From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, akpm@linux-foundation.org,
torvalds@linux-foundation.org, stable@vger.kernel.org
Cc: lwn@lwn.net, jslaby@suse.cz,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: Linux 6.18.35
Date: Tue, 9 Jun 2026 12:51:48 +0200 [thread overview]
Message-ID: <2026060949-banish-fox-9ba4@gregkh> (raw)
I'm announcing the release of the 6.18.35 kernel.
All users of the 6.18 kernel series must upgrade.
The updated 6.18.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.18.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/netlink/genetlink-c.yaml | 9
Documentation/netlink/genetlink-legacy.yaml | 9
Documentation/netlink/genetlink.yaml | 9
Documentation/netlink/netlink-raw.yaml | 9
Documentation/netlink/specs/handshake.yaml | 8
Makefile | 2
arch/arm64/include/asm/tlb.h | 2
arch/arm64/kvm/nested.c | 33 -
arch/arm64/kvm/pmu-emul.c | 4
arch/arm64/kvm/vgic/vgic-its.c | 6
arch/mips/dec/platform.c | 109 ++++
arch/riscv/include/asm/syscall_wrapper.h | 4
arch/x86/kernel/cpu/cpuid-deps.c | 1
arch/x86/kernel/fpu/signal.c | 11
arch/x86/kernel/ftrace.c | 7
arch/x86/kvm/svm/avic.c | 35 +
arch/x86/kvm/svm/sev.c | 76 ++-
drivers/accel/rocket/rocket_gem.c | 17
drivers/android/binder/allocation.rs | 8
drivers/android/binder/process.rs | 7
drivers/android/binder/transaction.rs | 11
drivers/auxdisplay/line-display.c | 2
drivers/bluetooth/btusb.c | 8
drivers/bluetooth/hci_qca.c | 42 -
drivers/comedi/drivers/comedi_test.c | 5
drivers/counter/counter-core.c | 3
drivers/cpufreq/intel_pstate.c | 13
drivers/gpio/gpio-adnp.c | 4
drivers/gpio/gpio-mxc.c | 2
drivers/gpio/gpio-rockchip.c | 23 -
drivers/gpio/gpio-virtuser.c | 4
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11
drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 1
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4
drivers/gpu/drm/bridge/sil-sii8620.c | 1
drivers/gpu/drm/drm_gem.c | 2
drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 ++++-
drivers/gpu/drm/i915/display/intel_display_core.h | 1
drivers/gpu/drm/i915/display/intel_display_irq.c | 8
drivers/gpu/drm/i915/display/intel_display_types.h | 3
drivers/gpu/drm/i915/display/intel_dpcd.h | 15
drivers/gpu/drm/i915/display/intel_psr.c | 60 +-
drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 -
drivers/gpu/drm/xe/xe_guc_ads.c | 5
drivers/hid/hid-ids.h | 1
drivers/hid/hid-picolcd_cir.c | 1
drivers/hid/hid-quirks.c | 1
drivers/hid/wacom_sys.c | 13
drivers/hid/wacom_wac.h | 1
drivers/hwmon/pmbus/adm1266.c | 7
drivers/hwmon/pmbus/pmbus.h | 5
drivers/hwmon/pmbus/pmbus_core.c | 8
drivers/i2c/busses/i2c-davinci.c | 2
drivers/iio/adc/ad4695.c | 23 -
drivers/iio/adc/mt6359-auxadc.c | 1
drivers/iio/adc/npcm_adc.c | 25 -
drivers/iio/adc/viperboard_adc.c | 4
drivers/iio/adc/xilinx-xadc-core.c | 11
drivers/iio/buffer/industrialio-hw-consumer.c | 4
drivers/iio/chemical/mhz19b.c | 17
drivers/iio/chemical/scd30_core.c | 2
drivers/iio/common/ssp_sensors/ssp_dev.c | 1
drivers/iio/dac/ad3530r.c | 54 +-
drivers/iio/dac/ad5686.c | 56 +-
drivers/iio/dac/ad5686.h | 1
drivers/iio/dac/max5821.c | 9
drivers/iio/gyro/adis16260.c | 3
drivers/iio/gyro/itg3200_buffer.c | 2
drivers/iio/imu/adis16550.c | 2
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 2
drivers/iio/industrialio-buffer.c | 1
drivers/iio/inkern.c | 6
drivers/iio/light/cm3323.c | 5
drivers/iio/light/veml6070.c | 14
drivers/iio/magnetometer/st_magn_core.c | 13
drivers/iio/pressure/bmp280-core.c | 2
drivers/iio/temperature/tsys01.c | 2
drivers/input/joystick/xpad.c | 14
drivers/input/misc/ims-pcu.c | 2
drivers/input/mouse/elan_i2c_core.c | 5
drivers/input/mouse/synaptics.c | 1
drivers/input/touchscreen/atmel_mxt_ts.c | 2
drivers/input/touchscreen/usbtouchscreen.c | 5
