Skip to content

6.6.135-rc1 review

Greg Kroah-Hartman linux-patches linux-tegra lkml regressions stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest50 patches 18 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/50lib/crypto: chacha: Zeroize permuted_state before it leaves scopelib/crypto/chacha.c+4 -00 replies
2/50wifi: rt2x00usb: fix devres lifetimedrivers/net/wireless/ralink/rt2x00/rt2x00usb.c+1 -10 replies
3/50xfrm_user: fix info leak in build_report()net/xfrm/xfrm_user.c+1 -00 replies
4/50net: rfkill: prevent unlimited numbers of rfkill events from being creatednet/rfkill/core.c+24 -110 replies
5/50mptcp: fix slab-use-after-free in __inet_lookup_establishednet/mptcp/protocol.c net/mptcp/protocol.h net/mptcp/subflow.c+12 -60 replies
6/50Input: uinput - fix circular locking dependency with ff-coredrivers/input/misc/uinput.c+21 -70 replies
7/50Input: uinput - take event lock when submitting FF request "event"drivers/input/misc/uinput.c+7 -00 replies
8/50MIPS: Always record SEGBITS in cpu_data.vmbitsarch/mips/include/asm/cpu-features.h arch/mips/include/asm/cpu-info.h arch/mips/include/asm/mipsregs.h +2 more+12 -80 replies
9/50MIPS: mm: Suppress TLB uniquification on EHINV hardwarearch/mips/mm/tlb-r4k.c+2 -10 replies
10/50MIPS: mm: Rewrite TLB uniquification for the hidden bit featurearch/mips/mm/tlb-r4k.c+228 -540 replies
11/50ASoC: simple-card-utils: Dont use __free(device_node) at graph_util_parse_dai()sound/soc/generic/simple-card-utils.c+5 -20 replies
12/50scsi: ufs: core: Fix use-after free in init error and remove pathsdrivers/ufs/core/ufshcd.c drivers/ufs/host/ufshcd-pci.c drivers/ufs/host/ufshcd-pltfrm.c +1 more+29 -300 replies
13/50virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LENdrivers/net/virtio_net.c+8 -80 replies
14/50mptcp: fix soft lockup in mptcp_recvmsg()net/mptcp/protocol.c+8 -36 replies
15/50usb: gadget: f_hid: move list and spinlock inits from bind to allocdrivers/usb/gadget/function/f_hid.c+6 -50 replies
16/50Revert "mptcp: add needs_id for netlink appending addr"net/mptcp/pm_netlink.c+5 -190 replies
17/50seg6: separate dst_cache for input and output paths in seg6 lwtunnelnet/ipv6/seg6_iptunnel.c+28 -130 replies
18/50netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTRnet/netfilter/nft_set_pipapo.c+14 -60 replies
19/50Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"drivers/gpu/drm/drm_file.c drivers/gpu/drm/drm_mode_config.c+4 -100 replies
20/50netfilter: nft_ct: fix use-after-free in timeout object destroyinclude/net/netfilter/nf_conntrack_timeout.h net/netfilter/nft_ct.c+2 -10 replies
21/50xfrm: clear trailing padding in build_polexpire()net/xfrm/xfrm_user.c+2 -00 replies
22/50tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSGnet/tipc/group.c+5 -10 replies
23/50wifi: brcmsmac: Fix dma_free_coherent() sizedrivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c+1 -10 replies
24/50Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dts arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi+7 -170 replies
25/50arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85Varch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi+1 -10 replies
26/50arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarityarch/arm64/boot/dts/hisilicon/hi3798cv200-poplar.dts+1 -10 replies
27/50arm64: dts: hisilicon: hi3798cv200: Add missing dma-rangesarch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi+1 -00 replies
28/50nfc: pn533: allocate rx skb before consuming bytesdrivers/nfc/pn533/uart.c+8 -30 replies
29/50batman-adv: reject oversized global TT response buffersnet/batman-adv/translation-table.c+7 -20 replies
30/50X.509: Fix out-of-bounds access when parsing extensionscrypto/asymmetric_keys/x509_cert_parser.c+4 -40 replies
31/50EDAC/mc: Fix error path ordering in edac_mc_alloc()drivers/edac/edac_mc.c+3 -30 replies
32/50net/tls: fix use-after-free in -EBUSY error path of tls_do_encryptionnet/tls/tls_sw.c+10 -00 replies
33/50net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()drivers/net/ethernet/altera/altera_tse_main.c+1 -00 replies
34/50batman-adv: hold claim backbone gateways by referencenet/batman-adv/bridge_loop_avoidance.c+18 -90 replies
35/50drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeatdrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c+18 -80 replies
36/50net/mlx5: Update the list of the PCI supported devicesdrivers/net/ethernet/mellanox/mlx5/core/main.c+1 -00 replies
37/50pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enableddrivers/pmdomain/imx/imx8mp-blk-ctrl.c+1 -70 replies
38/50mmc: vub300: fix NULL-deref on disconnectdrivers/mmc/host/vub300.c+1 -10 replies
39/50net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failuredrivers/net/ethernet/qualcomm/qca_uart.c+1 -10 replies
40/50net: stmmac: fix integer underflow in chain modedrivers/net/ethernet/stmicro/stmmac/chain_mode.c+6 -50 replies
41/50mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()mm/filemap.c+8 -30 replies
42/50net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c+2 -00 replies
43/50rxrpc: Fix call removal to use RCU safe deletioninclude/trace/events/rxrpc.h net/rxrpc/call_object.c+10 -160 replies
44/50rxrpc: Fix key reference count leak from call->keynet/rxrpc/call_object.c+1 -00 replies
45/50rxrpc: Only put the call ref if one was acquirednet/rxrpc/io_thread.c+2 -10 replies
46/50rxrpc: reject undecryptable rxkad response ticketsnet/rxrpc/rxkad.c+5 -10 replies
47/50rxrpc: fix reference count leak in rxrpc_server_keyring()net/rxrpc/server_key.c+3 -00 replies
48/50rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)net/rxrpc/af_rxrpc.c net/rxrpc/key.c+1 -70 replies
49/50rxrpc: Fix missing error checks for rxkad encryption/decryption failurenet/rxrpc/rxkad.c+38 -190 replies
50/50Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"drivers/pci/pci-driver.c drivers/pci/pci.c drivers/pci/pci.h+9 -100 replies

