-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 04 Jul 2026 20:24:27 +0200 Source: linux Binary: linux-doc linux-doc-6.12 linux-headers-6.12.95+deb13-common linux-headers-6.12.95+deb13-common-rt linux-libc-dev linux-source linux-source-6.12 linux-support-6.12.95+deb13 Architecture: all Version: 6.12.95-1 Distribution: trixie-security Urgency: high Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Salvatore Bonaccorso Description: linux-doc - Linux kernel specific documentation (meta-package) linux-doc-6.12 - Linux kernel specific documentation for version 6.12 linux-headers-6.12.95+deb13-common - Common header files for Linux 6.12.95+deb13 linux-headers-6.12.95+deb13-common-rt - Common header files for Linux 6.12.95+deb13-rt linux-libc-dev - Linux support headers for userspace development linux-source - Linux kernel source (meta-package) linux-source-6.12 - Linux kernel source for version 6.12 with Debian patches linux-support-6.12.95+deb13 - Support files for Linux 6.12 Closes: 1136179 1139686 Changes: linux (6.12.95-1) trixie-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.95 - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain - wifi: mt76: mt7921: fix a potential scan no APs - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (CVE-2026-53101) - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167) - gpiolib: Extract gpiochip_choose_fwnode() for wider use - gpiolib: Remove redundant assignment of return variable - gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() (CVE-2026-31732) - io_uring/net: Avoid msghdr on op_connect/op_bind async data - drm/xe/display: fix oops in suspend/shutdown without display (CVE-2026-53142) - [arm64] drm/v3d: Store the active job inside the queue's state - [arm64] drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139) - eventpoll: use hlist_is_singular_node() in __ep_remove() - eventpoll: split __ep_remove() - eventpoll: kill __ep_remove() - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: move epi_fget() up - eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) - iio: light: bh1780: fix PM runtime leak on error path (CVE-2026-43355) - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216) - Reapply "selftest/ptp: update ptp selftest to exercise the gettimex options" - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Dont call fill_pool() in early boot hardirq context - RDMA/bnxt_re: zero shared page before exposing to userspace - i2c: stub: Reject I2C block transfers with invalid length - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe() (CVE-2026-53325) - bpf: Reject sleepable kprobe_multi programs at attach time (CVE-2026-43010) - ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() - regulator: core: fix locking in regulator_resolve_supply() error path - dlm: prevent NPD when writing a positive value to event_done (CVE-2025-23131) - xfs: remove the expr argument to XFS_TEST_ERROR - xfs: fix error returns in CoW fork repair - Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()" - net: bonding: add broadcast_neighbor option for 802.3ad - bonding: add support for per-port LACP actor priority - bonding: print churn state via netlink - bonding: 3ad: implement proper RCU rules for port->aggregator (CVE-2026-52975) - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419) - bonding: fix NULL pointer dereference in actor_port_prio setting - staging: rtl8723bs: fix buffer over-read in rtw_update_protection (CVE-2026-53179) - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - locking/mutex: Remove wakeups from under mutex::wait_lock - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - phonet: Pass ifindex to fill_addr(). - phonet: Pass net and ifindex to phonet_address_notify(). - net: phonet: free phonet_device after RCU grace period (CVE-2026-53157) - rxrpc: Fix the ACK parser to extract the SACK table for parsing (CVE-2026-53151) - fuse: re-lock request before replacing page cache folio - ftrace: Update the mcount_loc check of skipped entries - ftrace: Have ftrace pages output reflect freed pages - ftrace: Do not over-allocate ftrace memory - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Check against is_kernel_text() instead of kaslr_offset() - net: ipv6: Make udp_tunnel6_xmit_skb() void - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070) - iio: light: veml6075: add bounds check to veml6075_it_ms index - iio: adc: ti-ads1298: add