drivers/iommu/io-pgtable-arm-v7s.c | 18
drivers/mailbox/mailbox.c | 15
drivers/mailbox/tegra-hsp.c | 2
drivers/md/bcache/super.c | 3
drivers/media/cec/core/cec-core.c | 2
drivers/media/common/siano/smsir.c | 1
drivers/media/i2c/ir-kbd-i2c.c | 2
drivers/media/pci/bt8xx/bttv-input.c | 3
drivers/media/pci/cx23885/cx23885-input.c | 1
drivers/media/pci/cx88/cx88-input.c | 3
drivers/media/pci/dm1105/dm1105.c | 1
drivers/media/pci/mantis/mantis_input.c | 1
drivers/media/pci/saa7134/saa7134-input.c | 1
drivers/media/pci/smipcie/smipcie-ir.c | 1
drivers/media/pci/ttpci/budget-ci.c | 1
drivers/media/rc/ati_remote.c | 6
drivers/media/rc/ene_ir.c | 2
drivers/media/rc/fintek-cir.c | 3
drivers/media/rc/igorplugusb.c | 3
drivers/media/rc/iguanair.c | 1
drivers/media/rc/img-ir/img-ir-hw.c | 3
drivers/media/rc/img-ir/img-ir-raw.c | 3
drivers/media/rc/imon.c | 3
drivers/media/rc/ir-hix5hd2.c | 2
drivers/media/rc/ir_toy.c | 1
drivers/media/rc/ite-cir.c | 2
drivers/media/rc/mceusb.c | 1
drivers/media/rc/rc-ir-raw.c | 5
drivers/media/rc/rc-loopback.c | 1
drivers/media/rc/rc-main.c | 6
drivers/media/rc/redrat3.c | 4
drivers/media/rc/st_rc.c | 2
drivers/media/rc/streamzap.c | 7
drivers/media/rc/sunxi-cir.c | 1
drivers/media/rc/ttusbir.c | 4
drivers/media/rc/winbond-cir.c | 2
drivers/media/rc/xbox_remote.c | 5
drivers/media/usb/au0828/au0828-input.c | 1
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 1
drivers/media/usb/dvb-usb/dvb-usb-remote.c | 6
drivers/media/usb/em28xx/em28xx-input.c | 1
drivers/misc/rp1/rp1_pci.c | 1
drivers/net/bonding/bond_main.c | 6
drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c | 3
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 2
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c | 4
drivers/net/ethernet/microsoft/mana/mana_en.c | 76 ++-
drivers/net/macsec.c | 3
drivers/net/phy/micrel.c | 15
drivers/net/phy/mscc/mscc.h | 8
drivers/net/phy/mscc/mscc_main.c | 23 -
drivers/net/team/team_core.c | 51 +-
drivers/net/team/team_mode_loadbalance.c | 4
drivers/net/tun.c | 5
drivers/net/vxlan/vxlan_core.c | 4
drivers/net/wireguard/send.c | 20
drivers/nfc/nxp-nci/i2c.c | 21
drivers/nvme/host/tcp.c | 2
drivers/parport/share.c | 11
drivers/platform/x86/intel/vsec.c | 91 ++--
drivers/s390/cio/chsc.c | 4
drivers/s390/cio/chsc_sch.c | 20
drivers/s390/cio/scm.c | 2
drivers/scsi/fcoe/fcoe_ctlr.c | 2
drivers/scsi/scsi_lib.c | 27 +
drivers/scsi/scsi_transport_fc.c | 77 +--
drivers/spi/spi-mem.c | 15
drivers/staging/media/av7110/av7110_ir.c | 1
drivers/target/iscsi/iscsi_target.c | 5
drivers/target/iscsi/iscsi_target_auth.c | 19
drivers/target/iscsi/iscsi_target_nego.c | 7
drivers/target/iscsi/iscsi_target_parameters.c | 62 ++
drivers/target/iscsi/iscsi_target_parameters.h | 2
drivers/thunderbolt/property.c | 32 +
drivers/tty/serdev/core.c | 21
drivers/tty/serial/8250/8250_dw.c | 2
drivers/tty/serial/8250/8250_port.c | 7
drivers/tty/serial/altera_jtaguart.c | 7
drivers/tty/serial/dz.c | 171 +++----
drivers/tty/serial/fsl_lpuart.c | 15
drivers/tty/serial/pch_uart.c | 19
drivers/tty/serial/qcom_geni_serial.c | 16
drivers/tty/serial/samsung_tty.c | 8
drivers/tty/serial/sh-sci.c | 2
drivers/tty/serial/zs.c | 226 +++-------
drivers/tty/serial/zs.h | 1
drivers/usb/cdns3/cdns3-gadget.c | 12
drivers/usb/cdns3/cdns3-plat.c | 11
drivers/usb/chipidea/core.c | 16
drivers/usb/class/cdc-acm.c | 2
drivers/usb/class/cdc-acm.h | 2
drivers/usb/class/usbtmc.c | 14
drivers/usb/core/config.c | 9
drivers/usb/core/hcd.c | 4
drivers/usb/core/quirks.c | 4
drivers/usb/dwc2/hcd.c | 4
drivers/usb/dwc3/dwc3-xilinx.c | 27 -
drivers/usb/gadget/composite.c | 5
drivers/usb/gadget/function/f_fs.c | 26 +
drivers/usb/gadget/function/f_hid.c | 3
drivers/usb/gadget/function/f_uvc.c | 28 -
drivers/usb/gadget/udc/dummy_hcd.c | 4
