[ANNOUNCE] Release v6.12.95-cip27

Hi all,

CIP kernel team has released Linux kernel v6.12.95-cip27.
The linux-6.12.y-cip tree has been updated base version from v6.12.94 to v6.12.95.
In this release, peripheral drivers such as irqchip, pinctrl, clk, dt-bindings, and
dts have been added to provide new support for Renesas’ RZ/G3L and RZ/V2N SoCs and
related boards (such as the SMARC EVK).


Information about this release is as follows:

  v6.12.95-cip27:
    repository:
      https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
    branch:
      linux-6.12.y-cip
    commit hash:
      86374cd567f1cf864cf654149961dd218ca7eee3
    fixed CVEs:
      CVE-2025-23131: dlm: prevent NPD when writing a positive value to event_done
      CVE-2026-23052: ftrace: Do not over-allocate ftrace memory
      CVE-2026-31732: gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
      CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time
      CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp()
      CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path
      CVE-2026-46054: selinux: fix overlayfs mmap() and mprotect() access checks
      CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF
      CVE-2026-46252: regulator: core: fix locking in regulator_resolve_supply() error path
      CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device.
      CVE-2026-52975: bonding: 3ad: implement proper RCU rules for port->aggregator
      CVE-2026-53070: sctp: disable BH before calling udp_tunnel_xmit_skb()
      CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
      CVE-2026-53139: drm/v3d: Skip CSD when it has zeroed workgroups
      CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display
      CVE-2026-53151: rxrpc: Fix the ACK parser to extract the SACK table for parsing
      CVE-2026-53157: net: phonet: free phonet_device after RCU grace period
      CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
      CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
      CVE-2026-53179: staging: rtl8723bs: fix buffer over-read in rtw_update_protection
      CVE-2026-53325: agp/amd64: Fix broken error propagation in agp_amd64_probe()
      CVE-2026-53326: debugobjects: Don't call fill_pool() in early boot hardirq context
      CVE-2026-53327: debugobjects: Do not fill_pool() if pi_blocked_on
      CVE-2026-53341: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
      CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role
      CVE-2026-53361: af_unix: Set gc_in_progress to true in unix_gc().
      CVE-2026-53362: ipv6: account for fraggap on the paged allocation path
    added commits:
      CIP: Bump version suffix to -cip27 after merge from stable
      irqchip/renesas-rzg2l: Add NMI support
      irqchip/renesas-rzg2l: Clear the shared interrupt bit in rzg2l_irqc_free()
      irqchip/renesas-rzg2l: Replace raw_spin_{lock,unlock} with guard() in rzg2l_irq_set_type()
      irqchip/renesas-rzg2l: Add shared interrupt support
      irqchip/renesas-rzg2l: Add RZ/G3L support
      dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Document RZ/G3L SoC
      dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Use pattern for interrupt-names
      irqchip/renesas-rzg2l: Drop IRQC_IRQ_COUNT macro
      irqchip/renesas-rzg2l: Drop IRQC_TINT_START macro
      irqchip/renesas-rzg2l: Drop IRQC_NUM_IRQ macro
      irqchip/renesas-rzg2l: Dynamically allocate fwspec array
      irqchip/renesas-rzg2l: Split rzfive_irqc_{mask,unmask} into separate IRQ and TINT handlers
      irqchip/renesas-rzg2l: Split rzfive_tint_irq_endisable() into separate IRQ and TINT helpers
      irqchip/renesas-rzg2l: Replace rzg2l_irqc_irq_{enable,disable} with TINT-specific handlers
      irqchip/renesas-rzg2l: Split set_type handler into separate IRQ and TINT functions
      irqchip/renesas-rzg2l: Split EOI handler into separate IRQ and TINT functions
      irqchip/renesas-rzg2l: Replace single irq_chip with per-region irq_chip instances
      irqchip/renesas-rzg2l: Drop redundant IRQC_TINT_START check in rzg2l_irqc_alloc()
