Linux LTS Kernel Cycles Get Their Doses of Security Fixes
Greg Kroah-Hartman drops four stable updates across the long-term tree, with Thunderbolt parsing and SCTP memory management leading the charge.
Greg Kroah-Hartman shipped four long-term support kernel updates on today. The stable tree just got a fresh layer of patches, with sizes ranging from a focused 154-commit update to a sprawling 608-patch release. If you're running anything from 5.10 up to 6.6, there's a new version for you.
This is the kind of steady rhythm that keeps data centers and desktop rigs from catching fire. The 5.10 branch is technically on life support, approaching its end-of-life window, but it still pulled in 388 patches. You shouldn't be surprised. LTS kernels don't just stop caring the moment they turn sixty.
Security Across the Stable Tree
The cross-cutting theme this cycle is memory safety. Specifically, use-after-free bugs and out-of-bounds reads hiding in places you probably don't think about. Thunderbolt port configuration parsing got a long-overdue bounds check across all four kernels. A malformed downstream device could previously trigger an out-of-bounds pointer dereference, which is a fun vector for anyone with a physical laptop and a grudge. The fix lands cleanly: bound the DROM dual link port number before indexing the port table.
SCTP kept its usual spot on the hit list. Five separate patches across the tree address dangling pointers in authenticated ASCONF parameter processing, stale chunk access during peer restarts, and transport pointer drift. Multiple KASAN dumps confirmed these were actually triggerable by authenticated network peers. Keep in mind that SCTP isn't exactly a household name in userland, but when it breaks, it breaks loudly.
BPF sockmap saw a double-socket-release bug under batch reallocation failure conditions, patched by Microsoft's AutonomousCodeSecurity team. Truncated security.ima extended attributes could previously leak kernel memory if the HMAC key wasn't loaded. Both fixes landed in every branch tested.
The 6.1.183 release is easily the largest at 608 patches, with KVM virtualization getting targeted attention. A role invalid warning fix prevents use-after-free during MMU operations, and VMCLEAR shadow handling got tightened up. If you're running nested virtualization on x86, that one's worth tracking down.
The hwmon subsystem ate a meaningful chunk of this cycle. A Corsair PSU driver caught an out-of-bounds access vector caused by missing string termination in hardware responses. Malicious or poorly manufactured hardware has been making headlines for years, and the kernel team keeps sanding down the edges. The rtl8723bs staging driver also received a comprehensive security pass across 5.15 and 6.6, slapping validation on monitor transmit frames and WMM parameter handlers.
What Actually Changed This Cycle
Next, the 5.15.216 update brings 455 patches, with a notable rewrite to the ADT7470 hardware monitor driver. Ten patches cover a divide-by-zero TOCTOU crash in fan speed reads, I2C flooding prevention, and PWM mask corrections. The 5.10.265 branch rounds out the cycle with 388 patches, including key request length validation for s390/zcrypt CCA ECC private keys. If you're running mainframe-adjacent workloads, that validation was practically a requirement before this update.
The 6.6.152 release is the most surgical of the bunch. Just 154 patches, but every single one targets something specific. TCP stack refcount warnings got smoothed over with kref_get_unless_zero(), IPVS ICMP rebasing issues were squashed, and a tracing crash involving ERR_PTR passed to kthread_stop() finally got resolved. You'll see it most in containerized environments where ring buffer tracing runs hot.
It's a rather dense update cycle if you count the combined patch volume, though the security focus makes the weight feel justified. The Thunderbolt and SCTP fixes alone justify a reboot for most production systems. If your fleet relies on BPF-driven network routing or runs untrusted USB peripherals, treat these as immediate priorities. Everything else fits neatly into your standard patch Tuesday.
All four releases cleared testing with contributors including Pavel Machek, Florian Fainelli, Shuah Khan, and Miguel Ojeda. If you're tracking the next stable cycle, the patch submission window usually opens within two weeks. Until then, pull what fits your version and let the machines run.
Linux kernel 5.10.265 released
Linux kernel version 5.10.265 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.265.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.10.265.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.265.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.10.265/v5.10.264
Linux kernel 5.15.216 released
Linux kernel version 5.15.216 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.216.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.15.216.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.216.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.15.216/v5.15.215
Linux kernel 6.1.183 released
Linux kernel version 6.1.183 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.183.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.1.183.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.183.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.1.183/v6.1.182
Linux kernel 6.6.152 released
Linux kernel version 6.6.152 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.152.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.6.152.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.152.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.6.152/v6.6.151