drivers/usb/gadget/udc/net2280.c | 4
drivers/usb/host/xhci-tegra.c | 79 +--
drivers/usb/musb/omap2430.c | 3
drivers/usb/serial/belkin_sa.c | 3
drivers/usb/serial/cypress_m8.c | 20
drivers/usb/serial/digi_acceleport.c | 23 -
drivers/usb/serial/keyspan.c | 4
drivers/usb/serial/mct_u232.c | 26 -
drivers/usb/serial/mxuport.c | 8
drivers/usb/serial/omninet.c | 9
drivers/usb/serial/option.c | 9
drivers/usb/serial/safe_serial.c | 11
drivers/usb/storage/unusual_uas.h | 7
drivers/usb/typec/altmodes/displayport.c | 2
drivers/usb/typec/tcpm/tcpci_maxim_core.c | 9
drivers/usb/typec/tcpm/tcpm.c | 117 +++--
drivers/usb/typec/tcpm/wcove.c | 13
drivers/usb/typec/tipd/core.c | 1
drivers/usb/typec/ucsi/displayport.c | 4
drivers/usb/typec/ucsi/ucsi.c | 24 -
drivers/usb/typec/ucsi/ucsi_ccg.c | 5
drivers/usb/usbip/vudc_dev.c | 1
drivers/usb/usbip/vudc_transfer.c | 3
fs/hpfs/alloc.c | 2
fs/smb/client/cifsacl.c | 116 +++--
fs/smb/client/smb2pdu.c | 2
fs/smb/server/smb2pdu.c | 11
fs/smb/server/smbacl.c | 8
include/kunit/test.h | 1
include/linux/compat.h | 4
include/linux/compiler-clang.h | 6
include/linux/compiler_attributes.h | 11
include/linux/compiler_types.h | 4
include/linux/hid.h | 2
include/linux/if_team.h | 3
include/linux/intel_vsec.h | 4
include/linux/mailbox_controller.h | 3
include/linux/parport.h | 1
include/linux/serdev.h | 1
include/linux/serial_core.h | 12
include/linux/syscalls.h | 4
include/media/rc-core.h | 2
include/net/netfilter/nf_tables.h | 7
include/net/xfrm.h | 3
ipc/util.c | 2
lib/debugobjects.c | 2
lib/kunit/executor.c | 19
lib/kunit/test.c | 1
mm/damon/sysfs-schemes.c | 8
mm/memcontrol.c | 6
mm/memfd.c | 12
mm/rmap.c | 2
mm/slab_common.c | 2
mm/slub.c | 1
net/bluetooth/6lowpan.c | 2
net/bluetooth/hci_conn.c | 4
net/bluetooth/hci_sync.c | 16
net/bluetooth/hidp/core.c | 23 -
net/bluetooth/iso.c | 12
net/bluetooth/l2cap_core.c | 41 +
net/bluetooth/l2cap_sock.c | 16
net/bridge/br_netlink.c | 17
net/bridge/br_switchdev.c | 1
net/bridge/br_sysfs_if.c | 30 -
net/bridge/netfilter/ebtables.c | 30 +
net/core/devmem.c | 11
net/core/filter.c | 2
net/core/skbuff.c | 45 +
net/ethtool/cmis.h | 4
net/ethtool/cmis_cdb.c | 9
net/ethtool/cmis_fw_update.c | 44 +
net/ethtool/coalesce.c | 6
net/ethtool/eeprom.c | 10
net/ethtool/linkstate.c | 6
net/ethtool/module.c | 41 +
net/ethtool/netlink.c | 4
net/ethtool/netlink.h | 4
net/ethtool/pse-pd.c | 10
net/ethtool/rss.c | 37 +
net/ethtool/strset.c | 2
net/ethtool/tsconfig.c | 15
net/ethtool/tsinfo.c | 19
net/handshake/genl.c | 3
net/handshake/genl.h | 1
net/handshake/handshake-test.c | 2
net/handshake/handshake.h | 4
net/handshake/netlink.c | 6
net/handshake/request.c | 16
net/handshake/tlshd.c | 6
net/hsr/hsr_forward.c | 4
net/ipv4/ah4.c | 2
net/ipv4/esp4.c | 4
net/ipv4/ip_tunnel_core.c | 22
net/ipv4/sysctl_net_ipv4.c | 2
net/ipv6/ah6.c | 2
net/ipv6/datagram.c | 54 ++
net/ipv6/esp6.c | 4
net/ipv6/exthdrs.c | 6
net/ipv6/ip6_vti.c | 23 -
net/ipv6/route.c | 5
net/iucv/af_iucv.c | 20
net/key/af_key.c | 6
net/l2tp/l2tp_core.c | 11
net/mctp/device.c | 1
net/mctp/neigh.c | 1
net/mctp/route.c | 1
net/mptcp/fastopen.c | 4
net/mptcp/mib.c | 1
net/mptcp/mib.h | 1
net/mptcp/protocol.c | 65 ++
net/mptcp/protocol.h | 31 +
net/mptcp/subflow.c | 8
net/netfilter/nf_conntrack_proto_tcp.c | 3
net/netfilter/nf_synproxy_core.c | 2
net/netfilter/nft_bitwise.c | 18
net/netfilter/nft_byteorder.c | 13
net/netfilter/xt_cpu.c | 2
net/netlink/af_netlink.c | 11
net/nfc/hci/core.c | 10
net/nfc/llcp_core.c | 11
net/nfc/llcp_sock.c | 2
net/nfc/nci/hci.c | 10
net/rxrpc/ar-internal.h | 14
net/rxrpc/call_event.c | 22
net/rxrpc/call_object.c | 2
net/rxrpc/conn_event.c | 32 -
net/rxrpc/insecure.c | 8
net/rxrpc/recvmsg.c | 68 ++-
net/rxrpc/rxgk.c | 147 ++----
net/rxrpc/rxgk_app.c | 46 --
