Syzbot CI

Subject	6.18.55-rc1 review
Author	gregkh@linuxfoundation.org
Date	2026-09-30 15:24:23 +0000 UTC
Version
Cc	achill@achill.org akpm@linux-foundation.org broonie@kernel.org conor@kernel.org f.fainelli@gmail.com gregkh@linuxfoundation.org hargar@microsoft.com jonathanh@nvidia.com linux-kernel@vger.kernel.org linux@roeck-us.net lkft-triage@lists.linaro.org patches@kernelci.org patches@lists.linux.dev pavel@nabladev.com rwarsow@gmx.de shuah@kernel.org sr@sladewatkins.com stable@vger.kernel.org sudipm.mukherjee@gmail.com torvalds@linux-foundation.org

Name	Content [All]
[PATCH 6.18 001/395] xfs: dont stash removename operations with unknown ftype	[Body]
[PATCH 6.18 002/395] erofs: fix large folio race in erofs_fscache_req_complete	[Body]
[PATCH 6.18 003/395] drm/amd/display: Atomize IRQ register read/modify/write ops	[Body]
[PATCH 6.18 004/395] ALSA: hda/realtek: Limit Star Labs internal mic boost	[Body]
[PATCH 6.18 005/395] ALSA: hda/realtek: Add StarFighter HDA SSID	[Body]
[PATCH 6.18 006/395] remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage	[Body]
[PATCH 6.18 007/395] KVM: s390: Fix IRQ injection with SIGP Stop and Store Status	[Body]
[PATCH 6.18 008/395] s390/uv: Fix loop condition in uv_find_secrets	[Body]
[PATCH 6.18 009/395] s390/uv: Prevent potential out-of-bounds read	[Body]
[PATCH 6.18 010/395] bpf: Fix bpf_skb_change_tail wrt csum partial skbs	[Body]
[PATCH 6.18 011/395] bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL	[Body]
[PATCH 6.18 012/395] selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc	[Body]
[PATCH 6.18 013/395] bpf: Fix divide-by-zero in btf_struct_walk()	[Body]
[PATCH 6.18 014/395] bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()	[Body]
[PATCH 6.18 015/395] tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context	[Body]
[PATCH 6.18 016/395] HID: multitouch: Add report ID mismatch quirk for ASUS ROG Z13 Folio	[Body]
[PATCH 6.18 017/395] HID: elecom: fix bus type for M-XGL20DLBK	[Body]
[PATCH 6.18 018/395] KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()	[Body]
[PATCH 6.18 019/395] bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()	[Body]
[PATCH 6.18 020/395] bpf: Fix out-of-bounds read of rtt_min in sock_ops	[Body]
[PATCH 6.18 021/395] bpf: Register dtor for freeing special fields	[Body]
[PATCH 6.18 022/395] bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk	[Body]
[PATCH 6.18 023/395] bpf, sockmap: Fix self-redirect copied_seq double-counting	[Body]
[PATCH 6.18 024/395] bpf, arm64: set up the frame pointer for the exception callback	[Body]
[PATCH 6.18 025/395] pinctrl: meson: Fix typo in s4 group name	[Body]
[PATCH 6.18 026/395] HID: amd_sfh: Validate PCI BAR size before mapping	[Body]
[PATCH 6.18 027/395] HID: bpf: fix __hid_bpf_hw_check_params report length	[Body]
[PATCH 6.18 028/395] KVM: riscv: Fix NACL hfence entry update order	[Body]
[PATCH 6.18 029/395] RISC-V: KVM: Preserve firmware counter value across stop/start	[Body]
[PATCH 6.18 030/395] RISC-V: KVM: Report snapshot write failure to the guest	[Body]
[PATCH 6.18 031/395] RISC-V: KVM: Fix perf-backed counter accounting across stop and read	[Body]
[PATCH 6.18 032/395] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes	[Body]
[PATCH 6.18 033/395] KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save	[Body]
[PATCH 6.18 034/395] KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()	[Body]
[PATCH 6.18 035/395] KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure	[Body]
[PATCH 6.18 036/395] KVM: arm64: vgic-v3: Fix GICv3 trapping in protected mode	[Body]
[PATCH 6.18 037/395] KVM: arm64: Fix MTE flag initialization for protected VMs	[Body]
[PATCH 6.18 038/395] KVM: arm64: Include VM type when checking VM capabilities in pKVM	[Body]
[PATCH 6.18 039/395] KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2	[Body]
[PATCH 6.18 040/395] KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0	[Body]
[PATCH 6.18 041/395] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP	[Body]
[PATCH 6.18 042/395] squashfs: Add dictionary size range check to prevent shift-out-of-bounds	[Body]
[PATCH 6.18 043/395] scsi: sd_zbc: Reject disks with too many zones	[Body]
[PATCH 6.18 044/395] pinctrl: sunxi: A523: fix voltage withstand encoding	[Body]
[PATCH 6.18 045/395] Bluetooth: SMP: reject Security Request over BR/EDR	[Body]