Reviews trailers per patch

21 of 50 patches have a Reviewed-by or Acked-by.

PatchArd BiesheuvelThuan NguyenDetlev CasanovaBean HuoManivannan SadhasivamEric BiggersMichael S. TsirkinMatthieu Baerts (NGI0)Geliang TangNicolas DichtelJustin IurmanStefano BrivioGuenter RoeckSimona VetterStanislaw GruszkaGreg Kroah-HartmanSimon HormanBreno LeitaoTung NguyenArend van SprielRen WeiMikhail GavrilovQiuxu ZhuoYuanhe ShuKiryl Shutsemau (Meta)David Hildenbrand (Arm)Jeffrey AltmanSabrina DubrocaKrzysztof KarasAndi ShytiPatrisious HaddadStefan WahrenIgnat KorchaginBrett A C SheffieldFlorian FainelliJon HunterPavel Machek (CIP)Peter SchneiderRon EconomosFrancesco DolciniBarry K. NathanShuah KhanMiguel OjedaShung-Hsi YuMark Brown
SeriesT-b T-b T-b T-b T-b T-b T-b T-b T-b T-b T-b T-b
1/50A-b
2/50A-b R-b
3/50
4/50
5/50R-b
6/50
7/50T-b
8/50
9/50
10/50
11/50T-b T-b
12/50R-b R-b A-b
13/50A-b
14/50R-b
15/50
16/50R-b
17/50R-b R-b
18/50R-b
19/50T-b A-b
20/50
21/50R-b R-b
22/50R-b R-b
23/50A-b
24/50
25/50
26/50
27/50
28/50
29/50T-b
30/50R-b
31/50R-b
32/50R-b
33/50
34/50
35/50R-b R-b
36/50R-b R-b
37/50
38/50
39/50R-b R-b
40/50
41/50T-b A-b A-b
42/50
43/50
44/50R-b
45/50
46/50T-b
47/50T-b
48/50
49/50
50/50

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 45 reviewers.