net/rxrpc/rxgk_common.h | 66 +-
net/rxrpc/rxkad.c | 115 +----
net/sched/cls_fw.c | 6
net/sched/sch_netem.c | 40 -
net/sched/sch_sfb.c | 2
net/sctp/socket.c | 2
net/smc/af_smc.c | 4
net/vmw_vsock/af_vsock.c | 49 +-
net/vmw_vsock/hyperv_transport.c | 9
net/vmw_vsock/virtio_transport_common.c | 26 -
net/vmw_vsock/vmci_transport.c | 8
net/xfrm/xfrm_input.c | 16
net/xfrm/xfrm_ipcomp.c | 12
net/xfrm/xfrm_iptfs.c | 29 +
net/xfrm/xfrm_policy.c | 17
net/xfrm/xfrm_state.c | 23 -
net/xfrm/xfrm_user.c | 5
sound/core/oss/pcm_oss.c | 18
sound/firewire/motu/motu-register-dsp-message-parser.c | 11
sound/hda/codecs/realtek/alc269.c | 1
sound/soc/codecs/simple-mux.c | 2
sound/soc/intel/boards/bytcht_es8316.c | 29 +
sound/soc/qcom/qdsp6/q6asm-dai.c | 43 +
sound/usb/mixer_scarlett2.c | 33 +
tools/bootconfig/main.c | 4
tools/net/ynl/pyynl/ynl_gen_c.py | 31 +
tools/testing/cxl/test/cxl.c | 105 +---
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 6
tools/testing/selftests/net/mptcp/mptcp_lib.sh | 10
348 files changed, 3346 insertions(+), 1734 deletions(-)
Abdurrahman Hussain (2):
hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
Advait Dhamorikar (1):
iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
Aldo Conte (1):
iio: light: cm3323: fix reg_conf not being initialized correctly
Alexander Stein (1):
gpio: mxc: fix irq_high handling
Alexandra Winter (1):
net/smc: Do not re-initialize smc hashtables
Alexandre Ghiti (1):
mm: memcontrol: propagate NMI slab stats to memcg vmstats
Alexandru Hossu (1):
scsi: target: iscsi: Validate CHAP_R length before base64 decode
Alexis Lothoré (eBPF Foundation) (1):
x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
Ali Ganiyev (1):
ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
Alice Ryhl (1):
rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
Andrei Vagin (1):
Revert "x86/fpu: Refine and simplify the magic number check during signal return"
Antoniu Miclaus (2):
iio: gyro: adis16260: fix division by zero in write_raw
iio: chemical: scd30: fix division by zero in write_raw
Arnd Bergmann (1):
iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
Ashutosh Desai (1):
nfc: hci: fix out-of-bounds read in HCP header parsing
Balasubramani Vivekanandan (1):
drm/xe: Restore IDLEDLY regiter on engine reset
Bartosz Golaszewski (1):
gpio: adnp: fix flow control regression caused by scoped_guard()
Ben Hutchings (1):
parport: Fix race between port and client registration
Benoît Monin (1):
iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
Berkant Koc (2):
drm/hyperv: validate resolution_count and fix WIN8 fallback
drm/hyperv: validate VMBus packet size in receive callback
Björn Töpel (1):
net: Avoid checksumming unreadable skb tail on trim
Breno Leitao (1):
net/iucv: fix locking in .getsockopt
Carl Lee (1):
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
Chaitanya Sabnis (1):
i2c: davinci: fix division by zero on missing clock-frequency
Chris Mason (1):
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
Christian König (1):
drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
Christofer Jonason (1):
iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
Chuck Lever (3):
net/handshake: Use spin_lock_bh for hn_lock
nvme-tcp: store negative errno in queue->tls_err
net/handshake: Pass negative errno through handshake_complete()
Cássio Gabriel (4):
ALSA: pcm: oss: Fix setup list UAF on proc write error
ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
ASoC: codecs: simple-mux: Fix enum control bounds check
ALSA: firewire-motu: Protect register DSP event queue positions
Dan Carpenter (3):
gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()
usb: dwc2: Fix use after free in debug code
usb: typec: tipd: Fix error code in tps6598x_probe()
