Skip to content

6.18.37-rc1 review

Greg Kroah-Hartman linux-patches lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest60 patches 9 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/60io_uring/net: Avoid msghdr on op_connect/op_bind async dataio_uring/net.c io_uring/opdef.c+20 -200 replies
2/60net: stmmac: fix stm32 (and potentially others) resume regressiondrivers/net/ethernet/stmicro/stmmac/stmmac_main.c+2 -10 replies
3/60fuse: re-lock request before replacing page cache foliofs/fuse/dev.c+5 -140 replies
4/60Revert "NFSD: Defer sub-object cleanup in export put callbacks"fs/nfsd/export.c fs/nfsd/export.h fs/nfsd/nfsctl.c+12 -660 replies
5/60debugobjects: Allow to refill the pool before SYSTEM_SCHEDULINGlib/debugobjects.c+1 -10 replies
6/60debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEPlib/debugobjects.c+2 -20 replies
7/60debugobjects: Do not fill_pool() if pi_blocked_onlib/debugobjects.c+14 -40 replies
8/60debugobjects: Dont call fill_pool() in early boot hardirq contextlib/debugobjects.c+37 -90 replies
9/60RDMA/bnxt_re: zero shared page before exposing to userspacedrivers/infiniband/hw/bnxt_re/ib_verbs.c+1 -10 replies
10/60i2c: stub: Reject I2C block transfers with invalid lengthdrivers/i2c/i2c-stub.c+5 -00 replies
11/60net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h+5 -40 replies
12/60agp/amd64: Fix broken error propagation in agp_amd64_probe()drivers/char/agp/amd64-agp.c+1 -10 replies
13/60ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()drivers/acpi/scan.c+15 -260 replies
14/60rose: fix dev_put() leak in rose_loopback_timer()net/rose/rose_loopback.c+2 -90 replies
15/60rose: hold loopback neighbour reference across timer callbacknet/rose/rose_loopback.c+10 -10 replies
16/60rose: fix race between loopback timer and module removalnet/rose/rose_loopback.c+24 -70 replies
17/60rose: clear neighbour pointer after rose_neigh_put() in state machinesnet/rose/rose_in.c+6 -00 replies
18/60rose: guard rose_neigh_put() against NULL in timer expirynet/rose/rose_timer.c+4 -10 replies
19/60rose: fix netdev double-hold in rose_rx_call_request()net/rose/af_rose.c+5 -30 replies
20/60rose: fix notifier unregistered too early in rose_exit()net/rose/af_rose.c+11 -20 replies
21/60rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanupnet/rose/af_rose.c+5 -00 replies
22/60rose: disconnect orphaned STATE_2 sockets when device is gonenet/rose/rose_timer.c+14 -00 replies
23/60rose: fix netdev double-hold in rose_make_new()net/rose/af_rose.c+1 -30 replies
24/60rose: release netdev ref and destroy orphaned incoming socketsnet/rose/af_rose.c net/rose/rose_timer.c+14 -40 replies
25/60rose: drop CALL_REQUEST in loopback timer when device is not runningnet/rose/rose_loopback.c+10 -00 replies
26/60rose: cancel neighbour timers in rose_neigh_put() before freeinginclude/net/rose.h+12 -00 replies
27/60rose: clear neighbour pointer in rose_kill_by_device()net/rose/af_rose.c+9 -10 replies
28/60rose: dont free fd-owned sockets when reaping in the heartbeatnet/rose/rose_timer.c+56 -10 replies
29/60regulator: core: fix locking in regulator_resolve_supply() error pathdrivers/regulator/core.c+9 -10 replies
30/60hv: utils: handle and propagate errors in kvp_registerdrivers/hv/hv_kvp.c+14 -130 replies
31/60Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMsdrivers/hv/vmbus_drv.c+26 -30 replies
32/60firmware: samsung: acpm: Fix cross-thread RX length corruptiondrivers/firmware/samsung/exynos-acpm.c+7 -70 replies
33/60sctp: disable BH before calling udp_tunnel_xmit_skb()net/sctp/ipv6.c net/sctp/protocol.c+4 -00 replies
34/60mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smapsDocumentation/filesystems/proc.rst fs/proc/task_mmu.c include/linux/mm.h +3 more+13 -20 replies
35/60mm: add atomic VMA flags and set VM_MAYBE_GUARD as suchinclude/linux/mm.h+44 -00 replies
36/60mm: update vma_modify_flags() to handle residual flags, documentmm/madvise.c mm/mlock.c mm/mprotect.c +4 more+142 -680 replies
37/60mm: implement sticky VMA flagsinclude/linux/mm.h mm/vma.c mm/vma.h +1 more+77 -200 replies
38/60mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD oneinclude/linux/mm.h mm/memory.c tools/testing/vma/vma_internal.h+56 -140 replies
39/60mm: set the VM_MAYBE_GUARD flag on guard region installmm/khugepaged.c mm/madvise.c+61 -320 replies
40/60mm: propagate VM_SOFTDIRTY on mergeinclude/linux/mm.h tools/testing/vma/vma_internal.h+13 -200 replies
41/60testing/selftests/mm: add soft-dirty merge self-testtools/testing/selftests/mm/soft-dirty.c+126 -10 replies
42/60net: export netif_open for self_test usagenet/core/dev.c+1 -00 replies
43/60net: net_failover: Fix the deadlock in slave registerdrivers/net/net_failover.c net/core/failover.c+11 -70 replies
44/60iio: light: veml6075: add bounds check to veml6075_it_ms indexdrivers/iio/light/veml6075.c+6 -20 replies
45/60iio: adc: ti-ads1298: add bounds check to pga_settings indexdrivers/iio/adc/ti-ads1298.c+6 -10 replies
46/60Input: rmi4 - fix register descriptor address calculationdrivers/input/rmi4/rmi_driver.c+1 -10 replies
47/60Input: rmi4 - refactor register descriptor parsingdrivers/input/rmi4/rmi_driver.c+76 -480 replies
48/60Input: rmi4 - fix type overflow in register countsdrivers/input/rmi4/rmi_driver.h+1 -10 replies
49/60Input: rmi4 - fix num_subpackets overflow in register descriptordrivers/input/rmi4/rmi_driver.h drivers/input/rmi4/rmi_f12.c+8 -10 replies
50/60Input: rmi4 - fix memory leak in rmi_set_attn_data()drivers/input/rmi4/rmi_driver.c+5 -10 replies
51/60Input: rmi4 - iterative IRQ handlerdrivers/input/rmi4/rmi_driver.c+16 -160 replies
52/60Input: rmi4 - fix bit count in bitmap_copy()drivers/input/rmi4/rmi_driver.c+3 -40 replies
53/60crypto: qat - remove unused character device and IOCTLsDocumentation/userspace-api/ioctl/ioctl-number.rst drivers/crypto/intel/qat/qat_common/adf_cfg.c drivers/crypto/intel/qat/qat_common/adf_cfg.h +5 more+1 -5580 replies
54/60vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_writedrivers/tty/vt/vc_screen.c+1 -10 replies
55/60serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zerodrivers/tty/serial/qcom_geni_serial.c+3 -60 replies
56/60drivers/base/memory: set mem->altmap after successful device registrationdrivers/base/memory.c+2 -10 replies
57/60ksmbd: reject non-VALID session in compound request branchfs/smb/server/smb2pdu.c+5 -00 replies
58/60media: vidtv: fix NULL pointer dereference in vidtv_mux_push_sidrivers/media/test-drivers/vidtv/vidtv_mux.c+7 -10 replies
59/60virtiofs: fix UAF on submount umountfs/fuse/file.c+7 -10 replies
60/60mm: do not copy page tables unnecessarily for VM_UFFD_WPinclude/linux/mm.h mm/memory.c+10 -20 replies