[PATCH 6.18 046/395] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()	[Body]
[PATCH 6.18 047/395] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel	[Body]
[PATCH 6.18 048/395] selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode	[Body]
[PATCH 6.18 049/395] scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()	[Body]
[PATCH 6.18 050/395] docs: s390/pci: Improve and update PCI documentation	[Body]
[PATCH 6.18 051/395] s390/pci/docs: Fix sriov_numvfs attribute name	[Body]
[PATCH 6.18 052/395] s390/cio: Fix cio_update_schib() to not cache invalid schib	[Body]
[PATCH 6.18 053/395] s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points	[Body]
[PATCH 6.18 054/395] s390/cio: Guard PMCW field accesses with dnv check	[Body]
[PATCH 6.18 055/395] fs: avoid repeated scans in evict_inodes()	[Body]
[PATCH 6.18 056/395] xsk: Use a 32-bit compare in xsk_map_gen_lookup	[Body]
[PATCH 6.18 057/395] bpf: Skip unsettled links in link iterator	[Body]
[PATCH 6.18 058/395] eth: fbnic: Fix payload page pool error cleanup	[Body]
[PATCH 6.18 059/395] net/sched: cls_u32: fix manual hash table handle IDR aliasing	[Body]
[PATCH 6.18 060/395] net: pcs: rzn1-miic: Fix config array initialization	[Body]
[PATCH 6.18 061/395] octeontx2-af: use seq_file for rsrc_alloc debugfs	[Body]
[PATCH 6.18 062/395] net/mlx5: devcom, Base component size on linked devices	[Body]
[PATCH 6.18 063/395] bpf: Restrict CO-RE poisoning to relocatable instructions	[Body]
[PATCH 6.18 064/395] libbpf: Reject truncated ldimm64 CO-RE relocations	[Body]
[PATCH 6.18 065/395] ipv4: fib: fix data-race and stale genid check around nh->nh_saddr	[Body]
[PATCH 6.18 066/395] netfilter: flowtable: publish HW_DEAD after worker is done	[Body]
[PATCH 6.18 067/395] netfilter: nfnetlink_queue: hold nfnl mutex in event notifier	[Body]
[PATCH 6.18 068/395] netfilter: nft_synproxy: use the family-aware checksum helper	[Body]
[PATCH 6.18 069/395] ipvs: revalidate ihl before icmp_send	[Body]
[PATCH 6.18 070/395] netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name	[Body]
[PATCH 6.18 071/395] arm64: io: Reject non-user protection in ioremap_prot()	[Body]
[PATCH 6.18 072/395] ocfs2: make ocfs2_calc_xattr_init() return void	[Body]
[PATCH 6.18 073/395] drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update	[Body]
[PATCH 6.18 074/395] drm/nouveau/clk: dont clobber reclock status when restoring volt/fan	[Body]
[PATCH 6.18 075/395] drm/nouveau/disp: dont reject HDMI config on cards without SCDC	[Body]
[PATCH 6.18 076/395] net/sched: act_ct: dont WARN on benign flow_offload_alloc() failure	[Body]
[PATCH 6.18 077/395] net: gue: reject invalid REMCSUM offsets	[Body]
[PATCH 6.18 078/395] net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure	[Body]
[PATCH 6.18 079/395] ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().	[Body]
[PATCH 6.18 080/395] eth: fbnic: Handle maximum standalone channels	[Body]
[PATCH 6.18 081/395] eth: fbnic: reset num_napi when the napi vectors are freed	[Body]
[PATCH 6.18 082/395] eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox	[Body]
[PATCH 6.18 083/395] eth: fbnic: Reuse RX mailbox pages	[Body]
[PATCH 6.18 084/395] eth fbnic: Add debugfs hooks for firmware mailbox	[Body]
[PATCH 6.18 085/395] eth: fbnic: Handle FW mailbox completions flagged with an error	[Body]
[PATCH 6.18 086/395] sctp: avoid livelock while updating retransmit path	[Body]
[PATCH 6.18 087/395] bpf: Bound ownership depth through local kptrs and graph roots	[Body]
[PATCH 6.18 088/395] net: usb: catc: bound the RX packet length in catc_rx_done()	[Body]
[PATCH 6.18 089/395] bpf: Check params size before reading reserved fields	[Body]
[PATCH 6.18 090/395] net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget	[Body]
[PATCH 6.18 091/395] drm/virtio: fix object leak when drm_gem_handle_create() fails	[Body]
[PATCH 6.18 092/395] drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()	[Body]
[PATCH 6.18 093/395] drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()	[Body]
[PATCH 6.18 094/395] drm/virtio: release the GEM object on virtio_gpu_vram_create() errors	[Body]
[PATCH 6.18 095/395] Revert "drm/virtio: Allow importing prime buffers when 3D is enabled"	[Body]
[PATCH 6.18 096/395] drm/virtio: sync shmem backing on guest-bound transfers	[Body]