David Ahern (1):
xfrm: Check for underflow in xfrm_state_mtu
David Carlier (3):
iio: adc: npcm: fix unbalanced clk_disable_unprepare()
iio: gyro: itg3200: fix i2c read into the wrong stack location
net: devmem: reject dma-buf bind with non-page-aligned size or SG length
David E. Box (2):
platform/x86/intel/vsec: Refactor base_addr handling
platform/x86/intel/vsec: Make driver_data info const
David Francis (1):
drm/amdkfd: Check for pdd drm file first in CRIU restore path
David Howells (2):
rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
David Jeffery (1):
scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
Davide Caratti (1):
net/sched: cls_fw: fix NULL dereference of "old" filters before change()
Dawei Feng (1):
octeontx2-pf: avoid double free of pool->stack on AQ init failure
Dev Jain (1):
mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
Dhabaleshwar Das (1):
accel/rocket: fix UAF via dangling GEM handle in create_bo
Dipayaan Roy (2):
net: mana: Add NULL guards in teardown path to prevent panic on attach failure
net: mana: Skip redundant detach on already-detached port
Dmitriy Zharov (1):
Input: xpad - add support for ASUS ROG RAIKIRI II
Dmitry Torokhov (3):
Input: xpad - fix out-of-bounds access for Share button
Input: elan_i2c - validate firmware size before use
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
Doruk Tan Ozturk (1):
Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
Eric Dumazet (4):
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
Eric Huang (2):
drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
Felix Gu (2):
iio: light: veml6070: Fix resource leak in probe error path
iio: buffer: hw-consumer: fix use-after-free in error path
Fernando Fernandez Mancera (1):
netfilter: nf_tables: fix dst corruption in same register operation
Florian Schmaus (1):
kunit: fix use-after-free in debugfs when using kunit.filter
Florian Westphal (2):
netfilter: xt_cpu: prefer raw_smp_processor_id
netfilter: ebtables: fix OOB read in compat_mtw_from_user
Geoffrey D. Bennett (1):
ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
Greg Kroah-Hartman (13):
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
iio: imu: adis16550: fix stack leak in trigger handler
iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
usb: typec: ucsi: ccg: reject firmware images without a ':' record header
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
usb: typec: altmodes/displayport: validate count before reading Status Update VDO
usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
usb: typec: ucsi: validate connector number in ucsi_connector_change()
Linux 6.18.35
Guangshuo Li (3):
counter: Fix refcount leak in counter_alloc() error path
usb: gadget: net2280: Fix double free in probe error path
usb: gadget: f_hid: fix device reference leak in hidg_alloc()
Guenter Roeck (1):
hwmon: (pmbus) Add support for guarded PMBus lock
Hamza Mahfooz (1):
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
Heitor Alves de Siqueira (4):
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
usb: usbtmc: check URB actual_length for interrupt-IN notifications
usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
Henri A (1):
media: rc: igorplugusb: fix control request setup packet
Herbert Xu (1):
xfrm: ipcomp: Free destination pages on acomp errors
Hongling Zeng (1):
serial: sh-sci: fix memory region release in error path
Hongtao Lee (1):
tools/bootconfig: Fix buf leaks in apply_xbc
Horatiu Vultur (1):
phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
Hyunwoo Kim (2):
KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
KVM: arm64: Reassign nested_mmus array behind mmu_lock
Ian Abbott (2):
comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
