[ANNOUNCE] Release v6.12.94-cip26

Hi all,

CIP kernel team has released Linux kernel v6.12.94-cip26.
The linux-6.12.y-cip tree has been updated base version from v6.12.92 to v6.12.94.
This release also includes the RSPI patch for Renesas ARM SoCs.

Information about this release is as follows:

  v6.12.94-cip26:
    repository:
      https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
    branch:
      linux-6.12.y-cip
    commit hash:
      e00178e6fe853ac0059d15909043e0fd5c19ece9
    fixed CVEs:
      CVE-2025-68768: inet: frags: flush pending skbs in fqdir_pre_exit()
      CVE-2026-23346: arm64: io: Extract user memory type in ioremap_prot()
      CVE-2026-43219: net: cpsw_new: Fix potential unregister of netdev that has not been registered yet
      CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare()
      CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments()
      CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised
      CVE-2026-46316: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
      CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one()
      CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one()
      CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface
      CVE-2026-52923: ipc: limit next_id allocation to the valid ID range
      CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user
      CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets
      CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers
      CVE-2026-53080: net/sched: cls_fw: fix NULL dereference of "old" filters before change()
      CVE-2026-23247: tcp: secure_seq: add back ports to TS offset
      CVE-2026-31663: xfrm: hold dev ref until after transport_finish NF_HOOK
      CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn()
      CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack
      CVE-2026-45850: ipvs: skip ipv6 extension headers for csum checks
      CVE-2026-46203: spi: cadence-quadspi: fix unclocked access on unbind
      CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp()
      CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache corruption
      CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
      CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period.
      CVE-2026-52917: sctp: diag: reject stale associations in dump_one path
      CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling
      CVE-2026-52929: sctp: stream: fully roll back denied add-stream state
      CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates
      CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send
      CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
      CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it
      CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
      CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
      CVE-2026-52948: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
      CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr()
      CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue
      CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G
      CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register
      CVE-2026-53135: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
      CVE-2026-53136: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
      CVE-2026-53137: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
      CVE-2026-53138: drm/amd/display: Bound VBIOS record-chain walk loops
      CVE-2026-53140: drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
      CVE-2026-53143: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
      CVE-2026-53144: drm/amdkfd: fix NULL dereference in get_queue_ids()
      CVE-2026-53146: thunderbolt: Limit XDomain response copy to actual frame size
      CVE-2026-53147: thunderbolt: Validate XDomain request packet size before type cast
      CVE-2026-53148: thunderbolt: Clamp XDomain response data copy to allocation size
      CVE-2026-53149: thunderbolt: Bound root directory content to block size
      CVE-2026-53150: thunderbolt: Reject zero-length property entries in validator
      CVE-2026-53152: mmc: dw_mmc-rockchip: Add missing private data for very old controllers
      CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths
      CVE-2026-53156: nvmem: core: fix use-after-free bugs in error paths
      CVE-2026-53158: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
      CVE-2026-53159: misc: fastrpc: fix DMA address corruption due to find_vma misuse
      CVE-2026-53160: misc: fastrpc: fix use-after-free race in fastrpc_map_create
      CVE-2026-53161: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
      CVE-2026-53168: fuse: reject fuse_notify() pagecache ops on directories
      CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
      CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
      CVE-2026-53177: bnxt_en: Fix NULL pointer dereference
      CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up()
      CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake
      CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists
      CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink
      CVE-2026-53184: udp: clear skb->dev before running a sockmap verdict
      CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial()
      CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length
      CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put()
      CVE-2026-53190: drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
      CVE-2026-53191: io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
      CVE-2026-53192: ALSA: timer: Fix UAF at snd_timer_user_params()
