Skip to content

5.10.269-rc1 review

Greg Kroah-Hartman linux-patches lkml stable 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest43 patches 13 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/43RDMA/rxe: Fix OOB in free_rd_atomic_resources()drivers/infiniband/sw/rxe/rxe_qp.c+1 -20 replies
2/43ipv6: mcast: Fix use-after-free when processing MLD queriesnet/ipv6/mcast.c+4 -40 replies
3/43ext4: dont enable DAX on new encrypted filesfs/ext4/ialloc.c fs/ext4/super.c+24 -200 replies
4/43ipvs: reload ip header after head reallocationnet/netfilter/ipvs/ip_vs_xmit.c+2 -40 replies
5/43io_uring/io-wq: fix worker accounting when canceling creation callbacksio_uring/io-wq.c+6 -30 replies
6/43bpf: Remove tst_run from lwt_seg6local_prog_ops.net/core/filter.c+0 -10 replies
7/43jfs: add check read-only before truncation in jfs_truncate_nolock()fs/jfs/inode.c+1 -10 replies
8/43jfs: add check read-only before txBeginAnon() callfs/jfs/jfs_extent.c+10 -00 replies
9/43KVM: arm64: Prevent access to vCPU events before initarch/arm64/kvm/arm.c+6 -00 replies
10/43bpf: Fix use-after-free in offloaded map/prog info fillkernel/bpf/offload.c+4 -60 replies
11/43Revert "PM: sleep: Use complete() in device_pm_sleep_init()"drivers/base/power/main.c+1 -50 replies
12/43selinux: switch two allocations to use kzalloc_objs()security/selinux/ss/conditional.c+6 -60 replies
13/43Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"drivers/mtd/maps/vmu-flash.c+5 -30 replies
14/43Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"fs/cifs/smb2ops.c+2 -20 replies
15/43ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()include/linux/inetdevice.h net/ipv4/igmp.c+14 -50 replies
16/43kcov: fix data corruption and race conditions on PREEMPT_RTinclude/linux/sched.h kernel/kcov.c lib/Kconfig.debug+57 -490 replies
17/43ext4: propagate errors from fast commit range replayfs/ext4/fast_commit.c+7 -30 replies
18/43nilfs2: reject invalid block index in GC ioctlfs/nilfs2/ioctl.c+19 -20 replies
19/43nfc: nci: fix uninit-value in the RF discover/activated NTF handlersnet/nfc/nci/ntf.c+2 -20 replies
20/43HID: magicmouse: do not keep a stale msc->input if no input is claimeddrivers/hid/hid-magicmouse.c+10 -00 replies
21/43nfc: nci: add data_len bound checks to activation parameter extractorsnet/nfc/nci/ntf.c+24 -40 replies
22/43nvmet-tcp: bound SGL data length before allocating command buffersdrivers/nvme/target/tcp.c+13 -00 replies
23/43HID: input: read battery capacity from its actual report offsetdrivers/hid/hid-input.c include/linux/hid.h+14 -40 replies
24/43fpga: dfl: fme: add error handlingdrivers/fpga/dfl-fme-perf.c+2 -00 replies
25/43accessibility: speakup: unregister tty ldisc on later init failuresdrivers/accessibility/speakup/main.c+1 -00 replies
26/43usb: usbtest: disable dynamic ID supportdrivers/usb/misc/usbtest.c+1 -00 replies
27/43usb: gadget: f_tcm: keep port count until LUN teardown completesdrivers/target/target_core_fabric_configfs.c drivers/usb/gadget/function/f_tcm.c include/target/target_core_fabric.h+11 -10 replies
28/43xfrm: espintcp: fix UAF during closenet/xfrm/espintcp.c+2 -16 replies
29/43xfrm: drop ESP-in-TCP packets with no ingress devicenet/xfrm/espintcp.c+6 -00 replies
30/43xfrm: ah6: validate routing header segments_leftnet/ipv6/ah6.c+18 -110 replies
31/43xfrm: fix xfrm_state_construct() auth-trunc leaknet/xfrm/xfrm_user.c+1 -10 replies
32/43ipv6: seg6: clear IPv4 control block on IPIP decapsulationnet/ipv6/seg6_local.c+7 -00 replies
33/43mm/swap: reject swapon() on filesystem-level encrypted filesDocumentation/filesystems/fscrypt.rst mm/swapfile.c+11 -00 replies
34/43crypto: atmel-tdes - use scatterlist length before DMA mappingdrivers/crypto/atmel-tdes.c+2 -30 replies
35/43crypto: mxs-dcp - fix source scatterlist length accessdrivers/crypto/mxs-dcp.c+1 -10 replies
36/43KVM: s390: vsie: zero stale crypto bitsarch/s390/kvm/vsie.c+1 -00 replies
37/43usb: core: Add lock to usb_wakeup_notification()drivers/usb/core/hub.c+3 -00 replies
38/43usb: core: Strengthen error handling in hub_hub_status()drivers/usb/core/hub.c+3 -10 replies
39/43ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()sound/usb/midi.c+2 -00 replies
40/43USB: serial: option: fix slab OOB read in interrupt URB callbackdrivers/usb/serial/option.c+17 -30 replies
41/43USB: serial: spcp8x5: drop broken carrier detect supportdrivers/usb/serial/spcp8x5.c+0 -130 replies
42/43USB: c67x00: fix use-after-free in c67x00_add_iso_urb()drivers/usb/c67x00/c67x00-sched.c+2 -20 replies
43/43usb: usbfs: fix use-after-free of usb_device in usbdev_release()drivers/usb/core/devio.c+1 -10 replies