Ido Schimmel (2):
bridge: Fix sleep in atomic context in netlink path
bridge: Fix sleep in atomic context in sysfs path
Ilya Maximets (2):
net: netlink: fix sending unassigned nsid after assigned one
net: netlink: don't set nsid on local notifications
Jacques Nilo (3):
serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
serial: 8250: dispatch SysRq character in serial8250_handle_irq()
serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
Jakub Kicinski (26):
ethtool: rss: avoid modifying the RSS context response
ethtool: rss: add missing errno on RSS context delete
ethtool: rss: fix falsely ignoring indir table updates
ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
ethtool: rss: fix hkey leak when indir_size is 0
ethtool: rss: avoid device context leak on reply-build failure
ethtool: module: call ethnl_ops_complete() on module flash errors
ethtool: module: avoid leaking a netdev ref on module flash errors
ethtool: module: avoid racy updates to dev->ethtool bitfield
ethtool: module: check fw_flash_in_progress under rtnl_lock
ethtool: module: fix cleanup if socket used for flashing multiple devices
ethtool: cmis: require exact CDB reply length
ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
ethtool: cmis: validate start_cmd_payload_size from module
ethtool: cmis: validate fw->size against start_cmd_payload_size
ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
ethtool: tsconfig: fix reply error handling
ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error
ethtool: pse-pd: fix missing ethnl_ops_complete()
ethtool: tsconfig: fix missing ethnl_ops_complete()
ethtool: tsinfo: fix uninitialized stats on the by-PHC path
ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback
ethtool: eeprom: add more safeties to EEPROM Netlink fallback
tools: ynl: add scope qualifier for definitions
Jamal Hadi Salim (1):
net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
Jan Volckaert (1):
USB: serial: option: add MeiG SRM813Q
Janusz Krzysztofik (1):
drm/i915: Fix potential UAF in TTM object purge
Jason A. Donenfeld (1):
wireguard: send: append trailer after expanding head
Jassi Brar (1):
mailbox: Fix NULL message support in mbox_send_message()
Jeremy Erazo (1):
usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
Jeremy Kerr (1):
net: mctp: ensure our nlmsg responses are initialised
Jiayuan Chen (2):
ipv6: fix possible infinite loop in rt6_fill_node()
ipv6: fix possible infinite loop in fib6_select_path()
Jijie Shao (1):
net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
Jingguo Tan (2):
vsock/virtio: bind uarg before filling zerocopy skb
xfrm: esp: restore combined single-frag length gate
Johan Hovold (8):
USB: serial: safe_serial: fix memory corruption with small endpoint
USB: serial: omninet: fix memory corruption with small endpoint
USB: serial: keyspan: fix missing indat transfer sanity check
USB: serial: mxuport: fix memory corruption with small endpoint
USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
USB: serial: cypress_m8: fix memory corruption with small endpoint
USB: serial: digi_acceleport: fix memory corruption with small endpoints
USB: serial: mct_u232: fix memory corruption with small endpoint
Jouni Högander (5):
drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
drm/i915/psr: Read Intel DPCD workaround register
drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
Junrui Luo (1):
macsec: fix replay protection at XPN lower-PN wrap
Justin Iurman (1):
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
Kai Aizen (1):
usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
Kim Seer Paller (1):
iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
Kuniyuki Iwashima (1):
ip6: vti: Use ip6_tnl.net in vti6_changelink().
