Patch "rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer" has been added to the 6.6-stable tree
gregkh at linuxfoundation.org
gregkh at linuxfoundation.org
Mon Jun 15 22:01:52 PDT 2026
This is a note to let you know that I've just added the patch titled
rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rxrpc-fix-response-packet-verification-to-extract-skb-to-a-linear-buffer.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.
>From stable+bounces-256801-greg=kroah.com at vger.kernel.org Sat May 30 04:51:30 2026
From: Sasha Levin <sashal at kernel.org>
Date: Fri, 29 May 2026 19:20:56 -0400
Subject: rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer
To: stable at vger.kernel.org
Cc: David Howells <dhowells at redhat.com>, Hyunwoo Kim <imv4bel at gmail.com>, Simon Horman <horms at kernel.org>, Jiayuan Chen <jiayuan.chen at linux.dev>, linux-afs at lists.infradead.org, stable at kernel.org, Jeffrey Altman <jaltman at auristor.com>, Marc Dionne <marc.dionne at auristor.com>, Jakub Kicinski <kuba at kernel.org>, Sasha Levin <sashal at kernel.org>
Message-ID: <20260529232056.1870836-2-sashal at kernel.org>
From: David Howells <dhowells at redhat.com>
[ Upstream commit 8bfab4b6ffc2fe92da86300728fc8c3c7ebffb56 ]
This improves the fix for CVE-2026-43500.
Fix the verification of RESPONSE packets to avoid the problem of
overwriting a RESPONSE packet sent via splice to a local address by
extracting the contents of the UDP packet into a kmalloc'd linear buffer
rather than decrypting the data in place in the sk_buff (which may corrupt
the original buffer).
Fixes: 24481a7f5733 ("rxrpc: Fix conn-level packet handling to unshare RESPONSE packets")
Reported-by: Hyunwoo Kim <imv4bel at gmail.com>
Closes: https://lore.kernel.org/r/afKV2zGR6rrelPC7@v4bel/
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Simon Horman <horms at kernel.org>
cc: Jiayuan Chen <jiayuan.chen at linux.dev>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Reviewed-by: Jeffrey Altman <jaltman at auristor.com>
Tested-by: Marc Dionne <marc.dionne at auristor.com>
Link: https://patch.msgid.link/20260515230516.2718212-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
net/rxrpc/ar-internal.h | 5 +++--
net/rxrpc/conn_event.c | 30 ++++++++++++------------------
net/rxrpc/insecure.c | 5 +++--
net/rxrpc/rxkad.c | 29 ++++++++++-------------------
4 files changed, 28 insertions(+), 41 deletions(-)
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -267,8 +267,9 @@ struct rxrpc_security {
struct sk_buff *);
/* verify a response */
- int (*verify_response)(struct rxrpc_connection *,
- struct sk_buff *);
+ int (*verify_response)(struct rxrpc_connection *conn,
+ struct sk_buff *response_skb,
+ void *response, unsigned int len);
/* clear connection security */
void (*clear)(struct rxrpc_connection *);
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -229,28 +229,22 @@ static void rxrpc_call_is_secure(struct
static int rxrpc_verify_response(struct rxrpc_connection *conn,
struct sk_buff *skb)
{
+ unsigned int len = skb->len - sizeof(struct rxrpc_wire_header);
+ void *buffer;
int ret;
- if (skb_cloned(skb) || skb_has_frag_list(skb) ||
- skb_has_shared_frag(skb)) {
- /* Copy the packet if shared so that we can do in-place
- * decryption.