Reviews trailers per patch

21 of 43 patches have a Reviewed-by or Acked-by.

PatchZhu YanjunDongliang MuDaniel BorkmannIdo SchimmelAlexander PotapenkoJan KaraDavid AhernEric DumazetJiayuan ChenAlec HallChristoph HellwigXu Yilun[email protected]Breno LeitaoRen WeiDisha GoelOjaswin MujooAndrea MayerBaoquan HeMuhammad Usama AnjumDarrick J. WongJulian AnastasovGabriel Krisman BertaziClaudio ImbrendaAlan SternFrank LiFlorian FainelliBrett A C SheffieldWoody SuwalskiDominique MartinetPavel Machek (CIP)Shuah KhanBarry K. Nathan
SeriesT-b T-b T-b T-b T-b T-b T-b
1/43R-b
2/43R-b R-b R-b
3/43R-b T-b R-b
4/43A-b
5/43R-b
6/43A-b
7/43
8/43
9/43
10/43R-b A-b
11/43
12/43
13/43
14/43
15/43R-b
16/43R-b
17/43R-b
18/43
19/43
20/43R-b T-b
21/43
22/43R-b
23/43R-b
24/43R-b
25/43
26/43T-b
27/43
28/43R-b
29/43R-b
30/43
31/43
32/43R-b
33/43R-b R-b R-b
34/43
35/43R-b
36/43R-b
37/43
38/43
39/43
40/43
41/43
42/43
43/43R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 33 reviewers.

Read the v1 thread

Cover letter [PATCH 5.10 00/43] 5.10.269-rc1 review

This is the start of the stable review cycle for the 5.10.269 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed, 02 Sep 2026 13:32:19 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.269-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.10.269-rc1

Miguel Peñaranda <[email protected]>
usb: usbfs: fix use-after-free of usb_device in usbdev_release()

Shuangpeng Bai <[email protected]>

    USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

Johan Hovold <[email protected]>
USB: serial: spcp8x5: drop broken carrier detect support

Jiale Yao <[email protected]>
USB: serial: option: fix slab OOB read in interrupt URB callback

Marouane El Moufid <[email protected]>
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

Griffin Kroah-Hartman <[email protected]>
usb: core: Strengthen error handling in hub_hub_status()

Griffin Kroah-Hartman <[email protected]>
usb: core: Add lock to usb_wakeup_notification()

Christian Borntraeger <[email protected]>
KVM: s390: vsie: zero stale crypto bits

Thorsten Blum <[email protected]>
crypto: mxs-dcp - fix source scatterlist length access

Thorsten Blum <[email protected]>
crypto: atmel-tdes - use scatterlist length before DMA mapping

Eric Biggers <[email protected]>
mm/swap: reject swapon() on filesystem-level encrypted files

Kyle Zeng <[email protected]>
ipv6: seg6: clear IPv4 control block on IPIP decapsulation

Zihan Xi <[email protected]>
xfrm: fix xfrm_state_construct() auth-trunc leak

Asim Viladi Oglu Manizada <[email protected]>
xfrm: ah6: validate routing header segments_left

Zhiling Zou <[email protected]>
xfrm: drop ESP-in-TCP packets with no ingress device

Sabrina Dubroca <[email protected]>
xfrm: espintcp: fix UAF during close

Shuangpeng Bai <[email protected]>
usb: gadget: f_tcm: keep port count until LUN teardown completes

Aleksandr Nogikh <[email protected]>
usb: usbtest: disable dynamic ID support

Haoxiang Li <[email protected]>
accessibility: speakup: unregister tty ldisc on later init failures

Griffin Kroah-Hartman <[email protected]>
fpga: dfl: fme: add error handling

Jose Villaseñor Montfort <[email protected]>
HID: input: read battery capacity from its actual report offset

Ibrahim Hashimov <[email protected]>
nvmet-tcp: bound SGL data length before allocating command buffers

Bryam Vargas <[email protected]>
nfc: nci: add data_len bound checks to activation parameter extractors

