[GIT PULL] Networking for v7.2-rc4
From: Paolo Abeni
Date: Fri Jul 17 2026 - 09:26:37 EST
Hi Linus!
This is one day later than usual, due to concurrent conferences. For
the same reason it's also dominated by subsystem PRs. Still for the
same reason, the next week's PR is expected to be larger than usual.
The following changes since commit 2c7c88a412aa6d09cd04b414211b4ef8553b5309:
Merge tag 'net-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-09 08:26:51 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git net-7.2-rc4
for you to fetch changes up to 56d96fededd61192cd7cc8d2b0f36adfd59036c3:
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (2026-07-17 13:20:38 +0200)
----------------------------------------------------------------
Including fixes from Wireless, IPsec, Netfilter and Bluetooth.
Current release - new code bugs:
- netfilter: flowtable: use correct direction to set up tunnel route
Previous releases - regressions:
- wifi:
- mac80211:
- free AP_VLAN bc_buf SKBs outside IRQ lock
- defer link RX stats percpu free to RCU
- fix double free on alloc failure
- cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
- ipv4: free fib_alias with kfree_rcu() on insert error path
- sched: act_tunnel_key: Defer dst_release to RCU callback
- xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
- bluetooth: fix locking in unpair_device/disconnect_sync
- can: add locking for raw flags bitfield
- openvswitch: reject oversized nested action attrs
- eth: bnxt_en: handle partially initialized auxiliary devices
- eth: ppp: defer channel free to an RCU grace period to fix UAF
Previous releases - always broken:
- netfilter: xt_nat: reject unsupported target families
- wifi:
- brcmfmac: fix heap overflow on a short auth frame
- cfg80211: add missing FTM API validation
- xfrm:
- reject optional IPTFS templates in outbound policies
- policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
- bluetooth: revalidate LOAD_CONN_PARAM queued update
- can: fix lockless bound/ifindex race and silent RX_SETUP failure
- eth: mlx5: free mlx5_st_idx_data on final dealloc
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
----------------------------------------------------------------
Abdun Nihaal (1):
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
Alexander Hölzl (1):
can: vxcan: Kconfig: fix description stating no local echo provided
Andre Carvalho (1):
selftests: netconsole: only restore MAC when it changed on resume
Antony Antony (1):
xfrm: reject optional IPTFS templates in outbound policies
Arnd Bergmann (1):
wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack
Asim Viladi Oglu Manizada (1):
net: openvswitch: reject oversized nested action attrs
Bryam Vargas (2):
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
Cen Zhang (6):
xfrm: cache the offload ifindex for netlink dumps
xfrm: clear mode callbacks after failed mode setup
wifi: cfg80211: cancel sched scan results work on unregister
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
wifi: cfg80211: use wiphy work for socket owner autodisconnect
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
Chen YanJun (1):
xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
Christophe JAILLET (1):
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
Corentin Labbe (1):
wifi: ralink: RT2X00: init EEPROM properly
Dawei Feng (2):
wifi: libertas: fix memory leak in helper_firmware_cb()
wifi: mac80211: fix memory leak in ieee80211_register_hw()
Eric Dumazet (1):
tcp: fix TIME_WAIT socket reference leak on PSP policy failure
Fan Wu (1):
can: esd_usb: kill anchored URBs before freeing netdevs
Florian Westphal (2):
ipvs: reload ip header after head reallocation
netfilter: xt_physdev: masks are not c-strings
HE WEI (ギカク) (1):
wifi: cfg80211: bound element ID read when checking non-inheritance
Haofeng Li (1):
wifi: cfg80211: validate EHT MLE before MLD ID read
Ivan Vecera (1):
dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
Jamal Hadi Salim (1):
net/sched: act_tunnel_key: Defer dst_release to RCU callback
James Raphael Tiovalen (1):
macsec: fix promiscuity refcount leak in macsec_dev_open()
Julian Anastasov (1):
ipvs: fix more places with wrong ipv6 transport offsets
Laxman Acharya Padhya (1):
Bluetooth: btrtl: validate firmware patch bounds
Lee Jones (1):
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
Maoyi Xie (3):
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