Lee Jones (3):
nfc: llcp: Fix use-after-free in llcp_sock_release()
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
Li Ming (1):
cxl/test: Update mock dev array before calling platform_device_add()
Linpu Yu (1):
ipc: limit next_id allocation to the valid ID range
Liu Kai (1):
HID: remove duplicate hid_warn_ratelimited definition
Luiz Augusto von Dentz (1):
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
Luka Gejak (1):
net: hsr: fix potential OOB access in supervision frame handling
Lukas Wunner (1):
platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
Maciej W. Rozycki (7):
serial: zs: Fix swapped RI/DSR modem line transition counting
serial: dz: Fix bootconsole message clobbering at chip reset
serial: dz: Fix bootconsole handover lockup
serial: dz: Convert to use a platform device
serial: zs: Fix bootconsole handover lockup
serial: zs: Switch to using channel reset
serial: zs: Convert to use a platform device
Maoyi Xie (2):
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
xfrm: route MIGRATE notifications to caller's netns
Marc Harvey (2):
net: team: Remove unused team_mode_op, port_enabled
net: team: Rename port_disabled team mode op to port_tx_disabled
Marco Scardovi (2):
gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
gpio: rockchip: teardown bugs and resource leaks
Matthew Maurer (1):
rust_binder: Avoid holding lock when dropping delivered_death
Matthieu Baerts (NGI0) (1):
selftests: mptcp: drop nanoseconds width specifier
Michael Bommarito (14):
smb: client: validate the whole DACL before rewriting it in cifsacl
l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
xfrm: ah: use skb_to_full_sk in async output callbacks
usbip: vudc: Fix use after free bug in vudc_remove due to race condition
usb: gadget: f_fs: copy only received bytes on short ep0 read
usb: gadget: f_fs: serialize DMABUF cancel against request completion
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
Michael Roth (1):
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
Michal Pecio (2):
usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
usb: core: Fix SuperSpeed root hub wMaxPacketSize
Mikulas Patocka (1):
hpfs: fix a crash if hpfs_map_dnode_bitmap fails
Mingzhe Zou (1):
bcache: fix uninitialized closure object
Minh Nguyen (1):
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
Muhammad Bilal (3):
Bluetooth: HIDP: fix missing length checks in hidp_input_report()
Bluetooth: ISO: fix UAF in iso_recv_frame
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
Myeonghun Pak (1):
serial: altera_jtaguart: handle uart_add_one_port() failures
Myrrh Periwinkle (2):
usb: typec: ucsi: Check if power role change actually happened before handling
usb: typec: ucsi: Don't update power_supply on power role change if not connected
Nathan Chancellor (1):
Disable -Wattribute-alias for clang-23 and newer
Nicolás Bazaes (1):
Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
Oliver Hartkopp (1):
bonding: refuse to enslave CAN devices
Oliver Neukum (1):
media: rc: ttusbir: fix inverted error logic
Paolo Abeni (4):
mptcp: handle first subflow closing consistently
mptcp: borrow forward memory from subflow
mptcp: cleanup fallback dummy mapping generation
mptcp: reset rcv wnd on disconnect
Pavel Begunkov (1):
net: skbuff: fix pskb_carve leaking zcopy pages
Pavitra Jha (1):
Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
Pengpeng Hou (1):
iio: chemical: mhz19b: reject oversized serial replies
Peter Chen (2):
usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles
Peter Oberparleiter (1):
s390/cio: Restore GFP_DMA for CHSC allocation
Prasanna S (1):
serial: qcom-geni: fix UART_RX_PAR_EN bit position
Prathamesh Deshpande (1):
net/mlx5: HWS: Reject unsupported remove-header action
Pratyush Yadav (Google) (1):
memfd: deny writeable mappings when implying SEAL_WRITE
Qbeliw Tanaka (1):
Input: xpad - add "Nova 2 Lite" from GameSir
Qi Tang (1):
ipv6: validate extension header length before copying to cmsg
Qiang Ma (1):
KVM: arm64: PMU: Preserve AArch32 counter low bits
Qing Wang (1):
mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
Radhey Shyam Pandey (1):
usb: dwc3: xilinx: fix error handling in zynqmp init error paths
Radu Sabau (1):
iio: adc: ad4695: Fix call ordering in offload buffer postenable
Rafael J. Wysocki (2):
cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()
cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E
Rahul Chandelkar (1):
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Robert Marko (1):
net: phy: micrel: fix LAN8814 QSGMII soft reset
Rodrigo Alencar (4):
iio: dac: ad5686: fix ref bit initialization for single-channel parts
iio: dac: ad5686: fix input raw value check
iio: dac: ad5686: acquire lock when doing powerdown control
iio: dac: ad5686: fix powerdown control on dual-channel devices
Salah Triki (4):
iio: dac: max5821: fix return value check in powerdown sync
iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
iio: temperature: tsys01: fix broken PROM checksum validation
Sam Burkels (1):
usb: storage: Add quirks for PNY Elite Portable SSD
Sanjay Chitroda (1):
iio: ssp_sensors: cancel delayed work_refresh on remove
Santhosh Kumar K (1):
spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
Sean Christopherson (8):
KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
KVM: SEV: Ignore Port I/O requests of length '0'
KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests
KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
KVM: SEV: Compute the correct max length of the in-GHCB scratch area
KVM: SEV: Check PSC request indices against the actual size of the buffer
KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
Sean Shen (1):
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
Sean Young (1):
media: rc: fix race between unregister and urb/irq callbacks
Sebastian Reichel (1):
usb: typec: tcpm: improve handling of DISCOVER_MODES failures
SeongJae Park (1):
mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
Seungjin Bae (1):
usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
Shaomin Chen (1):
xfrm: iptfs: reset runtime state when cloning SAs
Shardul Bankar (1):
mptcp: do not drop partial packets
Shitalkumar Gandhi (1):
serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
Shuai Zhang (3):
Bluetooth: btusb: Allow firmware re-download when version matches
Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
Bluetooth: hci_qca: Convert timeout from jiffies to ms
Siwei Zhang (2):
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
Srinivas Kandagatla (3):
ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
ASoC: qcom: q6asm-dai: close stream only when running
ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
Stepan Ionichev (1):
auxdisplay: line-display: fix OOB read on zero-length message_store()
Stephen J. Fuhry (1):
USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
Steve French (1):
smb: client: fix uninitialized variable in smb2_writev_callback
Svyatoslav Ryhel (1):
iio: Fix iio_multiply_value use in iio_read_channel_processed_scale
Thomas Fourier (1):
Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
Timur Kristóf (1):
drm/amd/pm/si: Disregard vblank time when no displays are connected
Tom Lendacky (1):
x86/mm: Disable broadcast TLB flush when PCID is disabled
Tudor Ambarus (1):
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
Usama Arif (1):
xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
Uwe Kleine-König (2):
serdev: Provide a bustype shutdown function
Bluetooth: hci_qca: Migrate to serdev specific shutdown function
Victor Nogueria (1):
net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Viken Dadhaniya (1):
serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
Wanquan Zhong (1):
USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
Wei-Cheng Chen (1):
xhci: tegra: Fix ghost USB device on dual-role port unplug
Weiming Shi (3):
tun: free page on short-frame rejection in tun_xdp_one()
tun: free page on build_skb failure in tun_xdp_one()
net: team: fix NULL pointer dereference in team_xmit during mode change
Wentao Guan (1):
USB: cdc-acm: Fix bit overlap and move quirk definitions to header
Wentao Liang (1):
usb: musb: omap2430: Fix use-after-free in omap2430_probe()
Xiaolei Wang (1):
misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
Xu Yang (1):
usb: chipidea: core: convert ci_role_switch to local variable
Yongchao Wu (1):
usb: cdns3: gadget: fix request skipping after clearing halt
Yuqi Xu (1):
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
Zeng Heng (1):
arm64: tlb: Flush walk cache when unsharing PMD tables
Zhang Cen (2):
USB: serial: belkin_sa: validate interrupt status length
USB: serial: cypress_m8: validate interrupt packet headers
Zhang Heng (1):
ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
Zhao Dongdong (1):
Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
Zhaoyang Yu (1):
tty: serial: pch_uart: add check for dma_alloc_coherent()
Zhengchuan Liang (2):
ipv6: exthdrs: refresh nh after handling HAO option
xfrm: input: hold netns during deferred transport reinjection
Zhenghang Xiao (3):
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
sctp: fix race between sctp_wait_for_connect and peeloff
drm/gem: fix race between change_handle and handle_delete
Ziyi Guo (1):
drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
Ziyu Zhang (1):
vsock: keep poll shutdown state consistent
hlleng (1):
HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
next reply other threads:[~2026-06-09 10:52 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-09 10:51 Greg Kroah-Hartman [this message]
2026-06-09 10:51 ` Linux 6.18.35 Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026060949-banish-fox-9ba4@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=lwn@lwn.net \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.