Reviews trailers per patch

22 of 60 patches have a Reviewed-by or Acked-by.

PatchMarek VasutSebastian Andrzej SiewiorJean DelvareLukas WunnerJeff LaytonAlexandr AlexandrovLong LiMichael KelleyKrister JohansenMatthew RuffellMarcelo Ricardo LeitnerPedro FalcatoVlastimil BabkaDavid Hildenbrand (Red Hat)Lance YangAndrey VaginCyrill GorcunovJavier CarrascoAhsan AttaJiri SlabyBartosz GolaszewskiOscar Salvador (SUSE)Namjae JeonGreg KurzFlorian FainelliBrett A C SheffieldPeter SchneiderShuah KhanRon EconomosMiguel OjedaMark BrownShung-Hsi Yu
SeriesT-b T-b T-b T-b T-b T-b T-b T-b
1/60
2/60T-b
3/60
4/60R-b T-b
5/60
6/60
7/60
8/60R-b
9/60
10/60R-b
11/60
12/60R-b
13/60
14/60
15/60
16/60
17/60
18/60
19/60
20/60
21/60
22/60
23/60
24/60
25/60
26/60
27/60
28/60
29/60
30/60R-b
31/60R-b T-b T-b
32/60
33/60A-b
34/60R-b R-b A-b R-b
35/60R-b R-b A-b R-b
36/60R-b R-b
37/60R-b R-b
38/60R-b R-b A-b
39/60R-b
40/60R-b R-b A-b A-b A-b
41/60
42/60
43/60
44/60R-b
45/60
46/60
47/60
48/60
49/60
50/60
51/60
52/60
53/60R-b
54/60R-b
55/60R-b
56/60A-b
57/60A-b
58/60
59/60R-b
60/60A-b A-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 32 reviewers.

