Skip to content

6.18.25-rc1 review

Greg Kroah-Hartman linux-patches lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest55 patches 11 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/55crypto: authencesn - Fix src offset when decrypting in-placecrypto/authencesn.c+4 -20 replies
2/55ipv6: add NULL checks for idev in SRv6 pathsnet/ipv6/exthdrs.c net/ipv6/seg6_hmac.c+6 -00 replies
3/55net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registersdrivers/net/ethernet/mediatek/mtk_eth_soc.c drivers/net/ethernet/mediatek/mtk_ppe.c drivers/net/ethernet/mediatek/mtk_ppe.h+52 -10 replies
4/55drm/amdgpu: replace PASID IDR with XArraydrivers/gpu/drm/amd/amdgpu/amdgpu_ids.c+19 -200 replies
5/55crypto: krb5enc - fix sleepable flag handling in encrypt dispatchcrypto/krb5enc.c+3 -20 replies
6/55crypto: krb5enc - fix async decrypt skipping hash verificationcrypto/krb5enc.c+31 -210 replies
7/55scripts: generate_rust_analyzer.py: define scriptsscripts/generate_rust_analyzer.py+13 -10 replies
8/55ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavengerfs/smb/server/vfs_cache.c+30 -110 replies
9/55ksmbd: validate owner of durable handle on reconnectfs/smb/server/mgmt/user_session.c fs/smb/server/oplock.c fs/smb/server/oplock.h +3 more+102 -150 replies
10/55arm64: tlb: Allow XZR argument to TLBI opsarch/arm64/include/asm/tlbflush.h+3 -30 replies
11/55arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBIarch/arm64/include/asm/tlbflush.h arch/arm64/kernel/sys_compat.c arch/arm64/kvm/hyp/nvhe/mm.c +3 more+47 -360 replies
12/55arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenancearch/arm64/include/asm/tlbflush.h+16 -40 replies
13/55arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish()arch/arm64/include/asm/tlbflush.h arch/arm64/kernel/sys_compat.c+5 -50 replies
14/55arm64: cputype: Add C1-Pro definitionsarch/arm64/include/asm/cputype.h+2 -00 replies
15/55arm64: errata: Work around early CME DVMSync acknowledgementDocumentation/arch/arm64/silicon-errata.rst arch/arm64/Kconfig arch/arm64/include/asm/cpucaps.h +8 more+264 -40 replies
16/55sched/debug: Fix avg_vruntime() usagekernel/sched/debug.c+3 -10 replies
17/55lib/crc: tests: Make crc_kunit test only the enabled CRC variantslib/crc/Kconfig lib/crc/tests/crc_kunit.c+23 -120 replies
18/55lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNITlib/crc/Kconfig+14 -00 replies
19/55lib/crc: tests: Add a .kunitconfig filelib/crc/.kunitconfig+3 -00 replies
20/55kunit: configs: Enable all CRC tests in all_tests.configtools/testing/kunit/configs/all_tests.config+2 -00 replies
21/55lib/crypto: tests: Add a .kunitconfig filelib/crypto/.kunitconfig+23 -00 replies
22/55lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNITlib/crypto/.kunitconfig lib/crypto/tests/Kconfig+19 -130 replies
23/55kunit: configs: Enable all crypto library tests in all_tests.configtools/testing/kunit/configs/all_tests.config+2 -00 replies
24/55lib/crypto: tests: Drop the default to CRYPTO_SELFTESTSlib/crypto/tests/Kconfig+7 -70 replies
25/55scripts/dtc: Remove unused dts_version in dtc-lexer.lscripts/dtc/dtc-lexer.l+0 -30 replies
26/55fs/ntfs3: validate rec->used in journal-replay file record checkfs/ntfs3/fslog.c+11 -10 replies
27/55f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionallyfs/f2fs/f2fs.h fs/f2fs/segment.c fs/f2fs/super.c+12 -70 replies
28/55f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()fs/f2fs/data.c+2 -20 replies
29/55f2fs: fix to avoid memory leak in f2fs_rename()fs/f2fs/namei.c+1 -00 replies
30/55f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footerfs/f2fs/data.c+2 -10 replies
31/55fuse: reject oversized dirents in page cachefs/fuse/readdir.c+4 -00 replies
32/55fuse: abort on fatal signal during sync initfs/fuse/dev.c fs/fuse/fuse_i.h fs/fuse/inode.c+9 -10 replies
33/55fuse: Check for large folio with SPLICE_F_MOVEfs/fuse/dev.c+3 -00 replies
34/55fuse: quiet down complaints in fuse_conn_limit_writefs/fuse/control.c+2 -20 replies
35/55fuse: fuse_dev_ioctl_clone() should wait for device file to be initializedfs/fuse/dev.c+8 -110 replies
36/55ksmbd: require minimum ACE size in smb_check_perm_dacl()fs/smb/server/smbacl.c+13 -40 replies
37/55smb: server: fix active_num_conn leak on transport allocation failurefs/smb/server/transport_tcp.c+2 -00 replies
38/55smb: server: fix max_connections off-by-one in tcp accept pathfs/smb/server/transport_tcp.c+1 -10 replies
39/55smb: client: require a full NFS mode SID before reading mode bitsfs/smb/client/cifsacl.c+1 -00 replies
40/55smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO pathfs/smb/client/smb2ops.c+6 -00 replies
41/55ksmbd: validate response sizes in ipc_validate_msg()fs/smb/server/mgmt/user_config.c fs/smb/server/transport_ipc.c+13 -90 replies
42/55ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()fs/smb/server/smbacl.c+23 -50 replies
43/55ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignmentfs/smb/server/smb2pdu.c+2 -00 replies
44/55ksmbd: use check_add_overflow() to prevent u16 DACL size overflowfs/smb/server/smbacl.c+12 -40 replies
45/55ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()fs/smb/server/connection.c+2 -30 replies
46/55writeback: Fix use after free in inode_switch_wbs_work_fn()fs/fs-writeback.c+19 -170 replies
47/55f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()fs/f2fs/compress.c+11 -30 replies
48/55ALSA: usb-audio: apply quirk for MOONDROP JU Jiusound/usb/mixer.c+7 -00 replies
49/55ALSA: hda/realtek: Add quirk for Legion S7 15IMHsound/hda/codecs/realtek/alc269.c+1 -00 replies
50/55ALSA: caiaq: take a reference on the USB device in create_card()sound/usb/caiaq/device.c+2 -20 replies
51/55net/packet: fix TOCTOU race on mmapd vnet_hdr in tpacket_snd()net/packet/af_packet.c+13 -80 replies
52/55crypto: ccp: Dont attempt to copy CSR to userspace if PSP command faileddrivers/crypto/ccp/sev-dev.c+7 -10 replies
53/55crypto: ccp: Dont attempt to copy PDH cert to userspace if PSP command faileddrivers/crypto/ccp/sev-dev.c+7 -10 replies
54/55crypto: ccp: Dont attempt to copy ID to userspace if PSP command faileddrivers/crypto/ccp/sev-dev.c+3 -00 replies
55/55rxrpc: Fix missing validation of ticket length in non-XDR key preparsingnet/rxrpc/key.c+4 -00 replies