[PATCH 6.18 097/395] drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach	[Body]
[PATCH 6.18 098/395] ovpn: preserve IPv6 scope id for netlink peer endpoints	[Body]
[PATCH 6.18 099/395] ovpn: skip UDP source validation for unspecified addresses	[Body]
[PATCH 6.18 100/395] ovpn: track UDP socket route key for peer dst cache	[Body]
[PATCH 6.18 101/395] ovpn: validate peer state before caching UDP dst	[Body]
[PATCH 6.18 102/395] ovpn: replace bind when learning local endpoint	[Body]
[PATCH 6.18 103/395] ovpn: replace bind when clearing stale local source	[Body]
[PATCH 6.18 104/395] ovpn: always unhash old VPN addresses before rehashing	[Body]
[PATCH 6.18 105/395] ovpn: reject duplicate peer VPN addresses	[Body]
[PATCH 6.18 106/395] ovpn: reject multipeer peers without VPN addresses	[Body]
[PATCH 6.18 107/395] ovpn: reject invalid peer VPN addresses	[Body]
[PATCH 6.18 108/395] Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough	[Body]
[PATCH 6.18 109/395] Bluetooth: btintel_pcie: validate device-supplied DMA indices	[Body]
[PATCH 6.18 110/395] Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()	[Body]
[PATCH 6.18 111/395] octeontx2-af: Fix memory scaling limitation in SR-IOV mode	[Body]
[PATCH 6.18 112/395] ipv6: Prevent rt6_insert_exception() for dying fib6_info.	[Body]
[PATCH 6.18 113/395] dpll: use exact lookup for reference sync pin id	[Body]
[PATCH 6.18 114/395] net: usb: sr9700: include receive overhead in the length check	[Body]
[PATCH 6.18 115/395] ipv6: Fix dst leak for uncached routes.	[Body]
[PATCH 6.18 116/395] udp: relocate a connected socket in the 4-tuple hash table on re-connect	[Body]
[PATCH 6.18 117/395] udp: remove a disconnected socket from the 4-tuple hash table	[Body]
[PATCH 6.18 118/395] tg3: clean up PHYLIB resources on probe failure	[Body]
[PATCH 6.18 119/395] drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable	[Body]
[PATCH 6.18 120/395] s390/debug: Do not register views for failed static debug areas	[Body]
[PATCH 6.18 121/395] s390/debug: Fix NULL pointer dereference in debug_info_copy()	[Body]
[PATCH 6.18 122/395] net: spacemit: clear TX descriptor on fragment mapping failure	[Body]
[PATCH 6.18 123/395] net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error	[Body]
[PATCH 6.18 124/395] genetlink: report the real command id for dump-only ops in policy dumps	[Body]
[PATCH 6.18 125/395] net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure	[Body]
[PATCH 6.18 126/395] thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds	[Body]
[PATCH 6.18 127/395] bpf: Fix bounds check for skb-backed dynptrs	[Body]
[PATCH 6.18 128/395] bpf: Fix bpf_sock context code generation	[Body]
[PATCH 6.18 129/395] bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc	[Body]
[PATCH 6.18 130/395] net/mlx5: Bridge, dont fail switchdev events of sibling eswitch ports	[Body]
[PATCH 6.18 131/395] net/mlx5: Bridge, dont fail unlink of untracked/unsupported peer ports	[Body]
[PATCH 6.18 132/395] sctp: hold asoc or transport before mod_timer() in timer handlers	[Body]
[PATCH 6.18 133/395] net: stmmac: selftests: Support running selftests on DSA conduits	[Body]
[PATCH 6.18 134/395] net: stmmac: selftests: Check the dev->features for S-TAG offload testing	[Body]
[PATCH 6.18 135/395] net: stmmac: selftests: Capture all packets for vlan checks	[Body]
[PATCH 6.18 136/395] net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K	[Body]
[PATCH 6.18 137/395] net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo test	[Body]
[PATCH 6.18 138/395] eth: fbnic: Avoid rounding zero ring sizes	[Body]
[PATCH 6.18 139/395] net/sched: fix potential stack infoleak in em_text_dump()	[Body]
[PATCH 6.18 140/395] bpf: Reject dev-bound-only programs on other devices	[Body]
[PATCH 6.18 141/395] nfc: nfcmrvl: validate helper command length before pull	[Body]
[PATCH 6.18 142/395] nfc: st21nfca: validate received frame size	[Body]
[PATCH 6.18 143/395] nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()	[Body]
[PATCH 6.18 144/395] selftests: nci: Correct pthread_create return value check	[Body]
[PATCH 6.18 145/395] nfc: llcp: Fix race condition in accept_queue lifecycle	[Body]
[PATCH 6.18 146/395] selftests: nci: Fix uninitialized family ID on missing attribute	[Body]
[PATCH 6.18 147/395] selftests/nci: Fix out-of-bounds store on thread join	[Body]