Read the v1 thread

Cover letter [PATCH 6.18 00/60] 6.18.37-rc1 review

This is the start of the stable review cycle for the 6.18.37 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.37-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.37-rc1

Lorenzo Stoakes <[email protected]>
mm: do not copy page tables unnecessarily for VM_UFFD_WP

Miklos Szeredi <[email protected]>
virtiofs: fix UAF on submount umount

Ruslan Valiyev <[email protected]>
media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si

Gil Portnoy <[email protected]>
ksmbd: reject non-VALID session in compound request branch

Georgi Djakov <[email protected]>

    drivers/base/memory: set mem->altmap after successful device registration

Viken Dadhaniya <[email protected]>
serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero

Yi Yang <[email protected]>
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

Giovanni Cabiddu <[email protected]>
crypto: qat - remove unused character device and IOCTLs

Dmitry Torokhov <[email protected]>
Input: rmi4 - fix bit count in bitmap_copy()

Dmitry Torokhov <[email protected]>
Input: rmi4 - iterative IRQ handler

Dmitry Torokhov <[email protected]>
Input: rmi4 - fix memory leak in rmi_set_attn_data()

Dmitry Torokhov <[email protected]>
Input: rmi4 - fix num_subpackets overflow in register descriptor

Dmitry Torokhov <[email protected]>
Input: rmi4 - fix type overflow in register counts

Dmitry Torokhov <[email protected]>
Input: rmi4 - refactor register descriptor parsing

Dmitry Torokhov <[email protected]>
Input: rmi4 - fix register descriptor address calculation

Sam Daly <[email protected]>
iio: adc: ti-ads1298: add bounds check to pga_settings index

Sam Daly <[email protected]>
iio: light: veml6075: add bounds check to veml6075_it_ms index

Faicker Mo <[email protected]>
net: net_failover: Fix the deadlock in slave register

Mike Marciniszyn (Meta) <[email protected]>
net: export netif_open for self_test usage

Lorenzo Stoakes <[email protected]>
testing/selftests/mm: add soft-dirty merge self-test

Lorenzo Stoakes <[email protected]>
mm: propagate VM_SOFTDIRTY on merge

Lorenzo Stoakes <[email protected]>
mm: set the VM_MAYBE_GUARD flag on guard region install

Lorenzo Stoakes <[email protected]>
mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one

Lorenzo Stoakes <[email protected]>
mm: implement sticky VMA flags

Lorenzo Stoakes <[email protected]>
mm: update vma_modify_flags() to handle residual flags, document

Lorenzo Stoakes <[email protected]>
mm: add atomic VMA flags and set VM_MAYBE_GUARD as such

Lorenzo Stoakes <[email protected]>
mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps

Xin Long <[email protected]>
sctp: disable BH before calling udp_tunnel_xmit_skb()

Tudor Ambarus <[email protected]>
firmware: samsung: acpm: Fix cross-thread RX length corruption

Dexuan Cui <[email protected]>
Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs

Thorsten Blum <[email protected]>
hv: utils: handle and propagate errors in kvp_register

André Draszik <[email protected]>
regulator: core: fix locking in regulator_resolve_supply() error path

Bernard Pidoux <[email protected]>
rose: don't free fd-owned sockets when reaping in the heartbeat

Bernard Pidoux <[email protected]>
rose: clear neighbour pointer in rose_kill_by_device()

Bernard Pidoux <[email protected]>
rose: cancel neighbour timers in rose_neigh_put() before freeing

Bernard Pidoux <[email protected]>
rose: drop CALL_REQUEST in loopback timer when device is not running

Bernard Pidoux <[email protected]>
rose: release netdev ref and destroy orphaned incoming sockets

Bernard Pidoux <[email protected]>
rose: fix netdev double-hold in rose_make_new()

Bernard Pidoux <[email protected]>
rose: disconnect orphaned STATE_2 sockets when device is gone

Bernard Pidoux <[email protected]>
rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup

Bernard Pidoux <[email protected]>
rose: fix notifier unregistered too early in rose_exit()

Bernard Pidoux <[email protected]>
rose: fix netdev double-hold in rose_rx_call_request()

Bernard Pidoux <[email protected]>
rose: guard rose_neigh_put() against NULL in timer expiry

Bernard Pidoux <[email protected]>
rose: clear neighbour pointer after rose_neigh_put() in state machines

Bernard Pidoux <[email protected]>
rose: fix race between loopback timer and module removal

Bernard Pidoux <[email protected]>
rose: hold loopback neighbour reference across timer callback

Bernard Pidoux <[email protected]>
rose: fix dev_put() leak in rose_loopback_timer()

Yicong Yang <[email protected]>
ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()

