm/svm.c | 19
arch/x86/kvm/vmx/common.h | 20
arch/x86/kvm/vmx/main.c | 26
arch/x86/kvm/vmx/posted_intr.c | 2
arch/x86/kvm/vmx/tdx.c | 92 -
arch/x86/kvm/vmx/vmx.c | 37
arch/x86/kvm/vmx/x86_ops.h | 1
arch/x86/kvm/x86.c | 69
arch/x86/kvm/xen.c | 18
arch/x86/mm/pat/set_memory.c | 8
block/blk-crypto-fallback.c | 6
drivers/accel/amdxdna/aie2_message.c | 1
drivers/accel/amdxdna/aie2_msg_priv.h | 1
drivers/accel/amdxdna/npu4_regs.c | 1
drivers/android/binder/thread.rs | 38
drivers/ata/sata_fsl.c | 18
drivers/base/base.h | 1
drivers/base/bus.c | 32
drivers/base/core.c | 4
drivers/base/dd.c | 90 -
drivers/block/xen-blkfront.c | 12
drivers/bluetooth/hci_vhci.c | 4
drivers/clk/renesas/r9a08g046-cpg.c | 6
drivers/cpufreq/rcpufreq_dt.rs | 1
drivers/gpu/drm/msm/msm_gem_shrinker.c | 3
drivers/gpu/drm/panthor/panthor_sched.c | 14
drivers/hid/amd-sfh-hid/amd_sfh_client.c | 4
drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.h | 2
drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_report_desc.h | 7
drivers/hid/hid-asus.c | 14
drivers/hid/hid-core.c | 4
drivers/hid/hid-cougar.c | 3
drivers/hid/hid-cp2112.c | 9
drivers/hid/hid-elo.c | 3
drivers/hid/hid-ids.h | 1
drivers/hid/hid-lenovo-go-s.c | 655 +++++--
drivers/hid/hid-logitech-dj.c | 3
drivers/hid/hid-mcp2200.c | 5
drivers/hid/hid-mcp2221.c | 10
drivers/hid/hid-picolcd_fb.c | 12
drivers/hid/hid-prodikeys.c | 7
drivers/hid/hid-pxrc.c | 3
drivers/hid/hid-quirks.c | 1
drivers/hid/hid-roccat-isku.c | 3
drivers/hid/hid-roccat-koneplus.c | 3
drivers/hid/hid-roccat-konepure.c | 3
drivers/hid/hid-roccat-kovaplus.c | 3
drivers/hid/hid-roccat-pyra.c | 3
drivers/hid/hid-roccat-ryos.c | 3
drivers/hid/hid-roccat-savu.c | 3
drivers/hid/hid-zydacron.c | 3
drivers/hid/usbhid/hid-core.c | 9
drivers/hid/usbhid/hiddev.c | 37
drivers/hid/wacom_sys.c | 198 +-
drivers/hid/wacom_wac.c | 99 -
drivers/hid/wacom_wac.h | 6
drivers/hv/mshv_vtl_main.c | 28
drivers/hv/ring_buffer.c | 29
drivers/infiniband/core/ib_core_uverbs.c | 10
drivers/infiniband/core/uverbs.h | 37
drivers/infiniband/core/uverbs_std_types_dmabuf.c | 39
drivers/infiniband/hw/irdma/icrdma_if.c | 9
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2
drivers/iommu/iommufd/eventq.c | 4
drivers/irqchip/irq-gic-v5-irs.c | 4
drivers/media/pci/cx23885/cx23885-core.c | 4
drivers/media/pci/cx23885/cx23885-dvb.c | 14
drivers/media/pci/cx88/cx88-mpeg.c | 9
drivers/media/pci/intel/ipu-bridge.c | 2
drivers/media/platform/marvell/mcam-core.c | 14
drivers/media/platform/microchip/microchip-csi2dc.c | 1
drivers/media/platform/microchip/microchip-isc-base.c | 6
drivers/media/platform/microchip/microchip-sama5d2-isc.c | 17
drivers/media/platform/microchip/microchip-sama7g5-isc.c | 17
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2
drivers/media/platform/samsung/s5p-mfc/s5p_mfc.c | 4
drivers/media/rc/bpf-lirc.c | 18
drivers/media/rc/fintek-cir.c | 4
drivers/media/rc/imon.c | 5
drivers/media/rc/ir-mce_kbd-decoder.c | 5
drivers/media/rc/lirc_dev.c | 3
drivers/media/rc/rc-ir-raw.c | 86
drivers/media/rc/rc-main.c | 61
drivers/media/rc/redrat3.c | 4
drivers/media/usb/au0828/au0828-dvb.c | 1
drivers/media/usb/em28xx/em28xx-audio.c | 7
drivers/media/usb/go7007/go7007-driver.c | 5
drivers/media/usb/gspca/gspca.c | 3
drivers/media/usb/hackrf/hackrf.c | 7
drivers/media/usb/usbtv/usbtv-core.c | 2
drivers/media/usb/usbtv/usbtv-video.c | 4
drivers/mtd/mtd_virt_concat.c | 2
drivers/net/tun.c | 14
drivers/net/usb/pegasus.c | 6
drivers/net/virtio_net.c | 26
drivers/net/wireless/ath/ath12k/core.c | 2
drivers/net/wireless/ath/ath12k/core.h | 9
drivers/net/wireless/ath/ath12k/dp.c | 81
drivers/net/wireless/ath/ath12k/dp.h | 108 -
drivers/net/wireless/ath/ath12k/dp_rx.c | 14
drivers/net/wireless/ath/ath12k/mac.c | 5
drivers/net/wireless/ath/ath12k/wifi7/dp_tx.c | 12
drivers/net/wireless/ath/ath9k/channel.c | 2
drivers/net/wireless/broadcom/b43/main.c | 5
drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 1
drivers/net/wireless/mediatek/mt76/mt7925/regs.h | 3
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4
drivers/net/wwan/wwan_hwsim.c | 4
drivers/nvme/target/auth.c | 1
drivers/nvme/target/fabrics-cmd-auth.c | 32
drivers/nvme/target/fc.c | 8
drivers/nvme/target/nvmet.h | 2
drivers/nvme/target/pr.c | 2
drivers/nvmem/core.c | 4
drivers/phy/phy-core.c | 45
drivers/platform/cznic/turris-omnia-mcu-base.c | 1
drivers/platform/x86/amd/hfi/hfi.c | 5
drivers/platform/x86/asus-wmi.c | 12
drivers/power/supply/pf1550-charger.c | 32
drivers/power/supply/sbs-battery.c | 11
drivers/pps/generators/pps_gen.c | 94 -
drivers/rapidio/devices/rio_mport_cdev.c | 5
drivers/s390/char/vmcp.c | 4
drivers/s390/crypto/zcrypt_api.c | 35
drivers/s390/crypto/zcrypt_ccamisc.c | 22
drivers/s390/crypto/zcrypt_msgtype50.c | 95 -
drivers/s390/crypto/zcrypt_msgtype6.c | 202 +-
drivers/scsi/dc395x.c | 10
drivers/spi/spi-pci1xxxx.c | 71
drivers/spmi/spmi.c | 3
drivers/staging/rtl8723bs/core/rtw_recv.c | 21
drivers/thunderbolt/icm.c | 6
drivers/tty/serial/serial_core.c | 16
drivers/usb/core/driver.c | 1
drivers/usb/core/message.c | 1
drivers/usb/gadget/legacy/inode.c | 3
drivers/vfio/pci/nvgrace-gpu/main.c | 17
drivers/video/backlight/lm3630a_bl.c | 1
drivers/video/backlight/qcom-wled.c | 35
drivers/video/fbdev/atmel_lcdfb.c | 11
drivers/video/fbdev/udlfb.c | 5
fs/afs/rxrpc.c | 57
fs/btrfs/verity.c | 7
fs/ceph/dir.c | 4
fs/exec.c | 11
fs/ext4/verity.c | 4
fs/fuse/dev.c | 3
fs/iomap/ioend.c | 10
fs/kernfs/mount.c | 32
fs/lockd/svclock.c | 2
fs/nfs/blocklayout/blocklayout.h | 5
fs/nfs/blocklayout/rpc_pipefs.c | 79
