]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commit
6.18-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 20 Jul 2026 15:30:59 +0000 (17:30 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 20 Jul 2026 15:30:59 +0000 (17:30 +0200)
commit42173a867bb167b83af4bd93ede80e71415e726f
tree19021b4af9a8a117d3f41fcb7e230c7f320fe435
parent766c9fb91b20518cf81668843d0ca51357cd1008
6.18-stable patches

added patches:
accel-amdxdna-fix-use-after-free-in-amdxdna_gem_dmabuf_mmap.patch
accel-ivpu-reject-firmware-log-with-size-smaller-than-header.patch
block-fix-ioring_uring_cmd_reissue-flags-check-in-blkdev_uring_cmd.patch
block-fix-race-in-blk_time_get_ns-returning-0.patch
block-remove-redundant-gd_need_part_scan-in-add_disk_final.patch
bpf-add-missing-access_ok-call-to-copy_user_syms.patch
bpf-fork-wipe-bpf_storage-before-bailouts-that-access-it.patch
bpf-reset-register-bounds-before-narrowing-retval-range-in-check_mem_access.patch
bus-mhi-ep-protect-mhi_ep_handle_syserr-in-the-error-path.patch
bus-mhi-host-pci_generic-fix-the-physical-function-check.patch
can-bcm-add-missing-rcu-list-annotations-and-operations.patch
can-bcm-defer-rx_op-deallocation-to-workqueue-to-fix-thrtimer-uaf.patch
can-bcm-fix-lockless-bound-ifindex-race-and-silent-rx_setup-failure.patch
can-esd_usb-kill-anchored-urbs-before-freeing-netdevs.patch
can-isotp-fix-use-after-free-race-with-concurrent-netdev_unregister.patch
can-isotp-serialize-tx-state-transitions-under-so-rx_lock.patch
can-isotp-use-unconditional-synchronize_rcu-in-isotp_release.patch
dm-bufio-fix-wrong-count-calculation-in-dm_bufio_issue_discard.patch
dm-era-fix-out-of-bounds-memory-access-for-non-zero-start-sector.patch
dm-integrity-don-t-increment-hash_offset-twice.patch
dm-integrity-fix-a-bug-if-the-bio-is-out-of-limits.patch
dm-integrity-fix-leaking-uninitialized-kernel-memory.patch
dm-ioctl-fix-a-possible-overflow-in-list_version_get_info.patch
dm-log-fix-a-bitset_size-overflow-on-32bit-machines.patch
dm-pcache-reject-option-groups-without-values.patch
dm-stats-fix-dm_jiffies_to_msec64.patch
dm-stats-fix-merge-accounting.patch
dm-thin-metadata-fix-metadata-snapshot-consistency-on-commit-failure.patch
dm-thin-metadata-fix-superblock-refcount-leak-on-snapshot-shadow-failure.patch
dm-verity-avoid-double-increment-of-use_bh_wq_enabled.patch
dm-verity-fix-a-possible-null-pointer-dereference.patch
dm-verity-increase-sprintf-buffer-size.patch
dm-verity-make-error-counter-atomic.patch
dm_early_create-fix-freeing-used-table-on-dm_resume-failure.patch
dma-fence-make-dma_fence_dedup_array-robust-against-0-count-input.patch
dmaengine-dw-edma-add-spinlock-to-protect-done_int_mask-and-abort_int_mask.patch
dmaengine-tegra-fix-burst-size-calculation.patch
fpga-dfl-add-bounds-check-in-dfh_get_param_size.patch
fpga-microchip-spi-fix-zero-header_size-oob-read-in-mpf_ops_parse_header.patch
hwmon-ltc2992-add-missing-select-regmap_i2c-to-kconfig.patch
hwmon-max6697-add-missing-select-regmap_i2c-to-kconfig.patch
i2c-imx-fix-locked-bus-on-smbus-block-read-of-0-atomic.patch
i2c-imx-fix-locked-bus-on-smbus-block-read-of-0-irq.patch
i2c-mediatek-fix-wrrd-for-socs-without-auto_restart-option.patch
i2c-mlxbf-fix-use-after-free-in-mlxbf_i2c_init_resource.patch
i2c-spacemit-fix-spurious-irq-handling-returning-irq_handled.patch
ice-fix-ice_init_link-error-return-preventing-probe.patch
