Thank you for your contribution to Debian.
Accepted: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 13 Apr 2026 20:58:30 +0200 Source: linux Architecture: source Version: 6.19.12-1 Distribution: unstable Urgency: medium Maintainer: Debian Kernel Team <[email protected]> Changed-By: Salvatore Bonaccorso <[email protected]> Changes: linux (6.19.12-1) unstable; urgency=medium . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.19.12 - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path - scsi: target: file: Use kzalloc_flex for aio_cmd - scsi: target: tcm_loop: Drain commands in target_reset handler - xfs: only assert new size for datafork during truncate extents - xfs: factor out xfs_attr3_node_entry_remove - xfs: factor out xfs_attr3_leaf_init - xfs: close crash window in attr dabtree inactivation - HID: logitech-hidpp: Enable MX Master 4 over bluetooth - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - atm: lec: fix use-after-free in sock_def_readable() - btrfs: don't take device_list_mutex when querying zone info - tg3: replace placeholder MAC address with device property - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure - HID: core: Mitigate potential OOB by removing bogus memset() - objtool/klp: fix mkstemp() failure with long paths - HID: multitouch: Check to ensure report responses match the request - btrfs: reserve enough transaction items for qgroup ioctls - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe - btrfs: reject root items with drop_progress and zero drop_level - drm/amd/display: Fix gamma 2.2 colorop TFs - smb: client: fix generic/694 due to wrong ->i_blocks - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - wifi: iwlwifi: mld: Fix MLO scan timing - wifi: iwlwifi: mvm: don't send a 6E related command when not supported - wifi: iwlwifi: mld: correctly set wifi generation data - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - cgroup: Wait for dying tasks to leave on rmdir - cgroup: Fix cgroup_drain_dying() testing the wrong condition - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys - [arm64,armhf] crypto: caam - fix overflow on long hmac keys - crypto: deflate - fix spurious -ENOSPC - crypto: af-alg - fix NULL pointer dereference in scatterwalk - mpls: add seqcount to protect the platform_label{,s} pair - [amd64,arm64] net: mana: Fix RX skb truesize accounting - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface - [arm64] net: enetc: reset PIR and CIR if they are not equal when initializing TX ring - [arm64] net: enetc: add graceful stop to safely reinitialize the TX Ring - [arm64] net: enetc: do not access non-existent registers on pseudo MAC - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak - net/ipv6: ioam6: prevent schema length wraparound in trace fill - tg3: Fix race for querying speed/duplex - net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - eth: fbnic: Account for page fragments when updating BDQ tail - bridge: br_nd_send: linearize skb before parsing ND options - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz - [arm64] net: enetc: do not allow VF to configure the RSS key - ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP - ipv6: prevent possible UaF in addrconf_permanent_addr() - net: introduce mangleid_features - net: use skb_header_pointer() for TCPv4 GSO frag_off check - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - bnxt_en: set backing store type from query type - crypto: algif_aead - Revert to operating out-of-place - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - net: bonding: fix use-after-free in bond_xmit_broadcast() - NFC: pn533: bound the UART receive buffer - ASoC: Intel: boards: fix unmet dependency on PINCTRL - bridge: mrp: reject zero test interval to avoid OOM panic - bpf: Fix regsafe() for pointers to packet - net: ipv6: flowlabel: defer exclusive option free until RCU teardown - mptcp: add eat_recv_skb helper - mptcp: fix soft lockup in mptcp_recvmsg() - net: stmmac: skip VLAN restore when VLAN hash ops are missing - ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP - netfilter: flowtable: strictly check for maximum number of actions - netfilter: nfnetlink_log: account for netlink header size - netfilter: x_tables: ensure names are nul-terminated - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conntrack_helper: pass helper to expect cleanup - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: use expect->helper - netfilter: nf_conntrack_expect: store netns and zone in expectation - netfilter: ctnetlink: ignore explicit helper on new expectations - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - netfilter: nf_tables: reject immediate NF_QUEUE verdict - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: L2CAP: Add support for setting BT_PHY - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails - Bluetooth: hci_sync: Fix UAF in le_read_features_complete - Bluetooth: hci_h4: Fix race during initialization - Bluetooth: MGMT: validate LTK enc_size on load - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - Bluetooth: MGMT: validate mesh send advertising payload length - rds: ib: reject FRMR registration before IB connection is established - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - net/sched: sch_netem: fix out-of-bounds access in packet corruption - net: macb: fix clk handling on PCI glue driver removal - net: macb: properly unregister fixed rate clocks - net/mlx5: lag: Check for LAG device before creating debugfs - net/mlx5: Avoid "No data available" when FW