fs/nfs/callback_xdr.c | 9
fs/nfs/delegation.c | 3
fs/nfs/dir.c | 2
fs/nfs/filelayout/filelayout.c | 8
fs/nfs/filelayout/filelayoutdev.c | 17
fs/nfs/flexfilelayout/flexfilelayout.c | 52
fs/nfs/flexfilelayout/flexfilelayout.h | 2
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 17
fs/nfs/localio.c | 31
fs/nfs/netns.h | 5
fs/nfs/nfs4_fs.h | 2
fs/nfs/nfs4proc.c | 8
fs/nfs/nfs4state.c | 38
fs/nfs/nfstrace.h | 5
fs/nfs/pnfs.c | 2
fs/nfs/pnfs.h | 1
fs/nfs/pnfs_nfs.c | 21
fs/nfsd/filecache.c | 4
fs/nfsd/flexfilelayout.c | 20
fs/nfsd/flexfilelayoutxdr.c | 4
fs/nfsd/flexfilelayoutxdr.h | 5
fs/nfsd/nfs3acl.c | 15
fs/nfsd/nfs4idmap.c | 4
fs/nfsd/nfs4layouts.c | 4
fs/nfsd/nfs4proc.c | 4
fs/nfsd/nfs4recover.c | 42
fs/nfsd/nfs4state.c | 250 ++
fs/nfsd/nfs4xdr.c | 26
fs/nfsd/nfsctl.c | 73
fs/nfsd/nfsproc.c | 19
fs/nfsd/state.h | 13
fs/nfsd/xdr4.h | 1
fs/ocfs2/cluster/heartbeat.c | 13
fs/ocfs2/cluster/netdebug.c | 4
fs/ocfs2/cluster/nodemanager.c | 3
fs/ocfs2/cluster/quorum.c | 7
fs/ocfs2/cluster/quorum.h | 1
fs/ocfs2/dlm/dlmconvert.c | 10
fs/ocfs2/dlm/dlmdebug.c | 5
fs/ocfs2/dlm/dlmdomain.c | 3
fs/ocfs2/dlm/dlmlock.c | 8
fs/ocfs2/dlmglue.c | 2
fs/ocfs2/file.c | 100 -
fs/ocfs2/filecheck.c | 5
fs/ocfs2/quota_local.c | 12
fs/ocfs2/refcounttree.c | 15
fs/ocfs2/super.c | 1
fs/overlayfs/copy_up.c | 110 -
fs/overlayfs/dir.c | 22
fs/overlayfs/inode.c | 16
fs/overlayfs/namei.c | 11
fs/overlayfs/overlayfs.h | 8
fs/overlayfs/readdir.c | 40
fs/overlayfs/super.c | 31
fs/proc/task_mmu.c | 9
fs/smb/client/cached_dir.c | 30
fs/smb/client/cifsacl.c | 9
fs/smb/client/cifsfs.c | 20
fs/smb/client/cifsglob.h | 2
fs/smb/client/cifsproto.h | 1
fs/smb/client/cifssmb.c | 152 +
fs/smb/client/connect.c | 40
fs/smb/client/inode.c | 4
fs/smb/client/readdir.c | 69
fs/smb/client/sess.c | 6
fs/smb/client/smb2misc.c | 16
fs/smb/client/smb2ops.c | 37
fs/smb/client/smb2pdu.c | 46
fs/smb/client/trace.h | 3
fs/smb/client/transport.c | 2
fs/smb/common/smbglob.h | 1
fs/smb/server/auth.c | 6
fs/smb/server/compress.c | 1
fs/smb/server/connection.c | 55
fs/smb/server/connection.h | 26
fs/smb/server/ksmbd_netlink.h | 8
fs/smb/server/ksmbd_work.c | 19
fs/smb/server/ksmbd_work.h | 2
fs/smb/server/mgmt/user_session.c | 202 +-
fs/smb/server/mgmt/user_session.h | 12
fs/smb/server/misc.c | 8
fs/smb/server/oplock.c | 875 +++++-----
fs/smb/server/oplock.h | 14
fs/smb/server/proc.c | 2
fs/smb/server/server.c | 23
fs/smb/server/server.h | 3
fs/smb/server/smb2misc.c | 8
fs/smb/server/smb2ops.c | 33
fs/smb/server/smb2pdu.c | 372 +++-
fs/smb/server/smb2pdu.h | 1
fs/smb/server/smb_common.c | 6
fs/smb/server/smbacl.c | 49
fs/smb/server/transport_ipc.c | 23
fs/smb/server/transport_tcp.c | 308 +++
fs/smb/server/vfs.c | 107 +
fs/smb/server/vfs.h | 3
fs/smb/server/vfs_cache.c | 261 +-
fs/smb/server/vfs_cache.h | 12
fs/smb/smbdirect/accept.c | 225 +-
fs/smb/smbdirect/connection.c | 12
fs/smb/smbdirect/internal.h | 2
fs/smb/smbdirect/listen.c | 137 +
fs/smb/smbdirect/rw.c | 1
fs/smb/smbdirect/socket.c | 113 +
fs/smb/smbdirect/socket.h | 42
fs/udf/inode.c | 2
fs/ufs/dir.c | 2
fs/verity/enable.c | 12
fs/xfs/libxfs/xfs_attr_leaf.c | 13
fs/xfs/libxfs/xfs_da_btree.c | 14
fs/xfs/libxfs/xfs_inode_fork.c | 4
fs/xfs/libxfs/xfs_symlink_remote.c | 8
fs/xfs/libxfs/xfs_symlink_remote.h | 2
fs/xfs/libxfs/xfs_trans_space.c | 6
fs/xfs/scrub/agheader_repair.c | 13
fs/xfs/scrub/alloc_repair.c | 11
fs/xfs/scrub/attr.c | 17
fs/xfs/scrub/attr_repair.c | 18
fs/xfs/scrub/bitmap.c | 20
fs/xfs/scrub/bmap.c | 7
fs/xfs/scrub/btree.c | 16
fs/xfs/scrub/common.c | 7
fs/xfs/scrub/cow_repair.c | 84
fs/xfs/scrub/dabtree.c | 27
fs/xfs/scrub/dir.c | 2
fs/xfs/scrub/dir_repair.c | 9
fs/xfs/scrub/dirtree.c | 4
fs/xfs/scrub/dirtree_repair.c | 76
fs/xfs/scrub/dqiterate.c | 1
fs/xfs/scrub/fscounters.c | 38
fs/xfs/scrub/ialloc_repair.c | 8
fs/xfs/scrub/inode.c | 2
fs/xfs/scrub/inode_repair.c | 181 ++
fs/xfs/scrub/iscan.c | 2
fs/xfs/scrub/metapath.c | 17
fs/xfs/scrub/newbt.c | 15
fs/xfs/scrub/newbt.h | 1
fs/xfs/scrub/parent_repair.c | 4
fs/xfs/scrub/quota.c | 8
fs/xfs/scrub/quota_repair.c | 39
fs/xfs/scrub/quotacheck_repair.c | 54
fs/xfs/scrub/readdir.c | 2
fs/xfs/scrub/reap.c | 65
fs/xfs/scrub/refcount.c | 17
fs/xfs/scrub/repair.c | 18
fs/xfs/scrub/repair.h | 2
fs/xfs/scrub/rtbitmap_repair.c | 2
fs/xfs/scrub/rtrefcount.c | 2
fs/xfs/scrub/rtsummary.c | 9
fs/xfs/scrub/rtsummary.h | 1
fs/xfs/scrub/rtsummary_repair.c | 2
fs/xfs/scrub/stats.c | 5
fs/xfs/scrub/symlink.c | 17
fs/xfs/scrub/trace.c | 13
fs/xfs/scrub/trace.h | 10
fs/xfs/scrub/xfarray.c | 4
fs/xfs/xfs_dquot.c | 20
fs/xfs/xfs_dquot.h | 2
fs/xfs/xfs_handle.c | 2
fs/xfs/xfs_inode_item_recover.c | 20
fs/xfs/xfs_mount.c | 9
fs/xfs/xfs_pnfs.c | 19
fs/xfs/xfs_qm.c | 42
fs/xfs/xfs_quota.h | 9
fs/xfs/xfs_trans_dquot.c | 6
include/linux/device.h | 5
include/linux/device/bus.h | 3
include/linux/filelock.h | 13
include/linux/fsverity.h | 12
include/linux/hiddev.h | 2
include/linux/interrupt.h | 2
include/linux/io_uring_types.h | 6
include/linux/kvm_host.h | 2
include/linux/pps_gen_kernel.h | 4
include/net/af_rxrpc.h | 5
include/net/mptcp.h | 9
include/trace/events/huge_memory.h | 18
include/trace/events/rxrpc.h | 2
include/trace/misc/nfs.h | 10
io_uring/bpf-ops.c | 16
io_uring/cancel.c | 43
io_uring/cancel.h | 2
io_uring/fdinfo.c | 14
io_uring/futex.c | 32
io_uring/io-wq.c | 138 +
io_uring/io_uring.c | 174 +
io_uring/io_uring.h | 44
io_uring/kbuf.c | 6
io_uring/loop.c | 8
io_uring/mpscq.h | 14
io_uring/napi.c | 4
io_uring/net.c | 49
io_uring/openclose.c | 11
io_uring/poll.c | 21
io_uring/register.c | 61