- */
- struct sk_buff *nskb = skb_copy(skb, GFP_NOFS);
+ buffer = kmalloc(len, GFP_NOFS);
+ if (!buffer)
+ return -ENOMEM;
- if (nskb) {
- rxrpc_new_skb(nskb, rxrpc_skb_new_unshared);
- ret = conn->security->verify_response(conn, nskb);
- rxrpc_free_skb(nskb, rxrpc_skb_put_response_copy);
- } else {
- /* OOM - Drop the packet. */
- rxrpc_see_skb(skb, rxrpc_skb_see_unshare_nomem);
- ret = -ENOMEM;
- }
- } else {
- ret = conn->security->verify_response(conn, skb);
- }
+ ret = skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), buffer, len);
+ if (ret < 0)
+ goto out;
+ ret = conn->security->verify_response(conn, skb, buffer, len);
+
+out:
+ kfree(buffer);
return ret;
}
--- a/net/rxrpc/insecure.c
+++ b/net/rxrpc/insecure.c
@@ -47,9 +47,10 @@ static int none_respond_to_challenge(str
}
static int none_verify_response(struct rxrpc_connection *conn,
- struct sk_buff *skb)
+ struct sk_buff *response_skb,
+ void *response, unsigned int len)
{
- return rxrpc_abort_conn(conn, skb, RX_PROTOCOL_ERROR, -EPROTO,
+ return rxrpc_abort_conn(conn, response_skb, RX_PROTOCOL_ERROR, -EPROTO,
rxrpc_eproto_rxnull_response);
}
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -874,7 +874,6 @@ static int rxkad_decrypt_ticket(struct r
*_expiry = 0;
ASSERT(server_key->payload.data[0] != NULL);
- ASSERTCMP((unsigned long) ticket & 7UL, ==, 0);
memcpy(&iv, &server_key->payload.data[2], sizeof(iv));
@@ -1023,14 +1022,15 @@ unlock:
* verify a response
*/
static int rxkad_verify_response(struct rxrpc_connection *conn,
- struct sk_buff *skb)
+ struct sk_buff *skb,
+ void *buffer, unsigned int len)
{
struct rxkad_response *response;
struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
struct rxrpc_crypt session_key;
struct key *server_key;
time64_t expiry;
- void *ticket = NULL;
+ void *ticket;
u32 version, kvno, ticket_len, level;
__be32 csum;
int ret, i;
@@ -1053,13 +1053,8 @@ static int rxkad_verify_response(struct
}
}
- ret = -ENOMEM;
- response = kzalloc(sizeof(struct rxkad_response), GFP_NOFS);
- if (!response)
- goto error;
-
- if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
- response, sizeof(*response)) < 0) {
+ response = buffer;
+ if (len < sizeof(*response)) {
ret = rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
rxkad_abort_resp_short);
goto error;
@@ -1071,6 +1066,9 @@ static int rxkad_verify_response(struct
trace_rxrpc_rx_response(conn, sp->hdr.serial, version, kvno, ticket_len);
+ buffer += sizeof(*response);
+ len -= sizeof(*response);
+
if (version != RXKAD_VERSION) {
ret = rxrpc_abort_conn(conn, skb, RXKADINCONSISTENCY, -EPROTO,
rxkad_abort_resp_version);
@@ -1090,13 +1088,8 @@ static int rxkad_verify_response(struct
}
/* extract the kerberos ticket and decrypt and decode it */
- ret = -ENOMEM;
- ticket = kmalloc(ticket_len, GFP_NOFS);
- if (!ticket)
- goto error;
-
- if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header) + sizeof(*response),
- ticket, ticket_len) < 0) {
+ ticket = buffer;
+ if (ticket_len > len) {
ret = rxrpc_abort_conn(conn, skb, RXKADPACKETSHORT, -EPROTO,
rxkad_abort_resp_short_tkt);
goto error;
@@ -1176,8 +1169,6 @@ static int rxkad_verify_response(struct
ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno);
error:
- kfree(ticket);
- kfree(response);
key_put(server_key);
_leave(" = %d", ret);
return ret;
Patches currently in stable-queue which might be from sashal at kernel.org are
queue-6.6/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-wi.patch
queue-6.6/bonding-refuse-to-enslave-can-devices.patch
queue-6.6/arm64-io-rename-ioremap_prot-to-__ioremap_prot.patch
queue-6.6/asoc-intel-bytcht_es8316-fix-mclk-leak-on-init-error.patch
queue-6.6/asoc-codecs-simple-mux-fix-enum-control-bounds-check.patch
queue-6.6/serial-dz-convert-to-use-a-platform-device.patch
queue-6.6/vsock-keep-poll-shutdown-state-consistent.patch
queue-6.6/bluetooth-l2cap-fix-possible-crash-on-l2cap_ecred_co.patch
queue-6.6/ice-fix-vf-queue-configuration-with-low-mtu-values.patch
queue-6.6/ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
queue-6.6/mm-memory-fix-spurious-warning-when-unmapping-device-private-exclusive-pages.patch
queue-6.6/x86-kexec-disable-kcov-instrumentation-after-load_se.patch
queue-6.6/ethtool-eeprom-add-more-safeties-to-eeprom-netlink-f.patch
queue-6.6/genetlink-use-internal-flags-for-multicast-groups.patch
queue-6.6/vxlan-vnifilter-fix-spurious-notification-on-vni-upd.patch
queue-6.6/6lowpan-fix-off-by-one-in-multicast-context-address-.patch
queue-6.6/sctp-fix-race-between-sctp_wait_for_connect-and-peel.patch
queue-6.6/pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
queue-6.6/mptcp-do-not-drop-partial-packets.patch
queue-6.6/ksmbd-fix-fsctl-permission-bypass-by-adding-a-permis.patch
queue-6.6/tools-rv-fix-cleanup-after-failed-trace-setup.patch
queue-6.6/drm-vc4-fix-krealloc-memory-leak.patch
queue-6.6/arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
queue-6.6/nfc-llcp-fix-use-after-free-race-in-nfc_llcp_recv_cc.patch
queue-6.6/perf-fix-dangling-cgroup-pointer-in-cpuctx.patch
queue-6.6/octeontx2-pf-avoid-double-free-of-pool-stack-on-aq-init-failure.patch
queue-6.6/net-hsr-defer-node-table-free-until-after-rcu-readers.patch
queue-6.6/net-netlink-fix-sending-unassigned-nsid-after-assign.patch
queue-6.6/bluetooth-bnep-reject-short-frames-before-parsing.patch
queue-6.6/of-kexec-refactor-ima_get_kexec_buffer-to-use-ima_va.patch
queue-6.6/smb-client-require-net-admin-for-cifs-swn-netlink.patch
queue-6.6/dm-cache-policy-smq-check-allocation-under-invalidat.patch
queue-6.6/ipmi-fix-rcu_read_unlock-to-srcu_read_unlock-in-hand.patch
queue-6.6/drm-i915-psr-read-intel-dpcd-workaround-register.patch
queue-6.6/net-fec-fix-pinctrl-default-state-restore-order-on-r.patch
queue-6.6/netfilter-nf_tables-fix-dst-corruption-in-same-regis.patch
queue-6.6/ipv6-rpl-fix-hdrlen-overflow-in-ipv6_rpl_srh_decompr.patch
queue-6.6/ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
queue-6.6/tun-free-page-on-short-frame-rejection-in-tun_xdp_on.patch
queue-6.6/usb-serial-mct_u232-fix-memory-corruption-with-small.patch
queue-6.6/bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
queue-6.6/inet-frags-add-inet_frag_queue_flush.patch
queue-6.6/bpf-track-equal-scalars-history-on-per-instruction-l.patch
queue-6.6/signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
queue-6.6/ethtool-eeprom-add-missing-ethnl_ops_begin-_complete.patch
queue-6.6/net-mlx5-fix-slab-out-of-bounds-in-mlx5_query_nic_vp.patch
queue-6.6/mptcp-use-plain-bool-instead-of-custom-binary-enum.patch
queue-6.6/net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
queue-6.6/hwmon-pmbus-core-protect-regulator-operations-with-m.patch
queue-6.6/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch
queue-6.6/net-mctp-ensure-our-nlmsg-responses-are-initialised.patch
queue-6.6/iio-adc-npcm-fix-unbalanced-clk_disable_unprepare.patch
queue-6.6/batman-adv-tt-fix-toctou-race-for-reported-vlans.patch
queue-6.6/ptp-vclock-switch-from-rcu-to-srcu.patch
queue-6.6/time-fix-off-by-one-in-settimeofday-usec-validation.patch