wifi: mac80211: defer link RX stats percpu free to RCU
wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
Marc Kleine-Budde (2):
Merge patch series "can: bcm: collected fixes"
Merge patch series "net: can: isotp-fixes"
Mikhail Gavrilov (1):
Bluetooth: mgmt: Translate HCI reason in Device Disconnected event
Norbert Szetei (1):
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
Oliver Hartkopp (14):
can: raw: add locking for raw flags bitfield
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
can: bcm: add locking when updating filter and timer values
can: bcm: fix CAN frame rx/tx statistics
can: bcm: add missing rcu list annotations and operations
can: bcm: extend bcm_tx_lock usage for data and timer updates
can: bcm: validate frame length in bcm_rx_setup() for RTR replies
can: bcm: add missing device refcount for CAN filter removal
can: bcm: fix stale rx/tx ops after device removal
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
can: bcm: track a single source interface for ANYDEV timeout/throttle ops
can: isotp: use unconditional synchronize_rcu() in isotp_release()
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
can: isotp: serialize TX state transitions under so->rx_lock
Pablo Neira Ayuso (1):
netfilter: flowtable: use correct direction to set up tunnel route
Pagadala Yesu Anjaneyulu (1):
wifi: mac80211: ibss: wait for in-flight TX on disconnect
Paolo Abeni (5):
Merge tag 'wireless-2026-07-09' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Merge tag 'ipsec-2026-07-10' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Merge tag 'nf-26-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Merge tag 'for-net-2026-07-13' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Merge tag 'linux-can-fixes-for-7.2-20260716' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Pauli Virtanen (4):
Bluetooth: hci_sync: extend conn_hash lookup critical sections
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
Peddolla Harshavardhan Reddy (1):
wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
Pengpeng Hou (5):
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
wifi: libertas: reject short monitor TX frames
wifi: rsi: bound background scan probe request copy
wifi: libipw: fix key index receive bound checks
wifi: rsi: validate beacon length before fixed buffer copy
Petr Wozniak (2):
xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
xfrm: fix stale skb->prev after async crypto steals a GSO segment
Qianyu Luo (1):
xfrm: nat_keepalive: avoid double free on send error
Rafael Beims (2):
wifi: mwifiex: fix roaming to different channel in host_mlme mode
wifi: mwifiex: fix permanently busy scans after multiple roam iterations
Runyu Xiao (2):
wifi: rt2x00: avoid full teardown before work setup in probe
wifi: brcmfmac: initialize SDIO data work before cleanup
Ruoyu Wang (2):
Bluetooth: hci_qca: Clear memdump state on invalid dump size
bnxt_en: Handle partially initialized auxiliary devices
Shahar Tzarfati (1):
wifi: mac80211: recalculate rx_nss on IBSS peer capability update
Shuhao Fu (1):
can: j1939: fix lockless local-destination check
Stéphane Grosjean (1):
can: peak: Modification of references to email accounts being deleted
Weiming Shi (3):
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
sctp: validate STALE_COOKIE cause length before reading staleness
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
Wyatt Feng (1):
netfilter: xt_nat: reject unsupported target families
Xiang Mei (4):
wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
wifi: mac80211: fix fils_discovery double free on alloc failure
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
Bluetooth: qca: fix NVM tag length underflow in TLV parser
Xiang Mei (Microsoft) (4):
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
Xin Long (1):
sctp: fix auth_hmacs array size in struct sctp_cookie
Xuanqiang Luo (1):
llc: fix SAP refcount leak when creating incoming sockets
Yizhou Zhao (2):
netfilter: ecache: fix inverted time_after() check
netfilter: nf_conncount: fix zone comparison in tuple dedup
Yousef Alhouseen (1):
wifi: mac80211_hwsim: avoid treating MCS as legacy rate index
Zhao Li (14):
wifi: nl80211: free RNR data on MBSSID mismatch
wifi: mac80211: validate extension-frame layout before RX
wifi: cfg80211: derive S1G beacon TSF from S1G fields
wifi: ieee80211: validate MLE common info length