io_uring/rsrc.c | 7
io_uring/rw.c | 18
io_uring/sqpoll.c | 35
io_uring/sqpoll.h | 3
io_uring/tctx.c | 9
io_uring/timeout.c | 105 -
io_uring/tw.c | 36
io_uring/uring_cmd.c | 2
io_uring/wait.c | 32
io_uring/wait.h | 15
io_uring/waitid.c | 12
io_uring/zcrx.c | 2
kernel/cgroup/cgroup.c | 28
kernel/fork.c | 4
kernel/irq/internals.h | 2
kernel/irq/manage.c | 31
kernel/kcov.c | 8
kernel/kcsan/core.c | 7
kernel/power/em_netlink.c | 122 -
kernel/power/em_netlink.h | 8
kernel/power/energy_model.c | 8
kernel/resource.c | 9
kernel/sched/ext/ext.c | 15
lib/klist.c | 16
lib/kobject_uevent.c | 6
mm/hugetlb.c | 15
mm/khugepaged.c | 21
mm/rmap.c | 11
mm/slab_common.c | 17
mm/truncate.c | 30
net/8021q/vlan_dev.c | 33
net/bluetooth/hci_event.c | 9
net/ceph/mon_client.c | 2
net/core/dev.c | 3
net/core/rtnetlink.c | 4
net/core/skbuff.c | 2
net/ipv4/inet_connection_sock.c | 4
net/ipv4/metrics.c | 5
net/mptcp/subflow.c | 35
net/netfilter/nft_payload.c | 40
net/rxrpc/recvmsg.c | 22
net/rxrpc/rxperf.c | 41
net/rxrpc/sendmsg.c | 86
net/sched/act_ife.c | 4
net/sched/cls_bpf.c | 28
net/sched/cls_flower.c | 50
net/sched/sch_generic.c | 14
net/sched/sch_teql.c | 60
net/sunrpc/auth_gss/svcauth_gss.c | 29
net/sunrpc/svc.c | 9
net/sunrpc/svc_xprt.c | 24
net/sunrpc/svcauth_unix.c | 9
net/sunrpc/svcsock.c | 86
rust/bindgen_parameters | 4
rust/bindings/bindings_helper.h | 2
rust/kernel/bitmap.rs | 70
rust/kernel/block/mq/gen_disk.rs | 10
rust/kernel/block/mq/operations.rs | 2
rust/kernel/bug.rs | 9
rust/kernel/configfs.rs | 43
rust/kernel/cpufreq.rs | 22
rust/kernel/fwctl.rs | 12
rust/kernel/module_param.rs | 9
security/apparmor/include/policy_ns.h | 16
security/apparmor/policy_ns.c | 2
security/landlock/fs.c | 10
sound/core/control.c | 2
sound/drivers/pcmtest.c | 42
sound/soc/amd/ps/acp63.h | 8
sound/soc/amd/ps/pci-ps.c | 2
sound/soc/amd/ps/ps-common.c | 2
sound/soc/generic/audio-graph-card2.c | 3
sound/synth/emux/emux_synth.c | 3
sound/synth/emux/soundfont.c | 9
sound/usb/line6/pcm.c | 8
sound/x86/intel_hdmi_audio.c | 9
tools/objtool/check.c | 1
virt/kvm/guest_memfd.c | 106 -
virt/kvm/guest_memfd.h | 19
virt/kvm/kvm_main.c | 75
virt/kvm/pfncache.c | 18
452 files changed, 8669 insertions(+), 3150 deletions(-)
Aamir Ahmed (1):
ksmbd: deny access for an empty DACL instead of granting the request
Aaradhana Sahu (8):
wifi: ath12k: move dp_profile_params to dp.h
wifi: ath12k: convert DP_TX_COMP_RING_SIZE to inline helper
wifi: ath12k: convert DP_RXDMA_MONITOR_BUF_RING_SIZE to inline helper
wifi: ath12k: convert DP_RXDMA_MONITOR_DST_RING_SIZE to inline helper
wifi: ath12k: convert ATH12K_NUM_POOL_TX_DESC to inline helper
wifi: ath12k: convert ATH12K_RX_DESC_COUNT to inline helper
wifi: ath12k: convert DP_RX_RELEASE_RING_SIZE to inline helper
wifi: ath12k: Make RXDMA buffer ring size configurable per memory profile
Abdifatah Suruur (4):
ksmbd: reserve space for the UTF-16 terminator in stream info
smb: client: fix fiemap wild read on empty truncated response
smb: client: reject short SESSION_SETUP responses
smb: client: validate the data area in SMB2_read()
Ahmed Yaseen (1):
HID: usbhid: skip interrupt IN polling for devices with no input reports
Alan Stern (1):
HID: core: Fix out-of-bounds left shift by 32 in s32ton()
Aldo Ariel Panzardo (8):
xfs: reject out-of-range attribute value lengths in xfs_attr_copy_value
xfs: reject remote xattr entries with an out-of-range value length
xfs: bound da-node entry count against the correct geometry
xfs: bound inode fork length against the fork size during log recovery
nfsd: clear XDR padding in GETXATTR replies
NFSD: copy SETXATTR data from all XDR buffer segments
nfsd: propagate SETXATTR value decode errors
nfsd: zero NFSv4 COMPOUND tag padding
Aleksandr Nogikh (1):
media: usbtv: fix null-pointer dereference on disconnect
Alice Ryhl (2):
rust: fwctl: declare cfi_encoding for fwctl_rpc_scope
rust_binder: wake epoll on self-work queued to poll thread
Ameer Hamza (4):
nfsd: fix race between client_info_show() and free_client()
nfsd: don't modify a session slot when replaying its cached reply
sunrpc: honor the netlink unix_gid NEGATIVE flag
sunrpc: treat empty auth.unix.gid replies as negative entries
Amir Goldstein (3):
ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN
ovl: fortify ovl_copy_xattr() against underlying layer modifications
ovl: skip copy up of empty security.capability
Amit Machhiwal (3):
KVM: PPC: Book3S HV: Add SRCU protection for virtual-mode HPT hcalls
KVM: PPC: Book3S HV: Add preempt_disable() around virtual-mode HPTE bit-lock users
KVM: PPC: Fix get_d_signext() 12-bit displacement for paired-single D-form
Andrea Parri (4):
kcsan: Avoid division by zero in kcsan_prandom_u32_max()
iomap: don't resubmit an ioend after ->writeback_submit() failed
vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
rtnetlink: wait for RCU readers in rtnl_link_unregister()
Andreas Hindborg (3):
rust: block: fix `Send` bound for `GenDisk`
rust: block: require `Sync` for `Operations::QueueData`
rust: configfs: fix data offset calculation for subsystem callbacks
Andreas Wendleder (1):
wifi: b43: fix use-after-free in b43_bcma_remove()
AngeloGioacchino Del Regno (1):
spmi: Fix potential use-after-free by grabbing of_node reference
Antonio Quartulli (1):
net/sched: fix packet reordering on requeue
Anuj Bolewar (1):
media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path
Balakrishnan Sambath (1):
media: microchip-isc: take a reference on the parsed endpoints
Baokun Li (1):
blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
