Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-01-26
Ported from the following upstream stable releases:
v6.6.111, v6.6.112, v6.12.52, v6.12.53
from git://git.kernel.org/
media: tunner: xc5000: Refactor firmware load
media: tuner: xc5000: Fix use-after-free in xc5000_release
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
USB: serial: option: add SIMCom 8230C compositions
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
ASoC: amd: acp: Adjust pdm gain value
dm-integrity: limit MAX_TAG_SIZE to 255
platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
perf subcmd: avoid crash in exclude_cmds when excludes is empty
ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
btrfs: ref-verify: handle damaged extent root tree
can: hi311x: fix null pointer dereference when resuming from sleep before
interface was enabled
can: rcar_canfd: Fix controller mode setting
platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list
ALSA: usb-audio: Kill timer properly at removal
ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
hid: fix I2C read buffer overflow in raw_event() for mcp2221
serial: stm32: allow selecting console when the driver is module
UBUNTU: [Config] enable SERIAL_STM32_CONSOLE
staging: axis-fifo: fix maximum TX packet length check
staging: axis-fifo: fix TX handling on copy_from_user() failure
staging: axis-fifo: flush RX FIFO on read errors
driver core/PM: Set power.no_callbacks along with power.no_pm
riscv: mm: Use hint address in mmap if available
riscv: mm: Do not restrict mmap address based on hint
crypto: rng - Ensure set_ent is always present
net/9p: fix double req put in p9_fd_cancelled
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
filelock: add FL_RECLAIM to show_fl_flags() macro
init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
selftests: arm64: Check fread return value in exec_target
gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
coresight: trbe: Prevent overflow in PERF_IDX2OFF()
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
smb: server: fix IRD/ORD negotiation with the client
x86/vdso: Fix output operand size of RDPID
arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
regmap: Remove superfluous check for !config in __regmap_init()
bpf/selftests: Fix test_tcpnotify_user
bpf: Remove migrate_disable in kprobe_multi_link_prog_run
libbpf: Fix reuse of DEVMAP
ARM: dts: renesas: porter: Fix CAN pin group
leds: flash: leds-qcom-flash: Update torch current clamp setting
cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
pinctrl: meson-gxl: add missing i2c_d pinmux
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
ARM: at91: pm: fix MCKx restore routine
arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
regulator: scmi: Use int type to store negative error codes
selftests/nolibc: fix EXPECT_NZ macro
block: use int to store blk_stack_limits() return value
PM: sleep: core: Clear power.must_resume in noirq suspend error path
ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use
correct boolean syntax
ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use
correct boolean syntax in DTS
ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
power: supply: cw2015: Fix a alignment coding style issue
pinctrl: renesas: Use int type to store negative error codes
null_blk: Fix the description of the cache_size module argument
arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
nbd: restrict sockets to TCP and UDP
firmware: firmware: meson-sm: fix compile-test default
cpuidle: qcom-spm: fix device and OF node leaks at probe
arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
pwm: tiehrpwm: Fix corner case in clock divisor calculation
ACPICA: Fix largest possible resource descriptor index
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
i3c: master: svc: Use manual response for IBI events
i3c: master: svc: Recycle unused IBI slot
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
bpf: Explicitly check accesses to bpf_sock_addr
smp: Fix up and expand the smp_call_function_many() kerneldoc
tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
headers
once: fix race by moving DO_ONCE to separate section
hwmon: (mlxreg-fan) Separate methods of fan setting coming from different
subsystems
thermal/drivers/qcom: Make LMH select QCOM_SCM
thermal/drivers/qcom/lmh: Add missing IRQ includes
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
i2c: designware: Fix clock issue when PM is disabled
i2c: designware: Add disabling clocks when probe fails
bpf: Enforce expected_attach_type for tailcall compatibility
drm/panel: novatek-nt35560: Fix invalid return value
drm/radeon/r600_cs: clean up of dead code in r600_cs
f2fs: fix condition in __allow_reserved_blocks()
drm/bridge: it6505: select REGMAP_I2C
media: zoran: Remove zoran_fh structure
phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
serial: max310x: Add error checking in probe()
drm/amd/display: Remove redundant semicolons
crypto: keembay - Add missing check after sg_nents_for_len()
hwrng: nomadik - add ARM_AMBA dependency
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
scsi: myrs: Fix dma_alloc_coherent() error check
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
RDMA/mlx5: Fix vport loopback forcing for MPV device
ALSA: lx_core: use int type to store negative error codes
media: st-delta: avoid excessive stack usage
crypto: hisilicon/zip - remove unnecessary validation for high-performance mode
configurations
crypto: hisilicon - re-enable address prefetch after device resuming
crypto: hisilicon/qm - check whether the input function and PF are on the same
device
inet: ping: check sock_net() in ping_get_port() and ping_lookup()
coresight: Only register perf symlink for sinks with alloc_buffer
drm/amdgpu: Power up UVD 3 for FW validation (v2)
drm/amd/pm: Disable ULV even if unsupported (v3)
drm/amd/pm: Fix si_upload_smc_data (v3)
drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
wifi: mwifiex: send world regulatory domain to driver