Reviews trailers per patch

25 of 55 patches have a Reviewed-by or Acked-by.

PatchMark RutlandWill DeaconVincent GuittotK Prateek NayakJohn StultzAndrea MayerArd BiesheuvelChristian KönigDaniel AlmeidaFiona BehrensTrevor GrossChenXiaoSongJoanne KoongBernd SchubertDarrick J. WongNamjae JeonTejun HeoChao YuWillem de BruijnPavel Machek (CIP)Florian FainelliPeter SchneiderMark BrownShuah KhanBrett A C SheffieldMiguel OjedaWentao GuanRon EconomosDileep MalepuBarry K. Nathan
SeriesT-b T-b T-b T-b T-b T-b T-b T-b T-b T-b T-b
1/55
2/55R-b
3/55
4/55R-b
5/55
6/55
7/55R-b R-b R-b
8/55R-b
9/55
10/55
11/55
12/55A-b R-b
13/55A-b R-b
14/55A-b R-b
15/55R-b
16/55R-b T-b T-b
17/55
18/55
19/55
20/55A-b
21/55A-b
22/55
23/55
24/55A-b
25/55
26/55
27/55
28/55R-b
29/55
30/55
31/55
32/55R-b R-b R-b
33/55
34/55
35/55
36/55A-b
37/55A-b
38/55A-b
39/55
40/55
41/55A-b
42/55A-b
43/55A-b
44/55A-b
45/55A-b
46/55A-b
47/55R-b
48/55
49/55
50/55
51/55R-b
52/55
53/55
54/55
55/55

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 30 reviewers.