Basavaraj Natikar (2):
HID: amd_sfh: Remove unsupported motion-state field from accelerometer report
HID: amd_sfh: Use report type from request node
Benjamin Coddington (9):
pNFS: Fix CB_NOTIFY_DEVICEID CHANGE to consume ndc_immediate
NFSv4/pnfs: bound the CB_NOTIFY_DEVICEID array count before allocating
NFSv4/pnfs: Free the netid when draining a data-server address list
NFSv4.1/pnfs: suspend pNFS on NFS4ERR_TOOSMALL from LAYOUTGET
NFSv4/filelayout: Anchor page coalescing on pattern_offset
NFSv4/flexfiles: fail I/O to the data server once a lock is lost
NFSv4/flexfiles: Use the full 64-bit offset for read DS selection
NFSv4/flexfiles: Use the full 64-bit stripe_unit
NFSv4/flexfiles: Bound page coalescing on the absolute stripe offset
Biju Das (1):
clk: renesas: r9a08g046: Propagate clk rate for ETH TX mux clocks
Binbin Deng (1):
apparmor: fix a use-after-free in aa_lookupn_ns()
Borislav Petkov (AMD) (1):
x86/bugs: Adapt SRSO mitigation to Zen6
Bryan O'Donoghue (1):
phy: core: Fix race-condition between _of_phy_get() and try_module_get()
Bui Viet Dung (2):
wwan: wwan_hwsim: Pin module for debugfs file operations
Bluetooth: hci_vhci: Pin module for debugfs file operations
Cen Zhang (9):
ocfs2/dlm: drain join handlers before releasing module text
ocfs2: drain quorum work before removing the cluster
ocfs2: pin owning modules for open debugfs files
ocfs2: publish the filecheck owner before adding sysfs attributes
ocfs2/heartbeat: unlink live slots when their node is missing
ocfs2/dlm: hold a lock reference across grant AST enqueue
ocfs2: cancel quota sync work before freeing quota info
ocfs2: pin refcount trees before dropping the lookup lock
ocfs2: snapshot dentry names in file and setattr traces
Cen Zhang (Microsoft Security FORGE Labs) (1):
nfsd: hold cl_lock in client_has_openowners()
Cen Zhang (Microsoft) (1):
ksmbd: fix parent dentry lifetime in directory enumeration
Cheng Yongkang (2):
io_uring/timeout: count cancelled timeouts in cq_timeouts
io_uring/net: fix multishot recv length limit accounting
Chengfeng Ye (1):
KVM: x86: Take SRCU in kvm_zap_gfn_range()
Chris Mason (19):
ovl: hold a reference on the parent in readdir
ovl: set OVL_WHITEOUTS before publishing the upper dir
ovl: take a snapshot of the name for copy up
ovl: use the pinned upper dir in ovl_fix_origin()
ovl: always encode the origin fh when index is enabled
ovl: check that the parents of volatile/dirty are dirs
ovl: check the casefold flag of directories only
ovl: do not copy up a dentry that was removed
ovl: do not copy up an xattr value that was never read
ovl: fix a torn path in ovl_get_redirect()
ovl: read the nlink xattr of every indexed non-dir
ovl: set the revalidate flags after d_instantiate()
sunrpc: pin gss module across auth_domain RCU free
io_uring/rsrc: charge buffer arrays and nodes to memcg
io_uring: charge tctx nodes and personalities
io_uring: free XArray nodes left by a failed store
io_uring/bpf-ops: clear bpf_ctx while submitting SQEs
io_uring: free the task context after a grace period
io_uring/sqpoll: don't wait for the thread to exit
Christian Borntraeger (1):
s390/vmcp: Initialize full session info to zero
Christian Brauner (3):
exec: cancel io_uring requests before de_thread()
fork: move the coredump and exec checks into create_io_thread()
fork: don't create io threads once PF_POSTCOREDUMP is set
Chuck Lever (20):
lockd: Fix use-after-free in nlmsvc_retry_blocked
pnfs/blocklayout: Complete a device upcall only on its own reply
pnfs/blocklayout: Complete a device upcall when the pipe is closed
NFSD: Destroy a recalled delegation the client does not hold
NFSD: Do not send CB_RECALL_ANY to NFSv4.0 clients
NFSD: Don't complete a cld upcall the daemon has not read
NFSD: Fail a pool_threads read whose reply does not fit
NFSD: Fix out-of-bounds read in the rpc_status dump
NFSD: map fh_verify() status codes for NFS_ACLv3 replies
NFSD: Map flex file layout IDs through the request's user namespace
NFSD: Reject an oversized principal hash from nfsdcld
NFSD: Resolve the recall-any mask names in the trace format
NFSD: Return NFSERR_ISDIR for NFSv2 READ and WRITE on a non-regular file
NFSD: Set nn->cld_net before registering the cld pipe
SUNRPC: Copy the deferred RPC Call from the head buffer
SUNRPC: Do not credit control-record octets to the RPC stream
SUNRPC: Reject a socket that already has an svc_sock attached
SUNRPC: Reject a TLS alert record that is not two octets
SUNRPC: Resume receiving after a TLS control record
SUNRPC: Treat every TLS error alert as fatal
Cong Nguyen (1):
media: microchip-csi2dc: fix async notifier leak on probe error path
Daan De Meyer (1):
io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN
DaeMyung Kang (5):
ksmbd: avoid restoring only in-memory EOF after allocation change
ksmbd: preserve unreadable named streams on open
ksmbd: return end of file for reads past a named stream's data
ksmbd: use the existing xattr name for a named stream
ksmbd: fix named stream write and EOF handling
Daehyeon Ko (2):
cgroup: serialize migrations of newly forked processes
mshv_vtl: detach poll waiter on POLLFREE
Daejun Park (2):
nvmet: fix use-after-free of the old registrant in nvmet_pr_preempt()
xfs: map pNFS layouts to the end of the extent again
Daijiamu (1):
ksmbd: use clear_and_wake_up_bit() directly
Dairui Zhang (2):
ksmbd: fix OOB read and cross-share confusion in ksmbd_validate_name_reconnect()
ksmbd: verify transform SessionId matches the decrypted header
Danish Khateeb (2):
pps: generators: fix use-after-free when closing a removed device