queue-6.6/usb-serial-cypress_m8-fix-memory-corruption-with-sma.patch
queue-6.6/gpio-mvebu-fix-null-pointer-dereference-in-suspend-r.patch
queue-6.6/xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
queue-6.6/x86-kexec-add-a-sanity-check-on-previous-kernel-s-im.patch
queue-6.6/netlabel-validate-unlabeled-address-and-mask-attribu.patch
queue-6.6/batman-adv-tt-avoid-empty-vlan-responses.patch
queue-6.6/net-hsr-fix-potential-oob-access-in-supervision-fram.patch
queue-6.6/drm-remove-plane-hsub-vsub-alignment-requirement-for.patch
queue-6.6/serdev-make-serdev_bus_type-const.patch
queue-6.6/serial-dz-fix-bootconsole-handover-lockup.patch
queue-6.6/net-sched-revert-net-sched-restrict-conditions-for-a.patch
queue-6.6/inet-frags-flush-pending-skbs-in-fqdir_pre_exit.patch
queue-6.6/net-ethernet-mtk_eth_soc-fix-use-after-free-in-metad.patch
queue-6.6/octeontx2-af-cgx-add-bounds-check-to-cgx_speed_mbps-index.patch
queue-6.6/mm-hugetlb-avoid-false-positive-lockdep-assertion.patch
queue-6.6/netfilter-bitwise-add-support-for-doing-and-or-and-x.patch
queue-6.6/drm-i915-psr-add-defininitions-for-intel_wa_register.patch
queue-6.6/net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
queue-6.6/vxlan-do-not-reuse-cached-ip_hdr-value-after-skb_tun.patch
queue-6.6/net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
queue-6.6/batman-adv-tvlv-reject-oversized-tvlv-packets.patch
queue-6.6/drm-fbcon-vga_switcheroo-avoid-race-condition-in-fbc.patch
queue-6.6/net-mvpp2-add-metadata-support-for-xdp-mode.patch
queue-6.6/xfrm-check-for-underflow-in-xfrm_state_mtu.patch
queue-6.6/netfilter-nf_conntrack-destroy-stale-expectfn-expect.patch
queue-6.6/net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
queue-6.6/ipv6-ioam-add-null-check-for-idev-in-ipv6_hop_ioam.patch
queue-6.6/rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
queue-6.6/drm-virtio-fix-driver-removal-with-disabled-kms.patch
queue-6.6/net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
queue-6.6/bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch
queue-6.6/rxrpc-fix-response-packet-verification-to-extract-skb-to-a-linear-buffer.patch
queue-6.6/batman-adv-v-stop-ogmv2-on-disabled-interface.patch
queue-6.6/net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
queue-6.6/arm64-tlb-flush-walk-cache-when-unsharing-pmd-tables.patch
queue-6.6/rdma-rxe-fix-trying-to-register-non-static-key-in-rx.patch
queue-6.6/clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
queue-6.6/serial-zs-convert-to-use-a-platform-device.patch
queue-6.6/bluetooth-mgmt-fix-backward-compatibility-with-users.patch
queue-6.6/ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
queue-6.6/selftests-bpf-tests-for-per-insn-sync_linked_regs-pr.patch
queue-6.6/mptcp-pm-fix-add_addr-timer-infinite-retry-on-option-space-insufficient.patch
queue-6.6/gpio-rockchip-convert-bank-clk-to-devm_clk_get_enabl.patch
queue-6.6/netfilter-ctnetlink-ensure-safe-access-to-master-con.patch
queue-6.6/net-af_key-zero-aligned-sockaddr-tail-in-pf_key-expo.patch
queue-6.6/mm-damon-sysfs-schemes-delete-tried-region-in-regions_rmdirs.patch
queue-6.6/batman-adv-bla-avoid-null-ptr-deref-for-claim-via-dr.patch
queue-6.6/media-rc-fix-race-between-unregister-and-urb-irq-cal.patch
queue-6.6/usb-serial-digi_acceleport-fix-memory-corruption-wit.patch
queue-6.6/bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
queue-6.6/serdev-provide-a-bustype-shutdown-function.patch
queue-6.6/batman-adv-iv-recover-ogm-scheduling-after-forward-p.patch
