[ANNOUNCE] Release v5.10.263-cip76

Hi all,

CIP kernel team has released Linux kernel v5.10.263-cip76.
The linux-5.10.y-cip tree has been updated base version from v5.10.260 to v5.10.263.
This release includes updates to the USB and SDHI drivers for Renesas ARM64 RZ
G2 SoCs.

Information about this release is as follows:

  v5.10.263-cip76:
    repository:
      https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
    branch:
      linux-5.10.y-cip
    commit hash:
      50209760a3646d8afaca26d50ca2834df369ade9
    fixed CVEs:
      CVE-2022-0742: A memory leak flaw was found in the Linux kernel’s ICMPv6 networking protocol, in ...
      CVE-2022-3114: Kernel: Unchecked kcalloc return leads to null pointer dereference.
      CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
      CVE-2022-49662: ipv6: fix lockdep splat in in6_dump_addrs()
      CVE-2023-52494: bus: mhi: host: Add alignment check for event ring read pointer
      CVE-2024-26631: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
      CVE-2024-27390: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
      CVE-2025-38550: ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
      CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
      CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp()
      CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter()
      CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
      CVE-2026-46135: nvmet-tcp: fix race between ICReq handling and queue teardown
      CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it
      CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
      CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count
      CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors
      CVE-2026-53399: nfsd: release layout stid on setlease failure
      CVE-2026-53400: i2c: core: fix adapter registration race
      CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
      CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state
      CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
      CVE-2026-63815: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
      CVE-2026-63818: f2fs: validate orphan inode entry count
      CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop
      CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg
      CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
      CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms
      CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize
      CVE-2026-64206: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
      CVE-2026-64266: fuse: re-lock request before returning from fuse_ref_folio()
      CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length
      CVE-2026-64271: Input: touchwin - reset the packet index on every complete packet
      CVE-2026-64273: Input: iforce - bound the device-reported force-feedback effect index
      CVE-2026-64274: Input: goodix - clamp the device-reported contact count
      CVE-2026-64275: Input: elan_i2c - prevent division by zero and arithmetic underflow
      CVE-2026-64276: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
      CVE-2026-64277: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
      CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry()
      CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
      CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching
      CVE-2026-64303: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
      CVE-2026-64304: crypto: qat - validate RSA CRT component lengths
      CVE-2026-64306: crypto: drbg - Fix returning success on failure in CTR_DRBG
      CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback
      CVE-2026-64313: crypto: ecc - Fix carry overflow in vli multiplication
      CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps
      CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps
      CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record
      CVE-2026-64318: partitions: aix: bound the pp_count scan to the ppe array
      CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count
      CVE-2026-64323: udf: validate VAT header length against the VAT inode size
      CVE-2026-64324: udf: validate free block extents against the partition length
      CVE-2026-64329: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
      CVE-2026-64330: usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
      CVE-2026-64331: usbip: vudc: fix NULL deref in vep_dequeue()
      CVE-2026-64332: USB: ulpi: fix memory leak on registration failure
      CVE-2026-64333: USB: serial: digi_acceleport: fix write buffer corruption
      CVE-2026-64334: USB: serial: digi_acceleport: fix hard lockup on disconnect
      CVE-2026-64335: USB: serial: digi_acceleport: fix broken rx after throttle
      CVE-2026-64337: usb: mtu3: unmap request DMA on queue failure
      CVE-2026-64338: USB: misc: uss720: unregister parport on probe failure
      CVE-2026-64340: USB: legousbtower: fix use-after-free on disconnect race
      CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect
      CVE-2026-64343: USB: ldusb: fix use-after-free on disconnect race
      CVE-2026-64344: USB: idmouse: fix use-after-free on disconnect race
      CVE-2026-64345: usb: gadget: f_printer: take kref only for successful open
      CVE-2026-64347: usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
      CVE-2026-64348: usb: free iso schedules on failed submit
      CVE-2026-64351: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
      CVE-2026-64359: nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
      CVE-2026-64360: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
      CVE-2026-64361: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
      CVE-2026-64362: HID: lg-g15: cancel pending work on remove to fix a use-after-free
      CVE-2026-64363: HID: appleir: fix UAF on pending key_up_timer in remove()
      CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags
      CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
      CVE-2026-64371: proc: protect ptrace_may_access() with exec_update_lock (part 1)
      CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
      CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot
      CVE-2026-64374: sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
      CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links)
      CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
      CVE-2026-64379: smb: client: mask server-provided mode to 07777 in modefromsid
      CVE-2026-64380: smb: client: harden POSIX SID length parsing
      CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard()
      CVE-2026-64403: Bluetooth: L2CAP: validate option length before reading conf opt value