pps: generators: don't use the driver's info after unregister
Darrick J. Wong (69):
xfs: fix integer overflow problem when setting large free areas
xfs: clear the symlink zapped flag if inline symlink is ok
xfs: mark cow extents bad if there's no rmap mapping for them
xfs: compute the correct fdblocks/frextents for repair when they're negative
xfs: fix ondisk symlink target validation in xrep_dinode_check_dfork
xfs: fix xfs_rename_space_res for non-pptr filesystems
xfs: fix missing xfs_qm_adjust_dqlimits call in quotacheck repair
xfs: fix buffer overruns in xfs_ioc_attr_list
xfs: online quotacheck must dirty dquot if enforcement adjustments needed
xfs: avoid cross-rtgroup reaping after a repair
xfs: actually lock the metafile reservation when adjusting after repair
xfs: fix unnecessary dapos truncation in xchk_dir_walk
xfs: fix buffer overflow in corrupt inline attr structure
xfs: actually report corrupt xattrs as XFAIL during cross-referencing
xfs: fix inode btree repair when a cluster is larger than a chunk
xfs: always reset incore attr fork buffer when resetting fork
xfs: don't pass iget failures up when marking ondisk inodes
xfs: zero out di_metatype when removing the metadir file iflag
xfs: flag excessive delalloc rt extents as corruption
xfs: don't fix the directory tree if live update fails
xfs: don't proceed with xattr repair if the live update fails
xfs: fix skipped inode mask handling in iscan
xfs: don't repair fs summary counters with garbage
xfs: fix lost errno returned from xfarray_foliosort
xfs: allow softlimit with no hardlimit in quota scrub
xfs: assign an owner to scrub_stats_fops
xfs: bail out of directory tree repairs on error
xfs: fix revalidation of xchk_dquot_iter cached mappings
xfs: abort dirtree repair if the live update hook dies
xfs: check fork type against dabtree block magic number
xfs: mark overfull dabtree node blocks as corrupt
xfs: jump out of xchk_bmap_check_rmap if fatal signals
xfs: adjust checks for cross-AG reaping issues
xfs: actually check XFS_DIFLAG2_METADATA for metadata btree data forks
xfs: fix xchk_stats_estimate_bufsize to allow for the trailing null
xfs: reduce new btree slack factor if free space is negative
xfs: reject absurdly large xattr value lengths in xchk_xattr_actor
xfs: release ip after unlinked list store failure
xfs: rescan the AGs if incore delalloc counter is negative
xfs: update quota flags on secondary supers when metadir enabled
xfs: abort directory tree repair whenever dl->aborted is set
xfs: always forget cached ACLs if the attr fork swap succeeds
xfs: always report inode repair setup failures
xfs: always report scrub errors in tracepoints
xfs: always zero the whole shortform header when zeroing attr fork
xfs: check for fragments when full-extent sharing matches
xfs: check for termination during rmap btree walk
xfs: clarify various parts of the bitmap API
xfs: clear set[ug]id mode bits when zapping attr fork
xfs: complain loudly when dirtree checker finds broken links
xfs: don't allow sm_agno for non-group metadir path checking
xfs: don't clear COWEXTSIZE on directories on reflink filesystems
xfs: don't overrun incore inode when cleaning attr forks
xfs: don't queue rmap update twice when reaping a fork
xfs: don't rescan ifree and icount when frozen
xfs: don't scan across metadata/regular directory trees for dirents
xfs: don't set a metadata directory's parent to sb_rootino
xfs: don't subtract excess usage twice when computing agf_btreeblks
xfs: don't try to repair rtsummary if the summary file isn't computed
xfs: don't try to scrub self-referential dirent in metapath checker
xfs: fix correction of unwritten extents in quota file data fork
xfs: fix data fork block count check in xrep_inode_blockcounts
xfs: init inode number for tracepoint
xfs: never reset the default quota timer
xfs: only written file data blocks can be shared
xfs: opportunistically skip btree block checks
xfs: propagate errors while checking null siblings
xfs: range-check bc_levels array access in scrub tracepoints
xfs: reattach dquots after changing inode ids
David Flynn (1):
nfsd: fetch direct I/O alignment for files handed to the filecache
David Heidelberg (3):
backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()
backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe
backlight: qcom-wled: Fix WLED3 brightness register stride
David Hildenbrand (Arm) (1):
mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()
David Howells (5):
rxrpc: Fix update of call->tx_pending without holding lock
rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data()
afs: Fix afs to abort the rxrpc call on send error
rxrpc: Fix double IRQ enablement
rxrpc: Fix return in rxrpc_recvmsg_data() for service calls
David Woodhouse (4):
KVM: pfncache: use a dedicated invalidation sequence for cache refresh
KVM: x86/xen: Enforce 4-byte alignment of vcpu_info registration
KVM: x86/xen: Take kvm->srcu in __kvm_xen_has_interrupt()
tun: Require CAP_NET_ADMIN to attach to an ownerless device
Deep Shah (1):
RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup
Deepanshu Kartikey (1):
media: imon: fix use-after-free in display_close via dev_dbg
Denis Benato (1):
platform/x86: asus-wmi: fix use-after-free unregistering kbd_led led
Derek J. Clark (10):
HID: hid-lenovo-go-s: Prevent deadlock if device removed during setup
HID: hid-lenovo-go-s: Return ret instead of 0 in mcu_property_out()
HID: hid-lenovo-go-s: Use pm_ptr for reset_resume callback
HID: hid-lenovo-go-s: Add suspend function and gate access under bool.