Read the v1 thread

Cover letter [PATCH 6.6 00/50] 6.6.135-rc1 review

This is the start of the stable review cycle for the 6.6.135 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.135-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.135-rc1

Manivannan Sadhasivam <[email protected]>
Revert "PCI: Enable ACS after configuring IOMMU for OF platforms"

David Howells <[email protected]>
rxrpc: Fix missing error checks for rxkad encryption/decryption failure

David Howells <[email protected]>
rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)

Luxiao Xu <[email protected]>
rxrpc: fix reference count leak in rxrpc_server_keyring()

Yuqi Xu <[email protected]>
rxrpc: reject undecryptable rxkad response tickets

Douya Le <[email protected]>
rxrpc: Only put the call ref if one was acquired

Anderson Nascimento <[email protected]>

    rxrpc: Fix key reference count leak from call->key

David Howells <[email protected]>
rxrpc: Fix call removal to use RCU safe deletion

David Carlier <[email protected]>
net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()

Baolin Wang <[email protected]>
mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

Tyllis Xu <[email protected]>
net: stmmac: fix integer underflow in chain mode

Pengpeng Hou <[email protected]>
net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure

Johan Hovold <[email protected]>
mmc: vub300: fix NULL-deref on disconnect

Jacky Bai <[email protected]>
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled

Michael Guralnik <[email protected]>
net/mlx5: Update the list of the PCI supported devices

Sebastian Brzezinka <[email protected]>
drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat

Haoze Xie <[email protected]>
batman-adv: hold claim backbone gateways by reference

David Carlier <[email protected]>
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()

Muhammad Alifa Ramdhan <[email protected]>
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption

Borislav Petkov (AMD) <[email protected]>
EDAC/mc: Fix error path ordering in edac_mc_alloc()

Lukas Wunner <[email protected]>
X.509: Fix out-of-bounds access when parsing extensions

Ruide Cao <[email protected]>
batman-adv: reject oversized global TT response buffers

Pengpeng Hou <[email protected]>
nfc: pn533: allocate rx skb before consuming bytes

Shawn Guo <[email protected]>
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges

Shawn Guo <[email protected]>
arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity

Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V

Sebastian Krzyszkowiak <[email protected]>
Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"

Thomas Fourier <[email protected]>
wifi: brcmsmac: Fix dma_free_coherent() size

Oleh Konko <[email protected]>
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

Yasuaki Torimaru <[email protected]>
xfrm: clear trailing padding in build_polexpire()

Tuan Do <[email protected]>
netfilter: nft_ct: fix use-after-free in timeout object destroy

Maarten Lankhorst <[email protected]>
Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"

Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR

Andrea Mayer <[email protected]>
seg6: separate dst_cache for input and output paths in seg6 lwtunnel

Matthieu Baerts (NGI0) <[email protected]>
Revert "mptcp: add needs_id for netlink appending addr"

Michael Zimmermann <[email protected]>
usb: gadget: f_hid: move list and spinlock inits from bind to alloc

Li Xiasong <[email protected]>
mptcp: fix soft lockup in mptcp_recvmsg()

Srujana Challa <[email protected]>
virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN

André Draszik <[email protected]>
scsi: ufs: core: Fix use-after free in init error and remove paths

Kuninori Morimoto <[email protected]>
ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()

Maciej W. Rozycki <[email protected]>
MIPS: mm: Rewrite TLB uniquification for the hidden bit feature

Maciej W. Rozycki <[email protected]>
MIPS: mm: Suppress TLB uniquification on EHINV hardware

Maciej W. Rozycki <[email protected]>
MIPS: Always record SEGBITS in cpu_data.vmbits

Dmitry Torokhov <[email protected]>
Input: uinput - take event lock when submitting FF request "event"

Mikhail Gavrilov <[email protected]>
Input: uinput - fix circular locking dependency with ff-core

Jiayuan Chen <[email protected]>
mptcp: fix slab-use-after-free in __inet_lookup_established

Greg Kroah-Hartman <[email protected]>
net: rfkill: prevent unlimited numbers of rfkill events from being created

