[ANNOUNCE] Release v6.12.104-cip30

Hi all,

CIP kernel team has released Linux kernel v6.12.104-cip30.
The linux-6.12.y-cip tree has been updated base version from v6.12.101 to v6.12.104.

Information about this release is as follows:

  v6.12.104-cip30:
    repository:
      https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
    branch:
      linux-6.12.y-cip
    commit hash:
      021c2f95227f3aca5dd6bf4c6c761088eb0ea888
    fixed CVEs:
      CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection
      CVE-2025-38525: rxrpc: Fix irq-disabled in local_bh_enable()
      CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated
      CVE-2026-64427: HID: logitech-dj: Fix maxfield check in DJ short report validation
      CVE-2026-64563: rhashtable: clear stale iter->p on table restart
      CVE-2026-64586: wifi: brcmfmac: drain bus_reset work on device removal
      CVE-2026-68169: mptcp: pm: userspace: fix use-after-free in get_local_id
      CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state()
      CVE-2026-68253: drm/i915/hdcp: check streams[] bounds before overflow
      CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR
      CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
      CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs
      CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
      CVE-2026-68273: drm/amdgpu: Fix context pstate override handling
      CVE-2026-68276: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
      CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
      CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown
      CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests
      CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests
      CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access()
      CVE-2026-74352: of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
      CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL
      CVE-2026-74441: usb: typec: ucsi: Fix race condition and ordering in port unregistration
      CVE-2026-74442: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
      CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer
      CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
      CVE-2026-74445: drm/vmwgfx: reject DX_BIND_QUERY without a DX context
      CVE-2026-74446: drm/amdkfd: hold event_mutex while checkpointing CRIU events
      CVE-2026-74447: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
      CVE-2026-74448: drm/amdkfd: fix QID bit leak in pqm_create_queue()
      CVE-2026-74451: drm/panthor: validate firmware interface structure sizes
      CVE-2026-74452: drm/panthor: reject firmware sections with oversized data
      CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job
      CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
      CVE-2026-74455: can: peak_usb: validate uCAN receive record lengths
      CVE-2026-74456: can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
      CVE-2026-74457: can: peak_usb: add bounds check for USB channel index
      CVE-2026-74458: can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
      CVE-2026-74459: can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
      CVE-2026-74460: can: ems_usb: validate CPC message lengths
      CVE-2026-74461: i2c: imx: Cancel hrtimer before clearing slave pointer
      CVE-2026-74463: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
      CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct
      CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure
      CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls
      CVE-2026-74468: gpio: pch: use raw_spinlock_t for the register lock
      CVE-2026-74469: sctp: prevent peer transport count overflow
      CVE-2026-74470: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
      CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events()
      CVE-2026-74472: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
      CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit()
      CVE-2026-74475: vxlan: use neigh_ha_snapshot() in route_shortcircuit()
      CVE-2026-74476: veth: convert frag_list skbs before running XDP
      CVE-2026-74478: um: vector: fix use-after-free in vector_mmsg_rx()
      CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group
      CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend
      CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
      CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance
      CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter
      CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
      CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps
      CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds
      CVE-2026-74493: net/smc: fix socket use-after-free during link group termination
      CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup
      CVE-2026-74497: ALSA: usb-audio: Clamp frame size in implicit-feedback mode
      CVE-2026-74498: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
      CVE-2026-74499: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
      CVE-2026-74500: ALSA: usb-audio: fix stack info leak in RME Digiface status
      CVE-2026-74501: ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
      CVE-2026-74502: ALSA: ump: fix double free of out_cvts on rawmidi error
      CVE-2026-74503: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
      CVE-2026-74504: ALSA: seq: Fix division by zero in initialize_timer()
      CVE-2026-74505: ALSA: 6fire: Fix UAF at error handling during probe
      CVE-2026-74507: Bluetooth: HIDP: validate numbered report payloads
      CVE-2026-74508: Bluetooth: HIDP: reject frames without a transaction header
      CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs
      CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation
      CVE-2026-74511: [REJECTED]: Bluetooth: mgmt: fix pending command UAF in EIR updates
      CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule()
      CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
      CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
      CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries()
      CVE-2026-74519: pinctrl: devicetree: don't free uninitialized dev_name on error path
      CVE-2026-74522: ksmbd: fix use-after-free in __close_file_table_ids()
      CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path
      CVE-2026-74524: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
      CVE-2026-74525: net: sxgbe: free TX rings on RX allocation failure
      CVE-2026-74531: Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
      CVE-2026-74532: Bluetooth: btintel: Validate length before parsing diagnostics TLV
      CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
      CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release
      CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
      CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon
      CVE-2026-74543: net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
      CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure
      CVE-2026-74546: hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
      CVE-2026-74547: hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
      CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove
      CVE-2026-74549: hwmon: (nct6775-core) Prevent access to unsupported weight registers
      CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails
      CVE-2026-74551: hwmon: (nzxt-smart2) DMA-align output buffer
      CVE-2026-74552: hwmon: (lm90) Only report alarms if driver is ready
      CVE-2026-74553: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
      CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
      CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
      CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
      CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
      CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
      CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table
      CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects()
      CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk()
      CVE-2026-74569: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
      CVE-2026-74572: btrfs: zoned: fix deadlock between metadata writeback and transaction commit
      CVE-2026-74574: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
      CVE-2026-74575: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
      CVE-2026-74576: mm/slab: prevent unbounded recursion in free path with new kmalloc type
      CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute()
      CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload
      CVE-2026-64017: blk-mq: pop cached request if it is usable
      CVE-2026-64575: bpf: tcp: fix double sock release on batch realloc
      CVE-2026-74514: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
    added commits:
      CIP: Bump version suffix to -cip30 after merge from stable

Best regards,
  Nobuhiro