From: Artem Dinaburg <artem@trailofbits.com>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>
Subject: Please consider these upstream CVE fixes for 6.12.y
Date: Mon, 31 Aug 2026 21:19:09 -0400
Message-ID: <20260901011909.58400-1-artem@trailofbits.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Hi Greg and Sasha,

Thanks for taking care of the earlier requests. I refreshed the 6.12 list
against the current stable queue, and these eight CVE fixes are still missing.
Linux CNA records list v6.12.107 as affected by each. The first five are
already in 6.18.y. The final three are missing there too. All eight are in
7.1.y and newer.

I applied the current 6.12.y queue to v6.12.107, then cherry-picked all eight
without changes. With WERROR enabled, the x86_64 allmodconfig kernel and
modules built without warnings. I also compiled the affected block, bnxt_en,
F2FS, MD, mt76, and ath11k paths on RISC-V with the relevant options and
WERROR enabled. I did not runtime-test these fixes.

Could you please queue all eight commits for 6.12.y, and queue the final three
for 6.18.y as well?

  7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c (CVE-2025-21817)
    block: mark GFP_NOIO around sysfs ->store()
  107b25db61122d8f990987895c2912927b8b6e3f (CVE-2025-22108)
    bnxt_en: Mask the bd_cnt field in the TX BD properly
  3147ee567dd9004a49826ddeaf0a4b12865d4409 (CVE-2025-22127)
    f2fs: fix potential deadloop in prepare_compress_overwrite()
  7e40f64896e8e3dca471e287672db5ace12ea0be (CVE-2025-38205)
    drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
  13017b427118f4311471ee47df74872372ca8482 (CVE-2025-38621)
    md: make rdev_addable usable for rcu mode
  a16d1ec4dd0cdcf689f324adde6067083bce9099 (CVE-2026-43344)
    perf/x86/intel/uncore: Fix die ID init and look up bugs
  c41075ce8cf05ed8c0e7b7efef000dce548ffc42 (CVE-2026-53102)
    wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
  ff49eba595df500e4ddccc593088c8a4ab5f2c27 (CVE-2026-53113)
    wifi: ath11k: fix memory leaks in beacon template setup

I used Codex to compare the histories and run the builds. I checked the final
list against vulns.git, the branch history, and stable-queue.

Assisted-by: Codex:GPT-5.6

Thanks,
Artem Dinaburg
Trail of Bits