From: Artem Dinaburg <artem@trailofbits.com>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>
Subject: Please consider post-v7.1 CVE fixes for 6.1.y, 6.6.y, 6.12.y, and 6.18.y
Date: Mon, 14 Sep 2026 01:53:41 -0400
Message-ID: <20260914055341.86197-1-artem@trailofbits.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Hi Greg and Sasha,

Thanks for taking care of the earlier requests. I found one final
direct-pickup group: 26 CVE fixes that entered mainline between v7.1 and v7.2
and are still missing from one or more supported 6.x trees. The Linux CNA
affected ranges include each target listed below. I left out anything that
needs an adapted backport.

I checked each of the 73 commit/tree pairs separately, then applied each
tree's full set together after its current stable queue. All applications were
clean, and every changed path built with CONFIG_WERROR enabled. The cumulative
x86_64 allmodconfig kernel and modules built without diagnostics on 6.6.y,
6.12.y, and 6.18.y. The 6.1.y build completed with four unrelated objtool
warnings; the same four warnings occurred on the unpatched tree. I also built
the CoreSight object on arm64 for each target where it is requested. I did not
runtime-test these fixes.

Could you please queue these commits for the trees shown?

  5152c6d49e3fd4e9f2e857c57527aead752f1f87 (CVE-2026-68097)
    Targets: 6.1.y
    ksmbd: validate ACE size against SID sub-authorities
  ffb2bd7ade36ec4da32c46a6eddbf4515316d08c (CVE-2026-68161)
    Targets: 6.1.y
    sctp: close UDP tunnel sockets during netns teardown
  fd098a23bf8fda7eae48db9b06e7c34fc4d228fa (CVE-2026-68286)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    drop_monitor: perform u64_stats updates under IRQ-disabled section
  7089f7ab99c89f443c92d8fcc585e63f2727f0b3 (CVE-2026-68287)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    drop_monitor: fix size calculations for 64-bit attributes
  5e9c8baee0329fbefe7c67aea945e2a07f15e98b (CVE-2026-68288)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
  47f42ff521b4eeb46e82f9a46a4783a99f7570d7 (CVE-2026-68289)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
  7dc3680b7ffe01add3e9299fde8471d2dd53a8ae (CVE-2026-68303)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    drm/vc4: hvs/v3d: Fix null dereference in unbind
  3f4920d165b29052255527d8ae7619e7ec132ece (CVE-2026-68337)
    Targets: 6.12.y, 6.18.y
    bpf: Reject redirect helpers without a bpf_net_context
  da55f570191d5d72f10c607a7043b947eb05ea46 (CVE-2026-68391)
    Targets: 6.1.y
    Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
  e054c1a6ae7310d2815778fddb87da616e11c255 (CVE-2026-72334)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    Bluetooth: ISO: fix malformed ISO_END/CONT handling
  5c6ce05e406520290c1d89da97fb3cd70c09137d (CVE-2026-72355)
    Targets: 6.18.y
    netfs: Fix barriering when walking subrequest list
  72a85e9464a5332fb2cd7efd26d9295275ceda2d (CVE-2026-72402)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    bpf: Mask pseudo pointer values in verifier logs
  9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2 (CVE-2026-72413)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    sctp: fix err_chunk memory leaks in INIT handling
  393d687131d8aa8c7e4de2cb494438e145d20fc2 (CVE-2026-72438)
    Targets: 6.12.y, 6.18.y
    md/raid10: fix writes_pending and barrier reference leaks on discard
      failures
  1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae (CVE-2026-72485)
    Targets: 6.6.y, 6.12.y, 6.18.y
    coresight: platform: defer connection counter increment until alloc
      succeeds
  d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd (CVE-2026-72494)
    Targets: 6.18.y
    RDMA/irdma: Replace waitqueue and flag with completion
  87267803a8c824616eb147c5dad7030a5db6f878 (CVE-2026-72496)
    Targets: 6.6.y, 6.12.y, 6.18.y
    RDMA/bnxt_re: Proper rollback if the ioremap fails
  4d87a251d45b4a95eb4c0abcfab809c9f231258a (CVE-2026-74258)
    Targets: 6.6.y, 6.12.y, 6.18.y
    bpf: Guard __get_user acesss with access_ok for uprobe_multi data
  e26657fe3b85c068b01f42bb0c602f242d643ba9 (CVE-2026-74269)
    Targets: 6.18.y
    bnxt: fix head underflow on XDP head-grow
  06b693d2eb6651a63ad85bad8673de3b7d4edd6d (CVE-2026-74289)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
  b7e44d1986d6671342c19b82192189ca5db5dab7 (CVE-2026-74291)
    Targets: 6.6.y, 6.12.y, 6.18.y
    ASoC: topology: Check PCM and DAI name strings before use
  d65adf85477247be04ac86886f8edfaa047b5d4a (CVE-2026-74294)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    ASoC: meson: aiu: Validate written enum values
  8c79aac429b583301f387374ff37c59be671df87 (CVE-2026-74407)
    Targets: 6.18.y
    wifi: ath11k: cancel SSR work items during PCI shutdown
  e8bb506e6ef749ac0336f3e579d8d02396b7d832 (CVE-2026-74521)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    ksmbd: use memcmp() to compare ClientGUIDs
  9006c116dd111d457bf5d074990210f70a4ad2c8 (CVE-2026-74735)
    Targets: 6.12.y, 6.18.y
    l2tp: fix tunnel and session refcount leak on seq_file release
  594d905195024b228c962627ae5ae7c17bd582a4 (CVE-2026-80521)
    Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
    af_unix: Unlink scc_entry in unix_del_edge().

Assisted-by: Codex:GPT-5.6

Thanks,
Artem Dinaburg
Trail of Bits