version queries fail - net/mlx5: Fix switchdev mode rollback in case of failure - bnxt_en: Refactor some basic ring setup and adjustment logic - bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() - bnxt_en: Restore default stat ctxs for ULP when resource is available - net/x25: Fix potential double free of skb - net/x25: Fix overflow when accumulating packets - net/sched: cls_fw: fix NULL pointer dereference on shared blocks - net/sched: cls_flow: fix NULL pointer dereference on shared blocks - net: hsr: fix VLAN add unwind on slave errors - ipv6: avoid overflows in ip6_datagram_send_ctl() - eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64 - bpf: reject direct access to nullable PTR_TO_BUF pointers - bpf: Reject sleepable kprobe_multi programs at attach time - bpf: Fix incorrect pruning due to atomic fetch precision tracking - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - gpiolib: clear requested flag if line is invalid - gpio: shared: call gpio_chip::of_xlate() if set - gpio: shared: handle pins shared by child nodes of devices - drm/bridge: Fix refcount shown via debugfs for encoder_bridges_show() - io_uring/rsrc: reject zero-length fixed buffer import - hwmon: (tps53679) Fix array access with zero-length block read - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") - gpio: shared: shorten the critical section in gpiochip_setup_shared() - dt-bindings: gpio: fix microchip #interrupt-cells - drm/xe/xe_pagefault: Disallow writes to read-only VMAs - drm/xe/pxp: Clean up termination status on failure - drm/xe/pxp: Remove incorrect handling of impossible state during suspend - drm/xe/pxp: Clear restart flag in pxp_start after jumping back - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - hwmon: (occ) Fix missing newline in occ_show_extended() - [riscv64] irqchip/riscv-aplic: Restrict genpd notifier to device tree only - drm/sysfb: Fix efidrm error handling and memory type mismatch - hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI - sched/fair: Fix zero_vruntime tracking fix - sched/debug: Fix avg_vruntime() usage - [amd64] perf/x86: Fix potential bad container_of in intel_pmu_hw_config - [riscv64] Reset pmm when PR_TAGGED_ADDR_ENABLE is not set - ACPI: RIMT: Add dependency between iommu and devices - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() - USB: serial: option: add MeiG Smart SRM825WN - drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() - sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl() - lib/crypto: chacha: Zeroize permuted_state before it leaves scope - sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback - ALSA: caiaq: fix stack out-of-bounds read in init_card - ALSA: ctxfi: Check the error for index mapping - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization - ALSA: hda/realtek: add quirk for Acer Swift SFG14-73 - ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15 - ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx - ALSA: hda/realtek: change quirk for HP OmniBook 7 Laptop 16-bh0xxx - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() - Bluetooth: SMP: derive legacy responder STK authentication from MITM state - Bluetooth: SMP: force responder MITM requirements before building the pairing response - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync - Bluetooth: hci_event: move wake reason storage into validated event handlers - ksmbd: fix OOB write in QUERY_INFO for compound requests - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1() - [amd64] x86/kexec: Disable KCOV instrumentation after load_segments() - drm/amdgpu: fix the idr allocation flags - gpib: fix use-after-free in IO ioctl handlers - iio: add IIO_DECLARE_QUATERNION() macro - iio: orientation: hid-sensor-rotation: fix quaternion alignment - iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace - iio: adc: ti-adc161s626: fix buffer read on big-endian - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion() - iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout() - iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD - drm/ast: dp501: Fix initialization of SCU2C - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - [amd64] drm/i915/cdclk: Do the full CDCLK dance for min_voltage_level changes - drm/amdgpu: Fix wait after reset sequence in S4 - drm/amdgpu: validate doorbell_offset in user queue creation - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB - drm/amdgpu/pm: drop SMU driver if version not matched messages - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: bcm5974 - recover from failed mode switch - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - iio: adc: ti-ads7950: normalize return value of gpio_get - iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get() - iio: adc: ade9000: fix wrong return type in streaming push - iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power - iio: adc: ade9000: move mutex init before IRQ registration - iio: adc: aspeed: clear reference voltage bits before configuring vref - iio: accel: fix ADXL355 temperature signature value - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 - iio: accel: adxl313: add missing error check in predisable - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: imu: adis16550: fix swapped gyro/accel filter functions - iio: light: vcnl4035: fix scan buffer on big-endian - iio: light: veml6070: fix veml6070_read() return value - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - mei: me: reduce the scope on unexpected reset - gpib: lpvo_usb: fix