      irqchip/renesas-rzg2l: Fix error path in rzg2l_irqc_common_probe()
      irqchip/renesas-rzg2l: Remove dev_err_probe() if error is -ENOMEM
      irqchip/renesas-rzg2l: Simplify checks in rzg2l_irqc_common_init()
      irqchip/renesas-rzg2l: Switch to using dev_err_probe()
      irqchip/renesas-rzg2l: Remove pm_put label
      irqchip/renesas-rzg2l: Use devm_pm_runtime_enable()
      irqchip/renesas-rzg2l: Use devm_reset_control_get_exclusive_deasserted()
      irqchip/renesas-rzg2l: Use local dev pointer in rzg2l_irqc_common_init()
      arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable PCIe
      arm64: dts: renesas: r9a09g056: Add PCIe node
      dt-bindings: PCI: renesas,r9a08g045-pcie: Add RZ/V2N support
      clk: renesas: r9a09g056: Add PCIe clocks and reset
      pinctrl: renesas: rzt2h: Skip PFC mode configuration if already set
      pinctrl: renesas: rzt2h: Remove unused variable in rzt2h_pinctrl_register()
      pinctrl: renesas: rzt2h: Add pin configuration support
      dt-bindings: pinctrl: renesas,r9a09g077: Document pin configuration properties
      pinctrl: renesas: rzt2h: Fix invalid wait context
      pinctrl: renesas: rzt2h: Fix device node leak in rzt2h_gpio_register()
      pinctrl: renesas: rzt2h: Add GPIO IRQ chip to handle interrupts
      pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function GPIOs
      pinctrl: renesas: rzt2h: Move GPIO enable/disable into separate function
      pinctrl: renesas: Remove unneeded semicolons
      arm64: dts: renesas: r9a08g046: Add OPP table
      arm64: dts: renesas: rzg3l-smarc-som: Enable eth0 (GBETH0) interface
      arm64: dts: renesas: r9a08g046: Add GBETH nodes
      arm64: dts: renesas: Add initial device tree for RZ/G3L SMARC EVK board
      arm64: dts: renesas: renesas-smarc2: Move usb3 nodes to board DTS
      arm64: dts: renesas: Add initial support for RZ/G3L SMARC SoM
      arm64: dts: renesas: Add initial DTSI for RZ/G3L SoC
      clk: renesas: rzg2l: Refactor rzg3l_cpg_pll_clk_endisable()
      clk: renesas: rzg2l: Consolidate DEF_MUX() and DEF_MUX_FLAGS()
      clk: renesas: r9a08g046: Add IA55_PCLK to critical module clocks
      clk: renesas: r9a08g046: Add I2C clocks and resets
      clk: renesas: r9a08g046: Add SCIF{1..5} clocks and resets
      clk: renesas: r9a08g046: Add WDT clocks and reset
      clk: renesas: r9a08g046: Add CA55 core clocks
      clk: renesas: r9a08g046: Add GPIO clocks/resets
      clk: renesas: r9a08g046: Add GBETH clocks and resets
      clk: renesas: r8a08g046: Add support for PLL6
      clk: renesas: rzg2l: Add support for enabling PLLs
      clk: renesas: rzg2l: Drop always-false check in rzg3s_cpg_pll_clk_recalc_rate()
      clk: renesas: Add support for RZ/G3L SoC
      dt-bindings: clock: renesas,rzg2l-cpg: Document RZ/G3L SoC
      clk: renesas: rzg2l: Re-enable critical module clocks during resume
      clk: renesas: rzg2l: Add rzg2l_mod_clock_init_mstop_helper()
      clk: renesas: rzg2l: Add helper for mod clock enable/disable
      clk: renesas: rzg2l: Add support for critical resets
      clk: renesas: rzg2l: Deassert reset on assert timeout
      clk: renesas: rzg2l: Re-assert reset on deassert timeout
      clk: renesas: rzg2l: Simplify rzg2l_cpg_assert() and rzg2l_cpg_deassert()
      clk: renesas: rzg2l: Rename mstp_clock to mod_clock
      clk: renesas: rzg2l: Remove unneeded nullify checks
      soc: renesas: rz-sysc: Add SoC identification for RZ/G3L SoC
      dt-bindings: soc: renesas: renesas,rzg2l-sysc: Document RZ/G3L SoC
      dt-bindings: soc: renesas: Document RZ/G3L SoC variants, SMARC SoM and Carrier-II EVK
      net: stmmac: dwmac-renesas-gbeth: Add support for RZ/G3L SoC
      net: stmmac: platform: Add snps,dwmac-5.30a IP compatible string
      net: stmmac: platform: Group GMAC4 compatible check
      dt-bindings: net: renesas,rzv2h-gbeth: Document Renesas RZ/G3L RMII{tx,rx} clocks
      dt-bindings: net: renesas,rzv2h-gbeth: Document Renesas RZ/G3L SoC
      dt-bindings: serial: renesas,scif: Document RZ/G3L SoC

Best regards,
  Nobuhiro