bounds check to pga_settings index - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - ksmbd: reject non-VALID session in compound request branch - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - virtiofs: fix UAF on submount umount - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) - [amd64] KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" - [amd64] KVM: SEV: Ignore MMIO requests of length '0' - [amd64] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ - [amd64] KVM: SEV: Ignore Port I/O requests of length '0' - batman-adv: tp_meter: keep unacked list in ascending ordered - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: prevent ELP transmission interval underflow - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: frag: avoid underflow of TTL - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: handle overlapping packets - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tt: track roam count per VID - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: tvlv: avoid race of cifsnotfound handler state - ipv6: account for fraggap on the paged allocation path (CVE-2026-53362) - fs: constify file ptr in backing_file accessor helpers - lsm: add backing_file LSM hooks - selinux: fix overlayfs mmap() and mprotect() access checks - inet: add indirect call wrapper for getfrag() calls - ipv4: account for fraggap on the paged allocation path - ntfs3: reject direct userspace writes to reserved $LX* xattrs - [amd64] KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() - [amd64] KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free - af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361) - mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program - mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g - mac802154: llsec: add skb_cow_data() before in-place crypto - net: skmsg: preserve sg.copy across SG transforms - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - apparmor: mediate the implicit connect of TCP fast open sendmsg - apparmor: fix use-after-free in rawdata dedup loop - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - fbdev: fix use-after-free in store_modes() - kernel/fork: clear PF_BLOCK_TS in copy_process() - block: invalidate cached plug timestamp after task switch - err.h: use __always_inline on all error pointer helpers - KEYS: fix overflow in keyctl_pkey_params_get_2() - keys: Pin request_key_auth payload in instantiate paths - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer - wifi: ath11k: fix warning when unbinding - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: iwlwifi: mvm: fix race condition in PTP removal - f2fs: validate compress cache inode only when enabled - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: keep atomic write retry from zeroing original data - block: Avoid mounting the bdev pseudo-filesystem in userspace - bpf: use kvfree() for replaced sysctl write buffer - exfat: fix potential use-after-free in exfat_find_dir_entry() - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - gfs2: fix use-after-free in gfs2_qd_dealloc - [arm64] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() - hdlc_ppp: sync per-proto timers before freeing hdlc state - blk-cgroup: fix UAF in __blkcg_rstat_flush() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - pNFS: Fix use-after-free in pnfs_update_layout() - fpga: region: fix use-after-free in child_regions_with_firmware() - rpmsg: char: Fix use-after-free on probe error path - ocfs2: reject oversized group bitmap descriptors - 9p: avoid putting oldfid in p9_client_walk() error path - [amd64] KVM: x86: hyper-v: Bound the bank index when querying sparse banks - [amd64] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - [riscv64] mm: Extract helper mark_new_valid_map() - [riscv64] kfence: Call mark_new_valid_map() for kfence_unprotect() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - i2c: core: fix adapter registration race - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - nfsd: check get_user() return when reading princhashlen - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race - nfsd: reset write verifier on deferred writeback errors - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - NFS: Prevent resource leak in nfs_alloc_server() - ksmbd: fix out-of-bounds read in smb_check_perm_dacl() - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - drivers/base/memory: set