Greg Kroah-Hartman <[email protected]>
xfrm_user: fix info leak in build_report()

Johan Hovold <[email protected]>
wifi: rt2x00usb: fix devres lifetime

Eric Biggers <[email protected]>
lib/crypto: chacha: Zeroize permuted_state before it leaves scope

-------------

Diffstat:

 Makefile                                           |   4 +-
 .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts |   2 +-
 arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi  |  24 +-
 .../boot/dts/hisilicon/hi3798cv200-poplar.dts      |   2 +-
 arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi     |   1 +
 arch/mips/include/asm/cpu-features.h               |   1 -
 arch/mips/include/asm/cpu-info.h                   |   2 -
 arch/mips/include/asm/mipsregs.h                   |   2 +
 arch/mips/kernel/cpu-probe.c                       |  13 +-
 arch/mips/kernel/cpu-r3k-probe.c                   |   2 +
 arch/mips/mm/tlb-r4k.c                             | 285 +++++++++++++++++----
 crypto/asymmetric_keys/x509_cert_parser.c          |   8 +-
 drivers/edac/edac_mc.c                             |   6 +-
 drivers/gpu/drm/drm_file.c                         |   5 +-
 drivers/gpu/drm/drm_mode_config.c                  |   9 +-
 drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c   |  26 +-
 drivers/input/misc/uinput.c                        |  35 ++-
 drivers/mmc/host/vub300.c                          |   2 +-
 drivers/net/ethernet/altera/altera_tse_main.c      |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   1 +
 .../net/ethernet/microchip/lan966x/lan966x_fdma.c  |   2 +
 drivers/net/ethernet/qualcomm/qca_uart.c           |   2 +-
 drivers/net/ethernet/stmicro/stmmac/chain_mode.c   |  11 +-
 drivers/net/virtio_net.c                           |  16 +-
 .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2x00usb.c     |   2 +-
 drivers/nfc/pn533/uart.c                           |  11 +-
 drivers/pci/pci-driver.c                           |   8 -
 drivers/pci/pci.c                                  |  10 +-
 drivers/pci/pci.h                                  |   1 -
 drivers/pmdomain/imx/imx8mp-blk-ctrl.c             |   8 +-
 drivers/ufs/core/ufshcd.c                          |  31 ++-
 drivers/ufs/host/ufshcd-pci.c                      |   2 -
 drivers/ufs/host/ufshcd-pltfrm.c                   |  25 +-
 drivers/usb/gadget/function/f_hid.c                |  11 +-
 include/net/netfilter/nf_conntrack_timeout.h       |   1 +
 include/trace/events/rxrpc.h                       |   2 +-
 include/ufs/ufshcd.h                               |   1 -
 lib/crypto/chacha.c                                |   4 +
 mm/filemap.c                                       |  11 +-
 net/batman-adv/bridge_loop_avoidance.c             |  27 +-
 net/batman-adv/translation-table.c                 |   9 +-
 net/ipv6/seg6_iptunnel.c                           |  41 ++-
 net/mptcp/pm_netlink.c                             |  24 +-
 net/mptcp/protocol.c                               |  13 +-
 net/mptcp/protocol.h                               |   1 +
 net/mptcp/subflow.c                                |  15 +-
 net/netfilter/nft_ct.c                             |   2 +-
 net/netfilter/nft_set_pipapo.c                     |  20 +-
 net/rfkill/core.c                                  |  35 ++-
 net/rxrpc/af_rxrpc.c                               |   6 -
 net/rxrpc/call_object.c                            |  25 +-
 net/rxrpc/io_thread.c                              |   3 +-
 net/rxrpc/key.c                                    |   2 +-
 net/rxrpc/rxkad.c                                  |  63 +++--
 net/rxrpc/server_key.c                             |   3 +
 net/tipc/group.c                                   |   6 +-
 net/tls/tls_sw.c                                   |  10 +
 net/xfrm/xfrm_user.c                               |   3 +
 sound/soc/generic/simple-card-utils.c              |   7 +-
 60 files changed, 599 insertions(+), 308 deletions(-)