Dear Maintainer, The riscv64 kernel is built with CONFIG_NR_CPUS=64. On hardware with more than 64 harts, the excess CPUs are silently lost at boot. Hardware: Board: SpacemiT V100 (C2201MB1) Vendor: SpacemiT (mvendorid=0x710) marchid: 0x8000000058000002 mimpid: 0x4c4d900 Arch: riscv64, MMU sv48 ISA: rv64imafdcvh_zicbom_zicboz_zicntr_zicond_zicsr_zifencei _zihintntl_zihintpause_zihpm_zimop_zawrs_zfa_zfh_zfhmin _zca_zcb_zcd_zcmop_zba_zbb_zbc_zbs_zkt_zvbb_zvbc_zve32f _zve32x_zve64d_zve64f_zve64x_zvfh_zvfhmin_zvkb_zvkg _zvkned_zvknhb_zvksed_zvksh_zvkt_smaia_smstateen_ssaia _sscofpmf_sstc_svinval_svnapot_svpbmt Physical harts: 80 (hart IDs 0-39, 64-87) Observed behaviour: $ nproc --all 64 $ cat /sys/devices/system/cpu/possible 0-63 16 harts are silently dropped at boot. The kernel only sees 64 CPUs. Boot messages: [ 0.000000] NR_CPUS is too small for the number of ACPI tables. This message is repeated 16 times. Kernel config: CONFIG_SMP=y CONFIG_NR_CPUS=64 Expected behaviour: All 80 harts should be usable. CONFIG_NR_CPUS should be raised to at least 256 for riscv64, matching the arm64 default. Suggested fix: In debian/config/riscv64/config, change: CONFIG_NR_CPUS=64 to: CONFIG_NR_CPUS=256 Workaround: None without recompiling the kernel. Thanks, Lufei This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not an intended recipient of this message, please delete it and any attachment from your system and notify the sender immediately by reply e-mail. Unintended recipients should not use, copy, disclose or take any action based on this message or any information contained in this message. Emails cannot be guaranteed to be secure or error free as they can be intercepted, amended, lost or destroyed, and you should take full responsibility for security checking. 本邮件及其任何附件具有保密性质，并可能受其他保护或不允许被披露给第三方。如阁下误收到本邮件，敬请立即以回复电子邮件的方式通知发件人，并将本邮件及其任何附件从阁下系统中予以删除。如阁下并非本邮件写明之收件人，敬请切勿使用、复制、披露本邮件或其任何内容，亦请切勿依本邮件或其任何内容而采取任何行动。电子邮件无法保证是一种安全和不会出现任何差错的通信方式，可能会被拦截、修改、丢失或损坏，收件人需自行负责做好安全检查。
Hi, No, this can't be changed as you say, because the value is not defined here, instead the upstream default is used. Sure we can override it in that file, but it would be way better if we can keep using the upstream default. A MR has been submitted to change the value in the Debian kernel [1] (to 128 instead of 256), but before doing that the default value change should be submitted upstream. Regards Aurelien [1] https://salsa.debian.org/kernel-team/linux/-/merge_requests/1995
We believe that the bug you reported is fixed in the latest version of linux, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1140651@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Salvatore Bonaccorso <carnil@debian.org> (supplier of updated linux package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Sat, 27 Jun 2026 16:14:29 +0200 Source: linux Architecture: source Version: 7.1.2-1~exp1 Distribution: experimental Urgency: medium Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1140651 Changes: linux (7.1.2-1~exp1) experimental; urgency=medium . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.2 - io_uring/net: Avoid msghdr on op_connect/op_bind async data - fuse: re-lock request before replacing page cache folio - Revert "NFSD: Defer sub-object cleanup in export put callbacks" - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe() - iio: light: veml6075: add bounds check to veml6075_it_ms index - iio: adc: ti-ads1298: add bounds check to pga_settings index - [amd64] crypto: qat - remove unused character device and IOCTLs - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - drivers/base/memory: set mem->altmap after successful device registration - ksmbd: reject non-VALID session in compound request branch - virtiofs: fix UAF on submount umount . [ Han Gao ] * [riscv64] set NR_CPUS to 128 (Closes: #1140651) Checksums-Sha1: 9c7a701def608555b861128813a2c5fc6461b59d 183274 linux_7.1.2-1~exp1.dsc 4228889db8648db61307a0073b537c78ce1b995c 161563732 linux_7.1.2.orig.tar.xz 846314cb52e02e97437fba4afb75831f103e8fcc 1466728 linux_7.1.2-1~exp1.debian.tar.xz 757c6773ddd826f546a232c1cbaf6d7921151b95 6945 linux_7.1.2-1~exp1_source.buildinfo Checksums-Sha256: 180d4d354330e5cc3aa16f5bba014820ba2d2bd108b12adf11e81172f002d7c0 183274 linux_7.1.2-1~exp1.dsc 3c77fa02c2242381ea5534ec981329453b2ef69771d1a3e56fb2e152caa81af8 161563732 linux_7.1.2.orig.tar.xz ad7c38b1b5574fe0eb56b6a5d60a5cd5315f6b03d79d32d6daede159d09bb17e 1466728 linux_7.1.2-1~exp1.debian.tar.xz c813a7e1827670d4af6c11514556304d24d7821bc4037840041e59c32970ea21 6945 linux_7.1.2-1~exp1_source.buildinfo Files: 76968af30ccae95f5ed524999c99d49a 183274 kernel optional linux_7.1.2-1~exp1.dsc 987db7cc2e001664a54fdf273dbfe1ea 161563732 kernel optional linux_7.1.2.orig.tar.xz c9747a5d18c92d5a656d53f215d61547 1466728 kernel optional linux_7.1.2-1~exp1.debian.tar.xz 0138b4296f10750b0cdcf4562ef6bb91 6945 kernel optional linux_7.1.2-1~exp1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmo/22FfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89Egy0QAKA316sMj9pGSN0u2Y+Usyob29sXqI0c 3ypkJ+XohpbQSPs4WKHe3ut/CptnHh+ncfYrYVF+7dBjhP1hiCQx43gwd8OncpXn DEg5XKFtVVQ9nbC7tDxRrieL5GAxdItNK9+ykDYcMUEa2dYgHEUtixJUV14tskTz jjX+lpyhhSbzisWdTcGs1cvI4esyyrk4t6KcYEn/4aVyrMej5DiOjf1VLeplHZC8 E3iEW/16gcEPW7whc7DzP6m6cSGOhpWx/4ozR0vjNd4XymChMliy2y6qSqmOMjTW sKum9NOM0ePMWnVSBlmLT/0AutBrEGIWLOCmxkg9OBwU3z07x87sHwGCPwnsVM3v 2Qv1KhdAXgXmeWEgfGDwylitwYinsPwm3SNfuIzltwPPlS+PYuvtV87iMpQv02p+ HGk+PAS5dlugSEbOjDR/xybotF0U6JldVfZR5LUP1sW+4W3jr7BhhoOL8JMdlkeK iMLP91YwmTDtPLQkyOuQk7zx2n2NOEPHyjQcN7+aKjhSvPvP9GWeAP6xrzOlB1zq FbEz60uuHw2NjsKPcjXEUfGFqzJkMkeg86cm1fhUDHAy0Z4cDZPTThyafARdF/F+ bPBHmWra8ZsrR0ccCAUhTt3GwyAyEJQe3m3mq+A9qQfkfIAyI92Yd/bm5ENSXs2K Nytw56s6Me4O =NcSd -----END PGP SIGNATURE-----
We believe that the bug you reported is fixed in the latest version of linux, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1140651@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Salvatore Bonaccorso <carnil@debian.org> (supplier of updated linux package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Thu, 02 Jul 2026 20:37:49 +0200 Source: linux Architecture: source Version: 7.0.14-1 Distribution: unstable Urgency: medium Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1128861 1140651 Changes: linux (7.0.14-1) unstable; urgency=medium . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.14 - io_uring/net: Avoid msghdr on op_connect/op_bind async data - [arm64] entry: Fix arm64-specific rseq brokenness - lockd: fix TEST handling when not all permissions are available. (Closes: #1128861) - fuse: re-lock request before replacing page cache folio - Revert "NFSD: Defer sub-object cleanup in export put callbacks" - RDMA/bnxt_re: zero shared page before exposing to userspace - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths (CVE-2026-52938) - i2c: stub: Reject I2C block transfers with invalid length - [arm64] net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe() - rose: fix dev_put() leak in rose_loopback_timer() - rose: hold loopback neighbour reference across timer callback - rose: fix race between loopback timer and module removal - rose: clear neighbour pointer after rose_neigh_put() in state machines - rose: guard rose_neigh_put() against NULL in timer expiry - rose: fix netdev double-hold in rose_rx_call_request() - rose: fix notifier unregistered too early in rose_exit() - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup - rose: disconnect orphaned STATE_2 sockets when device is gone - rose: fix netdev double-hold in rose_make_new() - rose: release netdev ref and destroy orphaned incoming sockets - rose: drop CALL_REQUEST in loopback timer when device is not running - rose: cancel neighbour timers in rose_neigh_put() before freeing - rose: clear neighbour pointer in rose_kill_by_device() - rose: don't free fd-owned sockets when reaping in the heartbeat - net: export netif_open for self_test usage - net: net_failover: Fix the deadlock in slave register - iio: light: veml6075: add bounds check to veml6075_it_ms index - iio: adc: ti-ads1298: add bounds check to pga_settings index - crypto: qat - remove unused character device and IOCTLs - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - drivers/base/memory: set mem->altmap after successful device registration - ksmbd: reject non-VALID session in compound request branch - virtiofs: fix UAF on submount umount . [ Han Gao ] * [riscv64] set NR_CPUS to 128 (Closes: #1140651) Checksums-Sha1: 4e3363fd4ceab7effaccf3b57ab4b23ad58e671c 196174 linux_7.0.14-1.dsc 5d4e1d19d8ce04ee2d6be9b1377865b66cc21fd9 160429680 linux_7.0.14.orig.tar.xz 3f2289146957c3c71dd0e13475dbba9cc8c953fc 1507740 linux_7.0.14-1.debian.tar.xz 4f6e25eca09c730374f3232c9ec1a15afaf31c60 6930 linux_7.0.14-1_source.buildinfo Checksums-Sha256: bcf30ddea7172ea24ef1e8afab018e4d2991744b30ca817cf908d2ffdbcc3535 196174 linux_7.0.14-1.dsc 366e8be6649c243760428184eeb9dae846c92c69cd63a630480ed71e24d0973f 160429680 linux_7.0.14.orig.tar.xz f22bf7282f5a209197bbe03cbfcef9911691ec0e27964ef95d2325092e7a6090 1507740 linux_7.0.14-1.debian.tar.xz d41de6476e5b2ed0f8320b4f282d09d5d9630e4db95dcf83dc03bc78944d6156 6930 linux_7.0.14-1_source.buildinfo Files: 1ca24447595be8c9544275868cd5ac29 196174 kernel optional linux_7.0.14-1.dsc d800c0db19f110d426dada251f6508f3 160429680 kernel optional linux_7.0.14.orig.tar.xz 46a6870e57b029e6100c19e627970903 1507740 kernel optional linux_7.0.14-1.debian.tar.xz 7ad02f662822e7dbf703600a4fe2fd8e 6930 kernel optional linux_7.0.14-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmpGsIxfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89EEmEP+gJDIAla7FkvmM7e2Dpddnx+mkF6fhoK +P4rvjPRFDYgsjrgM8M86rlTSNdBXvW0ZPUuAcbV4648Nn2KWFXNE5JGwdQKpgLI L2rnRKx/QrrMaHMboZnQgQmmnxcGPGVvm3JGeiMADuc04YhI1NGJxxPvULTVHlGR IXF2ynHKeKk/LJ1TUd0cE7mF3coKo2yvubx4ifaQ3s63DfTvTABGRUBoSn2x50T7 eB6QBK9gWsctkC/JHxFhvE17FGutcxOM8d5FKxAaUZijiLyjbpipTXCX2W2gsG97 aXgFEpaV4NzZoKn9OvNlLK/Lpjlc4Pqx/PoiN1fMD1i8fyo0gwjyKGPdh5iE1aGE mrbPkIMPRl+rrRz/S4MF2YN5CjCutKcoD0q9RZcce1PhXfy42X6Gny2pkwFXjj5T e2jY0tbwxd/K+a54XaFM5RTdPkEeFU9xFoajUubNovwORv2aVsvBnvncP+Ct0KDj 2UsK/rRW7tcqj+8i4luf/RA2w6GpV+DuPTZIvhIdCkCwOpbmWvvlCAKYtsCMssUf UKeALOiEhnSf2R8z9EiknoZIX5rlHeu7wFh3QW+Hw6f6iBfcO+Mg1qXP42HDoA4C N4skQ4t6261hRMklVb6UUsnXLGoEdTOyUSWisrPy4XjmVtUkux7JDYIlNBec56+q KI8TW9MxCdO7 =kyq3 -----END PGP SIGNATURE-----
We believe that the bug you reported is fixed in the latest version of linux, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1140651@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Salvatore Bonaccorso <carnil@debian.org> (supplier of updated linux package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Mon, 20 Jul 2026 09:13:07 +0200 Source: linux Architecture: source Version: 6.12.96-1 Distribution: trixie-security Urgency: high Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1140651 Changes: linux (6.12.96-1) trixie-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.96 - [arm64] bpf, arm64: Reject out-of-range B.cond targets - nfsd: fix file change detection in CB_GETATTR - nfsd: release layout stid on setlease failure - userfaultfd: gate must_wait writability check on pte_present() - perf: Fix dangling cgroup pointer in cpuctx backport - bcachefs: avoid truncating fiemap extent length - drm/amd: Fix set but not used warnings - gpio: rockchip: change the GPIO version judgment logic - gpio: rockchip: teardown bugs and resource leaks - gpio: rockchip: fix generic IRQ chip leak on remove (CVE-2026-53226) - mm/vmalloc: take vmap_purge_lock in shrinker (CVE-2026-46093) - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - f2fs: validate orphan inode entry count - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix listxattr handling of corrupted xattr entries - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - nfsd: add nfsd_file_{get,put} to 'nfs_to' nfsd_localio_operations - nfs_common: rename functions that invalidate LOCALIO nfs_clients - NFSv4/flexfiles: Remove cred local variable dependency - NFSv4/flexfiles: Add data structure support for striped layouts - NFSv4/flexfiles: reject zero filehandle version count - locking/rtmutex: Make sure we wake anything on the wake_q when we release the lock->wait_lock - apparmor: advertise the tcp fast open fix is applied - nfsd: move name lookup out of nfsd4_list_rec_dir() - nfsd: change nfs4_client_to_reclaim() to allocate data - bonding: fix xfrm offload feature setup on active-backup mode - block: add a store_limit operations for sysfs entries - block: fix queue freeze vs limits lock order in sysfs store methods (CVE-2025-21807) - mm/khugepaged: write all dirty file folios when collapsing - perf trace beauty fcntl: Fix build with older kernel headers - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - ACPI: NFIT: core: Fix possible NULL pointer dereference - [amd64] platform/x86: intel-hid: Protect ACPI notify handler against recursion - perf/core: Detach event groups during remove_on_exec - [amd64] drm/i915: ensure segment offset never exceeds allowed max - usb: gadget: function: rndis: add length check to response query - usb: gadget: function: rndis: add length check for header - iio: accel: bmc150: clamp the device-reported FIFO frame count - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: backend: fix uninitialized data in debugfs - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: event: Fix event FIFO reset race - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: light: al3010: fix incorrect scale for the highest gain range - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: opt3001: fix missing state reset on timeout - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: veml6030: fix channel type when pushing events - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: resolver: ad2s1210: notify trigger and clear state on fault read error - iio: temperature: Build mlx90635 with CONFIG_MLX90635 - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - ALSA: virtio: Add missing 384 kHz PCM rate mapping - ALSA: virtio: Validate control metadata from the device - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: es1938: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: gus: check snd_ctl_new1() return value - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - vfio/pci: Use a private flag to prevent power state change with VFs - vfio/pci: Latch disable_idle_d3 per device - vfio/pci: Release the VGA arbiter client on register_device() failure - vfio/pci: Fix racy bitfields and tighten struct layout - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - vfio: Remove device debugfs before releasing devres - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix wakeup source leak on probe failure - [arm*] binder: fix UAF in binder_thread_release() - [arm*] binder: fix UAF in binder_free_transaction() - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - PCI: host-common: Request bus reassignment when not probe-only - [arm*] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - netfilter: ipset: fix race between dump and ip_set_list resize - virtio_pci: fix vq info pointer lookup via wrong index - virtio-mmio: fix device release warning on module unload - hwrng: virtio: clamp device-reported used.len at copy_data() - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - usb: dwc3: run gadget disconnect from sleepable suspend context - 6lowpan: fix NHC entry use-after-free on error path - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - staging: vme_user: bound slave read/write to the kern_buf size - smb: client: restrict implied bcc[0] exemption to responses without data area - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: fix location monitor leak in tsi148 bridge - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: media: atomisp: reduce load_primary_binaries() stack usage - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB write in HT_caps_handler() - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - net: af_key: initialize alg_key_len for IPComp states - audit: Fix data races of skb_queue_len() readers on audit_queue - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - coresight: etb10: restore atomic_t for shared reading state - debugobjects: Plug race against a concurrent OOM disable - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - netpoll: fix a use-after-free on shutdown path - ipv4: igmp: remove multicast group from hash table on device destruction - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - mfd: cros_ec: Delay dev_set_drvdata() until probe success - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - mm: shrinker: fix shrinker_info teardown race with expansion - mm: shrinker: fix NULL pointer dereference in debugfs - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump - netfilter: handle unreadable frags - netfilter: ebtables: module names must be null-terminated - netfilter: ebtables: terminate table name before find_table_lock() - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() - Bluetooth: L2CAP: validate option length before reading conf opt value - fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr - fs/ntfs3: fsync files by syncing parent inodes - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() (CVE-2026-53027) - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - smb/client: Fix error code in smb2_aead_req_alloc() - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: require source read access for duplicate extents - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: run set info with opener credentials - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - ksmbd: use opener credentials for delete-on-close - ksmbd: use opener credentials for ADS I/O - smb: client: fix query directory replay double-free - smb: client: fix query_info() replay double-free - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_close() replay - smb: client: Fix next buffer leak in receive_encrypted_standard() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: harden POSIX SID length parsing - smb: client: fix atime clamp check in read completion - smb: client: mask server-provided mode to 07777 in modefromsid - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - cpufreq: qcom-cpufreq-hw: Fix possible double free - firmware_loader: fix device reference leak in firmware_upload_register() - [amd64] cpufreq: intel_pstate: Sync policy->cur during CPU offline - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - X.509: Fix validation of ASN.1 certificate header - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - tools/mm/slabinfo: Fix trace disable logic inversion - tools/mm/slabinfo: fix total_objects attribute name - HID: hid-goodix-spi: validate report size to prevent stack buffer overflow - HID: wacom: stop hardware after post-start probe failures - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - media: mtk-jpeg: cancel workqueue on release for supported platforms only - serial: 8250_mid: Disable DMA for selected platforms - xfs: use null daddr for unset first bad log block - xfs: release dquot buffer after dqflush failure - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: fix pointer arithmetic error on 32-bit systems - xfs: fix exchmaps reservation limit check - bpf: Reject fragmented frames in devmap - bpf: Restore sysctl new-value from 1 to 0 - bpf: Validate BTF repeated field counts before expansion - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - usb: free iso schedules on failed submit - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: f_printer: take kref only for successful open - USB: idmouse: fix use-after-free on disconnect race - USB: ldusb: fix use-after-free on disconnect race - USB: iowarrior: fix use-after-free on disconnect - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: legousbtower: fix use-after-free on disconnect race - usb: sl811-hcd: disable controller wakeup on remove - USB: storage: include US_FL_NO_SAME in quirks mask - USB: misc: uss720: unregister parport on probe failure - usb: mtu3: unmap request DMA on queue failure - USB: serial: keyspan_pda: fix information leak - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix write buffer corruption - USB: ulpi: fix memory leak on registration failure - USB: usb-storage: ene_ub6250: restore media-ready check - usbip: tools: support SuperSpeedPlus devices - usbip: vudc: fix NULL deref in vep_dequeue() - usb: typec: anx7411: use devm_pm_runtime_enable() - usb: typec: class: drop PD lookup reference - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: cancel pending work on system suspend - usb: gadget: f_fs: Fix DMA fence leak - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - [amd64] x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining - udf: validate free block extents against the partition length - udf: validate VAT header length against the VAT inode size - udf: validate sparing table length as an entry count, not a byte count - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - nvme: target: rdma: fix ndev refcount leak on queue connect - dm-ioctl: report an error if a device has no table - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - nvmet-auth: validate reply message payload bounds against transfer length - btrfs: do not trim a device which is not writeable - partitions: aix: bound the pp_count scan to the ppe array - isofs: bound Rock Ridge symlink components to the SL record - crypto: af_alg - Remove zero-copy support from skcipher and aead - [arm64] crypto: caam - use print_hex_dump_devel to guard key hex dumps - [arm64] crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - [amd64] crypto: ccp - Do not initialize SNP for SEV ioctls - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) - [amd64] crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: drbg - Fix the fips_enabled priority boost - [amd64] crypto: qat - keep VFs enabled during reset - [amd64] crypto: qat - notify fatal error before AER reset preparation - [amd64] crypto: qat - protect service table iterations with service_lock - [amd64] crypto: qat - validate RSA CRT component lengths - [arm64] fpsimd: Fix type mismatch in sme_{save,load}_state() - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - EDAC/i10nm: Don't fail probing if ADXL is missing - watchdog: apple: Add "apple,t8103-wdt" compatible - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - i2c: core: fix hang on adapter registration failure - tracing: Prevent out-of-bounds read in glob matching - audit: fix potential integer overflow in audit_log_n_hex() - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - module: decompress: check return value of module_extend_max_pages() - exfat: bound uniname advance in exfat_find_dir_entry() - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - riscv: mm: Unconditionally sfence.vma for spurious fault - mm: fix mmap errno value when MAP_DROPPABLE is not supported - mm: do file ownership checks with the proper mount idmap - [amd64] iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - iommufd: Set upper bounds on cache invalidation entry_num and entry_len - [amd64] KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - [amd64] KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits - [amd64] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - udmabuf: fix DMA direction mismatch in release_udmabuf() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - i2c: core: fix irq domain leak on adapter registration failure - i2c: core: fix NULL-deref on adapter registration failure - i2c: core: fix adapter probe deferral loop - i2c: core: fix adapter debugfs creation - i2c: core: fix adapter deregistration race - i2c: mpc: Fix timeout calculations - i2c: stm32f7: truncate clock period instead of rounding it - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: goodix - clamp the device-reported contact count - Input: iforce - bound the device-reported force-feedback effect index - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - reject an oversized device packet size - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - fix multi-touch slot corruption - Input: maple_keyb - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maplecontrol - set driver data before registering input device - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - RDMA/siw: bound Read Response placement to the RREAD length - fuse: fix device node leak in cuse_process_init_reply() - fuse: re-lock request before returning from fuse_ref_folio() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks - smb: client: reject overlapping data areas in SMB2 responses - xfs: fix null pointer dereference in tracepoint - xfs: fail recovery on a committed log item with no regions - xfs: resample the data fork mapping after cycling ILOCK - xfs: don't wrap around quota ids in dqiterate - xfs: set xfarray killable sort correctly - xfs: clamp timestamp nanoseconds correctly - xfs: fully check the parent handle when it points to the rootdir - xfs: don't zap bmbt forks if they are MAXLEVELS tall . [ Han Gao ] * [riscv64] set NR_CPUS to 128 (Closes: #1140651) . [ Salvatore Bonaccorso ] * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse." (context changes) Checksums-Sha1: 21b661746036e4cba3c16a788288983c9120733b 288306 linux_6.12.96-1.dsc 78e6ea9b3f9652a1e2fee2824d0335d4cf37d841 151315096 linux_6.12.96.orig.tar.xz c5b3683fcb5d262dc1c46dd52d8b90f05a15d696 1845940 linux_6.12.96-1.debian.tar.xz 4e749797757361bb58d1c932965a50959b91c53a 6883 linux_6.12.96-1_source.buildinfo Checksums-Sha256: 4fca3ebc4d2c1c2c7b88e05dc67fef7a7f539f03b19b4308f61d7ee3e2f1b738 288306 linux_6.12.96-1.dsc 59f9548e0384dbafd08eaf05872576de8de50206f972b091c567a9fc91867ca7 151315096 linux_6.12.96.orig.tar.xz 6052af0c3d43d5676853e25d1a52521d09440fa000dd73c30350783d47271918 1845940 linux_6.12.96-1.debian.tar.xz e933adf1588e7c1230b55602f1351d396f638adf55f53e933a14fcf23d5bfeb3 6883 linux_6.12.96-1_source.buildinfo Files: 5ddd7f2e226b76d61b2d2c472ebf573e 288306 kernel optional linux_6.12.96-1.dsc 295e51ef19b14cb2101caf7c77b44bc6 151315096 kernel optional linux_6.12.96.orig.tar.xz 3f9d5d60e812635c31775930800269f9 1845940 kernel optional linux_6.12.96-1.debian.tar.xz 675d3c6a7738c657452553ae335789a4 6883 kernel optional linux_6.12.96-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmpdzthfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89E7RYQAI93uK9bmXsh/MtqLQ7t1Zx009T+iA/j uAEdt4Ab8Y9FAhqS9vStYeDl39Hgx5JnYpEz98U7tTl1ttJ7QFPZ7KDTvtD5+k/P 4pwASsnmKL3cFSEsRXc1ihTcsqbDOwfZr4ESkD7ojH+YYOKcnENsE+GPHaWNEtMB tble4lNlWVMNfZBurO42IK1nirzb3aTR7yYIzB1QGGLtXvuLDrMiQgndhCqrHPx6 cStigaufry4xvdoCUmcd+Y59dh6rbGevBTROPrpaxe74xkKVyG0gXBRPqu248QZk Wa4ds450lYEXtTQGtqpnYItmsEah3iRNZy+Nd2VlJVbtxxz/SLouk0viyxDV3cHl CDYDJHuQysTl5L11tb2ztvaKF5hwxRd+PD6lrTp1Ys4kvqb7Zoqj2DjRI6ER9z8L 3I6e9CJ0QhA1OTYYqna9fdtVbypvnpW1yAZ/OsnvfM4WqrueezkjCpammefHqxt+ C4bhjGbIXkmp7l+Pcz449Mwho/MQ6QwZAJ2h3dg6YPWgwV5/IYY4VS0qWStFBNK4 yIx4fhwOgA4Ycg9k14oQuI9iA/pj//IN/li02Jw1pFUlcsXpfhH7MT8nX5Nfhz// vEkW8l4427bc9g567krlbve/mAijmsG+oxBja8meVvvGB6uhKx7szuGkmdLIMOt0 DPS5c3qePZLD =J7FM -----END PGP SIGNATURE-----