mem->altmap after successful device registration - Documentation: ioctl-number: Fix linuxppc-dev mailto link - Documentation: ioctl-number: Extend "Include File" column width - [amd64] crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - [amd64] crypto: qat - Return pointer directly in adf_ctl_alloc_resources - [amd64] crypto: qat - remove unused character device and IOCTLs - net/tcp-ao: fix use-after-free of key in del_async path - locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex - net: bonding: update the slave array for broadcast mode - bonding: annotate data-races arcound churn variables - bonding: do not set usable_slaves for broadcast mode . [ Salvatore Bonaccorso ] * net/netfilter: Enable NETFILTER_NETLINK_HOOK as module (Closes: #1139686) * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse." . [ Uwe Kleine-König ] * [amd64] Enable CONFIG_PINCTRL_CS42L43 and CONFIG_SPI_CS42L43 explicitly (Closes: #1136179) Checksums-Sha1: cf7cc4bda90a8e8cc9a7c3bba4d36e36d8cd5c2a 39465968 linux-doc-6.12_6.12.95-1_all.deb 82163c87dba943a32442b2a6a0e2126b4a89c9f3 1100 linux-doc_6.12.95-1_all.deb 352f118fde304b4ae99f9c3e2055e1b81f0e73df 9496772 linux-headers-6.12.95+deb13-common-rt_6.12.95-1_all.deb 0d5f858abaec7ef91f744e0acfaf1556fe0df671 11139464 linux-headers-6.12.95+deb13-common_6.12.95-1_all.deb 2b8a574bdef5602b79b122706db435ecdc96b0d4 2852492 linux-libc-dev_6.12.95-1_all.deb 357e7f99ca0d55c63ea1cd4ccc8d8decd70c924b 152599000 linux-source-6.12_6.12.95-1_all.deb fc06b64bace8f05213a33b041475bab5dd0f8424 1092 linux-source_6.12.95-1_all.deb baa9f170d483f39b751cfb15392102ca58dcc97a 1338204 linux-support-6.12.95+deb13_6.12.95-1_all.deb 115011ef7733da1d1e817aefca72434bd6b3b937 13834 linux_6.12.95-1_all-buildd.buildinfo Checksums-Sha256: 6c4da1bf39244e5c28ee4c07d1ef571d60c8f338463a05b2784ccf6913f91637 39465968 linux-doc-6.12_6.12.95-1_all.deb 87d53cefa75714ee56c353ca478a36ca220c08b159b604ae7e21ee49cef3d4a2 1100 linux-doc_6.12.95-1_all.deb fea4125325f816703c51cfec747a7ff57d8f97289c006714f7a4c95fecffdca6 9496772 linux-headers-6.12.95+deb13-common-rt_6.12.95-1_all.deb c63f1c0d068eb4156d00e3794ad16d2ae81ebbd3917ed9eb7d6e6a40c40eed37 11139464 linux-headers-6.12.95+deb13-common_6.12.95-1_all.deb c62d1f64927f3b0340133aa7e5587f65f607d2ad4d96be9c61d2cd85a397c931 2852492 linux-libc-dev_6.12.95-1_all.deb f9c0daa6a98a2d265ac479ac38a04e0aecd16cdaa7e65714f1ef42c0ccdea7f9 152599000 linux-source-6.12_6.12.95-1_all.deb 2096fc7ee6577ec6994b08c2b5bf5b4a3a65773f94f2e18236a71d61ebd24f89 1092 linux-source_6.12.95-1_all.deb a26a88dfc460f8d172ade45d05d56baf9dd5912939051aebefc9bae180da943d 1338204 linux-support-6.12.95+deb13_6.12.95-1_all.deb ec621aa9551b96691026b603228f3ea96b8f9d5af8144f0f2baaf6511a5d6bc7 13834 linux_6.12.95-1_all-buildd.buildinfo Files: 299c652647852351079be96ae2886899 39465968 doc optional linux-doc-6.12_6.12.95-1_all.deb 95003c8ebfa329b7706b1b477938f9c0 1100 doc optional linux-doc_6.12.95-1_all.deb 5514397e4bae5de45965d43f550a7632 9496772 kernel optional linux-headers-6.12.95+deb13-common-rt_6.12.95-1_all.deb ebb902a4d1b3fb9e80985da23babba26 11139464 kernel optional linux-headers-6.12.95+deb13-common_6.12.95-1_all.deb 566dc00c0f705b1560ddd9b030179d26 2852492 devel optional linux-libc-dev_6.12.95-1_all.deb 972813fe601fc28be72171f56989ba40 152599000 kernel optional linux-source-6.12_6.12.95-1_all.deb 61288d4281083fa8d662e0bff6e407c3 1092 kernel optional linux-source_6.12.95-1_all.deb a37a005a1e3f4805201b231f96eb8f08 1338204 devel optional linux-support-6.12.95+deb13_6.12.95-1_all.deb 0249968ae92ec8fa71e50325eb6c2976 13834 kernel optional linux_6.12.95-1_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmpKFmwACgkQmgPNRvTf /zf2CQ//WxImKXfSXpp7S4hNgU6bnGYMcFRCVrVe5syKrln064Jk20BZPwMk+vkX uiFrcKXUGkapPN0UBDB2ROEZRxfAA2MQarGlLinS7pVm6WI8aDcPgi7pznBfvay5 YlBhBCuFkojehTCsdSu5kTswh1iOWObx6g1bQ9fAGJp2czLPqx5uxvGY3Ifk5E4/ l5Q10TrUHcjoy9tN/7kgiN81OS/JjLyXD7A6DZ8J+34Wubp2WfOYEzSuFCDWQ9FD BgeuvOxE2tWpj2b6jCvMsftwqdhe/tC/IcS9sgLKa5/nBy4WLy4zdZLlTbmgNy7Y 8AZ670TGWdv/novc1W0pRerVbo++uhDOt4CdXLRm2rOU0+t4ESs040EDSMPMQtoO v2e2DEDd5HXn3qXVWiBIhhZjOc7MnTN9OWa4hpxv+GjJUZNaaZ/tiNH/Ka4nL59d /aalphXz7DjcgwMzODEPzQ2r78dZbE72NPQDCYIKifIpmkaR2xuVKlNvSR7ukLHJ PKnz+vg8AkERHmF+TvkiEJDQFDr7CepLMux0Ckc6Zjqy93kXvIeYhfaKKYXcnaaP ylC/0H0Gr+e3PezC3ZZZ+Q5mLUK1WVEuL/HHbeSH1h/3bMChAKLuyf806H7A1dNP kMC5NQOXBUVmJD2sb5RHFvHS1KPZYeg32FTJ0v/i8PFKBDebcGM= =4Hoi -----END PGP SIGNATURE-----