memory leak on disconnect - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - usb: ulpi: fix double free in ulpi_register_interface() error path - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: misc: usbio: Fix URB memory leak on submit failure - usb: ehci-brcm: fix sleep during atomic - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: core: phy: avoid double use of 'usb3-phy' - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue - usb: cdns3: gadget: fix state inconsistency on gadget init failure - usb: core: use dedicated spinlock for offload state - io_uring: protect remaining lockless ctx->rings accesses with RCU - auxdisplay: line-display: fix NULL dereference in linedisp_release - bridge: br_nd_send: validate ND option lengths - cdc-acm: new quirk for EPSON HMD - [amd64] comedi: runflags cannot determine whether to reclaim chanlist - [amd64] comedi: Reinit dev->spinlock between attachments to low-level drivers - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer - [amd64] comedi: me4000: Fix potential overrun of firmware buffer - [riscv64] firmware: microchip: fail auto-update probe if no flash found - dt-bindings: connector: add pd-disable dependency - spi: cadence-qspi: Fix exec_mem_op error handling - [s390x] zcrypt: Fix memory leak with CCA cards used as accelerator - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception - reset: gpio: fix double free in reset_add_gpio_aux_device() error path - PM: EM: Fix NULL pointer dereference when perf domain ID is not found - nvmem: imx: assign nvmem_cell_info::raw_len - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy - netfilter: ipset: drop logically empty buckets in mtype_del - gpib: Fix fluke driver s390 compile issue - vt: discard stale unicode buffer on alt screen exit after resize - vt: resize saved unicode buffer on alt screen exit after resize - vxlan: validate ND option lengths in vxlan_na_create - net: ftgmac100: fix ring allocation unwind on open failure - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path - sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU - sched_ext: Fix stale direct dispatch state in ddsp_dsq_id - gpio: mxc: map Both Edge pad wakeup to Rising Edge - gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() - thermal: core: Address thermal zone removal races with resume - thermal: core: Fix thermal zone device registration error path - misc: fastrpc: possible double-free of cctx->remote_heap - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe - usb: typec: thunderbolt: Set enter_vdo during initialization - [amd64] thunderbolt: Fix property read in nhi_wake_supported() - USB: dummy-hcd: Fix locking/synchronization error - USB: dummy-hcd: Fix interrupt synchronization error - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - usb: typec: ucsi: validate connector number in ucsi_notify_common() - HID: appletb-kbd: add .resume method in PM - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - usb: gadget: f_eem: Fix net_device lifecycle with device_move - usb: gadget: f_subset: Fix net_device lifecycle with device_move - usb: gadget: f_rndis: Fix net_device lifecycle with device_move - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - usb: gadget: f_uac1_legacy: validate control request size - kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid() - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() - kallsyms: cleanup code for appending the module buildid - kallsyms: prevent module removal when printing module name and buildid - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Checksums-Sha1: 86cdb87bbe747e11d426799c251ab851889bb2aa 196166 linux_6.19.12-1.dsc 5628cfa2a4ec0b68a97dc62ac3645b87b7053f7f 159223952 linux_6.19.12.orig.tar.xz 26007b1a755038997aad99e7e9bac09e21a31aee 1489288 linux_6.19.12-1.debian.tar.xz 1ddc9c8cea77fa321c9ea8e1229c07155c28a031 6913 linux_6.19.12-1_source.buildinfo Checksums-Sha256: 8566caf61792e234acce92ff16d0bdd1d69a05e873856d97220516393d32fb52 196166 linux_6.19.12-1.dsc 6876071aae89cb7e131532d2064c4597409457b934ca3a94f7717999ea277266 159223952 linux_6.19.12.orig.tar.xz 01d58687b9d1fcd681fc9a3354a9ef94319f814d19c58c1855e01e60c214fbf6 1489288 linux_6.19.12-1.debian.tar.xz 804b3a245006f8a0c94811335269c108f52bf9c861a8cc081825b44a721afb23 6913 linux_6.19.12-1_source.buildinfo Files: 7ae0e36f55a935bc0ab934dfbb0eb407 196166 kernel optional linux_6.19.12-1.dsc afbd1f8ed2a94f1659ca92c0d68f2bc5 159223952 kernel optional linux_6.19.12.orig.tar.xz 1fc527b23e2e9cb5fe6eb2a42d72fd18 1489288 kernel optional linux_6.19.12-1.debian.tar.xz 273df2766973bab10baacdd3d863be32 6913 kernel optional linux_6.19.12-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmndPutfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89EFjYP/1KjYi7wwE1w5C3OREZZ2eO5IHpfv+Mf mxFSSu5DGFOHPeGzN+OZt6DPhHii7XJdx5i9aOpPe9E1hyFmT94FLP0XEk+3sy7s CL2KXc5LayPJDod0xeVlJ4nWgaB7CGb9bf0RGv9a19TSEccQaMeRTZuVY38BCivt UwEaMwencqd85wwPuTkYOK/4ayoqdfFJ869mN1bzosaJ+ljz/l3bjkDYdFzOpUUJ HnSPJPfBo0gCeW8zeM2y69YB7yxGDXvX3RcqkIWqrQsz2rCsHVAvOny6qwSHRvZb e5L7knxUfbQTuUyDrqayK9iuKtRjXL5bv7imDYDy+UH2vTqZjLargpqNfPoBm7b5 Hm5LwdxKZLR21gs58m2gC0mXeqJ3gRF2snR0Xq9HHXFlJZYhe+6ha5FGzFqQQfaA qU0yq+m1FGlZZwelpRuv2dWEdhkiu7jhpk394Ri9T8c5A7fLRRnN7CG+T3+V9mW3 TtgjcAo5QKtD1zO+kYNNTgZoauJhE9Ou6bYeP3iGwturRwRQhA309nOC79lks5t7 +d4R3fEmQnunfd3YJWrCobvXq4h/sBEiowCMUF8NSV0y36gh9nmsPUETkX+Dq4q+ YH3RelXEjKFxpYswvdThTDX3c7UyplIia/dHqhGQkqmtTLTZa4ssYfTdhpGAMtEZ QNfHtrJA5VgQ =AMbM -----END PGP SIGNATURE-----
pgpbnbUyXxafS.pgp
Description: PGP signature