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
tcp: fix __tcp_close() to only send RST when required
drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
usb: phy: twl6030: Fix incorrect type for ret
usb: gadget: configfs: Correctly set use_os_string at bind
tty: n_gsm: Don't block input queue by waiting MSC
misc: genwqe: Fix incorrect cmd field being reported in error
pps: fix warning in pps_register_cdev when register device fail
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
drm/msm/dpu: fix incorrect type for ret
fs: ntfs3: Fix integer overflow in run_unpack()
fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
iio: consumers: Fix handling of negative channel scale in
iio_convert_raw_to_processed()
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
netfilter: ipset: Remove unused htable_bits in macro ahash_region
ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
drivers/base/node: handle error properly in register_one_node()
RDMA/cm: Rate limit destroy CM ID timeout error message
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
f2fs: fix to truncate first page in error path of f2fs_truncate()
f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
scsi: qla2xxx: edif: Fix incorrect sign of error code
scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
f2fs: fix zero-sized extent for precache extents
RDMA/core: Resolve MAC of next-hop device without ARP support
IB/sa: Fix sa_local_svc_timeout_ms read race
Documentation: trace: historgram-design: Separate sched_waking histogram
section heading and the following diagram
wifi: mac80211: fix Rx packet handling when pubsta information is not available
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
III
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
vfio/pds: replace bitmap_free with vfree
crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
RDMA/rxe: Fix race in do_task() when draining
wifi: rtw89: avoid circular locking dependency in ser_state_run()
PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
coresight-etm4x: Conditionally access register TRCEXTINSELR
coresight: etm4x: Support atclk
coresight: trbe: Return NULL pointer for allocation failures
NFSv4.1: fix backchannel max_resp_sz verification check
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
usb: vhci-hcd: Prevent suspending virtually attached devices
RDMA/siw: Always report immediate post SQ errors
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
vhost: vringh: Fix copy_to_iter return value check
Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
Bluetooth: ISO: Fix possible UAF on iso_conn_free
Bluetooth: ISO: don't leak skb in ISO_CONT RX
Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
KEYS: X.509: Fix Basic Constraints CA flag parsing
hwrng: ks-sa - fix division by zero in ks_sa_rng_init
ocfs2: fix double free in user_cluster_connect()
drivers/base/node: fix double free in register_one_node()
mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
nfp: fix RSS hash key size when RSS is not supported
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
configurable
net: dlink: handle copy_thresh allocation failure
net/mlx5: Stop polling for command response if interface goes down
net/mlx5: pagealloc: Fix reclaim race during command interface teardown
net/mlx5: fw reset, add reset timeout work
smb: client: fix crypto buffers in non-linear memory
vhost: vringh: Modify the return value check
bpf: Reject negative offsets for ALU ops
Squashfs: fix uninit-value in squashfs_get_parent
uio_hv_generic: Let userspace take care of interrupt mask
ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
fs: udf: fix OOB read in lengthAllocDescs handling
net: nfc: nci: Add parameter validation for packet data
mfd: rz-mtu3: Fix MTU5 NFCR register offset
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
dm: fix queue start/stop imbalance under suspend/load/resume races
dm: fix NULL pointer dereference in __dm_suspend()
LoongArch: Automatically disable kaslr if boot from kexec_file
ksmbd: fix error code overwriting in smb2_get_info_filesystem()
ext4: fix checks for orphan inodes
mm: hugetlb: avoid soft lockup when mprotect to large memory area
nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
misc: fastrpc: Fix fastrpc_map_lookup operation
misc: fastrpc: fix possible map leak in fastrpc_put_args
misc: fastrpc: Skip reference for DMA handles
Input: atmel_mxt_ts - allow reset GPIO to sleep
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
sunrpc: fix null pointer dereference on zero-length checksum
remoteproc: pru: Fix potential NULL pointer dereference in
pru_rproc_set_ctable()
pinctrl: check the return value of pinmux_ops::get_function_name()
bus: fsl-mc: Check return value of platform_get_resource()
net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
usb: typec: tipd: Clear interrupts first
arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
netfs: Prevent duplicate unlocking
nvmem: layouts: fix automatic module loading
uprobes: uprobe_warn should use passed task
lsm: CONFIG_LSM can depend on CONFIG_SECURITY
vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO
PM / devfreq: rockchip-dfi: double count on RK3588
soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
pwm: tiehrpwm: Don't drop runtime PM reference in .free()
pwm: tiehrpwm: Make code comment in .free() more useful
pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation
riscv, bpf: Sign extend struct ops return values properly
spi: fix return code when spi device has too many chipselects
bpf: Mark kfuncs as __noclone
crypto: octeontx2 - Call strscpy() with correct size argument
RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
idpf: fix Rx descriptor ready check barrier in splitq
wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
HID: hidraw: tighten ioctl command parsing
wifi: ath12k: fix wrong logging ID used for CE
iommu/vt-d: debugfs: Fix legacy mode page table dump logic