Jose Villaseñor Montfort <[email protected]>

    HID: magicmouse: do not keep a stale msc->input if no input is claimed

Samuel Page <[email protected]>
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers

Ryusuke Konishi <[email protected]>
nilfs2: reject invalid block index in GC ioctl

Guanghui Yang <[email protected]>
ext4: propagate errors from fast commit range replay

Tetsuo Handa <[email protected]>
kcov: fix data corruption and race conditions on PREEMPT_RT

Eric Dumazet <[email protected]>
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

Sasha Levin <[email protected]>
Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"

Sasha Levin <[email protected]>
Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"

Stephen Smalley <[email protected]>
selinux: switch two allocations to use kzalloc_objs()

Sasha Levin <[email protected]>
Revert "PM: sleep: Use complete() in device_pm_sleep_init()"

Jiayuan Chen <[email protected]>
bpf: Fix use-after-free in offloaded map/prog info fill

Oliver Upton <[email protected]>
KVM: arm64: Prevent access to vCPU events before init

Vasiliy Kovalev <[email protected]>
jfs: add check read-only before txBeginAnon() call

Vasiliy Kovalev <[email protected]>
jfs: add check read-only before truncation in jfs_truncate_nolock()

Sebastian Andrzej Siewior <[email protected]>
bpf: Remove tst_run from lwt_seg6local_prog_ops.

Vishnu Razdan <[email protected]>
io_uring/io-wq: fix worker accounting when canceling creation callbacks

Florian Westphal <[email protected]>
ipvs: reload ip header after head reallocation

Eric Biggers <[email protected]>
ext4: don't enable DAX on new encrypted files

Ido Schimmel <[email protected]>
ipv6: mcast: Fix use-after-free when processing MLD queries

Peiyang He <[email protected]>
RDMA/rxe: Fix OOB in free_rd_atomic_resources()

-------------

Diffstat:

 Documentation/filesystems/fscrypt.rst        |  4 ++
 Makefile                                     |  4 +-
 arch/arm64/kvm/arm.c                         |  6 ++
 arch/s390/kvm/vsie.c                         |  1 +
 drivers/accessibility/speakup/main.c         |  1 +
 drivers/base/power/main.c                    |  6 +-
 drivers/crypto/atmel-tdes.c                  |  5 +-
 drivers/crypto/mxs-dcp.c                     |  2 +-
 drivers/fpga/dfl-fme-perf.c                  |  2 +
 drivers/hid/hid-input.c                      | 17 +++--
 drivers/hid/hid-magicmouse.c                 | 10 +++
 drivers/infiniband/sw/rxe/rxe_qp.c           |  3 +-
 drivers/mtd/maps/vmu-flash.c                 |  8 ++-
 drivers/nvme/target/tcp.c                    | 13 ++++
 drivers/target/target_core_fabric_configfs.c |  8 +++
 drivers/usb/c67x00/c67x00-sched.c            |  4 +-
 drivers/usb/core/devio.c                     |  2 +-
 drivers/usb/core/hub.c                       |  7 ++-
 drivers/usb/gadget/function/f_tcm.c          |  2 +-
 drivers/usb/misc/usbtest.c                   |  1 +
 drivers/usb/serial/option.c                  | 20 +++++-
 drivers/usb/serial/spcp8x5.c                 | 13 ----
 fs/cifs/smb2ops.c                            |  4 +-
 fs/ext4/fast_commit.c                        | 10 ++-
 fs/ext4/ialloc.c                             |  4 ++
 fs/ext4/super.c                              | 40 ++++++------
 fs/jfs/inode.c                               |  2 +-
 fs/jfs/jfs_extent.c                          | 10 +++
 fs/nilfs2/ioctl.c                            | 21 ++++++-
 include/linux/hid.h                          |  1 +
 include/linux/inetdevice.h                   |  5 ++
 include/linux/sched.h                        |  8 +++
 include/target/target_core_fabric.h          |  2 +
 io_uring/io-wq.c                             |  9 ++-
 kernel/bpf/offload.c                         | 10 ++-
 kernel/kcov.c                                | 93 ++++++++++++++--------------
 lib/Kconfig.debug                            |  5 +-
 mm/swapfile.c                                |  7 +++
 net/core/filter.c                            |  1 -
 net/ipv4/igmp.c                              | 14 +++--
 net/ipv6/ah6.c                               | 29 +++++----
 net/ipv6/mcast.c                             |  8 +--
 net/ipv6/seg6_local.c                        |  7 +++
 net/netfilter/ipvs/ip_vs_xmit.c              |  6 +-
 net/nfc/nci/ntf.c                            | 32 ++++++++--
 net/xfrm/espintcp.c                          |  9 ++-
 net/xfrm/xfrm_user.c                         |  2 +-
 security/selinux/ss/conditional.c            | 12 ++--
 sound/usb/midi.c                             |  2 +
 49 files changed, 326 insertions(+), 166 deletions(-)