NIPA Branch net-next-hw-2026-10-22--00-00

Branches

net-next-hw-2026-10-22--00-00 (current) net-next-hw-2026-10-21--16-00 (comparison)

Compare code

Base trees

[c] Merge https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net

[-] net: stmmac: dwxgmac2: enable L2 split header support

[c] ionic: fix port_info use-after-free on firmware recovery

[c] ionic: free port_info when probe fails after the port is set up

[c] ptp: drain virtual clock sysfs operations before unregistering children

[c] ptp: unwind partially completed virtual clock creation

[c] ptp: vclock: propagate physical clock sampling errors

[c] ptp: vclock: serialize extended samples with counter updates

[c] ptp: vclock: preserve missing hardware timestamps

[-] dt-bindings: net: dsa: realtek: add RTL8367S-VB

[-] net: dsa: realtek: rtl8365mb: add chip family infrastructure

[-] net: dsa: realtek: rtl8365mb: set speed for family D

[-] net: dsa: realtek: rtl8365mb: set RGMII mode for family D

[-] net: dsa: realtek: rtl8365mb: set and get vlan 4k for family D

[-] net: dsa: realtek: rtl8365mb: use raw VID for PVID on family D

[-] net: dsa: realtek: rtl8365mb: add family D SDS13 PCS support

[-] net: dsa: realtek: rtl8365mb: re-latch the family D SerDes

[-] net: dsa: realtek: rtl8365mb: add support for RTL8367S-VB

[c] kcm: defer receive parsing when the lower socket's read_sock may sleep

[c] strparser: don't serialize all parser work on one ordered workqueue

[c] net/sched: sch_teql: fix slaves_lock IRQ deadlock

[c] net/sched: sch_teql: fix use-after-free on lower qdisc drop

[-] net: qrtr: do not take the sock lock on blocking recv

[-] net: qrtr: propagate sock_alloc_send_skb() errors from sendmsg()

[-] net: qrtr: implement shutdown()

[-] dt-bindings: net: mediatek-dwmac: fix unit in rx/tx delay property description

[-] dt-bindings: net: mediatek-dwmac: add support for MT8189 SoC

[-] net: stmmac: mediatek: simplify TX/RX delay handling in mt8195_set_delay

[-] net: stmmac: mediatek: simplify TX/RX delay handling in mt2712_set_delay

[-] net: stmmac: mediatek: add RX/TX delay stage divider in platform data

[-] net: stmmac: mediatek: add PERI_ETH_CTRLx register offset in platform data

[-] net: stmmac: mediatek: use TX clock phase shift in RGMII mode with 1Gbps speed

[-] net: stmmac: mediatek: add support for TX clock output enable feature

[-] net: stmmac: mediatek: add support for MT8189 SoC

[c] net: hibmcge: set netdev_ops before hbg_init() to fix NULL pointer dereference

[-] net: ti: icssm-prueth: use dev_close()/dev_open() in icssm_prueth_change_mode()