Mingyu Wang <[email protected]>
agp/amd64: Fix broken error propagation in agp_amd64_probe()

Weiming Shi <[email protected]>
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

Weiming Shi <[email protected]>
i2c: stub: Reject I2C block transfers with invalid length

Lord Ulf Henrik Holmberg <[email protected]>
RDMA/bnxt_re: zero shared page before exposing to userspace

Waiman Long <[email protected]>
debugobjects: Dont call fill_pool() in early boot hardirq context

Helen Koike <[email protected]>
debugobjects: Do not fill_pool() if pi_blocked_on

Sebastian Andrzej Siewior <[email protected]>
debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP

Sebastian Andrzej Siewior <[email protected]>
debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING

Yang Erkun <[email protected]>
Revert "NFSD: Defer sub-object cleanup in export put callbacks"

Joanne Koong <[email protected]>
fuse: re-lock request before replacing page cache folio

Russell King (Oracle) <[email protected]>
net: stmmac: fix stm32 (and potentially others) resume regression

Gabriel Krisman Bertazi <[email protected]>
io_uring/net: Avoid msghdr on op_connect/op_bind async data

-------------

Diffstat:

 Documentation/filesystems/proc.rst                 |   5 +-
 Documentation/userspace-api/ioctl/ioctl-number.rst |   1 -
 Makefile                                           |   4 +-
 drivers/acpi/scan.c                                |  41 +--
 drivers/base/memory.c                              |   3 +-
 drivers/char/agp/amd64-agp.c                       |   2 +-
 drivers/crypto/intel/qat/qat_common/adf_cfg.c      |  10 -
 drivers/crypto/intel/qat/qat_common/adf_cfg.h      |   1 -
 .../crypto/intel/qat/qat_common/adf_cfg_common.h   |  32 --
 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h |  38 --
 .../crypto/intel/qat/qat_common/adf_common_drv.h   |   3 -
 drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c  | 404 +--------------------
 drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c  |  70 ----
 drivers/firmware/samsung/exynos-acpm.c             |  14 +-
 drivers/hv/hv_kvp.c                                |  25 +-
 drivers/hv/vmbus_drv.c                             |  29 +-
 drivers/i2c/i2c-stub.c                             |   5 +
 drivers/iio/adc/ti-ads1298.c                       |   7 +-
 drivers/iio/light/veml6075.c                       |   8 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   2 +-
 drivers/input/rmi4/rmi_driver.c                    | 171 +++++----
 drivers/input/rmi4/rmi_driver.h                    |   4 +-
 drivers/input/rmi4/rmi_f12.c                       |   7 +
 drivers/media/test-drivers/vidtv/vidtv_mux.c       |   8 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c |   8 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h |   1 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   3 +-
 drivers/net/net_failover.c                         |  12 +-
 drivers/regulator/core.c                           |  10 +-
 drivers/tty/serial/qcom_geni_serial.c              |   9 +-
 drivers/tty/vt/vc_screen.c                         |   2 +-
 fs/fuse/dev.c                                      |  19 +-
 fs/fuse/file.c                                     |   8 +-
 fs/nfsd/export.c                                   |  67 +---
 fs/nfsd/export.h                                   |   7 +-
 fs/nfsd/nfsctl.c                                   |   8 +-
 fs/proc/task_mmu.c                                 |   1 +
 fs/smb/server/smb2pdu.c                            |   5 +
 include/linux/mm.h                                 | 104 ++++++
 include/net/rose.h                                 |  12 +
 include/trace/events/mmflags.h                     |   1 +
 io_uring/net.c                                     |  36 +-
 io_uring/opdef.c                                   |   4 +-
 lib/debugobjects.c                                 |  58 ++-
 mm/khugepaged.c                                    |  71 ++--
 mm/madvise.c                                       |  24 +-
 mm/memory.c                                        |  16 +-
 mm/mlock.c                                         |   2 +-
 mm/mprotect.c                                      |   2 +-
 mm/mseal.c                                         |   7 +-
 mm/vma.c                                           |  81 +++--
 mm/vma.h                                           | 130 +++++--
 net/core/dev.c                                     |   1 +
 net/core/failover.c                                |   6 +-
 net/rose/af_rose.c                                 |  49 ++-
 net/rose/rose_in.c                                 |   6 +
 net/rose/rose_loopback.c                           |  61 +++-
 net/rose/rose_timer.c                              |  87 ++++-
 net/sctp/ipv6.c                                    |   2 +
 net/sctp/protocol.c                                |   2 +
 tools/testing/selftests/mm/soft-dirty.c            | 127 ++++++-
 tools/testing/vma/vma.c                            |   3 +-
 tools/testing/vma/vma_internal.h                   |  49 +++
 63 files changed, 1023 insertions(+), 972 deletions(-)