$ the-wire · showcase
Networking fixes dominate: use-after-free in MPTCP, bridge FDB ordering, CAN and MM hotfixes
By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology
A day of upstream networking and MM fixes: an MPTCP use-after-free that needs RCU to plug, a bridge MRP ordering bug around FDB flushes, 15 CAN patches, and guard-page flags that fork and THP collapse were losing.
mptcp: pm: kernel: use RCU to free endpoint listeners torvalds/linux
mptcp_pm_nl_create_listen_socket() starts the TCP listener directly instead of going through mptcp_listen(), so it never sets SOCK_RCU_FREE on the parent MPTCP socket; Kyle Zeng's commit closes that window by freeing endpoint listeners under RCU. The exposure needed an authenticated MP_JOIN racing with endpoint teardown to touch the parent after its last reference was dropped, so it matters to ...
net: bridge: disable MRP ports before the FDB flush in del_nbp() torvalds/linux
by Cheng Yongkang
del_nbp() flushed the port's FDB entries before unregistering the RX handler, and for MRP ring ports br_stp_disable_port() was a no-op because br_set_state() ignores state changes while BR_MRP_AWARE_BIT is set, letting br_mrp_port_del() restore forwarding. The fix disables MRP ports first, so the flush no longer races a forwarding port in bridges with MRP rings.
Merge tag 'linux-can-fixes-for-7.4-20261103' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can torvalds/linux
by Paolo Abeni
Marc Kleine-Budde's pull request carries 15 patches to net/main: Vincent Mailhol drops CAN-XL frames on non CAN-XL devices, Kaixuan Li tightens the CAN ISOTP check for correct CAN CC/FD frames, and three Cunhao Lu patches make CAN skb freeing safe. CAN-XL frame leakage onto hardware that cannot handle it is the one that reaches embedded deployments.
Merge tag 'mm-hotfixes-stable-2026-11-04-20-02' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm torvalds/linux
Andrew Morton's MM hotfix pull preserves guard-page and soft-dirty state across VMA changes, so fork and THP collapse no longer lose guard markers and changes stay visible to applications that track modified memory. The same tag reroutes more MM components through mm/core in MAINTAINERS; anything parsing guard regions or soft-dirty bits should expect the correct flags after a collapse.
net: count last skb of each sk_backlog pass in __release_sock() torvalds/linux
Ray Zhang reproduced a >100ms reschedule latency stall on a 2-core Cortex-A53 under 500 concurrent TCPv6 streams (neper "tcp_stream -6 -T 1 -F 500" on CONFIG_PREEMPT_NONE), with resched_latency_warn() firing inside __release_sock(); the fix counts the last skb of each sk_backlog pass so the backlog walk can yield. Separately, Omarchy merged two fixes: Hex dictation now always sends hex dictatio...
