<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/git/stable/linux-stable.git/include, branch master</title>
<subtitle>Linux kernel stable tree</subtitle>
<id>https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/atom?h=master</id>
<link rel='self' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/atom?h=master'/>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/'/>
<updated>2026-08-28T23:37:55+00:00</updated>
<entry>
<title>Merge tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel</title>
<updated>2026-08-28T23:37:55+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-28T23:37:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=a99d741df7372f2175677673d78a6335f3e0706f'/>
<id>urn:sha1:a99d741df7372f2175677673d78a6335f3e0706f</id>
<content type='text'>
Pull more drm updates from Dave Airlie:
 "As mentioned last week, an msm pull request fell down the side of the
  couch or whatever the email equivalent of that is. This has the msm
  next stuff + the usual fixes for amd/intel.

  core:
   - use drm_warn instead of warn

  msm:
   - Bindings:
      - Added Shikra support
      - Document a840, a704, a722
   - Core:
      - Use drm_client buffers for fbdev emulation
      - teardown fixes
      - ARM32 DMA fixup
      - Remove objects from evict list when re-validated
      - Bunch of corner case and error path fixes
   - DPU:
      - Dropped dev_pm_opp_set_rate(0) preventing burnout
      - Fixed SSPP offsets of Kaanapali
   - DP:
      - Dropped dev_pm_opp_set_rate(0) preventing burnout
      - Cleaned up core code in preparation for MST support
      - Fixed prepare() to let Pipewire continue in case of the unplugged cable
   - GPU:
      - Add support for a704
      - Add support for a722
   - HDMI:
      - Simplifed register access

  amdgpu:
   - eGPU fixes
   - Runtime PM fix
   - UserQ fixes
   - Backlight fix
   - Discovery sysfs fix
   - Reset handling fixes
   - Buffer func handling fix for xgmi
   - VCN boundary check fix
   - DC lut handling fixes
   - MES fixes
   - UVD fix
   - VCE 3 fix
   - Enforce isolation fix
   - HPD fix for VGA/LVDS
   - DML fix
   - DCN 6 fixes
   - DC gpu reset fix

  amdkfd:
   - Fix return value
   - CU occupancy for GFX 11
   - CU occupancy for GFX 12/12.1
   - Queue bounds checking fix
   - SVM fixes
   - CRIU bounds checking fix

  radeon:
   - iMac display fix

  xe:
   - error message cleanups
   - i2c global register definitions as dependency for xe/i2c fixes
   - Media workardound
   - Add CCS to gt_idle debugfs print
   - Page fault related fix
   - i2c related fixes
   - System Controller mailbox bit fix"

* tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits)
  drm/xe/sysctrl: Read mailbox phase bit from hardware
  drm/xe/i2c: Keep the i2c controller always enabled
  drm/xe/i2c: Fix the interrupt handling
  i2c: designware: Global register definitions
  drm/xe: Reject page faults from non-fault-mode scratch VMs
  drm/xe/xe_gt_idle: Add CCS to the powergating info print
  drm/xe: Do not apply WA 14025883347 to media 3503
  drm/amd/display: fix dc_lock leak on GPU reset error paths
  drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule
  drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10
  drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
  drm/amdgpu/userq: fix lock missing for userq fence error set
  drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
  drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
  drm/amd/display: Log details when failing to register HPD IRQ
  drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
  drm/amdgpu: clamp the isolation index for rings outside a partition
  drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
  drm/amdgpu: Fix VCE 3 ring align_mask
  drm/kfd: Add CU occupancy support to GFX12.1
  ...
</content>
</entry>
<entry>
<title>Merge tag 'ceph-for-7.3-rc1' of https://github.com/ceph/ceph-client</title>
<updated>2026-08-28T18:51:05+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-28T18:51:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=548e7bcd0c5460ddcbca9600cea603ebeebf4da7'/>
<id>urn:sha1:548e7bcd0c5460ddcbca9600cea603ebeebf4da7</id>
<content type='text'>
Pull ceph updates from Ilya Dryomov:
 "A wide variety of mostly CephFS fixes and cleanups, split between
  changes that address edge cases (Sam, Xiubo, Matthew), efficiency
  improvements (Max) and AI-assisted hardening (Michael, Jeremy).

