============================================================ Changelog-Zusammenfassung: 7.2.11 (stable, Branch 7.2) ============================================================ Veröffentlicht: 2026-10-15 Quelle: https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.11 284 Commits, davon ca. 267 Fixes, 1 CVE-Referenz(en) Meistbetroffene Bereiche: namespace: 18 net: 17 wifi: 16 riscv: 12 Bluetooth: 12 btrfs: 7 drm/vc4: 6 ASoC: 6 KI-Zusammenfassung: Linux kernel 7.2.11 (stable) was a broad maintenance release focused on fixing bugs and hardening security across networking, storage, graphics, Bluetooth, and filesystem subsystems, with an especially large and systematic set of fixes to the mount/namespace core (dozens of patches addressing locking, propagation, loop detection, and unmount races). It also included substantial work on io_uring/mm interactions (RLIMIT_MEMLOCK accounting, mremap locked_vm leaks), DRM/AMD/Intel/VC4 driver stability, and numerous Wi-Fi, Bluetooth, and network driver corrections (mt76, ice, gve, stmmac, mlx5). Among the most notable security-relevant fixes were a buffer overflow in dm-integrity's inline mode with large tag sizes, a type confusion vulnerability in the ati_remote2 input driver's attribute handlers, a race condition in add_key() versus keyring restrictions in the KEYS subsystem, and improper validation of checksum_start in IPv4 checksum completion that could lead to out-of-bounds access. Additional reliability and security improvements touched SELinux label handling, fsverity info freeing via RCU, and various use-after-free/reference-leak fixes in RISC-V, UFS, and network drivers. Alle Änderungen (284): - HID: steam: Clean up locking - HID: steam: Refactor registration - HID: steam: Rearrange teardown sequence - HID: steam: Fully unregister controller when hidraw is opened - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK - io_uring/memmap: account the pages a compound region really uses - drm/amd/display: Don't replace a sink mode that shares the native totals - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ - sched_ext: Generate qseq from a per-task counter - drm/vc4: Fix binner slot allocation failing on an idle GPU - drm/vc4: Disable the V3D interrupt across runtime suspend - vsock: Fix memory leak in vmci_transport_recv_dgram_cb() - net: openvswitch: validate transport header presence in set_ipv6_addr - ptp: ocp: fix PCIe delay estimation calculation - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() - net/mlx5e: Order ICOSQ cc update after CQ doorbell - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down - drm/imagination: Fix reference and vm_bo handling in remap() - bareudp: set the inner protocol to the protocol of the packet - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() - bnxt_en: Re-write the BARs following any type of PCIe errors - bnxt_en: Fix driver init in kdump kernel - bnxt_en: Add bnxt_clear_bars() helper - riscv: ptrace: Zero-initialize regset buffers before copyin - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI - ASoC: sdw_utils: Add codec info for CS35L62 - pfcp: make sure the SEID is linear before reading it - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET - Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification" - net/sched: cls_route: reject change with no routing attribute - devlink: fix devlink_rel reference leak when notify work is pending - net: sparx5: start the TOD counters on non-PTP lan969x variants - net: always dissect GSO packets in __virtio_net_hdr_to_skb() - flow_dissector: avoid u16 truncation of skb->len when computing thoff - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() - spi: sg2044-nor: Honor SPI clock limits - spi: sg2044-nor: Return transfer errors - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes - ASoC: adau1372: allow sleepy powerdown GPIOs - Revert "wifi: ath12k: add panic handler" - drm/xe/sysctrl: Fix mailbox header handling - wifi: mt76: mt792x: pick the SAR table layout from the table itself - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit - wifi: mt76: mt7925: don't put the band auto marker in TGID - wifi: mt76: mt7915: disable rx napi when removing device - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown - wifi: mt76: use ALTX queue for packets to disassociated stations - wifi: mt76: account non-AQL frames per peer rather than per link - wifi: mt76: add PS buffering support for HW-managed TIM drivers - wifi: mac80211: add ieee80211_txq_aql_pending() - wifi: mac80211: add AQL support for multicast packets - wifi: mt76: mt7996: take over connection monitoring - scsi: ufs: mediatek: Handle mPHY power-on failures - Revert "net: stmmac: propagate PTP addend and system time programming errors" - riscv: vector: Fix output operands in context save - riscv: vector: Fix data pointer constraints in context save/restore - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param() - net: stmmac: Disable S-Tag processing on dwmac4 - net: stmmac: Do not advertise S-VLAN stripping when it is disabled - net/mlx5: Lag, split aggregate speed into oper and max helpers - net: make dev_xdp_sb_prog_count() see programs attached through a link - drm/xe: Do not emit Wa_16010904313 twice - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums - btrfs: fix lost error return value in btrfs_listxattr() - btrfs: fix xattr replace when multiple xattrs are packed in the same item - btrfs: don't stash io_uring encoded data across -EAGAIN - btrfs: unlock inode and extent in caller when io_uring read extent fails - btrfs: free iov when