Hi all,
CIP kernel team has released Linux kernel v6.12.101-cip29.
The linux-6.12.y-cip tree has been updated base version from v6.12.96 to v6.12.101.
This release incorporates updates for the watchdog, USB, xSPI, clock, and various
dts for Renesas RZ G2 SoCs.
Information about this release is as follows:
v6.12.101-cip29:
repository:
https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
branch:
linux-6.12.y-cip
commit hash:
6c6fd34960fb2eb93e503bfc06081c3ceb47bc07
fixed CVEs:
CVE-2025-39729: crypto: ccp - Fix dereferencing uninitialized error pointer
CVE-2025-39936: crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry
CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP.
CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends
CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb
CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
CVE-2026-64206: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
CVE-2026-64227: ACPI: driver: Check ACPI_COMPANION() against NULL during probe
CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
CVE-2026-64307: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
CVE-2026-64341: USB: iowarrior: fix use-after-free on disconnect race
CVE-2026-64352: bpf: Allow LPM map access from sleepable BPF programs
CVE-2026-64361: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
CVE-2026-64363: HID: appleir: fix UAF on pending key_up_timer in remove()
CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags
CVE-2026-64369: s390: Revert support for DCACHE_WORD_ACCESS
CVE-2026-64371: proc: protect ptrace_may_access() with exec_update_lock (part 1)
CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links)
CVE-2026-64390: ksmbd: track the connection owning a byte-range lock
CVE-2026-64401: smb: client: resolve SWN tcon from live registrations
CVE-2026-64405: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
CVE-2026-64413: netfilter: ebtables: zero chainstack array
CVE-2026-64416: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
CVE-2026-64421: media: nxp: imx8-isi: Fix use-after-free on remove
CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path
CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
CVE-2026-64438: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
CVE-2026-64441: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable
CVE-2026-64462: PCI: altera: Fix resource leaks on probe failure
CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout
CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown
CVE-2026-64488: ALSA: aoa: check snd_ctl_new1() return value
CVE-2026-64493: iio: pressure: mpl115: fix runtime PM leak on read error
CVE-2026-64507: x86/bugs: Enable IBPB flush on BPF JIT allocation
CVE-2026-64508: bpf: Support for hardening against JIT spraying
CVE-2026-64509: rust: block: fix GenDisk cleanup paths
CVE-2026-64510: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
CVE-2026-64531: net: openvswitch: reject oversized nested action attrs
CVE-2026-64532: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
CVE-2026-64533: fs/ntfs3: validate lcns_follow in log_replay conversion
CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
CVE-2026-64535: nvmet-tcp: Fix potential UAF when ddgst mismatch
CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time
CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
CVE-2026-64539: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
CVE-2026-64540: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na()
CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
CVE-2026-64544: crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect()
CVE-2026-64546: drm/edid: fix OOB read in drm_parse_tiled_block()
CVE-2026-64547: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
CVE-2026-64549: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
CVE-2026-64550: net: qualcomm: rmnet: validate MAP frame length before ingress parsing
CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness
CVE-2026-64552: virtio-net: fix len check in receive_big()
CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA
CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
CVE-2026-64555: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
CVE-2026-64557: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
CVE-2026-64558: s390/pkey: Check length in pkey_pckmo handler implementation
CVE-2026-64559: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap
CVE-2026-64585: can: esd_usb: kill anchored URBs before freeing netdevs
CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time
CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()