queue-6.6/net-sched-cls_fw-fix-null-dereference-of-old-filters.patch
queue-6.6/net-netlink-don-t-set-nsid-on-local-notifications.patch
queue-6.6/tcp-restrict-so_attach_filter-to-priv-users.patch
queue-6.6/batman-adv-tp_meter-directly-shut-down-timer-on-clea.patch
queue-6.6/netfilter-nf_log-validate-mac-header-was-set-before-.patch
queue-6.6/mm-page_alloc-clear-page-private-in-free_pages_prepa.patch
queue-6.6/octeontx2-af-npc-fix-cpt-channel-mask-in-npc_install.patch
queue-6.6/net-smc-do-not-re-initialize-smc-hashtables.patch
queue-6.6/af_unix-fix-uaf-read-of-tail-len-in-unix_stream_data_wait.patch
queue-6.6/batman-adv-tp_meter-avoid-role-confusion-in-tp_list.patch
queue-6.6/ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
queue-6.6/bluetooth-l2cap-clear-chan-ident-on-ecred-reconfigur.patch
queue-6.6/soc-tegra-pmc-fix-unsafe-generic_handle_irq-call.patch
queue-6.6/cgroup-cpuset-reset-dl-migration-state-on-can_attach-failure.patch
queue-6.6/tunnels-do-not-assume-transport-header-in-iptunnel_p.patch
queue-6.6/ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch
queue-6.6/bluetooth-hci_sync-fix-uaf-in-hci_le_create_cis_sync.patch
queue-6.6/selftests-mptcp-drop-nanoseconds-width-specifier.patch
queue-6.6/iomap-don-t-revert-iov_iter-on-partially-completed-b.patch
queue-6.6/net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
queue-6.6/batman-adv-bla-avoid-double-decrement-of-bla.num_req.patch
queue-6.6/batman-adv-tvlv-abort-ogm-send-on-tvlv-append-failur.patch
queue-6.6/alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
queue-6.6/media-rc-ttusbir-fix-inverted-error-logic.patch
queue-6.6/net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
queue-6.6/netfilter-nft_ct-bail-out-on-template-ct-in-get-eval.patch
queue-6.6/drm-fbdev-helper-set-and-clear-vga-switcheroo-client.patch
queue-6.6/tun-free-page-on-build_skb-failure-in-tun_xdp_one.patch
queue-6.6/net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
queue-6.6/bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
queue-6.6/arm64-io-extract-user-memory-type-in-ioremap_prot.patch
queue-6.6/bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
queue-6.6/netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
queue-6.6/asoc-wm_adsp-fix-null-dereference-when-removing-firm.patch
queue-6.6/ksmbd-fix-null-deref-of-opinfo-conn-in-oplock-lease-.patch
queue-6.6/net-skbuff-fix-missing-zerocopy-reference-in-pskb_ca.patch
queue-6.6/drm-dp-add-edp-1.5-bit-definition.patch
queue-6.6/ipv6-fix-possible-infinite-loop-in-rt6_fill_node.patch
queue-6.6/tee-optee-prevent-use-after-free-when-the-client-exi.patch
queue-6.6/disable-wattribute-alias-for-clang-23-and-newer.patch
queue-6.6/vxlan-vnifilter-send-notification-on-vni-add.patch
queue-6.6/usb-gadget-f_ncm-fix-net_device-lifecycle-with-devic.patch
queue-6.6/net-skbuff-fix-pskb_carve-leaking-zcopy-pages.patch
queue-6.6/net-sched-sch_sfb-replace-direct-dequeue-call-with-p.patch
queue-6.6/netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
queue-6.6/tunnels-load-network-headers-after-skb_cow-in-iptunn.patch
queue-6.6/bluetooth-hci_conn-fix-potential-uaf-in-set_cig_para.patch
queue-6.6/netfilter-synproxy-refresh-tcphdr-after-skb_ensure_w.patch
queue-6.6/rxrpc-fix-data-decrypt-vs-splice-by-copying-data-to-buffer-in-recvmsg.patch
queue-6.6/gpio-mxc-fix-irq_high-handling.patch
queue-6.6/bluetooth-hci_qca-migrate-to-serdev-specific-shutdown-function.patch
queue-6.6/mm-huge_memory-update-file-pmd-counter-before-folio_.patch
queue-6.6/kvm-arm64-remove-vpipt-i-cache-handling.patch