irqchip-crossbar-use-correct-index-in-crossbar_domain_free.patch
ksmbd-fix-integer-overflow-in-set_file_allocation_info.patch
mtd-maps-vmu-flash-fix-null-pointer-dereference-in-initialization.patch
mtd-rawnand-pause-continuous-reads-at-block-boundaries.patch
mtd-spi-nor-spansion-use-die-erase-for-multi-die-devices-only.patch
mtd-spi-nor-swp-improve-locking-user-experience.patch
net-sparx5-unregister-blocking-notifier-on-init-failure.patch
net-thunderbolt-fix-frags-overflow-by-bounding-frame_count.patch
netdev-genl-report-napi-thread-pid-in-the-caller-s-pid-namespace.patch
nfs-charge-unstable-writes-by-request-size-not-folio-size.patch
nvme-apple-prevent-shared-tags-across-queues-on-apple-a11.patch
nvmet-auth-reject-short-auth_receive-buffers.patch
nvmet-fix-refcount-leak-in-nvmet_sq_create.patch
nvmet-rdma-handle-inline-data-with-a-nonzero-offset.patch
openrisc-fix-jump_label-smp-syncing.patch
pkey-move-keytype-check-from-pkey-api-to-handler.patch
platform-x86-amd-pmc-add-delay_suspend-module-parameter.patch
platform-x86-amd-pmc-check-for-intermediate-wakeup-in-function.patch
platform-x86-amd-pmc-delay-suspend-for-some-lenovo-laptops.patch
platform-x86-amd-pmc-don-t-log-during-intermediate-wakeups.patch
platform-x86-dell-laptop-fix-missing-cleanups-in-init-error-path.patch
platform-x86-isst-restore-sst-pp-control-to-all-domains.patch
s390-pkey-check-length-in-pkey_pckmo-handler-implementation.patch
s390-pkey-check-length-in-pkey_verifyprotk-ioctl.patch
scsi-elx-efct-fix-i-o-leak-on-unsupported-additional-cdb.patch
scsi-elx-efct-fix-refcount-leak-in-efct_hw_io_abort.patch
scsi-hpsa-fix-dma-mapping-leak-on-ioaccel2-reset-path.patch
scsi-lpfc-fix-memory-leak-in-lpfc_sli4_driver_resource_setup.patch
scsi-sg-report-request-table-problems-when-any-status-is-set.patch
scsi-target-bound-pr-out-transportid-parsing-to-the-received-buffer.patch
scsi-target-core-fix-iscsi-isid-use-after-free-in-register-and-move.patch
scsi-xen-scsiback-free-the-command-tag-on-the-tmr-submit-failure-path.patch
scsi-xen-scsiback-free-unsubmitted-command-instead-of-double-putting-it.patch
sctp-validate-stale_cookie-cause-length-before-reading-staleness.patch
selftests-bpf-cover-negative-buffer-pointer-offsets.patch
smb-client-use-kvzalloc-for-megabyte-buffer-in-simple-fallocate.patch
spi-uniphier-fix-completion-initialization-order-before-devm_request_irq.patch
sunrpc-fix-uninitialized-xprt_create_args-structure.patch
taskstats-retain-dead-thread-stats-in-tgid-queries.patch
tcp-decrement-tcp_md5_needed-static-branch.patch
tcp-defer-md5sig_info-kfree-past-rcu-grace-period-in-tcp_connect.patch
time-fix-off-by-one-in-compat-settimeofday-usec-validation.patch
tpm-fix-event_size-output-in-tpm1_binary_bios_measurements_show.patch
tpm-make-the-tpm-character-devices-non-seekable.patch
tpm-restore-timeout-for-key-creation-commands.patch
tpm-tpm2-sessions-wait-for-async-kpp-completion-in-tpm_buf_append_salt.patch
tpm-tpm_tis_spi-use-wait_woken-in-wait_for_tmp_stat.patch
ufs-core-tracing-do-not-dereference-pointers-in-tp_printk.patch
xen-gntdev-fix-error-handling-in-ioctl.patch
xfrm-nat_keepalive-avoid-double-free-on-send-error.patch
xfrm-use-compat-translator-only-for-u64-alignment-mismatch.patch
xfrm-xfrm_interface-require-cap_net_admin-in-the-device-netns-for-changelink.patch
100 files changed:
queue-6.18/accel-amdxdna-fix-use-after-free-in-amdxdna_gem_dmabuf_mmap.patch [new file with mode: 0644]
queue-6.18/accel-ivpu-reject-firmware-log-with-size-smaller-than-header.patch [new file with mode: 0644]
queue-6.18/block-fix-ioring_uring_cmd_reissue-flags-check-in-blkdev_uring_cmd.patch [new file with mode: 0644]
queue-6.18/block-fix-race-in-blk_time_get_ns-returning-0.patch [new file with mode: 0644]
queue-6.18/block-remove-redundant-gd_need_part_scan-in-add_disk_final.patch [new file with mode: 0644]
queue-6.18/bpf-add-missing-access_ok-call-to-copy_user_syms.patch [new file with mode: 0644]
queue-6.18/bpf-fork-wipe-bpf_storage-before-bailouts-that-access-it.patch [new file with mode: 0644]
queue-6.18/bpf-reset-register-bounds-before-narrowing-retval-range-in-check_mem_access.patch [new file with mode: 0644]
queue-6.18/bus-mhi-ep-protect-mhi_ep_handle_syserr-in-the-error-path.patch [new file with mode: 0644]
queue-6.18/bus-mhi-host-pci_generic-fix-the-physical-function-check.patch [new file with mode: 0644]
queue-6.18/can-bcm-add-missing-rcu-list-annotations-and-operations.patch [new file with mode: 0644]
queue-6.18/can-bcm-defer-rx_op-deallocation-to-workqueue-to-fix-thrtimer-uaf.patch [new file with mode: 0644]
queue-6.18/can-bcm-fix-lockless-bound-ifindex-race-and-silent-rx_setup-failure.patch [new file with mode: 0644]
queue-6.18/can-esd_usb-kill-anchored-urbs-before-freeing-netdevs.patch [new file with mode: 0644]
queue-6.18/can-isotp-fix-use-after-free-race-with-concurrent-netdev_unregister.patch [new file with mode: 0644]
queue-6.18/can-isotp-serialize-tx-state-transitions-under-so-rx_lock.patch [new file with mode: 0644]
queue-6.18/can-isotp-use-unconditional-synchronize_rcu-in-isotp_release.patch [new file with mode: 0644]
queue-6.18/dm-bufio-fix-wrong-count-calculation-in-dm_bufio_issue_discard.patch [new file with mode: 0644]
queue-6.18/dm-era-fix-out-of-bounds-memory-access-for-non-zero-start-sector.patch [new file with mode: 0644]
queue-6.18/dm-integrity-don-t-increment-hash_offset-twice.patch [new file with mode: 0644]
queue-6.18/dm-integrity-fix-a-bug-if-the-bio-is-out-of-limits.patch [new file with mode: 0644]
queue-6.18/dm-integrity-fix-leaking-uninitialized-kernel-memory.patch [new file with mode: 0644]
queue-6.18/dm-ioctl-fix-a-possible-overflow-in-list_version_get_info.patch [new file with mode: 0644]
queue-6.18/dm-log-fix-a-bitset_size-overflow-on-32bit-machines.patch [new file with mode: 0644]
queue-6.18/dm-pcache-reject-option-groups-without-values.patch [new file with mode: 0644]
queue-6.18/dm-stats-fix-dm_jiffies_to_msec64.patch [new file with mode: 0644]
queue-6.18/dm-stats-fix-merge-accounting.patch [new file with mode: 0644]
queue-6.18/dm-thin-metadata-fix-metadata-snapshot-consistency-on-commit-failure.patch [new file with mode: 0644]
queue-6.18/dm-thin-metadata-fix-superblock-refcount-leak-on-snapshot-shadow-failure.patch [new file with mode: 0644]
queue-6.18/dm-verity-avoid-double-increment-of-use_bh_wq_enabled.patch [new file with mode: 0644]
queue-6.18/dm-verity-fix-a-possible-null-pointer-dereference.patch [new file with mode: 0644]
queue-6.18/dm-verity-increase-sprintf-buffer-size.patch [new file with mode: 0644]
queue-6.18/dm-verity-make-error-counter-atomic.patch [new file with mode: 0644]
