============================================================
 Changelog-Zusammenfassung: 5.10.269 (longterm, Branch 5.10)
============================================================
Veröffentlicht: 2026-09-02
Quelle: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.269

43 Commits, davon ca. 37 Fixes

Meistbetroffene Bereiche:
  usb: 5
  xfrm: 4
  USB: 3
  KVM: 2
  crypto: 2
  ipv6: 2
  HID: 2
  nfc: 2

KI-Zusammenfassung:
  Linux 5.10.269 (longterm) delivers a broad round of stability and security hardening across USB, networking, crypto, filesystem, and virtualization subsystems, fixing numerous use-after-free, out-of-bounds, and uninitialized-memory bugs. Among the most notable security fixes are the USB serial "option" driver slab OOB read in its interrupt URB callback, the ALSA usb-audio OOB write in snd_usbmidi_novation_output(), the xfrm ESP-in-TCP use-after-free during socket close, and the IPv6 MLD multicast use-after-free when processing queries. The update also touches core kernel infrastructure such as BPF (UAF in offloaded map/prog info, lwt_seg6local fix), KVM (s390 vsie stale crypto bits, arm64 vCPU event access before init), and io_uring/io-wq worker accounting. Additional fixes address filesystem robustness (ext4, jfs, nilfs2, xfs-related nfc/nfct checks), along with several reverted patches that had introduced regressions in SMB, MTD, and PM sleep handling.

Alle Änderungen (43):
  - usb: usbfs: fix use-after-free of usb_device in usbdev_release()
  - USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
  - USB: serial: spcp8x5: drop broken carrier detect support
  - USB: serial: option: fix slab OOB read in interrupt URB callback
  - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
  - usb: core: Strengthen error handling in hub_hub_status()
  - usb: core: Add lock to usb_wakeup_notification()
  - KVM: s390: vsie: zero stale crypto bits
  - crypto: mxs-dcp - fix source scatterlist length access
  - crypto: atmel-tdes - use scatterlist length before DMA mapping
  - mm/swap: reject swapon() on filesystem-level encrypted files
  - ipv6: seg6: clear IPv4 control block on IPIP decapsulation
  - xfrm: fix xfrm_state_construct() auth-trunc leak
  - xfrm: ah6: validate routing header segments_left
  - xfrm: drop ESP-in-TCP packets with no ingress device
  - xfrm: espintcp: fix UAF during close
  - usb: gadget: f_tcm: keep port count until LUN teardown completes
  - usb: usbtest: disable dynamic ID support
  - accessibility: speakup: unregister tty ldisc on later init failures
  - fpga: dfl: fme: add error handling
  - HID: input: read battery capacity from its actual report offset
  - nvmet-tcp: bound SGL data length before allocating command buffers
  - nfc: nci: add data_len bound checks to activation parameter extractors
  - HID: magicmouse: do not keep a stale msc->input if no input is claimed
  - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
  - nilfs2: reject invalid block index in GC ioctl
  - ext4: propagate errors from fast commit range replay
  - kcov: fix data corruption and race conditions on PREEMPT_RT
  - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
  - Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"
  - Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"
  - selinux: switch two allocations to use kzalloc_objs()
  - Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
  - bpf: Fix use-after-free in offloaded map/prog info fill
  - KVM: arm64: Prevent access to vCPU events before init
  - jfs: add check read-only before txBeginAnon() call
  - jfs: add check read-only before truncation in jfs_truncate_nolock()
  - bpf: Remove tst_run from lwt_seg6local_prog_ops.
  - io_uring/io-wq: fix worker accounting when canceling creation callbacks
  - ipvs: reload ip header after head reallocation
  - ext4: don't enable DAX on new encrypted files
  - ipv6: mcast: Fix use-after-free when processing MLD queries
  - RDMA/rxe: Fix OOB in free_rd_atomic_resources()