  One thing that stands out is Alex's change to how CephFS behaves in
  NEARFULL scenarios: the long-standing "make all writes synchronous"
  behavior has become opt-in. It was always somewhat controversial and
  doesn't make much sense for modern deployments; the new default is to
  continue normal operation (i.e. buffer writes as MDS allows, etc). The
  behavior in case the cluster reaches any FULL state remains the same
  as before"

* tag 'ceph-for-7.3-rc1' of https://github.com/ceph/ceph-client: (32 commits)
  ceph: force a cap message when a deferred revoke can't be acked immediately
  libceph: reject buckets with mismatched CRUSH ids
  ceph: reject export_targets ranks &gt;= CEPH_MAX_MDS in mdsmap decode
  ceph: fix leaked inode reference on writeback abort at umount
  libceph: remove ceph_put_page_vector()
  libceph: validate banner payload length
  ceph: make nearfull sync writes opt-in
  ceph: do not repeat ceph_trim_dentries() if no progress possible
  ceph: drop mdsc-&gt;mutex before decoding the MDS reply
  ceph: fix UAF in check_new_map() on session freed during unlock
  ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
  ceph: pass inode pointer around instead of reloading it
  ceph: mark cap remove with RB_CLEAR_NODE() instead of setting ci=NULL
  ceph: add helper function ceph_cap_is_removed()
  ceph: make __ceph_remove_cap() static
  ceph: cap delegated inode count in ceph_parse_deleg_inos()
  ceph: bound num_export_targets array for mds info v2/v3
  ceph: bound MDSCapAuth path and fs_name decode in handle_session()
  ceph: bound xattr value length in __build_xattrs()
  ceph: bound copied dentry name length in NFS export get_name
  ...
</content>
</entry>
<entry>
<title>Merge tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs</title>
<updated>2026-08-28T17:59:07+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-28T17:59:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=ce727a090be04dc7c51edd5c0da2a41d2fb6e106'/>
<id>urn:sha1:ce727a090be04dc7c51edd5c0da2a41d2fb6e106</id>
<content type='text'>
Pull UBI and UBIFS updates from Richard Weinberger:
 "UBI:
   - Support for a per-device wear-leveling threshold
   - Various fixes and cleanups of error paths
   - Correctly preserve torture flag up wear-leveling

  UBIFS:
   - Various fixes and cleanups of error paths and kernel-doc"

* tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
  UBI: support per-device wear-leveling threshold
  UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
  mtd: ubi: Release device reference on busy detach
  ubi: Fix rollback for explicit UBI device numbers
  ubifs: fix out-of-bounds read in signature length check
  UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
  UBI: Preserve torture flag when rescheduling failed erasures
  ubifs: ubifs.h: clean up kernel-doc comments
  ubifs: key.h: use correct function parameter name
  ubifs: debug.h: fix kernel-doc struct prototypes
</content>
</entry>
<entry>
<title>Merge tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs</title>
<updated>2026-08-28T17:48:48+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-28T17:48:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=115bd364ab20b2dbef22824ec80d15901847dbe2'/>
<id>urn:sha1:115bd364ab20b2dbef22824ec80d15901847dbe2</id>
<content type='text'>
Pull f2fs updates from Jaegeuk Kim:
 "In this round, key enhancements focus on reducing inode management
  memory overhead, introducing resizable tail sections with unified
  pinned allocation, and boosting I/O throughput via parallel
  multi-device flushes and asynchronous f2fs_write_end_io() execution.
  We also add dynamic device alias reservations to allow on-the-fly
  space donation from user partitions.

  Alongside these features, critical bug fixes resolve folio race
  conditions, lingering dirty flags, dentry and block counter leaks, and
  potential deadloops in f2fs_fsync_node_pages(). Additional stability
  patches address error-path handling across symlink, sync, and
  rename/unlink operations, prevent pinned file fragmentation, and
  correct segment migration and free section accounting in
  free_segment_range.

