Please consider post-v7.1 CVE fixes for 6.1.y, 6.6.y, 6.12.y, and 6.18.y

Hi Greg and Sasha,

Thanks for taking care of the earlier requests. I found one final direct-pickup group: 26 CVE fixes that entered mainline between v7.1 and v7.2 and are still missing from one or more supported 6.x trees. The Linux CNA affected ranges include each target listed below. I left out anything that needs an adapted backport.

I checked each of the 73 commit/tree pairs separately, then applied each tree's full set together after its current stable queue. All applications were clean, and every changed path built with CONFIG_WERROR enabled. The cumulative x86_64 allmodconfig kernel and modules built without diagnostics on 6.6.y, 6.12.y, and 6.18.y. The 6.1.y build completed with four unrelated objtool warnings; the same four warnings occurred on the unpatched tree. I also built the CoreSight object on arm64 for each target where it is requested. I did not runtime-test these fixes.

Could you please queue these commits for the trees shown?

5152c6d49e3fd4e9f2e857c57527aead752f1f87 (CVE-2026-68097)
Targets: 6.1.y
ksmbd: validate ACE size against SID sub-authorities
ffb2bd7ade36ec4da32c46a6eddbf4515316d08c (CVE-2026-68161)
Targets: 6.1.y
sctp: close UDP tunnel sockets during netns teardown
fd098a23bf8fda7eae48db9b06e7c34fc4d228fa (CVE-2026-68286)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
drop_monitor: perform u64_stats updates under IRQ-disabled section
7089f7ab99c89f443c92d8fcc585e63f2727f0b3 (CVE-2026-68287)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
drop_monitor: fix size calculations for 64-bit attributes
5e9c8baee0329fbefe7c67aea945e2a07f15e98b (CVE-2026-68288)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
47f42ff521b4eeb46e82f9a46a4783a99f7570d7 (CVE-2026-68289)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
7dc3680b7ffe01add3e9299fde8471d2dd53a8ae (CVE-2026-68303)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
drm/vc4: hvs/v3d: Fix null dereference in unbind
3f4920d165b29052255527d8ae7619e7ec132ece (CVE-2026-68337)
Targets: 6.12.y, 6.18.y
bpf: Reject redirect helpers without a bpf_net_context
da55f570191d5d72f10c607a7043b947eb05ea46 (CVE-2026-68391)
Targets: 6.1.y
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
e054c1a6ae7310d2815778fddb87da616e11c255 (CVE-2026-72334)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
Bluetooth: ISO: fix malformed ISO_END/CONT handling
5c6ce05e406520290c1d89da97fb3cd70c09137d (CVE-2026-72355)
Targets: 6.18.y
netfs: Fix barriering when walking subrequest list
72a85e9464a5332fb2cd7efd26d9295275ceda2d (CVE-2026-72402)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
bpf: Mask pseudo pointer values in verifier logs
9f58a0a4d6c2ed5d341bba64f058f15d1b0c36f2 (CVE-2026-72413)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
sctp: fix err_chunk memory leaks in INIT handling
393d687131d8aa8c7e4de2cb494438e145d20fc2 (CVE-2026-72438)
Targets: 6.12.y, 6.18.y
md/raid10: fix writes_pending and barrier reference leaks on discard
failures
1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae (CVE-2026-72485)
Targets: 6.6.y, 6.12.y, 6.18.y
coresight: platform: defer connection counter increment until alloc
succeeds
d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd (CVE-2026-72494)
Targets: 6.18.y
RDMA/irdma: Replace waitqueue and flag with completion
87267803a8c824616eb147c5dad7030a5db6f878 (CVE-2026-72496)
Targets: 6.6.y, 6.12.y, 6.18.y
RDMA/bnxt_re: Proper rollback if the ioremap fails
4d87a251d45b4a95eb4c0abcfab809c9f231258a (CVE-2026-74258)
Targets: 6.6.y, 6.12.y, 6.18.y
bpf: Guard __get_user acesss with access_ok for uprobe_multi data
e26657fe3b85c068b01f42bb0c602f242d643ba9 (CVE-2026-74269)
Targets: 6.18.y
bnxt: fix head underflow on XDP head-grow
06b693d2eb6651a63ad85bad8673de3b7d4edd6d (CVE-2026-74289)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
b7e44d1986d6671342c19b82192189ca5db5dab7 (CVE-2026-74291)
Targets: 6.6.y, 6.12.y, 6.18.y
ASoC: topology: Check PCM and DAI name strings before use
d65adf85477247be04ac86886f8edfaa047b5d4a (CVE-2026-74294)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
ASoC: meson: aiu: Validate written enum values
8c79aac429b583301f387374ff37c59be671df87 (CVE-2026-74407)
Targets: 6.18.y
wifi: ath11k: cancel SSR work items during PCI shutdown
e8bb506e6ef749ac0336f3e579d8d02396b7d832 (CVE-2026-74521)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
ksmbd: use memcmp() to compare ClientGUIDs
9006c116dd111d457bf5d074990210f70a4ad2c8 (CVE-2026-74735)
Targets: 6.12.y, 6.18.y
l2tp: fix tunnel and session refcount leak on seq_file release
594d905195024b228c962627ae5ae7c17bd582a4 (CVE-2026-80521)
Targets: 6.1.y, 6.6.y, 6.12.y, 6.18.y
af_unix: Unlink scc_entry in unix_del_edge().

Thanks,
Artem Dinaburg
Trail of Bits

Queued for 6.18, 6.12, 6.6 and 6.1 as requested, with one exception.

7dc3680b7ffe ("drm/vc4: hvs/v3d: Fix null dereference in unbind") is queued for 6.18 and 6.12 but not for 6.6 or 6.1. The NULL it guards against only appears once 013d382d11a2 ("drm/vc4: Call drm_atomic_helper_shutdown() at shutdown time") is in the tree, and that one is absent from both. On 6.6 and 6.1 dev_get_drvdata(master) equals data on every path, so the patch changes nothing there.

Everything else on the list is queued.

Thanks,
Sasha