queue-6.18/dm_early_create-fix-freeing-used-table-on-dm_resume-failure.patch [new file with mode: 0644]
queue-6.18/dma-fence-make-dma_fence_dedup_array-robust-against-0-count-input.patch [new file with mode: 0644]
queue-6.18/dmaengine-dw-edma-add-spinlock-to-protect-done_int_mask-and-abort_int_mask.patch [new file with mode: 0644]
queue-6.18/dmaengine-tegra-fix-burst-size-calculation.patch [new file with mode: 0644]
queue-6.18/fpga-dfl-add-bounds-check-in-dfh_get_param_size.patch [new file with mode: 0644]
queue-6.18/fpga-microchip-spi-fix-zero-header_size-oob-read-in-mpf_ops_parse_header.patch [new file with mode: 0644]
queue-6.18/hwmon-ltc2992-add-missing-select-regmap_i2c-to-kconfig.patch [new file with mode: 0644]
queue-6.18/hwmon-max6697-add-missing-select-regmap_i2c-to-kconfig.patch [new file with mode: 0644]
queue-6.18/i2c-imx-fix-locked-bus-on-smbus-block-read-of-0-atomic.patch [new file with mode: 0644]
queue-6.18/i2c-imx-fix-locked-bus-on-smbus-block-read-of-0-irq.patch [new file with mode: 0644]
queue-6.18/i2c-mediatek-fix-wrrd-for-socs-without-auto_restart-option.patch [new file with mode: 0644]
queue-6.18/i2c-mlxbf-fix-use-after-free-in-mlxbf_i2c_init_resource.patch [new file with mode: 0644]
queue-6.18/i2c-spacemit-fix-spurious-irq-handling-returning-irq_handled.patch [new file with mode: 0644]
queue-6.18/ice-fix-ice_init_link-error-return-preventing-probe.patch [new file with mode: 0644]
queue-6.18/irqchip-crossbar-use-correct-index-in-crossbar_domain_free.patch [new file with mode: 0644]
queue-6.18/ksmbd-fix-integer-overflow-in-set_file_allocation_info.patch [new file with mode: 0644]
queue-6.18/mtd-maps-vmu-flash-fix-null-pointer-dereference-in-initialization.patch [new file with mode: 0644]
queue-6.18/mtd-rawnand-pause-continuous-reads-at-block-boundaries.patch [new file with mode: 0644]
queue-6.18/mtd-spi-nor-spansion-use-die-erase-for-multi-die-devices-only.patch [new file with mode: 0644]
queue-6.18/mtd-spi-nor-swp-improve-locking-user-experience.patch [new file with mode: 0644]
queue-6.18/net-sparx5-unregister-blocking-notifier-on-init-failure.patch [new file with mode: 0644]
queue-6.18/net-thunderbolt-fix-frags-overflow-by-bounding-frame_count.patch [new file with mode: 0644]
queue-6.18/netdev-genl-report-napi-thread-pid-in-the-caller-s-pid-namespace.patch [new file with mode: 0644]
queue-6.18/nfs-charge-unstable-writes-by-request-size-not-folio-size.patch [new file with mode: 0644]
queue-6.18/nvme-apple-prevent-shared-tags-across-queues-on-apple-a11.patch [new file with mode: 0644]
queue-6.18/nvmet-auth-reject-short-auth_receive-buffers.patch [new file with mode: 0644]
queue-6.18/nvmet-fix-refcount-leak-in-nvmet_sq_create.patch [new file with mode: 0644]
queue-6.18/nvmet-rdma-handle-inline-data-with-a-nonzero-offset.patch [new file with mode: 0644]
queue-6.18/openrisc-fix-jump_label-smp-syncing.patch [new file with mode: 0644]
queue-6.18/pkey-move-keytype-check-from-pkey-api-to-handler.patch [new file with mode: 0644]
queue-6.18/platform-x86-amd-pmc-add-delay_suspend-module-parameter.patch [new file with mode: 0644]
queue-6.18/platform-x86-amd-pmc-check-for-intermediate-wakeup-in-function.patch [new file with mode: 0644]
queue-6.18/platform-x86-amd-pmc-delay-suspend-for-some-lenovo-laptops.patch [new file with mode: 0644]
queue-6.18/platform-x86-amd-pmc-don-t-log-during-intermediate-wakeups.patch [new file with mode: 0644]