  Enhancements:
   - reduce memory footprint of ino management
   - support dynamic reserve/release for device aliasing
   - issue multi-device flushes in parallel
   - add a way to run f2fs_write_end_io() asynchronously
   - support resizable tail section and unify pinned allocation

  Bug fixes:
   - fix to pass folio-&gt;index to f2fs_sanity_check_node_footer()
   - fix folio_nr_pages() race after put in large folio invalidate
   - fix to clear dirty flag on folio in error path
   - accurately adjust free_sections during free_segment_range
   - fix to avoid potential deadloop in f2fs_fsync_node_pages()
   - fix the error path in symlink, device alias in rename/unlink,
     f2fs_sync_fs
   - fix to migrate all curseg types during free_segment_range
   - fix to avoid pinfile fragment on fragment:{block, segment} mode
   - fix valid block count leak on data block allocation failure
   - fix dentry folio leak in find_in_level
   - reject overlapping move range after len expansion
   - fix some bugs related to file pinning, GC functions, i_size

  And, the series includes a number of minor bug fixes"

* tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (51 commits)
  f2fs: support resizable tail section and unify pinned allocation
  f2fs: don't leave the hashed inode while it's unlinked
  f2fs: accurately adjust free_sections during free_segment_range
  f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
  f2fs: use adjusted write range after f2fs_write_checks()
  f2fs: fix to propagate error from f2fs_sync_fs()
  f2fs: return symlink writeback errors
  f2fs: fix error handling on device alias check in rename and unlink
  f2fs: fix to reset all pinned status during fggc
  f2fs: use f2fs_{down, up}_(read, write}_trace() for nat_tree_lock
  f2fs: reduce memory footprint of ino management
  f2fs: fix i_size when pinned fallocate partially fails
  f2fs: fix to migrate all curseg types during free_segment_range
  f2fs: avoid setting SBI_NEED_FSCK on transient resize failure
  f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
  f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
  f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
  f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
  f2fs: unify add/remove ino entry API for all ino types
  f2fs: fix to zero post-EOF data when extending file size
  ...
</content>
</entry>
<entry>
<title>Merge tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound</title>
<updated>2026-08-28T17:01:02+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-28T17:01:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=c20313e98b04ce543936431b6122dd639d3a8346'/>
<id>urn:sha1:c20313e98b04ce543936431b6122dd639d3a8346</id>
<content type='text'>
Pull sound fixes from Takashi Iwai:
 "A collection of various small fixes since the last PR. Most changes
  are device-specific fixes, while there are a few fixes addressing the
  issues reported recently by fuzzers.

  Here are highlights:

  ALSA Core:
   - Prevent adding invalid kcontrols to the LED layer
   - Workaround for a false-positive mutex lockdep warning in rawmidi

  USB-audio:
   - Relaxed the sticky mixer behavior check that caused regressions
   - Fix an OOB write in Novation MIDI output
   - Proper cleanup after system-resume errors
   - Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X
     Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3

  HD-audio:
   - Conexant headset plugin fixes
   - Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3,
     TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9

  ASoC:
   - DAPM: Fix off-by-one check on the second enum channel
   - Tegra: Fix and sort register defaults
   - AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16,
     HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC
   - Fixes Qualcomm TDM handling
   - Fix double put_device() on SoundWire
   - Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926

  Misc:
   - Fix card leak on probe error on ice1712 driver
   - Hardening for legacy aoa, mtpav and pcxhr drivers"

* tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
  ALSA: control: Don't add invalid kcontrols to LED layer
  ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants
  ALSA: hda/conexant: Always enable the headset-mic pin on plugin
  ASoC: dapm: Fix off-by-one check on the second enum channel
  ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16
  ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk
  ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk
  ASoC: soc-generic-dmaengine: Fix DMA channel request warning
  ALSA: rawmidi: Another workaround for false-positive mutex lockdep warning
  ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD
  ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
  ALSA: hda/realtek: Fix speaker mute LED for HP Laptop 15-fd0039nt
  ALSA: usb-audio: Complete cleanup after system-resume errors
  ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8
  ALSA: aoa: i2sbus: Check IRQ before requesting it
  ALSA: usb-audio: Skip mixer creation on M-Audio Venom
  ALSA: usb-audio: Skip reading sample rate on M-Audio Venom
  ASoC: rt766: add RT766/RT767 VA1 device IDs
  ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
  ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
  ...
</content>
</entry>
<entry>
<title>Merge tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd</title>
<updated>2026-08-28T16:36:27+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-28T16:36:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=afe0579334f622c803f2864f22c04c20c320bd80'/>
<id>urn:sha1:afe0579334f622c803f2864f22c04c20c320bd80</id>
<content type='text'>
Pull TPM updates from Jarkko Sakkinen:
 "The bulk of this is Ross Philipson's TPM enablement for Trenchboot.
  That exposes TPM constants, and decouple and improve robustness of
  tpm_buf a bit in order to implement a minimal early TPM driver.

  Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on
  Intel before jumping into kernel's entry point. They re-initalize TPM
  PCRs but leave up to the early boot code measure initrd, boot_params
  and Trenchboot associated metadata.

  The motivation here is just that we would want in future iterations of
  the series put our full focus to the x86 part of the review, and call
  it a day as per TPM changes. Further, even if Trenchboot turned out to
  be empty lottery the worst possible outcome for TPM driver is that
  things get cleaned up a bit"

* tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  tpm-buf: Add TPM buffer support header for standalone reuse
  tpm-buf: Memory-safe allocations
  tpm-buf: Remove chip parameter from tpm_buf_append_handle()
  tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW
  tpm: Remove main TPM header from TPM event log header
  tpm: Move platform specific definitions to the new PTP header
  tpm: Move TPM common base definitions to the command header
  tpm: Move TPM2 specific definitions to the command header
  tpm: Move TPM1 specific definitions to the command header
  tpm: Initial step to reorganize TPM public headers
  tpm: st33zp24: Validate locality read result
  tpm: st33zp24: Return zero on status read failure
  tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null
  tpm: atmel: depend on X86
  tpm: Remove redundant dev_err()
  tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
</content>
</entry>
<entry>
<title>Merge tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net</title>
<updated>2026-08-27T20:53:43+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-27T20:53:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=1b78070aaef63512688aebfbc82365ef9d6660f1'/>
<id>urn:sha1:1b78070aaef63512688aebfbc82365ef9d6660f1</id>
<content type='text'>
Pull networking fixes from Jakub Kicinski:
 "Including fixes from Bluetooth, IPSec and Netfilter.

  Current release - fix to a fix:

   - netfilter: ipset: remove need to allocate memory on delete operations

  Current release - regressions:

   - macb: drop CONFIG_OF #if block, fix build

  Previous releases - always broken:

   - stream of fixes for SCTP continues

   - inet: frags: strip GSO state from fragments before reassembly

   - virtio-net: ensure that TCP packets don't overflow gso_segs

   - tcp-ao: fix use-after-free of current_key on reconnect to another
     peer

   - page_pool: remove zone/policy GFP flags when allocating XArray
     entries

   - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

   - tls: device: fix out-of-bounds write in tls_append_frag()

   - eth: bnxt:
      - ring the doorbell when SW USO exits early, avoid packets stuck
        in Tx
      - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid
        users of older NICs seeing non-actionable warning messages

   - eth: qede: fix NULL pointer dereference in TPA fragment processing"

* tag 'net-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)
  inet: frags: strip GSO state from fragments before reassembly
  net/sched: sch_htb: limit htb_classify inner-class filter hops
  selftests/net: packetdrill: add tcp_urg_ptr_retransmit
  tcp: fix corruption of urgent data on multi-segment retransmit
  usb: atm: usbatm: fix invalid ci_range initialization
  net: fec: only stop PTP if it was initialized
  slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
  net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
  net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
  net: dsa: mxl862xx: enable assisted learning on CPU port
  net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
  net: stmmac: drop gso_enabled_types and rely on netdev features
  net: stmmac: selftests: Don't test flow control for small rx fifos
  net: stmmac: selftests: Account for the UC filter list for filtering tests
  net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
  net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
  net: stmmac: selftests: Check multiple MMC counters
  selftests: net: Fix slow configurations in big_tcp_tunnels.sh
  selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh
  ...
</content>
</entry>
<entry>
<title>Merge tag 'nf-26-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf</title>
<updated>2026-08-27T20:13:18+00:00</updated>
<author>
<name>Jakub Kicinski</name>
<email>kuba@kernel.org</email>
</author>
<published>2026-08-27T20:13:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=4a9d62a8774f130a5b8de26ca9f415e6050a9d51'/>
<id>urn:sha1:4a9d62a8774f130a5b8de26ca9f415e6050a9d51</id>
<content type='text'>
Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Use DEBUG_NET_WARN_ON_ONCE() instead of WARN_ON() from the tproxy
   datapath, a recent bug found a way to reach WARN_ON from datapath
   due to insufficient validation of xt_TPROTO checkentry.
   From Fernando F. Mancera.

2) Similar to previous patch to replace WARN_ON_ONCE by
   DEBUG_NET_WARN_ON_ONCE() for connlimit. Not known issue, but
   since this patch has been around for a while, let's merge it.
   Also from Fernando.

3) Move nf_tables harware offload commit path after chain blob
   and audit to reduce chances of leaving the hardware in
   inconsistent state.

4) Add missing vzeroupper to nf_tables pipapo AVX2 to address
   performace degradation to later user of SSE code,
   from Eric Biggers.

5) Remove pr_debug() in x_tables extensions, a recent bogus found a
   way to print a unsanitized string in xt_IDLETIMER, many of these
   pr_debug() calls are there for historical reasons.

6) Use pr_info_ratelimited() in x_tables .checkentry.

7) Fix an imbalance in module refcount due to incorrect override
   expression logic with sets. Remove unnecessary clone in control
   plane, use the existing expressions provided by set or dynset
   expression. Release override expressions only.

8) Tigthen nf_tables device name removal, it is possible to remove
   prefix strings with exact device name. From Fernando F. Mancera.

9) Set on the set dead bit earlier, otherwise it is possible to
   call .commit on deleted sets. This also addresses the
   re-introduction of a bug.

* tag 'nf-26-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nf_tables: remove leftover set_update_list
  netfilter: nf_tables: set on dead bit when performing early element removal
  netfilter: nf_tables: skip double clone set expressions on element insert
  netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
  netfilter: x_tables: remove pr_debug
  netfilter: nft_set_pipapo_avx2: add missing vzeroupper
  netfilter: nf_tables: move hardware offload step after building the chain blob
  netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit
  netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks
====================

Link: https://patch.msgid.link/20260827141733.423453-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
</content>
</entry>
<entry>
<title>net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup</title>
<updated>2026-08-27T19:12:36+00:00</updated>
<author>
<name>Jamal Hadi Salim</name>
<email>jhs@mojatatu.com</email>
</author>
<published>2026-08-25T08:14:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=8f735d64382dcf162f4276d6699d03ad2f859c0b'/>
<id>urn:sha1:8f735d64382dcf162f4276d6699d03ad2f859c0b</id>
<content type='text'>
qdisc_get_stab() accepts a user-supplied size table, and
__qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through the
overhead, the size-table data (u16), and size_log (up to
STAB_SIZE_LOG_MAX). A crafted stab can therefore set qdisc_pkt_len()
to ~1 GiB for an ordinary skb. Per-flow deficit schedulers such as
DRR and ETS replenish one quantum per loop iteration; with a tiny
quantum (1) they spin billions of times under the qdisc lock,
producing a soft lockup / RCU stall as illustrated by vega@nebusec.ai.

Cap the final qdisc_pkt_len() to QDISC_PKT_LEN_MAX so the size-table
amplification cannot drive deficit schedulers into an unbounded loop.
A legitimate size table (e.g. qfq's overhead 999999999, which is
handled by dropping) is still accepted.

Introduce cap QDISC_PKT_LEN_MAX (1 &lt;&lt; 20) = 1 MiB which is well above
any legitimate single-skb wire length: the largest current skb-&gt;len
is GSO_MAX_SIZE (524280), and an ATM-style size table (53/48 cell tax)
amplifies that to ~578 KB, both comfortably below 1 MiB. At the same
time, 1 MiB bounds the deficit refill loop to ~1M iterations per
packet with quantum=1, which completes in a few milliseconds well
under the demonstrated softlockup threshold (~10^9 iterations).

