Please consider these upstream CVE fixes for 6.18.y

Hi Greg and Sasha,

Thanks for queueing the earlier fixes across the affected trees. My 6.12.y request covers the three fixes shared by 6.12.y and 6.18.y, leaving these six mainline CVE fixes still missing from 6.18.y. Linux CNA affected-version ranges include v6.18.48 for each. Every newer supported stable tree already has them.

I applied the current 6.18.y queue to v6.18.48, then cherry-picked this exact set without changes. The x86_64 allmodconfig kernel and modules built without warnings with WERROR enabled. The affected 32-bit tunnel code also compiled without warnings with the relevant options enabled. I did not runtime-test these fixes.

Could you please queue these six commits for 6.18.y?

8431c602f551549f082bbfa67f3003f2d8e3e132 (CVE-2026-23459)
ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
179ee84a89114b854ac2dd1d293633a7f6c8dac1 (CVE-2026-43009)
bpf: Fix incorrect pruning due to atomic fetch precision tracking
d2324a9317f00013facb0ba00b00440e19d2af5e (CVE-2026-43391)
nsfs: tighten permission checks for handle opening
4ae3e16f4b3bf64140f773629b765d605ee079a9 (CVE-2026-53313)
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
0c3887a134f191723b53e2a47e501b534c8723ee (CVE-2026-63839)
platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()
cce18c263e9623872327ba3c956012f73c1179cc (CVE-2026-64068)
netfs: Fix missing locking around retry adding new subreqs

I used Codex to compare the histories and run the builds. I checked the final list against vulns.git and the branch history.

Thanks,
Artem Dinaburg
Trail of Bits

Queued all six for 6.18.y, thanks.

Thanks,
Sasha