Read the v1 thread

Cover letter [PATCH 6.18 00/55] 6.18.25-rc1 review

This is the start of the stable review cycle for the 6.18.25 release. There are 55 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun, 26 Apr 2026 13:23:22 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.25-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.25-rc1

Anderson Nascimento <[email protected]>
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing

Sean Christopherson <[email protected]>
crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed

Sean Christopherson <[email protected]>
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed

Sean Christopherson <[email protected]>
crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed

Bingquan Chen <[email protected]>
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

Berk Cem Goksel <[email protected]>
ALSA: caiaq: take a reference on the USB device in create_card()

Eric Naim <[email protected]>
ALSA: hda/realtek: Add quirk for Legion S7 15IMH

Cryolitia PukNgae <[email protected]>
ALSA: usb-audio: apply quirk for MOONDROP JU Jiu

George Saad <[email protected]>
f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()

Jan Kara <[email protected]>
writeback: Fix use after free in inode_switch_wbs_work_fn()

DaeMyung Kang <[email protected]>
ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()

Tristan Madani <[email protected]>
ksmbd: use check_add_overflow() to prevent u16 DACL size overflow

Tristan Madani <[email protected]>
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

Michael Bommarito <[email protected]>
ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()

Michael Bommarito <[email protected]>
ksmbd: validate response sizes in ipc_validate_msg()

Michael Bommarito <[email protected]>
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

Michael Bommarito <[email protected]>
smb: client: require a full NFS mode SID before reading mode bits

DaeMyung Kang <[email protected]>
smb: server: fix max_connections off-by-one in tcp accept path

Michael Bommarito <[email protected]>
smb: server: fix active_num_conn leak on transport allocation failure

Michael Bommarito <[email protected]>
ksmbd: require minimum ACE size in smb_check_perm_dacl()

Miklos Szeredi <[email protected]>
fuse: fuse_dev_ioctl_clone() should wait for device file to be initialized

Darrick J. Wong <[email protected]>
fuse: quiet down complaints in fuse_conn_limit_write

Bernd Schubert <[email protected]>
fuse: Check for large folio with SPLICE_F_MOVE

Miklos Szeredi <[email protected]>
fuse: abort on fatal signal during sync init

Samuel Page <[email protected]>
fuse: reject oversized dirents in page cache

Chao Yu <[email protected]>
f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer

Chao Yu <[email protected]>
f2fs: fix to avoid memory leak in f2fs_rename()

Yongpeng Yang <[email protected]>

    f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()

Chao Yu <[email protected]>

    f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally

Greg Kroah-Hartman <[email protected]>

    fs/ntfs3: validate rec->used in journal-replay file record check

Nathan Chancellor <[email protected]>
scripts/dtc: Remove unused dts_version in dtc-lexer.l

Eric Biggers <[email protected]>
lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS

Eric Biggers <[email protected]>
kunit: configs: Enable all crypto library tests in all_tests.config

Eric Biggers <[email protected]>
lib/crypto: tests: Introduce CRYPTO_LIB_ENABLE_ALL_FOR_KUNIT

Eric Biggers <[email protected]>
lib/crypto: tests: Add a .kunitconfig file

Eric Biggers <[email protected]>
kunit: configs: Enable all CRC tests in all_tests.config

Eric Biggers <[email protected]>
lib/crc: tests: Add a .kunitconfig file

Eric Biggers <[email protected]>
lib/crc: tests: Add CRC_ENABLE_ALL_FOR_KUNIT

Eric Biggers <[email protected]>
lib/crc: tests: Make crc_kunit test only the enabled CRC variants

Peter Zijlstra <[email protected]>
sched/debug: Fix avg_vruntime() usage

Catalin Marinas <[email protected]>
arm64: errata: Work around early CME DVMSync acknowledgement

Catalin Marinas <[email protected]>
arm64: cputype: Add C1-Pro definitions

Catalin Marinas <[email protected]>
arm64: tlb: Pass the corresponding mm to __tlbi_sync_s1ish()

Catalin Marinas <[email protected]>
arm64: tlb: Introduce __tlbi_sync_s1ish_{kernel,batch}() for TLB maintenance

Mark Rutland <[email protected]>
arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI

Mark Rutland <[email protected]>
arm64: tlb: Allow XZR argument to TLBI ops

Namjae Jeon <[email protected]>
ksmbd: validate owner of durable handle on reconnect

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger

Tamir Duberstein <[email protected]>
scripts: generate_rust_analyzer.py: define scripts

Dudu Lu <[email protected]>
crypto: krb5enc - fix async decrypt skipping hash verification

Wesley Atwell <[email protected]>
crypto: krb5enc - fix sleepable flag handling in encrypt dispatch

Mikhail Gavrilov <[email protected]>
drm/amdgpu: replace PASID IDR with XArray

Daniel Golle <[email protected]>
net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers

Minhong He <[email protected]>
ipv6: add NULL checks for idev in SRv6 paths

Herbert Xu <[email protected]>
crypto: authencesn - Fix src offset when decrypting in-place

-------------

Diffstat:

 Documentation/arch/arm64/silicon-errata.rst  |   2 +
 Makefile                                     |   4 +-
 arch/arm64/Kconfig                           |  12 +++
 arch/arm64/include/asm/cpucaps.h             |   2 +
 arch/arm64/include/asm/cputype.h             |   2 +
 arch/arm64/include/asm/fpsimd.h              |  21 ++++
 arch/arm64/include/asm/tlbbatch.h            |  10 +-
 arch/arm64/include/asm/tlbflush.h            | 143 ++++++++++++++++++++++-----
 arch/arm64/kernel/cpu_errata.c               |  30 ++++++
 arch/arm64/kernel/entry-common.c             |   3 +
 arch/arm64/kernel/fpsimd.c                   |  79 +++++++++++++++
 arch/arm64/kernel/process.c                  |  36 +++++++
 arch/arm64/kernel/sys_compat.c               |   2 +-
 arch/arm64/kvm/hyp/nvhe/mm.c                 |   2 +-
 arch/arm64/kvm/hyp/nvhe/tlb.c                |   8 +-
 arch/arm64/kvm/hyp/pgtable.c                 |   2 +-
 arch/arm64/kvm/hyp/vhe/tlb.c                 |  10 +-
 arch/arm64/tools/cpucaps                     |   1 +
 crypto/authencesn.c                          |   6 +-
 crypto/krb5enc.c                             |  51 ++++++----
 drivers/crypto/ccp/sev-dev.c                 |  19 +++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c      |  39 ++++----
 drivers/net/ethernet/mediatek/mtk_eth_soc.c  |  22 ++++-
 drivers/net/ethernet/mediatek/mtk_ppe.c      |  30 ++++++
 drivers/net/ethernet/mediatek/mtk_ppe.h      |   1 +
 fs/f2fs/compress.c                           |  14 ++-
 fs/f2fs/data.c                               |   7 +-
 fs/f2fs/f2fs.h                               |   2 +-
 fs/f2fs/namei.c                              |   1 +
 fs/f2fs/segment.c                            |   6 +-
 fs/f2fs/super.c                              |  11 ++-
 fs/fs-writeback.c                            |  36 +++----
 fs/fuse/control.c                            |   4 +-
 fs/fuse/dev.c                                |  30 +++---
 fs/fuse/fuse_i.h                             |   1 +
 fs/fuse/inode.c                              |   1 +
 fs/fuse/readdir.c                            |   4 +
 fs/ntfs3/fslog.c                             |  12 ++-
 fs/smb/client/cifsacl.c                      |   1 +
 fs/smb/client/smb2ops.c                      |   6 ++
 fs/smb/server/connection.c                   |   5 +-
 fs/smb/server/mgmt/user_config.c             |   6 --
 fs/smb/server/mgmt/user_session.c            |   7 +-
 fs/smb/server/oplock.c                       |   7 ++
 fs/smb/server/oplock.h                       |   1 +
 fs/smb/server/smb2pdu.c                      |   5 +-
 fs/smb/server/smbacl.c                       |  61 +++++++++---
 fs/smb/server/transport_ipc.c                |  16 ++-
 fs/smb/server/transport_tcp.c                |   4 +-
 fs/smb/server/vfs_cache.c                    | 128 ++++++++++++++++++++----
 fs/smb/server/vfs_cache.h                    |  12 ++-
 kernel/sched/debug.c                         |   4 +-
 lib/crc/.kunitconfig                         |   3 +
 lib/crc/Kconfig                              |  21 ++--
 lib/crc/tests/crc_kunit.c                    |  28 ++++--
 lib/crypto/.kunitconfig                      |  11 +++
 lib/crypto/tests/Kconfig                     |  32 ++++--
 net/ipv6/exthdrs.c                           |   4 +
 net/ipv6/seg6_hmac.c                         |   2 +
 net/packet/af_packet.c                       |  21 ++--
 net/rxrpc/key.c                              |   4 +
 scripts/dtc/dtc-lexer.l                      |   3 -
 scripts/generate_rust_analyzer.py            |  14 ++-
 sound/hda/codecs/realtek/alc269.c            |   1 +
 sound/usb/caiaq/device.c                     |   4 +-
 sound/usb/mixer.c                            |   7 ++
 tools/testing/kunit/configs/all_tests.config |   4 +
 67 files changed, 870 insertions(+), 218 deletions(-)