CVE-2025-68299: afs: Fix delayed allocation of a cell's anonymous key
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock
CVE-2026-45901: netfilter: nf_tables: revert commit_mutex usage in reset path
CVE-2026-53078: bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs
CVE-2026-53364: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path
CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
CVE-2026-64290: iommufd: Break the loop on failure in iommufd_fault_fops_read()
CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR
CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing
CVE-2026-64565: Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
CVE-2026-64567: btrfs: reject free space cache with more entries than pages
CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
CVE-2026-64570: wifi: mac80211: fix fils_discovery double free on alloc failure
CVE-2026-64571: wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path
CVE-2026-64573: Bluetooth: qca: fix NVM tag length underflow in TLV parser
CVE-2026-64574: wifi: mac80211: tear down new links on vif update error path
CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate()
CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
CVE-2026-64578: ksmbd: validate compound request size before reading StructureSize2
CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
CVE-2026-64583: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
CVE-2026-64584: usb: gadget: f_midi: cancel pending IN work before freeing the midi object
added commits:
CIP: Bump version suffix to -cip29 after merge from stable
dt-bindings: watchdog: renesas,wdt: Document RZ/G3L support
dt-bindings: watchdog: factor out RZ/V2H(P) watchdog
dt-bindings: watchdog: factor out RZ/G2L watchdog
dt-bindings: watchdog: factor out RZ/N1 watchdog
dt-bindings: watchdog: factor out RZ/A watchdog
ASoC: dt-bindings: renesas,rz-ssi: Document RZ/G3L SoC
dt-bindings: i2c: renesas,riic: Document the R9A08G046 support
arm64: dts: renesas: rzg3e-smarc-som: Sort GMAC pinmux entries
phy: renesas: phy-rzg3e-usb3: Fix malformed MODULE_AUTHOR string
arm64: dts: renesas: r9a08g046l48-smarc: Enable audio
arm64: dts: renesas: rzg3l-smarc-som: Enable Versa clock generator
arm64: dts: renesas: r9a08g046l48-smarc: Enable I2C{2,3} devices
arm64: dts: renesas: r9a08g046: Add audio clock nodes
arm64: dts: renesas: r9a08g046: Add SSI support
arm64: dts: renesas: r9a08g046: Add DMAC node
arm64: dts: renesas: r9a08g046: Add i2c{0..3} device nodes
arm64: dts: renesas: rzg3l-smarc-som: Enable watchdog
arm64: dts: renesas: r9a08g046: Add wdt device node
arm64: dts: renesas: r9a08g046: Add scif{1..5} device nodes
clk: renesas: rzg2l: Rename RZG3L-prefixed PLL macros to CPG-prefixed ones
clk: renesas: rzg3s/rzg3l: Simplify PLL configuration macro
clk: renesas: rzg2l: Simplify SAM PLL configuration macro
clk: renesas: r9a08g046: Add RSPI clocks and resets
clk: renesas: r9a08g046: Add SSIF-2 clocks and resets
clk: renesas: r9a08g046: Add RSCI clocks and resets
clk: renesas: cpg-mssr: Add number of clock cells check
arm64: dts: renesas: rzg3s-smarc: Enable USB support
arm64: dts: renesas: r9a08g045: Add USB support
phy: renesas: rcar-gen3-usb2: Add suspend/resume support
phy: renesas: rcar-gen3-usb2: Move phy_data->init_bus check
dt-bindings: phy: renesas,usb2-phy: Mark resets as required for RZ/G3S
usb: renesas_usbhs: Assert/de-assert reset signals on suspend/resume
dt-bindings: usb: renesas,usbhs: Document RZ/G3S SoC
usb: host: ohci-platform: Call reset assert/deassert on suspend/resume
usb: host: ehci-platform: Call reset assert/deassert on suspend/resume
usb: host: Do not check priv->clks[clk]
reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it
reset: rzg2l-usbphy-ctrl: Add suspend/resume support
reset: rzg2l-usbphy-ctrl: Propagate the return value of regmap_field_update_bits()
reset: rzg2l-usbphy-ctrl: Fix a NULL vs IS_ERR() bug in probe
reset: rzg2l-usbphy-ctrl: Add support for RZ/G3S SoC
dt-bindings: reset: renesas,rzg2l-usbphy-ctrl: Document RZ/G3S support
reset: rzg2l-usbphy-ctrl: Add support for USB PWRRDY
arm64: dts: renesas: rzt2h-n2h-evk: Enable xSPI nodes
arm64: dts: renesas: r9a09g087: Add xSPI nodes
arm64: dts: renesas: r9a09g077: Add xSPI nodes
memory: renesas-rpc-if: Add suspend/resume support
memory: renesas-rpc-if: Fix duplicate device name on multi-instance platforms
dt-bindings: memory: renesas,rzg3e-xspi: Add RZ/T2H and RZ/N2H support
clk: renesas: r9a09g077: Add xSPI core and module clocks
mtd: spi-nor: add support for Macronix Octal flash
Best regards,
Nobuhiro
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.