[-] net: mana: prepare HWC ownership for safe reinitialization

[-] net: mana: give each HWC message slot its own completion state

[-] net: mana: support concurrent HWC requests

[-] net: mana: add dynamic HWC queue depth with reinit path

[c] net: qrtr: ns: retry service announcements on -EAGAIN

[c] net: usb: aqc111: fix set_mac_address return value

[-] net: phy: phy_link_topology: Add a helper for opportunistic alloc

[-] net: phy: phy_link_topology: Track ports in phy_link_topology

[-] net: phylink: Register a phy_port for MAC-driven SFP cages

[-] net: phy: Create SFP phy_port before registering upstream

[-] net: phy: Represent PHY-less SFP modules with phy_port

[-] net: phy: phy_port: Store information about a port's upstream

[-] net: phy: phy_link_topology: Add a helper to retrieve ports

[-] netlink: specs: Add ethernet port listing with ethtool

[-] net: ethtool: Introduce ethtool command to list ports

[-] Documentation: networking: Update the phy_port infrastructure description

[c] tls: restrict device-down TX fallback to hardware TX sockets

[c] veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled

[c] selftests: net: veth: test XDP_TX to a peer with GRO enabled

[c] net: pcs: xpcs: add ANRESTART support for SGMII link recovery

[c] dt-bindings: net: pcs: add rockchip,rk3568-xpcs support

[c] net: pcs: xpcs: add Rockchip RK3568 platform glue driver

[c] dt-bindings: net: rockchip-dwmac: document pcs-handle

[c] net: stmmac: dwmac-rk: add SGMII support for RK3568

[c] MAINTAINERS: add entry for Rockchip XPCS driver

[c] net: nixge: free IRQs before killing the DMA error tasklet

[c] net: nixge: wait for DMA reset before releasing buffers

[c] seg6: validate state in netfilter continuations

[-] erspan: drop packets with an unknown ERSPAN version

[-] erspan: skip the platform specific sub-header of ERSPAN type III

[c] net/sched: cls_api: unlink indr cb on a failed bind

[c] net: make room for the tunnel header in skb_segment_list()

[c] ip_tunnel: move the TCP fixed-ID flag to the inner header

[c] ipmr: set up GSO state for tunnel vifs

[c] ipmr: do not drop GSO packets that fit the MTU after segmentation

[-] net: bgmac: fix TX DMA unmapping on fragment mapping failure

[c] net: bgmac: rate limit RX error messages

[c] net/ncsi: fix use-after-free of ncsi_package in ncsi_remove_package()

[c] net/ncsi: fix use-after-free of ncsi_channel in ncsi_remove_channel()

[c] bnx2x: Close the VF when loading it fails after INIT

[c] net: libwx: fix VF PM suspend/resume flow

[c] net: cpsw: fix netdev cleanup on probe failure

[c] sctp: reject forged cookie peer_addr with unknown address family

[c] tipc: fix use-after-free of broadcast reception link at node release

[c] net/smc: fix lgr/lnk lifetime vs diag reader race

[c] net: qrtr: ns: keep going when an announcement cannot be sent

[c] net: qrtr: hold control packets behind the HELLO gate instead of dropping them

[c] tipc: fix broadcast sender hang on last acker departure

[c] net: hns3: bound debugfs queue-name sprintf with scnprintf

[c] nfc: pn533: bound the OUT URB wait in pn533_usb_send_frame()

[c] net: pse-pd: si3474: keep detection enabled on the other PIs

[c] net: pse-pd: si3474: validate the channels of a PI

[c] tls: Bound consecutive no-data records in tls_sw_read_sock()

[c] tls: Check for a pending signal after an empty record

[c] tls: Honor O_NONBLOCK in tls_sw_splice_read()

[c] tls: Consume empty data records in tls_sw_splice_read()

[c] tls: Consume empty data records in tls_sw_recvmsg()