      CVE-2026-53193: ALSA: timer: Forcibly close timer instances at closing
      CVE-2026-53194: USB: serial: kl5kusb105: fix bulk-out buffer overflow
      CVE-2026-53195: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
      CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info()
      CVE-2026-53198: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
      CVE-2026-53199: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
      CVE-2026-53202: accel/ivpu: Fix signed integer truncation in IPC receive
      CVE-2026-53203: accel/ivpu: Add buffer overflow check in MS get_info_ioctl
      CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices
      CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
      CVE-2026-53208: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
      CVE-2026-53209: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
      CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper()
      CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy
      CVE-2026-53213: drm/vc4: fix krealloc() memory leak
      CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route()
      CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use
      CVE-2026-53216: net: mvpp2: limit XDP frame size to the RX buffer
      CVE-2026-53217: net: mvpp2: sync RX data at the hardware packet offset
      CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
      CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers
      CVE-2026-53220: netfilter: revalidate bridge ports
      CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
      CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs
      CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
      CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR
      CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads
      CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
      CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
      CVE-2026-53232: net: phy: clean the sfp upstream if phy probing fails
      CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit()
      CVE-2026-53234: net: ibm: emac: Fix use-after-free during device removal
      CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list()
      CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users
      CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume
      CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths
      CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
      CVE-2026-53241: ALSA: seq: dummy: fix UMP event stack overread
      CVE-2026-53242: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
      CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
      CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
      CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
      CVE-2026-53251: Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
      CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev()
      CVE-2026-53253: Bluetooth: bnep: reject short frames before parsing
      CVE-2026-53254: Bluetooth: RFCOMM: validate skb length in MCC handlers
      CVE-2026-53255: Bluetooth: MGMT: validate advertising TLV before type checks
      CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
      CVE-2026-53261: devlink: Release nested relation on devlink free
      CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
      CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression
      CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle
      CVE-2026-53265: dm cache policy smq: check allocation under invalidate lock
      CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable
      CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval
      CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read
      CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting
      CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit
      CVE-2026-53271: ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
      CVE-2026-53272: erofs: fix use-after-free on sbi->sync_decompress
      CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant
      CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
      CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries
    added commits:
      CIP: Bump version suffix to -cip26 after merge from stable
      arm64: dts: renesas: r9a09g047e57-smarc: Enable RSPI0
      arm64: dts: renesas: r9a09g047: Add RSPI nodes
      spi: rzv2h-rspi: Fix silent failure in clock setup error path
      spi: rzv2h-rspi: Simplify clock rate search function signatures
      spi: rzv2h-rspi: Fix invalid SPR=0/BRDV=0 clock configuration
      spi: rzv2h-rspi: Fix max_speed_hz advertising prohibited bit rate
      spi: rzv2h-rspi: Add support for RZ/G3L (R9A08G046)
      spi: rzv2h-rspi: add support for DMA mode
      spi: rzv2h-rspi: split out PIO transfer
      spi: rzv2h-rspi: enable TX buffer empty interrupt
      spi: rzv2h-rspi: set TX FIFO threshold to 0
      spi: rzv2h-rspi: set MUST_RX/MUST_TX
      spi: rzv2h-rspi: store RX interrupt in state
      spi: rzv2h-rspi: use device-managed APIs
      spi: rzv2h-rspi: do not set SPI_TRANS_FAIL_IO
      spi: rzv2h-rspi: remove call to spi_finalize_current_transfer()
      spi: rzv2h-rspi: fix rzv2h_rspi_transfer_one() indentation
      spi: dt-bindings: renesas,rzv2h-rspi: Document RZ/G3E SoC support
      spi: dt-bindings: renesas,rzv2h-rspi: Document dmas property
      spi: dt-bindings: renesas,rzv2h-rspi: allow multiple DMAs
      spi: dt-bindings: renesas,rzv2h-rspi: document optional support for DMA
      clk: renesas: r9a09g047: Add entries for the RSPIs
      driver core: Add device probe log helper dev_warn_probe()
      dmaengine: Add devm_dma_request_chan()

Best regards,
  Nobuhiro