Please consider these upstream CVE fixes for 6.1.y, 6.6.y, and 6.12.y

Hi Greg and Sasha,

Thanks again for taking care of the earlier batches. I realized I had left out fixes that entered mainline after an older stable branch was cut and never reached that branch, so I went back over those intervals.

The 28 commits below are still missing from one or more affected 6.x trees. The Linux CNA affected ranges include every target listed here. All affected newer supported 6.x trees either already have the commit or are included in its Targets line. These are only direct pickups; I left out anything that needs an adapted backport.

I applied each target's set on top of its current stable queue. All 36 applications were clean. With every touched subsystem enabled, I built the resulting kernels and modules under x86_64 allmodconfig with CONFIG_WERROR. The 6.6 and 6.12 builds were clean. The 6.1 allmodconfig build completed with no errors and the same four pre-existing objtool warnings as before; a second pass with Xen and CPU mitigations disabled was clean too. I did not run runtime tests.

For cc31744a2945, 6.1.y previously took and reverted the older d794734c9bbf change with the same subject. The commit below is the later fix now listed by the CNA for CVE-2024-50017; this exact commit has not been in the 6.1.y queue.

Could you please queue these commits for the trees shown?

1d38a9ee81570c4bd61f557832dead4d6f816760 (CVE-2023-52676)
Targets: 6.1.y
bpf: Guard stack limits against 32bit overflow
fd819ad3ecf6f3c232a06b27423ce9ed8c20da89 (CVE-2024-35887)
Targets: 6.1.y
ax25: fix use-after-free bugs caused by ax25_ds_del_timer
cc31744a294584a36bf764a0ffa3255a8e69f036 (CVE-2024-50017)
Targets: 6.1.y
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
98b1e3b27734139c76295754b6c317aa4df6d32e (CVE-2025-21651)
Targets: 6.6.y
net: hns3: don't auto enable misc vector
9741e72b2286de8b38de9db685588ac421a95c87 (CVE-2025-21649)
Targets: 6.1.y, 6.6.y
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
16c6c35c03ea73054a1f6d3302a4ce4a331b427d (CVE-2024-58097)
Targets: 6.1.y
wifi: ath11k: fix RCU stall while reaping monitor destination ring
68410c5bd381a81bcc92b808e7dc4e6b9ed25d11 (CVE-2025-23129)
Targets: 6.1.y, 6.6.y
wifi: ath11k: Clear affinity hint before calling
ath11k_pcic_free_irq() in error path
6130825f34d41718c98a9b1504a79a23e379701e (CVE-2025-22124)
Targets: 6.6.y
md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
3db4404435397a345431b45f57876a3df133f3b4 (CVE-2025-40325)
Targets: 6.1.y, 6.6.y
md/raid10: wait barrier before returning discard request with REQ_NOWAIT
0032c99e83b9ce6d5995d65900aa4b6ffb501cce (CVE-2025-22103)
Targets: 6.1.y
net: fix NULL pointer dereference in l3mdev_l3_rcv
c7d82913d5f9e97860772ee4051eaa66b56a6273 (CVE-2025-22101)
Targets: 6.6.y
net: libwx: fix Tx L4 checksum
beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42 (CVE-2025-22039)
Targets: 6.6.y
ksmbd: fix overflow in dacloffset bounds check
1df0d4c616138784e033ad337961b6e1a6bcd999 (CVE-2025-37802)
Targets: 6.6.y
ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
fbb429ddff5c8e479edcc7dde5a542c9295944e6 (CVE-2025-37833)
Targets: 6.1.y, 6.6.y
net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
101841c38346f4ca41dc1802c867da990ffb32eb (CVE-2025-38660)
Targets: 6.6.y
[ceph] parse_longname(): strrchr() expects NUL-terminated string
e09299225d5ba3916c91ef70565f7d2187e4cca0 (CVE-2025-38591)
Targets: 6.6.y
bpf: Reject narrower access to pointer ctx fields
efe24898485c5c831e629d9c6fb9350c35cb576f (CVE-2025-71302)
Targets: 6.12.y
drm/panthor: fix for dma-fence safe access rules
235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b (CVE-2026-23137)
Targets: 6.12.y
of: unittest: Fix memory leak in unittest_data_add()
270564513489d98b721a1e4a10017978d5213bff (CVE-2026-43288)
Targets: 6.1.y
ext4: move ext4_percpu_param_init() before ext4_mb_init()
779c60a5190c42689534172f4b49e927c9959e4e (CVE-2026-45897)
Targets: 6.1.y, 6.6.y
netfilter: nft_counter: serialize reset with spinlock
2aa8a4fa8d5b7d0e1ebcec100e1a4d80a1f4b21a (CVE-2026-23448)
Targets: 6.1.y
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
77914255155e68a20aa41175edeecf8121dac391 (CVE-2026-23447)
Targets: 6.1.y
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
fa6e24963342de4370e3a3c9af41e38277b74cf3 (CVE-2026-31420)
Targets: 6.1.y, 6.6.y
bridge: mrp: reject zero test interval to avoid OOM panic
426c355742f02cf743b347d9d7dbdc1bfbfa31ef (CVE-2026-43088)
Targets: 6.1.y
net: af_key: zero aligned sockaddr tail in PF_KEY exports
10f86a2a5c91fc4c4d001960f1c21abe52545ef6 (CVE-2026-53078)
Targets: 6.1.y, 6.6.y
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
1baff47b81f94f9231c91236aa511420d0e266b9 (CVE-2026-53010)
Targets: 6.6.y, 6.12.y
ksmbd: fix use-after-free in smb2_open during durable reconnect
0c22d9511cbde746622f8e4c11aaa63fe76d45f9 (CVE-2026-52961)
Targets: 6.6.y
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
cc57232cae23c0df91b4a59d0f519141ce9b5b02 (CVE-2026-52944)
Targets: 6.12.y
ksmbd: fix FSCTL permission bypass by adding a permission check for
FSCTL_SET_SPARSE

Thanks,
Artem Dinaburg
Trail of Bits

Queued for 6.12.y, 6.6.y, and 6.1.y, thanks. A few exceptions:

- 0c22d9511cbd ("ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size") is queued for 6.6.y but not 6.1.y: it applies cleanly there but
does not build, since 6.1.y predates the ceph doutc() logging refactor the fix's 'cl' client pointer depends on.
- 3db440443539 ("md/raid10: wait barrier before returning discard request with REQ_NOWAIT") is not queued anywhere: its own follow-up needs a prerequisite
that itself needs further follow-ups still missing on 6.6.y, 6.1.y, and 5.15.y.
- efe24898485c ("drm/panthor: fix for dma-fence safe access rules") was not queued for 6.12.y: its own upstream tag reads 'Cc: [email protected] #
v6.17+', and the dma-fence infrastructure it depends on is not present before 6.17.

Everything else on the list is queued as requested.

Thanks,
Sasha