-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Aug 2026 06:19:09 +0200 Source: linux-signed-amd64 Architecture: source Version: 6.12.107+1 Distribution: trixie-security Urgency: high Maintainer: Debian Kernel Team Changed-By: Salvatore Bonaccorso Changes: linux-signed-amd64 (6.12.107+1) trixie-security; urgency=high . * Sign kernel from linux 6.12.107-1 . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.106 - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept - ALSA: scarlett2: Use a private URB for the notification endpoint - rndis_host: add overflow check in rndis_rx_fixup() - gpio: ml-ioh: use raw_spinlock_t for the register lock (CVE-2026-80562) - gve: fix zero-length skb frag with header-split - hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (CVE-2026-64216) - inet: frags: add inet_frag_putn() helper - ipv4: frags: remove ipq_put() - inet: frags: change inet_frag_kill() to defer refcount updates - inet: frags: save a pair of atomic operations in reassembly - inet: frags: publish queues before arming timer (CVE-2026-74662) - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (CVE-2026-74653) - NTB: ntb_netdev: Preserve RX queue depth on allocation failure (CVE-2026-74626) - serial: amba-pl011: synchronize DMA teardown - serial: sc16is7xx: rename EFR mutex with generic name - serial: sc16is7xx: use guards for simple mutex locks - serial: sc16is7xx: enable THRI before filling TX FIFO - xfs: namespace the maximum length/refcount symbols - xfs: don't use a xfs_log_iovec for ri_buf in log recovery - xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) - xfs: hoist per-bucket unlinked list check to helper - xfs: don't livelock in scrub on a circular unlinked list - ALSA: dummy: Check card index validity at probe - ocfs2: fix missing metadata reservation for large xattrs - null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows - kcov: fix data corruption and race conditions on PREEMPT_RT - ext4: stop retrying saturated xattr cache entries - ext4: clear error before retrying inode xattr space fallback - ext4: propagate errors from fast commit range replay - xfs: validate attr entry pointer before field access - libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557) - nfc: digital: clamp SENSF_RES length to the destination buffer - nfc: fdp: bound the device-reported read length and fix an skb leak - nfc: microread: validate target discovery payload lengths - nfc: llcp: bound the connect_sn TLV walk to the skb - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers - nfc: llcp: reject PDUs shorter than the LLCP header - nfc: pn533: purge fragmented skbs during cleanup - nfc: st21nfca: validate ATR_REQ length against the received frame - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers - nfc: nci: free destination parameters when closing a connection - ndisc: ndisc_send_redirect() cleanup - Input: byd - synchronize timer deletion before freeing private data (CVE-2026-80572) - ipv4: reject undersized MTUs in ip_do_fragment() - ipv6: fix use-after-free in ip6_finish_output2() - nvmet-auth: zero the AUTH_RECEIVE response buffer - nvmet-fc: fix invalid free in LS IOD error path - nvmet-tcp: bound SGL data length before allocating command buffers - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations - mptcp: pm: fix data race in add_addr timer callback - [arm64] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (CVE-2026-80583) - drm/xe: Fix DPT allocation paths. - HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C - HID: magicmouse: re-enable multitouch after reset-resume - HID: magicmouse: do not keep a stale msc->input if no input is claimed - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - HID: core: fix OOB read of field->usage in hid_set_field() - net/ionic: avoid OOB TX partner lookup for hwstamp RXQ - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581) - ipv4: start using dst_dev_rcu() (CVE-2025-40074) - mptcp: pm: fix memory leak from alloc-during-teardown race - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard - Input: atkbd - skip deactivate for HONOR ZQC-P - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() - HID: nintendo: register input device after capabilities are set - HID: nintendo: stop device IO before hid_hw_stop on probe failure - HID: core: fix number/pointer type confusion on long items - HID: sensor: custom: Fix use-after-free in enable_sensor - HID: hyperv: validate initial device info bounds - Bluetooth: hci_event: fix LE list UAF on reset - Bluetooth: hci_event: validate LE Set CIG Parameters response - Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync - Bluetooth: hci_aml: validate firmware segment lengths - net: gro: properly validate BIG TCP aggregation criteria https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.107 - inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590) Checksums-Sha1: 7fe6600c98887f8906a3558e1c0c4772f310b9f8 10935 linux-signed-amd64_6.12.107+1.dsc 64dc538eaca38779613d9f8fa782c953f588ec1a 1006476 linux-signed-amd64_6.12.107+1.tar.xz Checksums-Sha256: 06f60d42d09d862e8747aba241ab3985907b2ec674ad60cb1c96d84e0bea847f 10935 linux-signed-amd64_6.12.107+1.dsc 01bcd3f1053d8042c0c786a8e879c50dfa4a0aafaf0c5db17e000e819f5e68c7 1006476 linux-signed-amd64_6.12.107+1.tar.xz Files: c50203a66c94552a487671426af03df6 10935 kernel optional linux-signed-amd64_6.12.107+1.dsc 43af2341d72ead50f0c30634770e369d 1006476 kernel optional linux-signed-amd64_6.12.107+1.tar.xz -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQSInBJdRTWyTRy0ztFCTVFtUgONCgUCapLI6AAKCRBCTVFtUgON CsNkAP9/ScZ2+8tKsaKSmbC6UwQL+h3q3aEPWO6DZYii7TuT2AD/SSpo8xh9PRx3 q//4VIBRCRTxxf5/9zKz9DmSn1oslAw= =TKQs -----END PGP SIGNATURE-----