queue-6.18/platform-x86-dell-laptop-fix-missing-cleanups-in-init-error-path.patch [new file with mode: 0644]
queue-6.18/platform-x86-isst-restore-sst-pp-control-to-all-domains.patch [new file with mode: 0644]
queue-6.18/s390-pkey-check-length-in-pkey_pckmo-handler-implementation.patch [new file with mode: 0644]
queue-6.18/s390-pkey-check-length-in-pkey_verifyprotk-ioctl.patch [new file with mode: 0644]
queue-6.18/scsi-elx-efct-fix-i-o-leak-on-unsupported-additional-cdb.patch [new file with mode: 0644]
queue-6.18/scsi-elx-efct-fix-refcount-leak-in-efct_hw_io_abort.patch [new file with mode: 0644]
queue-6.18/scsi-hpsa-fix-dma-mapping-leak-on-ioaccel2-reset-path.patch [new file with mode: 0644]
queue-6.18/scsi-lpfc-fix-memory-leak-in-lpfc_sli4_driver_resource_setup.patch [new file with mode: 0644]
queue-6.18/scsi-sg-report-request-table-problems-when-any-status-is-set.patch [new file with mode: 0644]
queue-6.18/scsi-target-bound-pr-out-transportid-parsing-to-the-received-buffer.patch [new file with mode: 0644]
queue-6.18/scsi-target-core-fix-iscsi-isid-use-after-free-in-register-and-move.patch [new file with mode: 0644]
queue-6.18/scsi-xen-scsiback-free-the-command-tag-on-the-tmr-submit-failure-path.patch [new file with mode: 0644]
queue-6.18/scsi-xen-scsiback-free-unsubmitted-command-instead-of-double-putting-it.patch [new file with mode: 0644]
queue-6.18/sctp-validate-stale_cookie-cause-length-before-reading-staleness.patch [new file with mode: 0644]
queue-6.18/selftests-bpf-cover-negative-buffer-pointer-offsets.patch [new file with mode: 0644]
queue-6.18/series
queue-6.18/smb-client-use-kvzalloc-for-megabyte-buffer-in-simple-fallocate.patch [new file with mode: 0644]
queue-6.18/spi-uniphier-fix-completion-initialization-order-before-devm_request_irq.patch [new file with mode: 0644]
queue-6.18/sunrpc-fix-uninitialized-xprt_create_args-structure.patch [new file with mode: 0644]
queue-6.18/taskstats-retain-dead-thread-stats-in-tgid-queries.patch [new file with mode: 0644]
queue-6.18/tcp-decrement-tcp_md5_needed-static-branch.patch [new file with mode: 0644]
queue-6.18/tcp-defer-md5sig_info-kfree-past-rcu-grace-period-in-tcp_connect.patch [new file with mode: 0644]
queue-6.18/time-fix-off-by-one-in-compat-settimeofday-usec-validation.patch [new file with mode: 0644]
queue-6.18/tpm-fix-event_size-output-in-tpm1_binary_bios_measurements_show.patch [new file with mode: 0644]
queue-6.18/tpm-make-the-tpm-character-devices-non-seekable.patch [new file with mode: 0644]
queue-6.18/tpm-restore-timeout-for-key-creation-commands.patch [new file with mode: 0644]
queue-6.18/tpm-tpm2-sessions-wait-for-async-kpp-completion-in-tpm_buf_append_salt.patch [new file with mode: 0644]
queue-6.18/tpm-tpm_tis_spi-use-wait_woken-in-wait_for_tmp_stat.patch [new file with mode: 0644]
queue-6.18/ufs-core-tracing-do-not-dereference-pointers-in-tp_printk.patch [new file with mode: 0644]
queue-6.18/xen-gntdev-fix-error-handling-in-ioctl.patch [new file with mode: 0644]
queue-6.18/xfrm-nat_keepalive-avoid-double-free-on-send-error.patch [new file with mode: 0644]
queue-6.18/xfrm-use-compat-translator-only-for-u64-alignment-mismatch.patch [new file with mode: 0644]
queue-6.18/xfrm-xfrm_interface-require-cap_net_admin-in-the-device-netns-for-changelink.patch [new file with mode: 0644]