Kernel security patches and Rust IRQ review

Security work led the day across WiFi staging, TPM sealing, qdisc DoS paths, signal queues, and TCP state transitions. Substantial review also continued on Rust interrupt primitives and first USB4 support for Apple Silicon.

Staging rtl8723bs bounds WPS attribute copy

A patch for the rtl8723bs staging driver adds a bound on the WPS attribute copy inside rtw_get_wps_attr_content(). The change addresses a remote stack overflow that can arise while processing WiFi scan results. Systems still using this Realtek chipset gain a concrete memory-safety fix in the wireless path.

Refcounted IRQ disable and SpinLockIrq for Rust

Version 4 of a 17-part series introduces refcounted interrupt disable together with SpinLockIrq support for Rust kernel code. The thread exceeded 100 messages and drew detailed input from Thomas Gleixner and Peter Zijlstra on preempt_count and irqflags semantics. The work supplies safer concurrency primitives as more Rust lands in the kernel.

Bounds check before memcpy in trusted TPM1 seal

Patches add a bounds check in tpm_seal() ahead of memcpy and reject unauthenticated TPM responses inside trusted_tpm1.c. Maintainers asked the submitter for a real name and to drop an alias. The changes harden trusted-key sealing against malformed or unauthenticated TPM data.

Clamp quantum and psched_mtu in qdisc change paths

Successive net series (v2 and v3) add missing clamps on quantum and psched_mtu in the change paths of eight qdiscs. The clamps close denial-of-service vectors that craft size tables to produce long deficit loops while holding the qdisc lock. Network operators gain protection against lock-held CPU spin from malicious configuration updates.

Initial USB4 and Thunderbolt for Apple M1/M2/M3

A 19-part series supplies the first USB4/Thunderbolt driver and device-tree nodes for Apple M1, M2, and M3 SoCs. The Thunderbolt maintainer is actively reviewing the patches. Mainline support would bring Thunderbolt connectivity to recent Apple hardware running Linux.

Careful list deletion in signal queue flush

Developers examined a use-after-free that can occur when flush_sigqueue runs during non-leader exec() in the presence of POSIX timers. The proposed fix switches the removal to list_del_init_careful(). The change closes a race that corrupts signal-queue state across exec transitions.

TCP fixes for requests completing on non-listening sockets

A net series corrects multiple use-after-free bugs in TCP state transitions that involve connect with AF_UNSPEC, listen, and IPV6_ADDRFORM. Requests can finish on a socket that is no longer listening, leaving dangling references. The patches harden core networking against these completion races.