Conditions to recreate the bug:
- CONFIG_NET_SCHED=y, CONFIG_NET_SCH_DRR=y (or CONFIG_NET_SCH_ETS=y).
- Attach a DRR (or ETS) root qdisc with a crafted TCA_STAB that
  amplifies qdisc_pkt_len to ~1 GiB (e.g. size_log=15, data=[32768]).
- Add a class with a tiny quantum of 1 and send one small packet; the
  deficit loop spins billions of times under the qdisc lock and trips
  the softlockup detector (panic with kernel.softlockup_panic=1).
- Reachable as root or from an unprivileged user in a fresh user+net
  namespace (unshare -Urn) with namespace-local CAP_NET_ADMIN.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: vega@nebusec.ai
Tested-by: Victor Nogueira &lt;victor@mojatatu.com&gt;
Signed-off-by: Jamal Hadi Salim &lt;jhs@mojatatu.com&gt;
Link: https://patch.msgid.link/20260825081403.133992-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski &lt;kuba@kernel.org&gt;
</content>
</entry>
<entry>
<title>Merge tag 'leds-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds</title>
<updated>2026-08-27T18:05:51+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-08-27T18:05:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=7cc2726d4847c48844eb0ee16f973d449260f248'/>
<id>urn:sha1:7cc2726d4847c48844eb0ee16f973d449260f248</id>
<content type='text'>
Pull LED updates from Lee Jones:
 "New Support &amp; Features:
   - Core: Extend netdev trigger speeds up to 100G
   - PWM Multicolor: Introduce default-intensity property
   - Analog Devices LTC3220: Add support for 18 channel LED driver
   - NXP PCA963x: Add multicolor LED class support

  Improvements &amp; Fixes:
   - GPIO: Clear error pointers for skipped LEDs
   - Broadcom BCM63138: Use %pe to print pinctrl error instead of %ld
   - ISSI IS31FL319x: Modernize device registration by using fwnode APIs
   - NXP PCA9532: Fix inverted GPIO output polarity
   - NXP PCA9532: Fix phantom device registration on missing hardware
   - STMicroelectronics ST1202: Correct and extend hw_pattern
     documentation
   - STMicroelectronics ST1202: Fix channel disable logic on zero
     brightness and ensure brightness changes are applied in active mode
   - STMicroelectronics ST1202: Fix hardware pattern sequence
     programming, validate inputs, and correct pattern duration
     calculations
   - STMicroelectronics ST1202: Validate LED reg property against
     channel count
   - TI LP5860: Fix a potential double-unlock during device
     initialization and fix error handling path by using
     devm_mutex_init()

  Cleanups &amp; Refactoring:
   - GPIO: Make legacy gpiolib interface optional

  Device Tree Binding Updates:
   - Core: Add default-intensity property
   - Core: Document "gpio" trigger
   - Analog Devices LTC3220: Add DT binding for LTC3220 18 channel LED
     driver
   - Broadcom BCM6358: Convert to DT schema
   - LaCie NS2: Convert to DT schema
   - NXP PCA963x: Add multicolor LED support
   - NXP PCA963x: Fix reg maximum for pca9635
   - TI TPS65217: Convert backlight bindings to DT schema"

* tag 'leds-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (29 commits)
  leds: is31fl319x: Modernize registration
  dt-bindings: leds: lacie,ns2-leds: Convert to DT schema
  leds: pca963x: Add multicolor LED class support
  dt-bindings: leds: nxp,pca963x: Add multicolor LED support
  dt-bindings: leds: nxp,pca963x: Fix reg maximum for pca9635
  leds: gpio: Clear error pointers for skipped LEDs
  dt-bindings: leds: backlight: Convert TPS65217 to DT schema
  leds: pca9532: Fix phantom device registration on missing hardware
  leds: gpio: Make legacy gpiolib interface optional
  leds: bcm63138: Use %pe to print pinctrl error instead of %ld
  dt-bindings: leds: Add default-intensity property
  leds: ltc3220: Add Support for LTC3220 18 channel LED Driver
  dt-bindings: leds: Add LTC3220 18 channel LED Driver
  dt-bindings: leds: bcm6358: Convert to DT schema
  dt-bindings: leds: Document "gpio" trigger
  leds: st1202: Correct and extend hw_pattern documentation
  leds: st1202: Validate LED reg property against channel count
  leds: st1202: Disable channel when brightness is set to zero
  leds: st1202: Fix brightness having no effect while pattern mode is active
  leds: st1202: Fix spurious pattern sequence start in setup
  ...
</content>
</entry>
</feed>