[c] tls: Return copied data ahead of a run of empty records

[c] selftests: tls: Skip the zero_len tests when TLS is unavailable

[c] selftests: tls: Extend coverage for zero-length records

[c] selftests: tls: Cover splice on a nonblocking socket

[c] tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table

[c] tls: device: keep tls_sw_fallback() from encrypting its own output

[c] net: pse-pd: don't enable a PI again while disabling it

[c] net: hns: stop service work before device resource teardown

[c] net/rds: include the scope id in the sendmsg connection cache check

[c] net/rds: keep the connected peer's scope id apart from the bound one

[c] net: ethernet: ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl

[c] veth: fix stale peer max_mtu on XDP program replacement

[c] net: atlantic: Unregister before clearing RXNFC rules

[c] qlcnic: Protect loopback filter hashes

[c] virtio-net: fix frag overflow in big packets receive

[c] netlink: fix out-of-bounds bitmap access clearing stale mc groups

[c] vxlan: reject adding a remote to a nexthop fdb entry

[c] net: wangxun: keep NGBE OCP cards MAC enabled

[c] net: txgbe: keep MAC enabled for SP devices that support NCSI

[c] net: txgbe: keep MAC enabled for AML devices that support NCSI

[c] ipmr: only copy pktinfo to cache reports

[c] ipmr: validate VIF indexes before offload lookup

[c] qed: Protect iSCSI connection hash operations

[c] net: lan969x: don't disable hardirqs in fdma tx clear

[c] net: lan969x: fix DSM calendar for empty taxis

[c] net: sparx5/lan969x: do not clobber the PSFP cycle timer update period

[c] pppoe: delete session hash entries by pointer match

[c] net: wwan: iosm: validate msg_head before indexing msg_ring

[c] tun: Require CAP_NET_ADMIN to attach to an ownerless device

[c] net/sched/sch_cake: serialize reconfiguration with the datapath

[c] net/sched/sch_cake: reduce parent backlog when clearing a tin

[c] net/sched/sch_cake: widen buffer_used to u64

[c] net/sched/sch_cake: drop dead nla_nest_end() error check

[c] tls: fix the open record check in the max payload size setsockopt

[c] veth: keep carrier off when resizing channels with a down peer

[c] selftests: net: check veth carrier after changing channel counts

[c] net: shrink the payload-only part of skb dataref to one bit

[c] usbnet: fix EVENT_RX_PAUSED race in usbnet_skb_return()

[c] net/mlx5e: Stop asserting for RTNL when closing channels

[+] Merge https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net

[+] ionic: fix port_info use-after-free on firmware recovery

[+] ionic: free port_info when probe fails after the port is set up

[+] ptp: drain virtual clock sysfs operations before unregistering children

[+] ptp: unwind partially completed virtual clock creation

[+] ptp: vclock: propagate physical clock sampling errors

[+] ptp: vclock: serialize extended samples with counter updates

[+] ptp: vclock: preserve missing hardware timestamps

[+] kcm: defer receive parsing when the lower socket's read_sock may sleep

[+] strparser: don't serialize all parser work on one ordered workqueue

[+] net/sched: sch_teql: fix slaves_lock IRQ deadlock

[+] net/sched: sch_teql: fix use-after-free on lower qdisc drop

[+] net: hibmcge: set netdev_ops before hbg_init() to fix NULL pointer dereference

[+] net: qrtr: ns: retry service announcements on -EAGAIN

[+] net: usb: aqc111: fix set_mac_address return value

[+] tls: restrict device-down TX fallback to hardware TX sockets

[+] veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled

[+] selftests: net: veth: test XDP_TX to a peer with GRO enabled

[+] net: pcs: xpcs: add ANRESTART support for SGMII link recovery

[+] dt-bindings: net: pcs: add rockchip,rk3568-xpcs support

[+] net: pcs: xpcs: add Rockchip RK3568 platform glue driver

[+] dt-bindings: net: rockchip-dwmac: document pcs-handle

[+] net: stmmac: dwmac-rk: add SGMII support for RK3568

[+] MAINTAINERS: add entry for Rockchip XPCS driver

[+] net: nixge: free IRQs before killing the DMA error tasklet

[+] net: nixge: wait for DMA reset before releasing buffers

[+] seg6: validate state in netfilter continuations

[+] net/sched: cls_api: unlink indr cb on a failed bind

[+] net: make room for the tunnel header in skb_segment_list()

[+] ip_tunnel: move the TCP fixed-ID flag to the inner header

[+] ipmr: set up GSO state for tunnel vifs

[+] ipmr: do not drop GSO packets that fit the MTU after segmentation

[+] net: bgmac: rate limit RX error messages

[+] net/ncsi: fix use-after-free of ncsi_package in ncsi_remove_package()

[+] net/ncsi: fix use-after-free of ncsi_channel in ncsi_remove_channel()

[+] bnx2x: Close the VF when loading it fails after INIT

[+] net: libwx: fix VF PM suspend/resume flow

[+] net: cpsw: fix netdev cleanup on probe failure

[+] sctp: reject forged cookie peer_addr with unknown address family

[+] tipc: fix use-after-free of broadcast reception link at node release

[+] net/smc: fix lgr/lnk lifetime vs diag reader race

[+] net: qrtr: ns: keep going when an announcement cannot be sent

[+] net: qrtr: hold control packets behind the HELLO gate instead of dropping them