wifi: nl80211: validate nested MBSSID IE blobs
wifi: nl80211: constrain MBSSID TX link ID range
wifi: cfg80211: validate PMSR measurement type data
wifi: cfg80211: validate PMSR FTM preamble range
wifi: cfg80211: reject unsupported PMSR FTM location requests
wifi: cfg80211: reject empty PMSR peer lists
wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
wifi: mac80211: validate deauth frame length before reason access
wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
wifi: cfg80211: validate assoc response length before status and IE access
Zhengyang Chen (1):
selftests: netfilter: add bridge tunnel flowtable regression
Zhiling Zou (1):
wifi: mac80211: free ack status frame on TX header build failure
Zhiping Zhang (1):
net/mlx5: free mlx5_st_idx_data on final dealloc
.mailmap | 4 +-
drivers/bluetooth/btqca.c | 2 +-
drivers/bluetooth/btrtl.c | 5 +-
drivers/bluetooth/hci_qca.c | 4 +
drivers/dpll/dpll_netlink.c | 3 +
drivers/net/can/Kconfig | 7 +-
drivers/net/can/peak_canfd/peak_canfd.c | 2 +-
drivers/net/can/peak_canfd/peak_canfd_user.h | 2 +-
drivers/net/can/peak_canfd/peak_pciefd_main.c | 4 +-
drivers/net/can/sja1000/peak_pci.c | 4 +-
drivers/net/can/sja1000/peak_pcmcia.c | 4 +-
drivers/net/can/usb/esd_usb.c | 5 +-
drivers/net/can/usb/peak_usb/pcan_usb.c | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 +-
drivers/net/can/usb/peak_usb/pcan_usb_core.h | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 2 +-
drivers/net/can/usb/peak_usb/pcan_usb_pro.h | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 39 +-
drivers/net/ethernet/mellanox/mlx5/core/lib/st.c | 1 +
drivers/net/macsec.c | 7 +-
drivers/net/ppp/ppp_generic.c | 18 +-
.../broadcom/brcm80211/brcmfmac/cyw/core.c | 6 +
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +-
drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 4 +-
drivers/net/wireless/intersil/p54/txrx.c | 8 +
drivers/net/wireless/marvell/libertas/firmware.c | 1 +
drivers/net/wireless/marvell/libertas/tx.c | 7 +
drivers/net/wireless/marvell/libertas_tf/main.c | 2 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +-
drivers/net/wireless/marvell/mwifiex/join.c | 1 -
drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2800pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 +-
drivers/net/wireless/ralink/rt2x00/rt61pci.c | 2 +-
drivers/net/wireless/rsi/rsi_91x_hal.c | 8 +
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 12 +-
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 16 +-
include/linux/can/dev/peak_canfd.h | 2 +-
include/linux/ieee80211-eht.h | 12 +-
include/net/bluetooth/hci_core.h | 1 +
include/net/cfg80211.h | 4 +-
include/net/sctp/structs.h | 3 +-
include/net/xfrm.h | 2 +
net/bluetooth/hci_event.c | 18 +-
net/bluetooth/hci_sync.c | 66 ++-
net/bluetooth/mgmt.c | 105 +++-
net/can/bcm.c | 646 ++++++++++++++++-----
net/can/isotp.c | 298 +++++++---
net/can/j1939/transport.c | 18 +-
net/can/raw.c | 66 +--
net/core/dev.c | 10 +-
net/ipv4/fib_trie.c | 2 +-
net/ipv4/tcp_ipv4.c | 6 +-
net/ipv6/netfilter.c | 4 +-
net/ipv6/tcp_ipv6.c | 6 +-
net/ipv6/xfrm6_policy.c | 1 +
net/iucv/af_iucv.c | 4 +
net/llc/llc_conn.c | 1 -
net/mac80211/cfg.c | 11 +-
net/mac80211/ibss.c | 13 +-
net/mac80211/iface.c | 8 +-
net/mac80211/main.c | 3 +-
net/mac80211/mlme.c | 12 +-
net/mac80211/nan.c | 35 +-
net/mac80211/rx.c | 34 +-
net/mac80211/sta_info.c | 15 +-
net/mac80211/tx.c | 17 +-
net/mac80211/util.c | 3 +
net/mpls/af_mpls.c | 3 +
net/netfilter/ipvs/ip_vs_app.c | 10 +-
net/netfilter/ipvs/ip_vs_core.c | 3 +-
net/netfilter/ipvs/ip_vs_xmit.c | 6 +-
net/netfilter/nf_conncount.c | 6 +-
net/netfilter/nf_conntrack_ecache.c | 2 +-
net/netfilter/nf_flow_table_core.c | 6 +-
net/netfilter/xt_nat.c | 9 +
net/netfilter/xt_physdev.c | 5 -
net/openvswitch/flow_netlink.c | 201 +++++--
net/sched/act_tunnel_key.c | 14 +-
net/sctp/sm_statefuns.c | 23 +-
net/wireless/core.c | 14 +-
net/wireless/core.h | 4 +-
net/wireless/mlme.c | 101 +++-
net/wireless/nl80211.c | 25 +-
net/wireless/pmsr.c | 34 +-
net/wireless/scan.c | 18 +-
net/wireless/sme.c | 6 +-
net/xfrm/xfrm_device.c | 13 +-
net/xfrm/xfrm_iptfs.c | 1 +
net/xfrm/xfrm_nat_keepalive.c | 15 +-
net/xfrm/xfrm_policy.c | 4 +-
net/xfrm/xfrm_state.c | 12 +-
net/xfrm/xfrm_user.c | 41 +-
.../drivers/net/netconsole/netcons_resume.sh | 3 +-
.../selftests/net/netfilter/nft_flowtable.sh | 55 ++
98 files changed, 1681 insertions(+), 601 deletions(-)