[PATCH 6.18 148/395] nfc: virtual_ncidev: Add missing ioctl compat handler	[Body]
[PATCH 6.18 149/395] nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure	[Body]
[PATCH 6.18 150/395] nfc: st21nfca: validate ISO15693 inventory length	[Body]
[PATCH 6.18 151/395] nfc: llcp: fix -ENOMEM on connect with zero-length service name	[Body]
[PATCH 6.18 152/395] nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()	[Body]
[PATCH 6.18 153/395] nfc: llcp: fix slab-out-of-bounds reads when logging service names	[Body]
[PATCH 6.18 154/395] nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()	[Body]
[PATCH 6.18 155/395] net/sched: act_gate: budget the per-entry list in get_fill_size	[Body]
[PATCH 6.18 156/395] net: bcmgenet: stop Tx NAPI before disabling the queues	[Body]
[PATCH 6.18 157/395] veth: manage XDP program pointers during channel resize	[Body]
[PATCH 6.18 158/395] net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()	[Body]
[PATCH 6.18 159/395] vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets	[Body]
[PATCH 6.18 160/395] bpf: Fix immediate JMP JEQ/JNE on MIPS32	[Body]
[PATCH 6.18 161/395] bpf: Fix BSWAP 32 and 16 on MIPS64	[Body]
[PATCH 6.18 162/395] tg3: use random MAC address when tg3_get_device_address fails	[Body]
[PATCH 6.18 163/395] net: stmmac: clear stale buf->page after recycling on skb build failure	[Body]
[PATCH 6.18 164/395] net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems	[Body]
[PATCH 6.18 165/395] net: bcmgenet: initialize u64 stats seq counter for all queues	[Body]
[PATCH 6.18 166/395] net: bcmgenet: do not skip WoL power up on GENET V1	[Body]
[PATCH 6.18 167/395] net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr	[Body]
[PATCH 6.18 168/395] net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT	[Body]
[PATCH 6.18 169/395] ip_gre: Reject enabling collect metadata through changelink	[Body]
[PATCH 6.18 170/395] vxlan: use one headroom snapshot for neighbour replies	[Body]
[PATCH 6.18 171/395] net: xps: reject an out of range traffic class	[Body]
[PATCH 6.18 172/395] drm/imagination: clamp freelist reconstruction requests	[Body]
[PATCH 6.18 173/395] bonding: crypto offload enabled, non-offload slave failover, rekey failed	[Body]
[PATCH 6.18 174/395] macsec: initialize SecY before registering the netdevice	[Body]
[PATCH 6.18 175/395] net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621	[Body]
[PATCH 6.18 176/395] net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq	[Body]
[PATCH 6.18 177/395] tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()	[Body]
[PATCH 6.18 178/395] net: phylink: record the PHY only once bringup cannot fail	[Body]
[PATCH 6.18 179/395] nfp: hold IPsec RX state under the XArray lock	[Body]
[PATCH 6.18 180/395] net/smc: fix UAF on lgr list traversal in smcr_port_err()	[Body]
[PATCH 6.18 181/395] tipc: Fix a data race on mon->peer_cnt in mon_timeout()	[Body]
[PATCH 6.18 182/395] net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails	[Body]
[PATCH 6.18 183/395] gve: Consolidate and persist ethtool ring changes	[Body]
[PATCH 6.18 184/395] gve: Use extack to log xdp config verification errors	[Body]
[PATCH 6.18 185/395] gve: Allow ethtool to configure rx_buf_len	[Body]
[PATCH 6.18 186/395] gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO	[Body]
[PATCH 6.18 187/395] gve: Enable hw-gro by default if device supported	[Body]
[PATCH 6.18 188/395] gve: add support for UDP GSO for DQO format	[Body]
[PATCH 6.18 189/395] gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO	[Body]
[PATCH 6.18 190/395] gve: fix TX drop when GSO MSS is too small for hw	[Body]
[PATCH 6.18 191/395] gve: DQO: reject TSO packets with an out of range MSS	[Body]
[PATCH 6.18 192/395] llc: fix skb UAF and leaks on llc_mac_hdr_init() failure	[Body]
[PATCH 6.18 193/395] bridge: check llc_mac_hdr_init() return value in br_send_bpdu()	[Body]
[PATCH 6.18 194/395] net/sched: sch_teql: fix shadowed err in __teql_resolve()	[Body]
[PATCH 6.18 195/395] vlan: ensure sufficient headroom in vlan_dev_hard_header()	[Body]
[PATCH 6.18 196/395] autofs: fix sbi->pipe file reference leak in autofs_kill_sb()	[Body]
[PATCH 6.18 197/395] perf/x86/intel: Ensure KVM guest PEBS path doesnt set unwanted PERF_GLOBAL_CTRL bits	[Body]
[PATCH 6.18 198/395] perf/x86/intel: Dont write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED	[Body]