[+] tipc: fix broadcast sender hang on last acker departure

[+] net: hns3: bound debugfs queue-name sprintf with scnprintf

[+] nfc: pn533: bound the OUT URB wait in pn533_usb_send_frame()

[+] net: pse-pd: si3474: keep detection enabled on the other PIs

[+] net: pse-pd: si3474: validate the channels of a PI

[+] tls: Bound consecutive no-data records in tls_sw_read_sock()

[+] tls: Check for a pending signal after an empty record

[+] tls: Honor O_NONBLOCK in tls_sw_splice_read()

[+] tls: Consume empty data records in tls_sw_splice_read()

[+] tls: Consume empty data records in tls_sw_recvmsg()

[+] tls: Return copied data ahead of a run of empty records

[+] selftests: tls: Skip the zero_len tests when TLS is unavailable

[+] selftests: tls: Extend coverage for zero-length records

[+] selftests: tls: Cover splice on a nonblocking socket

[+] tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table

[+] tls: device: keep tls_sw_fallback() from encrypting its own output

[+] net: pse-pd: don't enable a PI again while disabling it

[+] net: hns: stop service work before device resource teardown

[+] net/rds: include the scope id in the sendmsg connection cache check

[+] net/rds: keep the connected peer's scope id apart from the bound one

[+] net: ethernet: ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl

[+] veth: fix stale peer max_mtu on XDP program replacement

[+] net: atlantic: Unregister before clearing RXNFC rules

[+] qlcnic: Protect loopback filter hashes

[+] virtio-net: fix frag overflow in big packets receive

[+] netlink: fix out-of-bounds bitmap access clearing stale mc groups

[+] vxlan: reject adding a remote to a nexthop fdb entry

[+] net: wangxun: keep NGBE OCP cards MAC enabled

[+] net: txgbe: keep MAC enabled for SP devices that support NCSI

[+] net: txgbe: keep MAC enabled for AML devices that support NCSI

[+] ipmr: only copy pktinfo to cache reports

[+] ipmr: validate VIF indexes before offload lookup

[+] qed: Protect iSCSI connection hash operations

[+] net: lan969x: don't disable hardirqs in fdma tx clear

[+] net: lan969x: fix DSM calendar for empty taxis

[+] net: sparx5/lan969x: do not clobber the PSFP cycle timer update period

[+] pppoe: delete session hash entries by pointer match

[+] net: wwan: iosm: validate msg_head before indexing msg_ring

[+] tun: Require CAP_NET_ADMIN to attach to an ownerless device

[+] net/sched/sch_cake: serialize reconfiguration with the datapath

[+] net/sched/sch_cake: reduce parent backlog when clearing a tin

[+] net/sched/sch_cake: widen buffer_used to u64

[+] net/sched/sch_cake: drop dead nla_nest_end() error check

[+] tls: fix the open record check in the max payload size setsockopt

[+] veth: keep carrier off when resizing channels with a down peer

[+] selftests: net: check veth carrier after changing channel counts

[+] net: shrink the payload-only part of skb dataref to one bit

[+] usbnet: fix EVENT_RX_PAUSED race in usbnet_skb_return()

[+] net/mlx5e: Stop asserting for RTNL when closing channels

New patches

@@ -1,110 +1,103 @@

eth: i40e: sync MAC filters before restarting queues after a reset

ice: don't switch to symmetric RSS hash on indir-only ethtool -X

nipa-local: i40e: keep q_vectors array in sync with channel count changes

nipa-local: dbg: add debug to rss xfrm

selftests/nci: increase t4t_tag_read timeout for debug kernels

nipa: disable some lib/ kunit tests

nipa: config: disable CPU_MITIGATIONS

nipa: disable 6.17's merge window kunit tests

nipa: forwarding: set timeout to 3 hours

nipa: selftests: net: enable profiling

nipa: profile (time) test output

nipa: config: x86: use periodic HZ tick

nipa: config: x86: disable GPUs and sound

nipa: config: disable kmemleak auto scan

nipa: disable random kunit tests

[+] selftests: tc-testing: test offload flags of reused matchall actions

[+] net/sched: act_api: inherit filter offload flags only on new actions

[+] tcp: fix authentication bypass via unsupported TCP auth options

[+] tcp: release congestion control reference on rejection

[+] selftests: net: packetdrill: add test for negative sk_forward_alloc in tcp_wmem_schedule()