HID: hid-lenovo-go-s: Bound stale reply window before reusing send_cmd_complete
HID: hid-lenovo-go-s: Move attribute init to after device query
HID: hid-lenovo-go-s: Reorganize and rename hid_gos_cfg
HID: hid-lenovo-go-s: Add kobject_uevent notify during reset-resume
HID: hid-lenovo-go-s: Move static led_classdev_mc to drvdata struct
HID: hid-lenovo-go-s: Use devm_kzalloc for drvdata
Diego Oliva (6):
smb: client: fix use-after-free infoleak via the readdir resume name
smb: client: fix OOB last_entry pointer from unbounded LastNameOffset
smb: client: fix OOB read of the resume name sent in TRANS2_FIND_NEXT2
smb: client: fix OOB read in the SMB_FIND_FILE_UNIX name scan
smb: client: reject FIND data areas that run past the received response
smb: client: reject short or out-of-range FIND response parameters
Dominik Maier (3):
smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl()
io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
io_uring/register: enforce per-task restrictions in io_uring_register_blind()
Eduard Zateev (1):
smb: client: hold server info until cifsd exits
Eliot Courtney (1):
rust: bitmap: restrict bitmap length to at most i32::MAX
Eric Biggers (1):
fsverity: Set S_VERITY only after rollback is no longer possible
Eric Dumazet (1):
vlan: restore HW VLAN tag insertion with reorder_hdr off
Eric Sandeen (1):
xfs: validate rc_domain in xchk_rtrefcount_mergeable
Eva Crystal (1):
accel/amdxdna: clear the mailbox channel pointer when starting it fails
FUJITA Tomonori (2):
rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML
rust: bug: update the SAFETY comment for warn_slowpath_fmt() on UML
Fan Wu (7):
PM: EM: Fix use-after-free of perf domain in netlink doit handlers
media: au0828: fix use-after-free in bulk_timeout timer on disconnect
ASoC: amd: ps: fix snd_acp63_remove() teardown ordering
media: imx-jpeg: cancel timeout worker when streaming stops
media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers
media: s5p-mfc: use timer_shutdown_sync() for the self-rearming watchdog
scsi: dc395x: sync the waiting_timer before freeing the host
Fang Xieyan (1):
kcov: ignore an out-of-range comparison count in write_comp_data()
Florian Westphal (1):
netfilter: nft_payload: restrict checksum offsets to known values
Frank Zhang (1):
rust: rcpufreq_dt: add module alias
Fredric Cover (1):
smb: client: fix early procfs exposure race
Gabor Tanz (1):
HID: quirks: Always poll the Anne Pro 2 with product ID a292
Giorgi Kobakhia (2):
udf: fix return value for non-recorded-allocated extents in udf_map_block()
ksmbd: fix overflow in dacloffset bounds check in build_sec_desc()
Greg Kroah-Hartman (1):
Linux 7.3.2
Guangshuo Li (1):
RDMA/irdma: avoid use-after-free in icrdma_remove
Günther Noack (1):
landlock: Fix superblock use-after-free in release_inode()
Harald Freudenberger (3):
s390/zcrypt: Fix and improve zcrypt reply message verification checks
s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility()
s390/zcrypt: Guard domain index uses against speculative bypass
Harshit Mogalapalli (2):
mtd: virt-concat: unlink concat node before freeing it
mtd: virt-concat: unlink discarded items before freeing
Heiko Carstens (4):
s390/extable: Fix mvcos instruction decoding
s390/kprobes: Prevent kprobes on instructions with exception table entry
s390/probes: Fix wrong opcode for cgrb fixup
s390/signal: Fix incorrect return address in signal frame
Hengyu Liang (1):
serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports
Henry Hu (1):
ksmbd: fix invalid pointer dereference when get_inode_acl() fails
Henry Martin (1):
smb: client: fix use-after-free in cifs_ses_add_channel()
Hungyu Lin (1):
ovl: reserve space for the casefolded name terminator
Ian Bridges (4):
ksmbd: fix session reference leak on compounded SESSION_SETUP
ksmbd: fix out-of-bounds read when padding the final compound response
ksmbd: fix app-instance non-durable supersede session UAF
ksmbd: fix use-after-free after a failed durable reconnect
Igor Putko (1):
serial: core: shut down initialized port on removal
Imre Kaloz (1):
mm/slab: sample slab_state once in kmem_cache_destroy()
Jamal Hadi Salim (3):
net/sched: cls_bpf: accept dev-bound programs on shared blocks
net/sched: sch_teql: fix slaves_lock IRQ deadlock
net/sched: act_ife: do not consume the inner header on egress
James Kim (1):
rapidio: mport_cdev: fix use-after-free in mport_mm_close()
Jan Koester (1):
ksmbd: ignore network devices of other namespaces
Janne Grunau (1):
nvmem: core: Fix OOB read for bit offsets of more than one byte
Jeff Layton (4):
NFSD: cap the number of listeners accepted in listener_set
nfsd: don't offer flexfiles layouts when NFSv3 isn't being served
NFSD: validate transport name in listener_set before serv creation
SUNRPC: keep the first error in svc_register()
Jens Axboe (4):
io_uring/timeout: don't put a sequence target behind the last flush
io_uring/timeout: don't flush with the sequence behind the last flush
io_uring/timeout: don't lose a cancel as io-wq arms a timeout
io_uring: keep the drain active when a deferred drain request is started
Jiale Yao (16):
HID: zydacron: validate key report length
HID: cougar: reject short special-key reports
HID: cp2112: validate response report lengths
HID: elo: reject short touchscreen reports
HID: logitech-dj: validate unnumbered keyboard reports
HID: mcp2200: validate READ_ALL response length
HID: mcp2221: validate response report length
HID: prodikeys: validate fixed-format MIDI reports
HID: pxrc: reject short input reports
HID: roccat: isku: reject short button reports
HID: roccat: koneplus: reject short button reports
HID: roccat: konepure: reject short button reports
HID: roccat: kovaplus: reject short button reports
HID: roccat: pyra: reject short button reports
HID: roccat: ryos: reject short special reports
HID: roccat: savu: reject short special reports
Jiaming Zhang (1):
ocfs2: fix chunk number of the first chunk in a local quota file
Jimmy Zuber (1):
NFS: Fix stale negative cache on failed nfs_mkdir()
Johan Hovold (2):
driver core: take parent lock on deferred probe
driver core: fix parent lock use-after-free on USB disconnect
Jonathan Gopel (1):
thunderbolt: Do not RPM complete unrelated subtrees on unplug
Josef Bacik (46):
io_uring/waitid: own the request before clearing ->head
io_uring/cmd: don't leave list poison in ->hash_node
io_uring/wait: don't spin on a stuck overflow list
io_uring/io-wq: don't lose the signal that ends work
io_uring/io-wq: don't hide a link from cancellations
io_uring: don't flood a cancelling task with task_work
io_uring: don't lose the DEFER_TASKRUN wake up
io_uring/cancel: rearm local work wake up before sleep
io_uring/mpscq: disable preemption while pushing
io_uring/io-wq: don't go to sleep on pending work
io_uring/io-wq: don't strand work when a worker exits
io_uring/io-wq: don't exit with a creation pending
io_uring/io-wq: let cancel find picked up hashed work
io_uring/poll: don't lose a cancel as io-wq arms poll
io_uring: don't lose a cancel as io-wq parks a request
io_uring/cancel: don't forget that the work was running
io_uring/cancel: recognize "no timeout" on 32-bit
