============================================================ Changelog-Zusammenfassung: 6.12.108 (longterm, Branch 6.12) ============================================================ Veröffentlicht: 2026-09-02 Quelle: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.108 99 Commits, davon ca. 81 Fixes Meistbetroffene Bereiche: HID: 11 selinux: 8 crypto: 7 usb: 6 xfrm: 6 smc: 4 USB: 3 KVM: 3 KI-Zusammenfassung: Linux 6.12.108 is a longterm maintenance release focused heavily on hardening and fixing use-after-free, out-of-bounds, and race-condition bugs across USB, ALSA, HID, networking (netfilter, xfrm, TCP-AO, SMC, Bluetooth), crypto, filesystems (jfs, nilfs2, exfat, fuse), and SELinux subsystems. Notable security-relevant fixes include the SELinux policy-parsing hardening (stricter permission/class validation to prevent malicious policy exploitation), several xfrm/IPsec fixes closing use-after-free and memory-leak issues in ESP-in-TCP and NAT keepalive handling, RDMA/rxe fixes for out-of-bounds access and use-after-free in responder QP handling, and multiple USB/HID driver fixes (e.g., USB serial OOB read, HID pidff OOB write, magicmouse recursion) addressing exploitable memory corruption from untrusted device input. Other important changes touch KVM (s390 vsie crypto bit clearing, arm64 vCPU event access, x86 MMU write tracking), TCP-AO key lifecycle fixes, and CAN j1939 netdevice unregistration handling. Overall, this release is a broad stability and security-hardening update rather than introducing new features. Alle Änderungen (99): - usb: usbfs: fix use-after-free of usb_device in usbdev_release() - wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() - USB: serial: spcp8x5: drop broken carrier detect support - USB: serial: option: fix slab OOB read in interrupt URB callback - ALSA: usb-audio: Complete cleanup after system-resume errors - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() - usb: core: Strengthen error handling in hub_hub_status() - usb: core: Add lock to usb_wakeup_notification() - KVM: s390: vsie: zero stale crypto bits - crypto: qce - Remove unsafe/deprecated algorithms - crypto: mxs-dcp - fix source scatterlist length access - crypto: qce - fix CCM AAD buffer underallocation - crypto: atmel-tdes - use scatterlist length before DMA mapping - crypto: qcom-rng - Remove crypto_rng interface - crypto: qcom-rng - Allow zero as a random number - crypto: qcom-rng - Enable clock in hwrng case - mm/swap: reject swapon() on filesystem-level encrypted files - netfilter: nf_tables: don't queue packet path object notifications - vxlan: keep the last remote linked during FDB flush - batman-adv: reject unrepresentable multicast TVLV offsets - ipv6: seg6: clear IPv4 control block on IPIP decapsulation - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context - xfrm: bound nat keepalive state collection - xfrm: fix xfrm_state_construct() auth-trunc leak - xfrm: ah6: validate routing header segments_left - xfrm: avoid lock inversion in nat keepalive work - xfrm: drop ESP-in-TCP packets with no ingress device - xfrm: espintcp: fix UAF during close - net/tcp-ao: fix use-after-free of current_key on reconnect to another peer - tcp: fix AO info use-after-free in tcp_ao_connect_init() - net/tcp: fix TCP-AO key deletion in VRFs - x86/CPU/AMD: Carve out a Zen5 models range - gtp: serialize PDP context updates - tls: device: fix out-of-bounds write in tls_append_frag() - usb: gadget: f_tcm: keep port count until LUN teardown completes - usb: usbtest: disable dynamic ID support - fuse: fix invalidate lock leak on open O_TRUNC DAX failure - fuse: fix invalidate lock leak on setattr writeback failure - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure - xhci: dbgtty: Fix unregister on tty_register_driver() failure - usb: xhci: Handle USB3 port events when there is one roothub - accessibility: speakup: unregister tty ldisc on later init failures - fpga: dfl: fme: add error handling - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() - Bluetooth: hci_sync: Fix accept list UAF during suspend - Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() - HID: uclogic: fix use-after-free of inrange_timer on remove - HID: ft260: fix stack-use-after-return write in I2C read race - HID: ft260: validate i2c input report length - HID: asus: fix missing hid_is_usb() check - HID: asus: simplify RGB init sequence - HID: pidff: fix OOB write when hid->inputs is empty - HID: pidff: clang-format pass - HID: pidff: Use ARRAY_SIZE macro instead of sizeof - HID: pidff: Rework pidff_set_time() to fix warnings - nfc: nci: add data_len bound checks to activation parameter extractors - nilfs2: reject invalid block index in GC ioctl - nilfs2: correct return value kernel-doc descriptions for ioctl functions - ksmbd: harden file lifetime during session teardown - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - veth: fix OOB txq access in veth_poll() with asymmetric queue counts - ring buffer: Propagate __rb_map_vma return value to caller - selinux: switch two allocations to use kzalloc_objs() - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). - ASoC: nau8821: Cancel pending work before suspend - Revert "PM: sleep: Use complete() in device_pm_sleep_init()" - riscv: Fix register corruption from uninitialized cregs on error - bpf: Fix use-after-free in offloaded map/prog info fill - ASoC: nau8821: Cancel delayed work on component remove - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). - smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). - KVM: arm64: Prevent access to vCPU events before init - smc: Fix use-after-free in __pnet_find_base_ndev(). - can: j1939: make j1939_sk_bind() fail if device is no longer registered - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler - can: j1939: implement NETDEV_UNREGISTER notification handler - mISDN: hfcpci: Fix warning when deleting uninitialized timer - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() - exfat: fix double free in delayed_free - jfs: Fix null-ptr-deref in jfs_ioc_trim - ibmvnic: Use kernel helpers for hex dumps - jfs: add check read-only before txBeginAnon() call - jfs: add check read-only before truncation in jfs_truncate_nolock() - perf: Reject exited events as group leaders - selinux: require a class's permission values to cover its permission count - selinux: reject a permission value exceeding the class permission count - selinux: more strict policy parsing - selinux: use u16 for security classes - selinux: make more use of str_read() when loading the policy - selinux: avoid unnecessary indirection in struct level_datum - selinux: use known type instead of void pointer - HID: uhid: convert to hid_safe_input_report() - nvme-tcp: fix usage of page_frag_cache - io_uring/io-wq: fix worker accounting when canceling creation callbacks - ext4: don't enable DAX on new encrypted files - KVM: x86/mmu: Check write tracking in all address spaces - RDMA/rxe: Fix OOB in free_rd_atomic_resources() - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp