-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Aug 2026 06:19:09 +0200 Source: linux Binary: linux-doc linux-doc-6.12 linux-headers-6.12.107+deb13-common linux-headers-6.12.107+deb13-common-rt linux-libc-dev linux-source linux-source-6.12 linux-support-6.12.107+deb13 Architecture: all Version: 6.12.107-1 Distribution: trixie-security Urgency: high Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Salvatore Bonaccorso Description: linux-doc - Linux kernel specific documentation (meta-package) linux-doc-6.12 - Linux kernel specific documentation for version 6.12 linux-headers-6.12.107+deb13-common - Common header files for Linux 6.12.107+deb13 linux-headers-6.12.107+deb13-common-rt - Common header files for Linux 6.12.107+deb13-rt linux-libc-dev - Linux support headers for userspace development linux-source - Linux kernel source (meta-package) linux-source-6.12 - Linux kernel source for version 6.12 with Debian patches linux-support-6.12.107+deb13 - Support files for Linux 6.12 Changes: linux (6.12.107-1) trixie-security; urgency=high . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.106 - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept - ALSA: scarlett2: Use a private URB for the notification endpoint - rndis_host: add overflow check in rndis_rx_fixup() - gpio: ml-ioh: use raw_spinlock_t for the register lock (CVE-2026-80562) - gve: fix zero-length skb frag with header-split - hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (CVE-2026-64216) - inet: frags: add inet_frag_putn() helper - ipv4: frags: remove ipq_put() - inet: frags: change inet_frag_kill() to defer refcount updates - inet: frags: save a pair of atomic operations in reassembly - inet: frags: publish queues before arming timer (CVE-2026-74662) - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (CVE-2026-74653) - NTB: ntb_netdev: Preserve RX queue depth on allocation failure (CVE-2026-74626) - serial: amba-pl011: synchronize DMA teardown - serial: sc16is7xx: rename EFR mutex with generic name - serial: sc16is7xx: use guards for simple mutex locks - serial: sc16is7xx: enable THRI before filling TX FIFO - xfs: namespace the maximum length/refcount symbols - xfs: don't use a xfs_log_iovec for ri_buf in log recovery - xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) - xfs: hoist per-bucket unlinked list check to helper - xfs: don't livelock in scrub on a circular unlinked list - ALSA: dummy: Check card index validity at probe - ocfs2: fix missing metadata reservation for large xattrs - null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows - kcov: fix data corruption and race conditions on PREEMPT_RT - ext4: stop retrying saturated xattr cache entries - ext4: clear error before retrying inode xattr space fallback - ext4: propagate errors from fast commit range replay - xfs: validate attr entry pointer before field access - libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557) - nfc: digital: clamp SENSF_RES length to the destination buffer - nfc: fdp: bound the device-reported read length and fix an skb leak - nfc: microread: validate target discovery payload lengths - nfc: llcp: bound the connect_sn TLV walk to the skb - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers - nfc: llcp: reject PDUs shorter than the LLCP header - nfc: pn533: purge fragmented skbs during cleanup - nfc: st21nfca: validate ATR_REQ length against the received frame - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers - nfc: nci: free destination parameters when closing a connection - ndisc: ndisc_send_redirect() cleanup - Input: byd - synchronize timer deletion before freeing private data (CVE-2026-80572) - ipv4: reject undersized MTUs in ip_do_fragment() - ipv6: fix use-after-free in ip6_finish_output2() - nvmet-auth: zero the AUTH_RECEIVE response buffer - nvmet-fc: fix invalid free in LS IOD error path - nvmet-tcp: bound SGL data length before allocating command buffers - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations - mptcp: pm: fix data race in add_addr timer callback - [arm64] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (CVE-2026-80583) - drm/xe: Fix DPT allocation paths. - HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C - HID: magicmouse: re-enable multitouch after reset-resume - HID: magicmouse: do not keep a stale msc->input if no input is claimed - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - HID: core: fix OOB read of field->usage in hid_set_field() - net/ionic: avoid OOB TX partner lookup for hwstamp RXQ - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581) - ipv4: start using dst_dev_rcu() (CVE-2025-40074) - mptcp: pm: fix memory leak from alloc-during-teardown race - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard - Input: atkbd - skip deactivate for HONOR ZQC-P - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() - HID: nintendo: register input device after capabilities are set - HID: nintendo: stop device IO before hid_hw_stop on probe failure - HID: core: fix number/pointer type confusion on long items - HID: sensor: custom: Fix use-after-free in enable_sensor - HID: hyperv: validate initial device info bounds - Bluetooth: hci_event: fix LE list UAF on reset - Bluetooth: hci_event: validate LE Set CIG Parameters response - Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync - Bluetooth: hci_aml: validate firmware segment lengths - net: gro: properly validate BIG TCP aggregation criteria https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.107 - inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590) Checksums-Sha1: 5a4e57c6fcc1af5d27d0dcc5ad7ef6fa46a51a69 39537196 linux-doc-6.12_6.12.107-1_all.deb 71e116edbeefaa58662e282f915c429c0f92ebab 1100 linux-doc_6.12.107-1_all.deb 7b66c343cd3209f7675937003e1a68ddb99551c6 9570084 linux-headers-6.12.107+deb13-common-rt_6.12.107-1_all.deb 844469a74d010616aa2c718d2b85f7f5bb1c048e 11214736 linux-headers-6.12.107+deb13-common_6.12.107-1_all.deb b10cb849084121247812039a0d80ff406c0f2235 2919204 linux-libc-dev_6.12.107-1_all.deb b8287f23f15aa4bfbfba363705b6d16a08af3a86 152778344 linux-source-6.12_6.12.107-1_all.deb de1c31d9d7bc0413ce68435811a1588c4d984d72 1096 linux-source_6.12.107-1_all.deb 29fd900685908f616f799d74a49c04edb88ce0e4 1405792 linux-support-6.12.107+deb13_6.12.107-1_all.deb 7310e761bdb53c63348f1f8fdcbe43cd9b226d42 13967 linux_6.12.107-1_all-buildd.buildinfo Checksums-Sha256: bc1d4603031c1f668f2189a9abb561a135c87f52b1f1ff93c05b1fe875275816 39537196 linux-doc-6.12_6.12.107-1_all.deb e404deb6629c4fe4ac4717185333be1196f0419e336025aee45d6ed14d5a90f4 1100 linux-doc_6.12.107-1_all.deb 98ff376ab43b200ab426fa140036ce18cf5a38036c5196c147b03632bada8a78 9570084 linux-headers-6.12.107+deb13-common-rt_6.12.107-1_all.deb 12dc292d7c238928fbcb7eebbe79208758fe263a4e2ea0e9b6734e6df12020a5 11214736 linux-headers-6.12.107+deb13-common_6.12.107-1_all.deb dc68dd53c7356598d005866da0d19d7bd33af2a62971aced624cdf04492902b4 2919204 linux-libc-dev_6.12.107-1_all.deb 775b9ef84d7fa7927ccebfec33fbbe9aeb2482ebf9a92c771aafd33fb6e2ee27 152778344 linux-source-6.12_6.12.107-1_all.deb 04005afa494fe9a9151435f574af37c26b61f6ae0dafdfb8a975b492be361ac4 1096 linux-source_6.12.107-1_all.deb b8b528595d2faca2436ce6905a1ff0960596d356894d881e8284439c33a30cd4 1405792 linux-support-6.12.107+deb13_6.12.107-1_all.deb 679eb4762ac9dcdd34f3dcdd8f20952b4ae443fd8603920b2783ae386e07720d 13967 linux_6.12.107-1_all-buildd.buildinfo Files: 4bbe30f3a5918a636ff894850b355f47 39537196 doc optional linux-doc-6.12_6.12.107-1_all.deb d57bc7bfef8fd2d775c530705b990b44 1100 doc optional linux-doc_6.12.107-1_all.deb 2d8b69475348259512b838bf4b141064 9570084 kernel optional linux-headers-6.12.107+deb13-common-rt_6.12.107-1_all.deb 53d6a256d2a0cd251415305c887d3546 11214736 kernel optional linux-headers-6.12.107+deb13-common_6.12.107-1_all.deb 0083d1655c47f6781366f430d166336d 2919204 devel optional linux-libc-dev_6.12.107-1_all.deb d083b03d8ab500867d6d15d9c06f2b91 152778344 kernel optional linux-source-6.12_6.12.107-1_all.deb 1bff1b6f61bb39d2482d42af3b7b827e 1096 kernel optional linux-source_6.12.107-1_all.deb eba0ead6d493a821a8a2e4b53346adcf 1405792 devel optional linux-support-6.12.107+deb13_6.12.107-1_all.deb 7bdcbc625e8382e300dfd9f8a2a14036 13967 kernel optional linux_6.12.107-1_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmqSnVQACgkQmgPNRvTf /zc6EQ//XTA20BJsz1F2Hh9LK87MUF2CgVoGspnk3S9NBOFusmynrsz63VbCXaHa QLWNqGDdgvL5bffm0uXpGP5HDSxX7YwI1BBW9x099IhrenMiic/ikd43ar1HDoK3 /Eh2U+IapxOP1FJzU2SQNVLVgJJaA/61WIs/qWupaT7BR/NdIdMb1g5TjYaIdmHL 8vFwfmAatzAoXrWkRtJaTgpkc2OYed0KrYcOg0QUinW2Vpq6jU3GL3lWy4GbIlMB VK2oVuV6PAW9cNbc9fKyAKhwqV9tU9p1vKTqnfdrxl5095b/Q/Lo/Js7M4PkKupV BYAS9UaLRLG1B5QMP9uFVsiqTnHBWf+ikE0K1WCIii3hZhvbflQp2lUXntjbzhWp Rl+6Tr8CeScqKETz7zZvLPqKYJw+ZIkAZKqJmrnTroYZfFg9Il3fCrYIZFz7Vlkd Yd+TJaonCnNFgIOpRAfF1ToSsfVBoJuX0+kKSH56HaFbs6pss/7AbsEU/Z0io2V/ 9JISimrL1RKW1ExDPUQRjBtqP2azUKwn0Gv92rgXOcgv68c5zMwBEBVfZSY4kDCn x0JGvWhrnNWOTKMJnchTy2er6lDAYWbSjYMgKc2rr1Tftnqp/0a4FvS/Z9uRzOrf Tmie0cewHPOAxKgikYP7UFUDEKmBJxpGJRyvoMBQdwFQb5eidGY= =GQUY -----END PGP SIGNATURE-----