Linux Kernel: Late-Cycle Cleanup Hits Use-After-Free Bugs Hard
The September 19 merge window was dominated by rc4-stage bug fixes across nearly every subsystem, with a clear pattern of use-after-free and reference-counting bugs surfacing in drivers from SMB clients to hardware monitoring to MMC hosts. Several fixes also close security-relevant gaps, most notably in the SMB client's handling of malicious server responses.
Duration: PT2M36S
Episode overview
This episode is a short developer briefing from Linux Kernel.
It explains recent repository work in plain language.
- Show: Linux Kernel
- Published: 2026-09-19T13:14:37Z
- Audio duration: PT2M36S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day. It's September 19th, and this is your Linux Kernel briefing.
Today's activity is release-cycle housekeeping: sixteen merge commits, all bug fixes, no new features. But look across them and one pattern jumps out. Use-after-free and reference-counting bugs are everywhere this cycle.
Start with hwmon, where fixes to w83793, w83791d, pwm-fan, and hp-wmi-sensors all address the same class of bug: freeing data structures while something else still holds a reference. MMC saw the identical pattern hit its hsq driver and mmci busy-timeout work, plus a fix to cancel SDIO IRQ work before freeing the…
The second theme is security-hardening in the SMB client, folded into commit 17e7b8e. This is the most consequential merge of the batch. It fixes multiple out-of-bounds reads, a stale pointer bug in compound PDU handling, and a heap overflow in the symlink parser — all reachable from a malicious or compromised…
Rounding things out: ksmbd fixed session-expiration logic so valid SMB sessions no longer get dropped after ten seconds of inactivity — a correctness fix with real UX impact for anyone hitting mysterious disconnects. NTFS got a batch of runlist and MFT record fixes aimed at making…
W…
Nearby episodes from Linux Kernel
- Release Candidate Four Stabilizes Ahead of Merge
- PowerPC Fixes Close Security and Stability Gaps
- Scheduler Race Fixes Head Into Release Candidate
- Late-Cycle Fixes Converge on Race Conditions and Resource Leaks
- Release Candidate Cleanup Sweep
- Weekly Recap - Late-Cycle Bug Fixing Across the Stack
- Late-Cycle Fixes Converge on Data Integrity
- Late-Cycle Fixes and the Rise of Bounds Checking