queue-6.6/xhci-tegra-fix-ghost-usb-device-on-dual-role-port-un.patch
queue-6.6/net-mana-add-null-guards-in-teardown-path-to-prevent.patch
queue-6.6/mptcp-cleanup-fallback-dummy-mapping-generation.patch
queue-6.6/mptcp-handle-first-subflow-closing-consistently.patch
queue-6.6/netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
queue-6.6/net-cpsw_new-fix-potential-unregister-of-netdev-that.patch
queue-6.6/bcache-fix-uninitialized-closure-object.patch
queue-6.6/drm-i915-psr-apply-intel-dpcd-workaround-when-sdp-on.patch
queue-6.6/net-phy-clean-the-sfp-upstream-if-phy-probing-fails.patch
queue-6.6/net-iucv-fix-locking-in-.getsockopt.patch
queue-6.6/platform-x86-intel-vsec-fix-enable_cnt-imbalance-on-pcie-error-recovery.patch
queue-6.6/sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
queue-6.6/ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
queue-6.6/netfilter-xt_cpu-prefer-raw_smp_processor_id.patch
queue-6.6/bluetooth-hci_qca-convert-timeout-from-jiffies-to-ms.patch
queue-6.6/selftests-bpf-update-comments-find_equal_scalars-syn.patch
queue-6.6/bpf-remove-mark_precise_scalar_ids.patch
queue-6.6/batman-adv-tt-reject-oversized-local-tvlv-buffers.patch
queue-6.6/net-annotate-sk-sk_write_space-for-udp-sockmap.patch
queue-6.6/r8152-handle-the-return-value-of-usb_reset_device.patch
queue-6.6/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-wi.patch
queue-6.6/netfilter-ebtables-fix-oob-read-in-compat_mtw_from_u.patch
queue-6.6/mptcp-reset-rcv-wnd-on-disconnect.patch
queue-6.6/soc-qcom-ice-fix-race-between-qcom_ice_probe-and-of_.patch
queue-6.6/ima-verify-the-previous-kernel-s-ima-buffer-lies-in-.patch
queue-6.6/octeontx2-af-replace-deprecated-strncpy-with-strscpy.patch
queue-6.6/tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
queue-6.6/nfc-nxp-nci-i2c-use-rising-edge-irq-on-acpi-systems.patch
queue-6.6/ipv6-addrconf-annotate-data-races-around-devconf-fields-ii.patch
queue-6.6/iio-adc-npcm-convert-to-platform-remove-callback-returning-void.patch
queue-6.6/bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
queue-6.6/netfilter-bitwise-rename-some-boolean-operation-func.patch
queue-6.6/net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
queue-6.6/drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
queue-6.6/net-mlx4-avoid-gcc-10-__bad_copy_from-false-positive.patch
queue-6.6/ipv6-fix-possible-infinite-loop-in-fib6_select_path.patch
queue-6.6/hsr-remove-warn_once-in-hsr_addr_is_self.patch
queue-6.6/scsi-core-run-queues-for-all-non-sdev_del-devices-fr.patch
queue-6.6/netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
queue-6.6/nfc-llcp-fix-use-after-free-in-llcp_sock_release.patch
queue-6.6/landlock-fix-handling-of-disconnected-directories.patch
queue-6.6/netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
queue-6.6/netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
queue-6.6/phy-mscc-use-phy_id_match_exact-for-vsc8584-vsc8582-.patch
queue-6.6/usb-gadget-u_ether-fix-null-pointer-deref-in-eth_get.patch
queue-6.6/net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
queue-6.6/af_unix-cache-state-msg-in-unix_stream_read_generic.patch
queue-6.6/sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
queue-6.6/ipv4-free-net-ipv4.sysctl_local_reserved_ports-after.patch
queue-6.6/net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
queue-6.6/arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
queue-6.6/mptcp-introduce-the-mptcp_init_skb-helper.patch
More information about the linux-afs
mailing list