[PATCH 6.18 199/395] perf/x86/intel: Dont pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused	[Body]
[PATCH 6.18 200/395] perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()	[Body]
[PATCH 6.18 201/395] perf/core: Fix a refcount leak in attach_perf_ctx_data()	[Body]
[PATCH 6.18 202/395] sched/core: Account PSI IRQ time to the execution context, not the scheduling context	[Body]
[PATCH 6.18 203/395] mptcp: return sk_wait_data() errors from recvmsg()	[Body]
[PATCH 6.18 204/395] rculist: add list_splice_rcu() for private lists	[Body]
[PATCH 6.18 205/395] netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase	[Body]
[PATCH 6.18 206/395] x86/mce: Fix hardware debug register corruption on task migration	[Body]
[PATCH 6.18 207/395] x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11	[Body]
[PATCH 6.18 208/395] virtio_net: copy zerocopy frags in start_xmit without NAPI	[Body]
[PATCH 6.18 209/395] tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow	[Body]
[PATCH 6.18 210/395] tcp: prevent collapsing skbs across boundary in rtx queue	[Body]
[PATCH 6.18 211/395] sctp: discard the rest of the packet on a stale-cookie error	[Body]
[PATCH 6.18 212/395] af_packet: fix integer overflow in prb_calc_retire_blk_tmo()	[Body]
[PATCH 6.18 213/395] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2	[Body]
[PATCH 6.18 214/395] arm64: errata: match the target implementation CPUs own MIDR	[Body]
[PATCH 6.18 215/395] ata: libata-scsi: bound the ATA passthru sense descriptor writes	[Body]
[PATCH 6.18 216/395] bna: prevent IOC timer rearm during teardown	[Body]
[PATCH 6.18 217/395] bpf: fs/xattr: dont assume the inode is locked in path_unlink/path_rmdir	[Body]
[PATCH 6.18 218/395] crypto: s390/hmac - Generate intermediate CV for API partial block handling	[Body]
[PATCH 6.18 219/395] cgroup/pids: Restore pids.events notifications in local mode	[Body]
[PATCH 6.18 220/395] fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT	[Body]
[PATCH 6.18 221/395] fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbots "WARNING in do_new_mount" saga	[Body]
[PATCH 6.18 222/395] writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes	[Body]
[PATCH 6.18 223/395] workqueue: Fix NULL current_pwq deref in flush dependency check	[Body]
[PATCH 6.18 224/395] writeback: report a Tasks-RCU quiescent state per cgwb drain pass	[Body]
[PATCH 6.18 225/395] fsl/fman: Fix clk reference leak in read_dts_node()	[Body]
[PATCH 6.18 226/395] ipe: fix use-after-free when auditing a newly loaded policy	[Body]
[PATCH 6.18 227/395] ipe: protect the dm-verity root hash with RCU	[Body]
[PATCH 6.18 228/395] ipv6: do not let ipv6_find_hdr() return an offset past the packet end	[Body]
[PATCH 6.18 229/395] ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST	[Body]
[PATCH 6.18 230/395] gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()	[Body]
[PATCH 6.18 231/395] gpio: cdev: fix kernel stack leak to user-space in error path	[Body]
[PATCH 6.18 232/395] gpio: zynq: fix runtime PM leak on request error path	[Body]
[PATCH 6.18 233/395] llc: reserve device headroom for allocated frames	[Body]
[PATCH 6.18 234/395] mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()	[Body]
[PATCH 6.18 235/395] rds: ib: Clear the sg list when mapping an MR fails	[Body]
[PATCH 6.18 236/395] drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()	[Body]
[PATCH 6.18 237/395] drm/imagination: Fix page count for page table for map() interface	[Body]
[PATCH 6.18 238/395] drm/i915: fix incorrect RCU teardown order	[Body]
[PATCH 6.18 239/395] drm/i915/dp_mst: Fix configuring FEC for a disconnected stream	[Body]
[PATCH 6.18 240/395] drm/i915/dp_mst: Fix configuring TUs for a disconnected stream	[Body]
[PATCH 6.18 241/395] drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()	[Body]
[PATCH 6.18 242/395] drm/amd/display: Bump frame warning limit for clang builds of dml	[Body]
[PATCH 6.18 243/395] drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()	[Body]
[PATCH 6.18 244/395] drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()	[Body]
[PATCH 6.18 245/395] drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()	[Body]
[PATCH 6.18 246/395] drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM	[Body]
