SUIVI DES NOYAUX LTS 6.12.y ET 6.18.y Correctifs AX.25 / ROSE / NetRom (F6BVP) État du 2026-10-16 19:45 ---------------------------------------------------------------------- 1. VERSIONS PUBLIÉES 6.12.y 6.18.y kernel.org 6.12.113 6.18.57 publiée le 2026-10-15 2026-10-15 Sources raspberrypi/linux 6.12.113 6.18.57 rpi-update (branche master) - 6.18.56 Raspberry Pi OS trixie (apt) - 6.18.50 Raspberry Pi OS bookworm (apt) 6.12.109 - 2. CORRECTIFS FUSIONNÉS (mod-orphan) : PREMIÈRE VERSION LTS .NNN = publié à partir de 6.12.NNN / 6.18.NNN file = en file d'attente stable (prochaine version) - = absent de cette branche LTS 6.12 6.18 Correctif ---------------------------------------------------------------------- .112 .37 rose: fix dev_put() leak in rose_loopback_timer() .112 .37 rose: hold loopback neighbour reference across timer callback .112 .37 rose: fix race between loopback timer and module removal .112 .37 rose: clear neighbour pointer after rose_neigh_put() in state machines .112 .37 rose: guard rose_neigh_put() against NULL in timer expiry .112 .37 rose: fix netdev double-hold in rose_rx_call_request() .112 .37 rose: fix notifier unregistered too early in rose_exit() - .37 rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup - .37 rose: disconnect orphaned STATE_2 sockets when device is gone .112 .37 rose: fix netdev double-hold in rose_make_new() - .37 rose: release netdev ref and destroy orphaned incoming sockets .112 .37 rose: drop CALL_REQUEST in loopback timer when device is not running .112 .37 rose: cancel neighbour timers in rose_neigh_put() before freeing - .37 rose: clear neighbour pointer in rose_kill_by_device() - .37 rose: don't free fd-owned sockets when reaping in the heartbeat - .55 rose: keep the route needed for routing loop detection - .55 rose: guard rose_transmit_link() against a NULL neighbour - .55 rose: use timer_shutdown_sync() for t0timer teardown - .55 rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3 - - ax25: bound REJ-driven fast retransmits with the existing N2 counter - - rose: purge rose_neigh->queue on final teardown - - rose: hold a reference on incoming sockets queued for accept() - - rose: clear stale N(R)/N(S) before (re)transmitting a data frame - - netrom: linearize and validate lengths in nr_rx_frame() - - netrom: require full NET/ROM headers in nr_route_frame() - - net: netrom: validate source address in nr_find_socket() - - netrom: bound fragment reassembly in nr_queue_rx_frame() - - ax25: fix OOB read after address header strip in ax25_rcv() - - ax25: check frame length in ax25_decode() and ax25_rx_iframe() - - net: ax25: fix integer overflow in ax25_rx_fragment() - - netrom: use a single lock for the node and neighbour lists - - netrom: look up and update routes in one critical section - - netrom: fix reference count leak in nr_rt_device_down - - netrom: clear nr_neigh->ax25 under the routing lock in nr_link_failed() - - netrom: fix nr_node leak when nr_del_node() removes the last route - - rose: clear through routes when a neighbour is removed from the tables - - rose: restart the link of a neighbour created over a live AX.25 connection - - ax25: serialise the transmission of I frames on a connection - - rose: process received frames and send with the socket locked - - ax25: don't create two connections for the same link in ax25_send_frame() - - ax25: read the connection's ax25_dev only once when walking ax25_list - - ax25: wait for ax25_send_frame() before detaching the connections of a device - - ax25: don't accept frames on a device that is going down - - ax25: send a private copy of each I frame - - rose: clear the circuits of a neighbour that restarts the link - - ax25: send unacknowledged I frames again when a link is re-established - - rose: bring up the link of the preferred route passed over by a connect request ---------------------------------------------------------------------- Total : 47 correctifs fusionnés ; 10 dans 6.12.y, 19 dans 6.18.y 3. EN FILE D'ATTENTE STABLE (prochaine version) 6.12.y : 0 correctif(s) de la liste autres correctifs radioamateur (hors liste) : 1 - ax25: Remove broken autobind 6.18.y : rien en attente 4. DISPONIBILITÉ SUR RASPBERRY PI 6.12.113 : rpi-update ne suit pas la série 6.12 (sources raspberrypi/linux rpi-6.12.y : 6.12.113) 6.18.57 : pas encore dans rpi-update (6.18.56) attendue vers le 2026-10-22 (publication + 7 j) 5. AVERTISSEMENT ! 6.18.y (depuis 6.18.37) contient « rose: release netdev ref and destroy orphaned incoming sockets » sans le correctif de sa régression « rose: hold a reference on incoming sockets queued for accept() », pas encore fusionné : garder les modules corrigés. 6. CORRECTIFS EN REVUE (dans aucun noyau officiel) 3 PR ouvertes sur linux-netdev/mod-orphan (disponibles seulement dans les modules corrigés) : #19 ax25: fix format specifier for sock_i_ino() #30 ax25: don't free an incoming SABM skb left on the listener's queue #37 rose: fix sk_filter_trim_cap() compatibility across kernel versions