      CVE-2026-64406: Bluetooth: fix UAF in bt_accept_dequeue()
      CVE-2026-64408: Bluetooth: bnep: pin L2CAP connection during netdev registration
      CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock()
      CVE-2026-64412: netfilter: ebtables: module names must be null-terminated
      CVE-2026-64413: netfilter: ebtables: zero chainstack array
      CVE-2026-64420: mfd: cros_ec: Delay dev_set_drvdata() until probe success
      CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
      CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction
      CVE-2026-64425: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
      CVE-2026-64429: gpio: eic-sprd: use raw_spinlock_t in the irq startup path
      CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue
      CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states
      CVE-2026-64438: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
      CVE-2026-64442: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
      CVE-2026-64445: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
      CVE-2026-64446: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
      CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area
      CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks
      CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path
      CVE-2026-64455: USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
      CVE-2026-64456: hwrng: virtio: clamp device-reported used.len at copy_data()
      CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable
      CVE-2026-64462: PCI: altera: Fix resource leaks on probe failure
      CVE-2026-64465: usb: xhci: Fix sleep in atomic context in xhci_free_streams()
      CVE-2026-64468: binder: fix UAF in binder_free_transaction()
      CVE-2026-64469: binder: fix UAF in binder_thread_release()
      CVE-2026-64470: Bluetooth: btusb: fix use-after-free on marvell probe failure
      CVE-2026-64471: Bluetooth: btusb: fix use-after-free on registration failure
      CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure
      CVE-2026-64478: ALSA: usb-audio: avoid kobject path lookup in DualSense match
      CVE-2026-64483: ALSA: firewire: isight: bound the sample count to the packet payload
      CVE-2026-64484: ALSA: es1938: check snd_ctl_new1() return value
      CVE-2026-64487: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
      CVE-2026-64488: ALSA: aoa: check snd_ctl_new1() return value
      CVE-2026-64494: iio: light: gp2ap002: fix runtime PM leak on read error
      CVE-2026-64495: iio: gyro: bmg160: bail out when bandwidth/filter is not in table
      CVE-2026-64496: iio: event: Fix event FIFO reset race
      CVE-2026-64497: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
      CVE-2026-64500: iio: adc: lpc32xx: Initialize completion before requesting IRQ
      CVE-2026-64503: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
      CVE-2026-64504: iio: accel: bmc150: clamp the device-reported FIFO frame count
      CVE-2026-64505: usb: gadget: function: rndis: add length check for header
      CVE-2026-64510: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
      CVE-2026-64514: userfaultfd: gate must_wait writability check on pte_present()
      CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
      CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
      CVE-2026-64540: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
      CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
      CVE-2026-64544: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
      CVE-2026-64546: drm/edid: fix OOB read in drm_parse_tiled_block()
      CVE-2026-64547: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
      CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
      CVE-2026-64549: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
      CVE-2026-64550: net: qualcomm: rmnet: validate MAP frame length before ingress parsing
      CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness
      CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA
      CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
      CVE-2026-64589: i2c: core: fix NULL-deref on adapter registration failure
      CVE-2026-64593: btrfs: do not trim a device which is not writeable
      CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time
      CVE-2026-64599: crypto: amlogic - avoid double cleanup in meson_crypto_probe()
      CVE-2026-64602: iio: adc: spear: Initialize completion before requesting IRQ
      CVE-2026-64604: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
      CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race
    added commits:
      CIP: Bump version suffix to -cip76 after merge from stable
      usb: renesas: Suppress binding attributes
      arm64: dts: renesas: rzg3s-smarc: Enable USB support
      arm64: dts: renesas: r9a08g045: Add USB support
      phy: renesas: rcar-gen3-usb2: Add suspend/resume support
      phy: renesas: rcar-gen3-usb2: Move phy_data->init_bus check
      phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
      phy: renesas: rcar-gen3-usb2: store drvdata pointer in channel
      phy: renesas: rcar-gen3-usb2: Add support for the RZ/G3S SoC
      phy: renesas: rcar-gen3-usb2: Add support to initialize the bus
      dt-bindings: phy: renesas,usb2-phy: Mark resets as required for RZ/G3S
      dt-bindings: phy: renesas,usb2-phy: Document RZ/G3S phy bindings
      usb: renesas_usbhs: Assert/de-assert reset signals on suspend/resume
      dt-bindings: usb: renesas,usbhs: Document RZ/G3S SoC
      usb: host: ohci-platform: Call reset assert/deassert on suspend/resume
      usb: host: ehci-platform: Call reset assert/deassert on suspend/resume
      usb: host: Do not check priv->clks[clk]
      reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it
      reset: rzg2l-usbphy-ctrl: Add suspend/resume support
      reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits()
      reset: rzg2l-usbphy-ctrl: Fix a NULL vs IS_ERR() bug in probe
      reset: rzg2l-usbphy-ctrl: Add support for RZ/G3S SoC
      dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G3S support
      reset: rzg2l-usbphy-ctrl: Add support for USB PWRRDY
      pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down
      pinctrl: renesas: rzg2l: Add support for pull-up/down
      clk: renesas: rzg2l: Deassert reset on assert timeout
      clk: renesas: r9a08g045: Add clocks, resets and power domains for USB
      arm64: dts: renesas: r9a07g054: Add max-frequency to SDHI nodes
      arm64: dts: renesas: r9a07g044: Add max-frequency to SDHI nodes
      arm64: dts: renesas: r9a07g044: Rename SDHI clocks
      arm64: dts: renesas: r9a07g043: Add max-frequency to SDHI nodes

Best regards,
  Nobuhiro