[+] tcp: clamp return value of tcp_wmem_schedule() to non-negative

[+] ipv4: igmp: report interface group allocation failure on join

[+] net/smc: reject CDC messages after connection teardown

[+] net: fix frag_list leak in skb_segment_list() error path

[+] net/sched: fq_codel: read flowchain under the qdisc lock in fq_codel_walk

[+] net: page_pool: bound queue_idx before indexing dev->_rx[]

[+] net: xps: re-validate the queue index after switching to the subordinate device

[+] net: xps: bound the cleanup loop by the old map's num_tc

[+] net-sysfs: reject a one-entry RPS flow table

[+] net: reject flow_limit_table_len values below 2

[+] net/sched: re-cap skb->queue_mapping before indexing dev->_tx[]

[+] net/sched: gred: keep the qdisc lock while updating the table

[+] net/sched: taprio: unwind the netdevice notifier if register_qdisc() fails

[+] net/sched: etf: initialise the sock_exterr_skb before filling it

[+] net: gso: validate transport header before computing segment length

[+] selftests/net: tcp_mmap: remove unused -k option and keepflag

[+] net: enetc: pad short XDP frames in software

[+] net: enetc: ensure head buffer has at least 16 octets

[+] net: enetc: do not rely on mEMAC hardware frame padding

[+] net: enetc: reserve VLAN extension BDs for software TSO

wifi: wext: Limit notifier event flushes to the device's netns

net: sparx5: fix tx DCB index drift in fdma xmit

net/mlx5: Bridge, fix bogus MDB offload errors

net: hns3: fix use-after-free in debugfs read during reset/unload

net: hns3: fix interface stuck after OOM with full hardware rx queue

net: hns3: fix vector resource leak in hns3_nic_alloc_vector_data

net/sched: clamp skb->queue_mapping before indexing the tx queue

[-] selftests/bpf: add tests for the page_owner bpf_iter target

[-] mm/page_owner: add bpf_page_owner_get_memcg_info() kfunc

[-] mm/page_owner: record the NUMA node in the scan cursor

[-] mm/page_owner: add open-coded page_owner iterator

[-] mm/page_owner: add bpf_iter target "page_owner"

[-] mm/page_owner: protect page access with mem-hotplug read lock

[-] mm/page_owner: extract page_owner_next_eligible() from read loop

net/mlx5: Use only loaded devices for PTP clock operations

net: sparx5/lan969x: do not read past skb->len when injecting a frame

[-] can: protect the receive lists with a per-device lock

[-] can: dev: can_put_echo_skb(): free skb on invalid echo index

[-] can: replace ARPHRD_CAN type checks with can_get_ml_priv()

[-] can: proc: remove pointers from CAN specific proc output

[-] can: proc: skip stats calculation after reset in can_stat_update()

[-] can: proc: reset pkg_stats atomics individually

[-] can: isotp: check the frame type, not just the length

[-] can: skb: make CAN skb allocation failure paths IRQ-safe

[-] can: raw: remove redundant NULL check before netdev_hold()

[-] can: skb: make echo skb freeing safe in any IRQ context

[-] can: dev: can_dropped_invalid_skb: drop CAN XL frames on non-CAN XL devices

net: airoha: keep PPE offload when NPU refuses flow stats

cipso_v4: fail the walk on malformed options

octeontx2-af: Fix representor flow rule PF_FUNC mask and channel In representor mode, an AF-installed TX rule must still match on PF_FUNC, so do not clear the mask when rep_mode is set. Also, do not overwrite a channel already provided in the request when the rule comes from a representor device; only default to the PF/VF rx_chan_base when none is given.