btrfs_uring_read_extent() fails - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio - zloop: zero out only the unread tail of short reads - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3 - nvmet: use the local P2P device on metadata allocation failure - nvmet: return Invalid Field for invalid NSIDs feature 82h - ice: Restore Ordered MMIO Writes for Tx Doorbells - bonding: fix the program leak when XDP is replaced - tee: optee: ffa: support shared memory offsets on large-page kernels - net: stmmac: propagate PTP addend and system time programming errors - wifi: mt76: mt7996: program a link again if the driver holds it - cxgb4/ch_ktls: disable softirqs around tid_list erases - lib/dim: fix 32-bit overflow in dim_calc_stats() rates - amt: send the relay's General Query directly from the receive path - net/sched: em_text: reject unterminated algo before autoload - drm/vc4: Use kvmalloc_objs() for the BO cache size list - drm/vc4: Free the BO cache size list on teardown - drm/aspeed: Balance the display clock enable on teardown - gpio: exar: initialize the ID before registering its cleanup - drm/dp: don't mark the AUX backlight enabled when enabling failed - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() - drm/bridge: Fix unlocked list access in drm_bridge_attach() - drm/bridge: Fix unlocked list_del in drm_bridge_add() - Bluetooth: btintel_pcie: Add shared HW reset for clean start - Bluetooth: btintel_pcie: fix TX descriptor bounds check - scsi: ufs: core: Hold a clock reference across the probe - fs: don't let a migrating task hide its reference from do_umount() - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single - arm64: dts: lx2160a: fix incorrect pinmux - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks - xfs: fix exchange-range-to-eof file size exchange - xfs: stop exchanging reflink flags when exchanging mappings - namespace: keep the lock on a mount that a propagated copy is moved beneath - namespace: handle mount locking for automounts correctly - namespace: never expire a locked mount - nullfs: don't update the access time - namespace: refuse an automount below a mount that is in no namespace - fcntl: refuse F_SET_RW_HINT on an immutable inode - namei: don't reveal overmounted entries in refwalk - namespace: unhash a dentry before detaching the mounts on it - namespace: don't let a pseudo dentry become the root of a mount - unshare: don't drop active namespace references that were never taken - dcache: don't put a mountpoint on a dentry that's being removed - namespace: check the mounts before reading their parents in pivot_root() - namespace: remove the fsnotify marks of a mount namespace in process context - namespace: don't reconfigure internal superblocks via remount and umount - namespace: look at the topmost mount for a mount namespace file - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE - namespace: check a recursive bind mount for mount namespace loops - namespace: check a submount for references right before unmounting it - namespace: queue a mount only once for mount notifications - namespace: check the target before walking it in do_mount_setattr() - fs: refuse fspick() on internal superblocks - namespace: don't copy an unmounted mount tree - namespace: don't inherit MNT_UMOUNT in clone_mnt() - statmount: read the parent of an unmounted mount under mount_lock - namespace: reset the old parent's ->overmount in mnt_change_mountpoint() - fs: don't silently unmount busy mounts - mount: keep a copied mount unbindable - drm/amd/display: disable self-refresh on tearing flips - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs - drm/amdgpu/userq: return the memdup_user() error for the user MQD - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks - drm/amdgpu: make Mac FB workaround generic - drm/amdgpu: serialize vblank counter reads against GPU reset - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info - drm/amdkfd: align SDMA doorbell base for shader doorbell writes - drm/bridge: th1520-dw-hdmi: Fix remove() callback - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin - drm/xe: Fix shrinker accounting double-subtraction on nested external pins - drm/xe/i2c: cancel the client work on remove - drm/vmwgfx: validate pitch coming from userspace - drm/vc4: Fix firmware reference leak in vc4_drm_bind() - drm/vc4: drain the hangcheck timer and works on V3D unbind - drm/panthor: validate userspace queue count against initialized firmware slot count - drm/imagination: Size page table preallocation by device address - drm/i915/gt: Unmask interrupts only when ACTIVE is true - drm/i915/gem: Prevent overstepping exec array boundary - drm/gud: don't keep a connector without a CRTC as connector_state - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex - Bluetooth: RFCOMM: free the skb when the DLC has no owner - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() - Bluetooth: MGMT: Fix status of pending commands flushed on power off - Bluetooth: ISO: Serialize concurrent connect calls - Bluetooth: ISO: Reject concurrent BIS listener setup - Bluetooth: hci_sync: Fix command skb lifetime during scan setup - Bluetooth: hci_sock: Serialize dead-device detachment - Bluetooth: btintel_pcie: use managed IRQ teardown - riscv: ptrace: reject CFI regset access when extensions are absent - riscv: patch: fix handling of bpf-jit execmem addresses - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header - riscv: futex: untag the user pointer before the atomic access - riscv: fix load_unaligned_zeropad() fixup for RV32 - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() - scsi: qedi: Initialize callback state before registration - scsi: ch: Do not keep references to data transfer element devices - pmdomain: rockchip: propagate subdomain add errors - pmdomain: rockchip: fix clock leak on domain probe failure - pmdomain: rockchip: don't ignore clock lookup errors on attach - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 - regulator: of: fill in supply names in of_regulator_bulk_get_all() - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() - optee: register TEE devices only once fully initialized - openvswitch: fix soft lockup in the netlink flow dump - nvme: fix swapped ZRASF zone state values for full and read only - net: team: free skb when broadcast has no txable port - net: team: stop reusing skb after queue override - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop - net: usb: ax88179_178a: fix rx frame length for non-last packets - net: sparx5: free the matchall entry on destroy - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() - net: dsa: microchip: fix KSZ8765 fiber detection - net: bridge: avoid recursive multicast port cleanup - net/smc: protect clcsock lifetime in smc_getname - net/packet: guard the ll header push in packet_rcv_spkt() - mmc: sdhci-sprd: disable runtime PM on remove - mmc: mtk-sd: Cancel request timeout work on remove - mmc: cavium-thunderx: destroy slot platform devices on remove - mmc: cavium-octeon: destroy slot platform devices on remove - dm: fix reading free memory in do_resume - dm-snap: reject the transient exception store for snapshot-merge - dm-integrity: fix buffer overflow in inline mode with large tag size - dm-crypt: reject the lmk IV mode with AEAD ciphers - mm: don't schedule deferred kernel page table freeing while booting - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them - memstick: core: wait for request completion before freeing card - KEYS: Fix add_key() race with keyring restriction - keys: finalize persistent keyring timeout after link attempt - ip6_gre: remove obsolete ERSPAN PMTU update - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 - io_uring/register: don't exempt disabled rings from task restrictions - ice: fix metadata_dst refcount handling on representor teardown - ice: fix use-after-free in dynamic port cleanup - ibmveth: fix TX LTB and filter unwind on open-fail - ibmveth: h_free logical LAN on open-fail after register - gve: fix XSK buffer leak on error descriptor - gve: fix XSK buffer leak when rings are stopped - gve: fix napi_disable deadlock when attempting to disable XSK pools - iavf: send MAC change request synchronously - gpio: xilinx: fix runtime PM leak on request error path - gpio: mpsse: fix race when arming the IRQ poll worker - fsverity: RCU-delay the freeing of struct fsverity_info - EDAC/amd64: Mask UMC chip select to the four implemented selects - e1000e: add system to disable K1 list - selftests/mm: cleanup -Wformat issues in hugetlb-mmap - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts - selinux: fix data race on AVC latest_notif - Revert "wifi: libertas: reject short monitor TX frames" - tipc: hold a reference to nodes found by link name - tipc: destroy topsrv workqueues before closing connections - tcp: reject net_iov in zerocopy receive mapping hints - swiotlb: fix default_swiotlb_limit() for non-growable default pool - strparser: make sure __strp_recv isn't running before tearing down the parser - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() - xen/netfront: don't leak the skb when xennet_fill_frags() fails - x86/CPU/AMD: Fix AMD TLBI Erratum #1718 - workqueue: Fix NULL current_pwq deref in chained work check - wireguard: noise: reject response consumption after intermediate initiation - wireguard: queueing: preserve tstamp_type when encapsulating packet - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init() - wifi: mt76: mt7603: initialize global station WCID - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() - vsock/virtio: account only unread bytes in read_skb() - usb: f81604: fix struct f81604_int_data size mismatch - dm ioctl: don't let data_start run past the buffer - cipso: adjust cached option offsets when removing CIPSO - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() - can: fix unique skb identifier regression under RPS - can: dev: init_can_skb(): restore skb header initialization - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) - arm64: irq: exclude the softirq stack switch from KCOV - ALSA: hda/tas2781: Accept V1 calibration data without CRC - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers - Input: xpad - add support for Corsair Novablade Pro - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox - Input: ati_remote2 - fix type confusion in device attribute handlers - ipv6: do not warn on route notification size race - ipv4: do not warn on route notification size race - ipv4: stop route notification sizing when nexthop group shrinks - ipv4: stop exception dump when nexthop group shrinks - ipv4: stop PMTU walk when nexthop group shrinks - rust_binder: reschedule node refcount update on thread exit - ipv4: validate checksum_start before completing checksum - ipv6: udp: Create exceptions before socket matching - ipv4: udp: Create exceptions before socket matching - ipv6: Fix redirect exception creation for UDP/RAW sockets - net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry - net/mlx5e: Prevent stale XSK buffer release on refill retry - fs: Free any excess xarray nodes in clear_inode() - bnxt_en: fix DMA mapping length for padded small packets