Commit 0d508d470983 for kernel

commit 0d508d4709837bcc88e314c0533a42d3c55b31e3
Merge: 2c455ddca782 b9e002df320f
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Oct 20 19:35:13 2026 -1000

    Merge tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

    Pull audit updates from Paul Moore:

     - Fix the accounting of audit filter rule additions and removals

       Tracking audit filter rules is important as their presence can
       trigger additional processing. Unfortunately, the existing code did
       not properly track the removal of filter rules, resulting in some
       cases where additional processing was done when none was required.

       This not only corrects the accounting problems, but also provides a
       cleaner API for tracking audit filter rule additions and removals.

     - Add a FSOPEN record to log the filesystem name in the new mount API

       Close a long standing audit blindspot by capturing the filesystem
       name, e.g. "tmpfs", when calling fsopen().

     - Split audit's storage of process and file capabilities

       Instead of a single structure that stores all possible capability
       information, create a dedicated audit file capabilities struct and
       convert the existing audit capabilities struct into a process
       capabilities struct. This saves 80 bytes from the per-task
       audit_context on 64-bit systems.

     - Ensure that the PROCTITLE record is reset on exec()

       This fixes a problem where systemd would set a temporary PROCTITLE
       string after forking a child process before calling exec(),
       effectively locking the PROCTITLE string to the temporary value. This
       pull request resets the PROCTITLE state on exec() so that newly
       executed processes can set their PROCTITLE correctly.

     - Add some missing unlikely() annotations to the audit wrapper
       functions

     - Clean up the audit netlink multicast skb length adjustment

    * tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
      audit: add FSOPEN record to log filesystem name
      audit: separate file and process capability storage
      audit: Fix filter rule accounting after automatic removal
      audit: use copied skb length in kauditd_send_multicast_skb()
      audit: add missing unlikely hint to audit_dummy_context() wrappers
      audit: free proctitle in context so it can be re-set by fork on exec_binprm