[PATCH 6.18 247/395] drm/nouveau: fix autosuspend cleanup during teardown	[Body]
[PATCH 6.18 248/395] drm/nouveau: Fix bridge reference leak in nv1a_ram_new()	[Body]
[PATCH 6.18 249/395] drm/nouveau: fix double-free in nvif_vmm_dtor	[Body]
[PATCH 6.18 250/395] drm/nouveau: Fix gem reference leak in validate_init()	[Body]
[PATCH 6.18 251/395] drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()	[Body]
[PATCH 6.18 252/395] drm/nouveau: RCU-free the scheduler-containing nouveau_sched	[Body]
[PATCH 6.18 253/395] drm/nouveau: dont bump pin count on failed re-pin in nouveau_bo_pin_locked()	[Body]
[PATCH 6.18 254/395] drm/xe/vm: nuke PTs only after unlinking contested VMAs	[Body]
[PATCH 6.18 255/395] drm/xe: harden adjust_idledly() against divide-by-zero and overflow	[Body]
[PATCH 6.18 256/395] drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV	[Body]
[PATCH 6.18 257/395] drm/xe: Keep walking on SVM eviction failure	[Body]
[PATCH 6.18 258/395] drm/virtio: fix memory leak of fence event on execbuffer failure	[Body]
[PATCH 6.18 259/395] drm/virtio: fix NULL pointer dereference on fence allocation failure	[Body]
[PATCH 6.18 260/395] gpio: tps65219: Fix GPIO input value reads	[Body]
[PATCH 6.18 261/395] gpio: tps65219: Use the variant-specific direction callback	[Body]
[PATCH 6.18 262/395] gpio: tps65219: Fix TPS65214 GPIO direction programming	[Body]
[PATCH 6.18 263/395] mm/hugetlb: preserve mremap address delta when skipping page tables	[Body]
[PATCH 6.18 264/395] mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()	[Body]
[PATCH 6.18 265/395] PCI: of_property: Omit bus properties without a subordinate bus	[Body]
[PATCH 6.18 266/395] packet: use ubuf_info completion for TX_RING packets	[Body]
[PATCH 6.18 267/395] HID: alps: fix use-after-free on input2 registration failure	[Body]
[PATCH 6.18 268/395] HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard	[Body]
[PATCH 6.18 269/395] HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()	[Body]
[PATCH 6.18 270/395] net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()	[Body]
[PATCH 6.18 271/395] net/mlx5e: advertise MACsec offload only when supported	[Body]
[PATCH 6.18 272/395] net/mlx5e: fix swapped IPv6 IPsec policy masks	[Body]
[PATCH 6.18 273/395] net/sched: reject IDR error pointers when deleting actions	[Body]
[PATCH 6.18 274/395] net: airoha: npu: cancel wdt_work after releasing the WDT IRQ	[Body]
[PATCH 6.18 275/395] net: arp: terminate device name before lookup	[Body]
[PATCH 6.18 276/395] net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read	[Body]
[PATCH 6.18 277/395] net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()	[Body]
[PATCH 6.18 278/395] net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry	[Body]
[PATCH 6.18 279/395] net: openvswitch: conntrack: remove add_helper dead code	[Body]
[PATCH 6.18 280/395] net: openvswitch: conntrack: fix helper UAF due to extensions realloc	[Body]
[PATCH 6.18 281/395] net: atl1c: fix soft lockup on out-of-range tpd_cons read	[Body]
[PATCH 6.18 282/395] net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read	[Body]
[PATCH 6.18 283/395] net: bridge: mdb: restart port group walk after deletion	[Body]
[PATCH 6.18 284/395] net: ena: fix PHC cleanup on probe failure	[Body]
[PATCH 6.18 285/395] net: ena: fix MMIO read buffer leak on probe failure	[Body]
[PATCH 6.18 286/395] net: phy: micrel: Advance register data pointer in write loop	[Body]
[PATCH 6.18 287/395] net: txgbe: fix FDIR filter restore for VF rules	[Body]
[PATCH 6.18 288/395] net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist	[Body]
[PATCH 6.18 289/395] net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()	[Body]
[PATCH 6.18 290/395] netfilter: ip6t_rpfilter: reject routes without inet6_dev	[Body]
[PATCH 6.18 291/395] netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read	[Body]
[PATCH 6.18 292/395] netfilter: nf_tables: skip expired catchall elements on insert and delete	[Body]
[PATCH 6.18 293/395] nfc: fix use-after-free in nfc_get_local_general_bytes	[Body]
[PATCH 6.18 294/395] nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()	[Body]
[PATCH 6.18 295/395] nfc: port100: reject frames whose declared length exceeds the received data	[Body]
[PATCH 6.18 296/395] nfc: trf7970a: power down on startup RX gain failure	[Body]