net: wwan: mhi_wwan_ctrl: add ADB channel support

bus: mhi: pci_generic: add Rolling Wireless RW135R-GL and RW151 support

sfc: ptp: avoid racing PPS timestamp updates

sfc: ptp: serialize host and MC synchronization transactions

sfc: ptp: drop the stale frequency reset in efx_ptp_start()

selftests: drv-net: devmem: Skip when hugetlbfs isn't supported

inet: reject unhashed sockets during established lookups

net: usb: cdc_mbim: don't enable BHs in tx_fixup under netpoll

net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll

net/mlx5: DR, Fix out-of-bounds write when sync to HW fails

net/mlx5: HWS, Fix heap buffer overflow in insert header action

net/mlx5: HWS, Handle NULL in vport destination action creation

tls: avoid field-spanning write when copying crypto info

gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

fou: reserve headroom before pushing the encap header

net/mlx5e: IPsec, Fix out-of-bounds comparison of neighbour keys

[-] net: wwan: qcom_bam_dmux: Assign restricted DMA pool to remote processor

[-] dt-bindings: net: qcom,bam-dmux: Add memory-region and qcom,vmid properties

net/mlx5e: SHAMPO: Do not merge PSP packets

[-] net/nebula-matrix: add common dev start/stop operation

[-] net/nebula-matrix: add common/ctrl dev init/remove operation

[-] net/nebula-matrix: dispatch: implement channel RPC framework and serialize hardware ops

[-] net/nebula-matrix: dispatch: add control-level routing core infrastructure

[-] net/nebula-matrix: add chip-wide hardware init/deinit implementation

[-] net/nebula-matrix: add intr resource implementation

[-] net/nebula-matrix: add common resource implementation

[-] net/nebula-matrix: add channel layer

[-] nfc: nfcmrvl: stop firmware work before unregistering

[-] nfc: serialize firmware download state

[-] nfc: nfcmrvl: publish UART state before registration

[-] nfc: nci: uart: quiesce callbacks during teardown

[-] nfc: nci: uart: serialize driver selection

[-] nfc: nci: skip controller reset while unregistering

seg6: Fix unset mac header in SRv6 End.DT VRF decapsulation

ppp: linearize bridged packets when required

net: usb: pegasus: check rx pkt_len against the received length

net: usb: pegasus: do not advance rx_skb->data on dropped frames

[+] netmem: rename get/put_netmem() to netmem_inc/dec_ref()

[+] netmem: rename get/put_net_iov() to net_iov_inc/dec_ref()

dql: Reset the adjusted limit when resetting the queue

net: stmmac: fix rx checksum offload with extended descriptors

gve: fix out-of-bounds read in gve_get_flow_rule_entry()

tls: keep TX and RX hardware offload on the same device

net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

rxrpc: Fix RACK-TLP implementation

rxrpc: Fix counting of in-flight transmitted packets

rxrpc: Fix the comments saying RFC8958 to be RFC8985

eth: fbnic: Correct packet header prefetch

net: pse-pd: pd692x0: defer probe while a manager supply is unresolved

net: pse-pd: pd692x0: release the manager power budget through devres

net: pse-pd: use each PI's own supply handle for the power budget

net: pse-pd: unwind allocations when controller registration fails

net: pse-pd: keep the PI data until the PI regulators are gone

net: pse-pd: unregister from the controller list before freeing PI data

net: pse-pd: stop async event sources before freeing PI data in unregister

net: pse-pd: do not tie a shared power domain to its creator's devres

net: pse-pd: check the PI state under the lock when setting a power limit

net: pse-pd: do not reach a freed PHY from the notification worker

net: pse-pd: do not keep a failed IRQ in pcdev->irq

net: pse-pd: fix module refcount leak in pse_control_get_internal()

net: pse-pd: remove dead pi_get_admin_state() checks

net: pse-pd: size the notification kfifo after defaulting nr_lines

net/sched: cake: hash before segmenting and reject an overlong split

net/sched: cap the accounted backlog before it can wrap

net/sched: cake: use a dedicated split-GSO list iterator

net/sched: cake: return the classifier result to the caller

net/mlx4: always create the eth and ib auxiliary devices

Test results