io_uring/cancel: let CANCEL_ALL find parked requests
io_uring: wake ring pollers for local task_work
io_uring/wait: look at all CQ waiters on wake up
io_uring/poll: drop stale double poll entry on rearm
io_uring/futex: allocate private hash before waiting
io_uring: drop the CQE cache if a refill fails
io_uring: don't split 128b SQEs at the SQPOLL cap
io_uring/register: don't wrap 32b CQEs when resizing
io_uring/register: handle index wrap when resizing
io_uring/register: keep 128b SQEs intact on resize
io_uring/fdinfo: fix CQE dump of CQE32 rings
io_uring/timeout: don't skip over reached sequences
io_uring/timeout: keep repeat count on multishot update
io_uring/timeout: use the right clock for ABS updates
io_uring/wait: no early -ETIME if min_wait finds work
io_uring/napi: make stale entries time out after 60s
io_uring/napi: don't busy poll past an expired timeout
io_uring/zcrx: fix buffer offsets in areas above 4GB
io_uring/kbuf: handle index wrap in last buffer check
io_uring/sqpoll: let the thread sleep on disabled rings
io_uring/openclose: keep the lock in io_pipe_fixed()
io_uring: don't pass restart error codes to userspace
io_uring/net: don't retry recv on uncommitted buffers
io_uring/timeout: no ABS update of multishot timeouts
io_uring/timeout: don't end a linked timeout with 1
io_uring: look up the file before queueing to io-wq
driver core: Limit the messages on a refused uevent
mm/hugetlb: fix use-after-free of a new anon folio
io_uring/io-wq: no new workers once the exit has begun
Joseph Qi (1):
ocfs2/dlm: hold the lookup reference across convert AST enqueue
Jérémy Jean (4):
nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF
nfsd: preflight SEQUENCE replies before accepting a slot
SUNRPC: fix oversized GSS proxy token copy
ksmbd: fix SMB2 CREATE response buffer overflow
Kaho Jiang (1):
net: ipv4: add zero check for snd_cwnd_clamp
Kameron Carr (1):
Drivers: hv: vmbus: Bounds check the shared ring buffer indices
Karl Mehltretter (3):
ARM: 9524/1: mm: align hugetlb mappings to the huge page size
ksmbd: use u8 for SMB2 oplock level values
klist: avoid accesses after waking klist_remove()
Keqiang Duan (1):
KVM: x86: Clear hardware HLT state when userspace makes a vCPU not-halted
Kyle Zeng (3):
io_uring/io-wq: save worker type before dropping its reference
net: sched: prevent scheduling deactivated qdiscs
io_uring: defer foreign io-wq enqueues to task_work
Lee Jones (5):
HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities
HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration
HID: wacom: Fix Use-After-Free in wacom_intuos_pad
HID: wacom: Fix Use-After-Free in wacom_bamboo_pad
HID: wacom: Redesign shared sibling data lifecycle
Lee Seong Hyeon (1):
ksmbd: reject FSCTL_SET_ZERO_DATA on a directory handle
Lizhi Hou (1):
accel/amdxdna: Add support for AIE2 revision 9
Loc Nguyen (1):
KVM: x86: Request event processing for exception VM-Exits
Lorenzo Pieralisi (2):
dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints
irqchip/gic-v5: Fix standalone IRSes OF probe
Lorenzo Stoakes (1):
rust: bindings: fix VM_MAYSHARE value
Lorenzo Stoakes (ARM) (1):
HID: picoLCD: check for fb_deferred_io_init() error
Luxiao Xu (1):
smb: client: fix buffer overflow in SMB2_tcon()
Mario Limonciello (1):
platform/x86/amd: hfi: Fix a use-after-free when unloading the driver
Mario Peter (1):
driver core: take parent lock in async device attach
Mehmet Koseoglu (1):
rust: cpufreq: reject NULL from cpufreq_cpu_get()
Michail Andreas Michalopoulos (2):
ksmbd: accept share config responses from ksmbd-tools before 3.5.3
ksmbd: restore Kerberos logins with released ksmbd-tools
Miguel Ojeda (2):
objtool/rust: add one more `noreturn` Rust function for Rust 1.101.0
rust: bindings: fix `VM_MAYSHARE` blocklist entry
Mike Rapoport (Microsoft) (1):
x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
Mike Snitzer (3):
NFS/localio: detect a short read or write before the iterator has moved
NFS/localio: fix nfs_local_dio_misaligned tracepoint
NFS/localio: report the stability a DIO WRITE actually has
Myeonghun Pak (6):
media: cx88: Disable PCI device on MPEG initialization failure
backlight: lm3630a: Cancel delayed work before destroying workqueue
media: cx23885: unregister DVB bus when SP2 CI setup fails
power: supply: pf1550: drain IRQ work before unregistering supplies
power: supply: sbs-battery: disable polling before supply teardown
HID: mcp2221: always initialize and cancel init_work
Namjae Jeon (15):
ksmbd: wait for negotiation before receiving another PDU
ksmbd: defer connection scavenging while session locks are busy
ksmbd: drain session procfs readers before dropping table references
ksmbd: fix extended session security negotiation for raw NTLMSSP
ksmbd: hold a connection reference for each session channel
ksmbd: limit sessions on each connection
ksmbd: prevent session binding in compound requests
ksmbd: prevent share root removal through empty paths
ksmbd: prevent stale data from being written by SMB2 WRITE requests
ksmbd: reclaim ended sessions on logoff and expiration
ksmbd: validate security descriptor offsets before pointer arithmetic
ksmbd: track delivery of queued TCP writes
ksmbd: retry break notifications on another connection
ksmbd: rebind completed CREATE replays without draining the old channel
ksmbd: keep retry timeout clamp bounds constant
NeilBrown (1):
nfsd: honour client-provided attributes for NFS4_CREATE_EXCLUSIVE4_1
Ngoc Quy (1):
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
Nguyen Quang Le Kien (1):
usb: gadget: fix refcount underflow in gadgetfs_bind() error path
Nickolai Zeldovich (1):
resource: report a devm_request_resource() conflict under the lock
Nicolin Chen (1):
iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
Niklas Cassel (1):
ata: sata_fsl: Fix use-after-free of host_priv on probe() failure
Nirmoy Das (1):
iommufd: Fix event queue release use-after-free
Osama Abdelkader (1):
drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase
Panz Dev (1):
HID: asus: do not send keyboard init reports to touchpads
Paulo Alcantara (3):
smb: client: don't resurrect an exiting tcon from cached dir workers
smb: client: reclaim credits for decrypted reads with no matching mid
smb: client: require stable pages for SMB compression
Pavankumar Nandeshwar (1):
wifi: ath12k: Increase RXDMA buffer ring size for default memory profile
Pei Xiao (1):
media: cx23885: Fix use-after-free in cx23885_finidev due to race condition
Peter Ujfalusi (1):
ALSA: x86: hdmi: fix chmap array missing terminator entry
Ping Cheng (2):
HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration
HID: wacom: Write shared touch initial status only once
Priya Bala Govindasamy (1):
rust: module_param: Fix potentially incorrect access of `SetOnce<T>`
Radek Podgorny (1):
Bluetooth: forget a peer's RPA once it advertises its identity address
Ratnaker Gautam (3):
smb: client: bound POSIX lock data area by response length
smb: client: validate NT transaction response layout and offsets
smb: client: validate SMB1 EA list bounds before parsing
Richard Patel (2):
genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
genirq: Move interrupt thread exit_work object to irqaction
Ridham Khurana (1):
platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE()
Rik van Riel (1):
media: redrat3: fix UAF in probe error path leaving rc device registered
Rosen Penev (1):
wifi: ath9k: delete channel-context timers on deinit
Ruide Cao (1):
mptcp: hold MP_JOIN msk ref when cloning reqsk
Sean Christopherson (14):
KVM: guest_memfd: Gracefully handle xarray errors when binding a memslot
x86/cpuid: Mark CPUID function 0x23 as being indexed
KVM: Only bind memslot to guest_memfd instance for CREATE operations
KVM: nSVM: Reject KVM_SET_NESTED_STATE if L1 has EFER.LMA=1 && EFER.LME=0
KVM: nSVM: Ignore EFER.LMA if EFER.LME=0 when preparing L2 state
KVM: Use goto to handle errors during memslot preparation
KVM: VMX: Disallow using to_vmx() in common VT code
KVM: VMX: Formally define KVM's "0xdead" exit reason used for failed VM-Enter
KVM: x86/mmu: Bug the VM if KVM attempts to walk more levels than the MMU has
KVM: x86/mmu: Bug the VM if KVM calcs a CPU role with EFER.LMA=1 && CR4.PAE=0
KVM: x86: Preserve DR6.BLD (Bus Lock Detect) when delivering #DB payload
KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak
KVM: guest_memfd: Split bind() into prepare()+commit() phases
KVM: guest_memfd: Establish memslot<=>guest_memfd bindings *after* memslot is ready
Sean Young (10):
media: rc: Ensure that rc_unregister_device() does not free input device
media: rc: Ensure registered is cleared in error path
media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister
media: rc: Fix race condition during rc_register_device()
media: rc: mce_kbd: Fix inconsistent locking of keylock
media: rc: Use after free in ir_raw_event_handle()
media: rc: After rc_unregister_device() timers can be re-armed
media: rc: Fix use after free in bpf progs
media: rc: Fix ABBA deadlock by making locks more fine grained
media: rc: Fix build failure with CONFIG_LIRC disabled
Shakeel Butt (1):
kernfs: don't lose IN_DELETE_SELF when decoding a file handle
Shivank Garg (1):
KVM: guest_memfd: take the invalidate lock when unbinding a dying file
Shuangpeng Bai (1):
media: gspca: use vb2_video_unregister_device() on disconnect
Stefan Metzmacher (4):
smb: smbdirect: don't wait for RDMA_CM_EVENT_DISCONNECTED in smbdirect_socket_destroy_sync()
smb: smbdirect: release failed pending sockets of a listener
smb: smbdirect: don't hand out already failed sockets in smbdirect_socket_accept()
smb: smbdirect: fix buffer length underflow in RDMA transfers
Sumanth Korikkar (1):
s390/cpum_cf: Check session mask before cpu offline
Sung Byeongchan (2):
ksmbd: validate AppInstanceId takeover target
ALSA: pcmtest: handle multiple wraps in random capture fill
Takashi Iwai (2):
ALSA: control: Fix UAF in snd_ctl_elem_add() on card disconnect
ALSA: emux: Fix UAF of soundfont zones at note-on
Tejun Heo (1):
sched_ext: Fix use-after-free of a local reenq node left on an inactive cpu
Tianchu Chen (1):
staging: rtl8723bs: fix protected RX frame validation in decrypt path
Tobias Schumacher (5):
s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup
s390/pci: Fix MSI directed-mode teardown IRQ bit count
s390/pci: Fix resource leak in zpci MSI setup
s390/pci: Fix use-after-free race in zpci floating interrupt cleanup
s390/pci: Add error cleanup in zpci_directed_irq_init()
Trond Myklebust (1):
NFSv4: Fix a regression in the handling of CB_RECALL_ANY
Vernon Yang (3):
mm: khugepaged: fix folio is used after folio_put/unlock()
mm: khugepaged: fix folio is used after pte_unmap_unlock()
mm: khugepaged: fix swap entry value to folio_pfn()
VeroFess (1):
smb: server: size directory name conversion buffer correctly
Wei Jie Law (1):
net: usb: pegasus: do not advance rx_skb->data on dropped frames
Weibin Liu (1):
spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout
Weigang He (1):
media: rc: fintek-cir: process a full RX buffer instead of overflowing it
Weiming Shi (2):
virtio_net: atomically disable rx mode work
smb: client: stop processing a read response after a receive error
Wentao Liang (3):
ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c()
drm/msm: Fix vm_bo use-after-free in with_vm_locks()
nfsd: Fix id-to-name cache entry leak in idtoname_parse()
Xiang Mei (5):
fuse: don't BUG when the copy buffer is exhausted
libceph: bound mon_command ack decode to front len
media: em28xx: reject audio endpoint with zero packet size
media: go7007: only set audio_enabled if go7007_snd_init() succeeded
fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use
Xiaoyao Li (8):
KVM: VMX: Make handle_bus_lock_vmexit() a shared helper
KVM: VMX: Preserve negative return value in vmx_handle_exit() with bus lock detected
KVM: TDX: Check if there is valid exit infos based on vp_enter_ret
KVM: TDX: Enable Notify VM exit
KVM: TDX: Set bits 31:16 to 0 and use UNDEFINED when synthesizing exit reason
KVM: TDX: Stuff exit_reason with UNDEFINED on wait_for_sept_zap return
KVM: TDX: Don't assume exit_reason[31:16] is all-0 in tdx_to_vmx_exit_reason()
KVM: TDX: Enable Bus Lock VM exit
YANXIN LI (1):
ufs: use u64 for directory size in ufs_last_byte
Yehyeong Lee (1):
nvmet-fc: fix use-after-free in nvmet_fc_ls_create_connection()
Yibo Tan (2):
media: ipu-bridge: Fix use-after-free in IVSC error path
fbdev: atmel_lcdfb: Prevent FIFO work after removal
Yichong Chen (2):
io_uring/kbuf: advance head when a pickup empties the buffer ring
io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
Yongjun Gwon (1):
ksmbd: serialize directory emptiness checks with readdir
Yosry Ahmed (1):
KVM: SVM: Trigger new ASID allocation in both VMCBs on pCPU switch
Yousef Alhouseen (1):
HID: hiddev: keep state alive through disconnect unlock
YuanZhe Liu (1):
ALSA: line6: Clear prev_fbuf on capture buffer release
Yuanfu Xie (1):
ceph: fail readdir when the MDS reply carries no dirfrag
Yuchao Zhang (1):
xen-blkfront: unbind irq before tearing down ring and shadow requests
Yuhang Zheng (1):
net/sched: cls_flower: avoid stale mask references after delete
Zhang Yi (1):
mm/truncate: look up the end-edge straddler by index
Zhao Gongyi (1):
filelock: keep superblock active through delegation wait
Zhao Li (1):
wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement
Zhiling Zou (1):
SUNRPC: trace an accepted transport before publishing it
Zi Yan (1):
mm/rmap: don't discard lazyfree THPs at PMD level
Zijing Yin (1):
SUNRPC: fix netns use-after-free in write_gssp()
Zikang Gao (1):
smb: client: do not pass a NULL buf to is_oplock_break()
Zizhen Liu (1):
net: skbuff: propagate shared-frag marker in skb_zerocopy()
ck.chang (1):
wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask
owen kwan (1):
net/sched: sch_teql: fix use-after-free on lower qdisc drop
next reply other threads:[~2026-11-06 17:18 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-06 17:17 Greg Kroah-Hartman [this message]
2026-11-06 17:17 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026110646-extruding-blitz-b2bc@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=lwn@lwn.net \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®