[PATCH 6.18 297/395] scsi: libiscsi_tcp: Check the data direction of a Data-In PDU	[Body]
[PATCH 6.18 298/395] parisc: Increase kernel stack size to 32kb	[Body]
[PATCH 6.18 299/395] perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()	[Body]
[PATCH 6.18 300/395] perf/core: Run sched_task() for PMUs with only CPU-wide events	[Body]
[PATCH 6.18 301/395] pinctrl: single: free the IRQ on domain creation failure	[Body]
[PATCH 6.18 302/395] pinctrl: sunxi: keep a shadow copy of the data register output latches	[Body]
[PATCH 6.18 303/395] s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()	[Body]
[PATCH 6.18 304/395] s390/cmf: Fix virtual vs physical address confusion	[Body]
[PATCH 6.18 305/395] s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()	[Body]
[PATCH 6.18 306/395] s390/pci: Fix missing device lock in zpci_report_status()	[Body]
[PATCH 6.18 307/395] s390/pci: Report SCLP status on error events when no pdev is associated	[Body]
[PATCH 6.18 308/395] s390/pci: Dont report recovery success on skipped recovery	[Body]
[PATCH 6.18 309/395] s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config	[Body]
[PATCH 6.18 310/395] KVM: Ensure memory attributes xarray nodes are accounted to the callers memcg	[Body]
[PATCH 6.18 311/395] KVM: Dont treat reserved xarray entries as having memory attributes	[Body]
[PATCH 6.18 312/395] KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV	[Body]
[PATCH 6.18 313/395] KVM: SEV: Do cache maintenance on the source VM during intra-host migration	[Body]
[PATCH 6.18 314/395] KVM: arm64: Fix AArch32 DBGBXVR<n> handling	[Body]
[PATCH 6.18 315/395] KVM: arm64: Fix spurious warning for benign stage 2 teardown race	[Body]
[PATCH 6.18 316/395] KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race	[Body]
[PATCH 6.18 317/395] KVM: arm64: Transfer the hyp stack pages out of the host stage-2	[Body]
[PATCH 6.18 318/395] RISC-V: KVM: Synchronize hrtimer callback during teardown	[Body]
[PATCH 6.18 319/395] RISC-V: KVM: Propagate interrupted G-stage faults	[Body]
[PATCH 6.18 320/395] RISC-V: KVM: Fix HSM hart status error propagation	[Body]
[PATCH 6.18 321/395] Bluetooth: hci_conn: fix CIS hold ownership on reuse	[Body]
[PATCH 6.18 322/395] Bluetooth: hci_sock: validate event length before filtering	[Body]
[PATCH 6.18 323/395] Bluetooth: hci_sock: reject out-of-range OCF values	[Body]
[PATCH 6.18 324/395] Bluetooth: ISO: balance the parent hold in hci_bind_bis()	[Body]
[PATCH 6.18 325/395] Bluetooth: ISO: release unused CIS holds after channel attach	[Body]
[PATCH 6.18 326/395] Bluetooth: L2CAP: validate frame length before control and FCS access	[Body]
[PATCH 6.18 327/395] Bluetooth: mgmt: fix race in read_unconf_index_list()	[Body]
[PATCH 6.18 328/395] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO	[Body]
[PATCH 6.18 329/395] smb: client: fix create context out-of-bounds reads	[Body]
[PATCH 6.18 330/395] smb: client: clean up failed cached directory opens	[Body]
[PATCH 6.18 331/395] smb: client: preserve create-context parsing errors	[Body]
[PATCH 6.18 332/395] smb: client: validate POSIX create context length	[Body]
[PATCH 6.18 333/395] xfs: dont assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption	[Body]
[PATCH 6.18 334/395] xfs: fix attr fork block count checks in xrep_inode_blockcounts	[Body]
[PATCH 6.18 335/395] xfs: release orphanage dir inode if chown fails	[Body]
[PATCH 6.18 336/395] xfs: use correct jiffies comparison function in xchk_maybe_relax	[Body]
[PATCH 6.18 337/395] xfs: check padding field in xfs_ioc_commit_range	[Body]
[PATCH 6.18 338/395] xfs: dont call xfs_exchange_range_finish for a dry run	[Body]
[PATCH 6.18 339/395] xfs: use the correct reservations for rtrmap/refcount recovery	[Body]
[PATCH 6.18 340/395] xfs: check di_forkoff correctly in scrub	[Body]
[PATCH 6.18 341/395] xfs: fix rtgroup repair estimations	[Body]
[PATCH 6.18 342/395] xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots	[Body]
[PATCH 6.18 343/395] xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits	[Body]
[PATCH 6.18 344/395] xfs: dont let hidden_space go negative in xfs_metafile_resv_init	[Body]
[PATCH 6.18 345/395] xfs: drop dquot flush lock when we cant find a buffer to flush	[Body]
[PATCH 6.18 346/395] xfs: fix blockgc group quota scanning when usrquota isnt enforced	[Body]
[PATCH 6.18 347/395] xfs: fix cursor and pointer handling when recovering iunlink buckets	[Body]
[PATCH 6.18 348/395] net: tls: fix silent data drop under pipe back-pressure	[Body]
[PATCH 6.18 349/395] cgroup/cpuset: Move up prstate_housekeeping_conflict() helper	[Body]
[PATCH 6.18 350/395] cgroup/cpuset: Ensure domain isolated CPUs stay in root or isolated partition	[Body]
[PATCH 6.18 351/395] cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict	[Body]
[PATCH 6.18 352/395] vlan: require the MAC header to be present in __vlan_insert_inner_tag()	[Body]
[PATCH 6.18 353/395] i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL	[Body]
[PATCH 6.18 354/395] drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk	[Body]
[PATCH 6.18 355/395] drm/i915/psr: Fixes for Dell XPS DA14260 quirk	[Body]
[PATCH 6.18 356/395] drm/i915/psr: Disable PSR2 on Xiaomi Book Pro 14 2026 as a quirk	[Body]
[PATCH 6.18 357/395] drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1	[Body]
[PATCH 6.18 358/395] drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()	[Body]
[PATCH 6.18 359/395] drm/client: Remove holds_console_lock parameter from suspend/resume	[Body]
[PATCH 6.18 360/395] drm/client: Pass force parameter to client restore	[Body]
[PATCH 6.18 361/395] drm/client: fix restore of partially initialized client	[Body]
[PATCH 6.18 362/395] mm/rmap: allocate anon_vma_chain objects unlocked when possible	[Body]
[PATCH 6.18 363/395] mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish	[Body]
[PATCH 6.18 364/395] mm/hugetlb: create hstate_is_gigantic_no_runtime helper	[Body]
[PATCH 6.18 365/395] mm/hugetlb: do not dissolve gigantic pages without runtime support	[Body]
[PATCH 6.18 366/395] super: make iterate_supers_type() deletion-safe	[Body]
[PATCH 6.18 367/395] PCI: Fix BAR resize for devices on a root bus	[Body]
[PATCH 6.18 368/395] HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM	[Body]
[PATCH 6.18 369/395] HID: alps: unregister DualPoint Stick input device on remove	[Body]
[PATCH 6.18 370/395] net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths	[Body]
[PATCH 6.18 371/395] net: ipconfig: Remove outdated comment and indent code block	[Body]
[PATCH 6.18 372/395] net: ipconfig: bound DHCP option construction	[Body]
[PATCH 6.18 373/395] perf/x86/intel: Update event constraints and cache_extra_regsfor ADL	[Body]
[PATCH 6.18 374/395] perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification	[Body]
[PATCH 6.18 375/395] perf/x86/intel: Update event constraints and cache_extra_regsfor LNL	[Body]
[PATCH 6.18 376/395] perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints	[Body]
[PATCH 6.18 377/395] x86/sev: Move the internal header	[Body]
[PATCH 6.18 378/395] x86/sev: Add internal header guards	[Body]
[PATCH 6.18 379/395] x86/sev: Carve out the SVSM code into a separate compilation unit	[Body]
[PATCH 6.18 380/395] x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()	[Body]
[PATCH 6.18 381/395] x86/sev: Make vTPM SVSM calls preemption-safe	[Body]
[PATCH 6.18 382/395] net/sched: act_ct: fix helper UAF due to extensions realloc	[Body]
[PATCH 6.18 383/395] net/sched: act_ct: avoid modifying shared unconfirmed ct entry	[Body]
[PATCH 6.18 384/395] RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()	[Body]
[PATCH 6.18 385/395] RISC-V: KVM: Serialize IMSIC attributes with vCPU migration	[Body]
[PATCH 6.18 386/395] Revert "rust: net: phy: fix off-by-one bit positions in device status accessors"	[Body]
[PATCH 6.18 387/395] rust: net: phy: fix off-by-one bit positions in device status accessors	[Body]
[PATCH 6.18 388/395] mm/damon/core: fix unconditionally skip last region	[Body]
[PATCH 6.18 389/395] hfsplus: avoid double unload_nls() on mount failure	[Body]
[PATCH 6.18 390/395] sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags	[Body]
[PATCH 6.18 391/395] rose: keep the route needed for routing loop detection	[Body]
[PATCH 6.18 392/395] rose: guard rose_transmit_link() against a NULL neighbour	[Body]
[PATCH 6.18 393/395] rose: use timer_shutdown_sync() for t0timer teardown	[Body]
[PATCH 6.18 394/395] rose: dont warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3	[Body]
[PATCH 6.18 395/395] bpf: Reject key-less BTF for hash maps	[Body]

ID (for dev)	ab7740b2-2781-483c-972b-ec6210c90241
Status	waiting

Patches (395)

Series Summary

Sessions

Session 2026-09-30