coresight: tmc: Move ACPI support from AMBA driver to platform driver
coresight: tmc: Support atclk
coresight: catu: Move ACPI support from AMBA driver to platform driver
coresight: catu: Support atclk
coresight: Fix incorrect handling for return value of devm_kzalloc
PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
PCI: rcar-gen4: Assure reset occurs before DBI access
iommu/vt-d: Disallow dirty tracking if incoherent page walk
ptp: Add a upper bound on max_vclocks
Bluetooth: ISO: free rx_skb if not consumed
PCI: j721e: Fix incorrect error message in probe()
io_uring/waitid: always prune wait queue entry in io_waitid_wait()
fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
tee: fix register_shm_helper()
UBUNTU: Upstream stable to v6.6.111, v6.6.112, v6.12.52, v6.12.53
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-01-26
+
+ Ported from the following upstream stable releases:
+ v6.6.111, v6.6.112, v6.12.52, v6.12.53
+
from git://git.kernel.org/
+
+ media: tunner: xc5000: Refactor firmware load
+ media: tuner: xc5000: Fix use-after-free in xc5000_release
+ media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
+ USB: serial: option: add SIMCom 8230C compositions
+ wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
+ ASoC: amd: acp: Adjust pdm gain value
+ dm-integrity: limit MAX_TAG_SIZE to 255
+ platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
+ perf subcmd: avoid crash in exclude_cmds when excludes is empty
+ ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
+ btrfs: ref-verify: handle damaged extent root tree
+ can: hi311x: fix null pointer dereference when resuming from sleep before
interface was enabled
+ can: rcar_canfd: Fix controller mode setting
+ platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list
+ ALSA: usb-audio: Kill timer properly at removal
+ ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
+ hid: fix I2C read buffer overflow in raw_event() for mcp2221
+ serial: stm32: allow selecting console when the driver is module
+ UBUNTU: [Config] enable SERIAL_STM32_CONSOLE
+ staging: axis-fifo: fix maximum TX packet length check
+ staging: axis-fifo: fix TX handling on copy_from_user() failure
+ staging: axis-fifo: flush RX FIFO on read errors
+ driver core/PM: Set power.no_callbacks along with power.no_pm
+ riscv: mm: Use hint address in mmap if available
+ riscv: mm: Do not restrict mmap address based on hint
+ crypto: rng - Ensure set_ent is always present
+ net/9p: fix double req put in p9_fd_cancelled
+ KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
+ filelock: add FL_RECLAIM to show_fl_flags() macro
+ init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
+ seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
+ selftests: arm64: Check fread return value in exec_target
+ gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
+ coresight: trbe: Prevent overflow in PERF_IDX2OFF()
+ perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+ smb: server: fix IRD/ORD negotiation with the client
+ x86/vdso: Fix output operand size of RDPID
+ arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
+ regmap: Remove superfluous check for !config in __regmap_init()
+ bpf/selftests: Fix test_tcpnotify_user
+ bpf: Remove migrate_disable in kprobe_multi_link_prog_run
+ libbpf: Fix reuse of DEVMAP
+ ARM: dts: renesas: porter: Fix CAN pin group
+ leds: flash: leds-qcom-flash: Update torch current clamp setting
+ cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
+ ACPI: processor: idle: Fix memory leak when register cpuidle device failed
+ soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+ pinctrl: meson-gxl: add missing i2c_d pinmux
+ blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
+ ARM: at91: pm: fix MCKx restore routine
+ arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
+ regulator: scmi: Use int type to store negative error codes
+ selftests/nolibc: fix EXPECT_NZ macro
+ block: use int to store blk_stack_limits() return value
+ PM: sleep: core: Clear power.must_resume in noirq suspend error path
+ ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to
use correct boolean syntax
+ ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use
correct boolean syntax in DTS
+ ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
+ PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
+ power: supply: cw2015: Fix a alignment coding style issue
+ pinctrl: renesas: Use int type to store negative error codes
+ null_blk: Fix the description of the cache_size module argument
+ arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
+ nbd: restrict sockets to TCP and UDP
+ firmware: firmware: meson-sm: fix compile-test default
+ cpuidle: qcom-spm: fix device and OF node leaks at probe
+ arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
+ arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
+ arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+ pwm: tiehrpwm: Fix corner case in clock divisor calculation
+ ACPICA: Fix largest possible resource descriptor index
+ nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
+ i3c: master: svc: Use manual response for IBI events
+ i3c: master: svc: Recycle unused IBI slot
+ selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
+ bpf: Explicitly check accesses to bpf_sock_addr
+ smp: Fix up and expand the smp_call_function_many() kerneldoc
+ tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
headers
+ once: fix race by moving DO_ONCE to separate section
+ hwmon: (mlxreg-fan) Separate methods of fan setting coming from different
subsystems
+ thermal/drivers/qcom: Make LMH select QCOM_SCM
+ thermal/drivers/qcom/lmh: Add missing IRQ includes
+ i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+ i2c: designware: Fix clock issue when PM is disabled
+ i2c: designware: Add disabling clocks when probe fails
+ bpf: Enforce expected_attach_type for tailcall compatibility
+ drm/panel: novatek-nt35560: Fix invalid return value
+ drm/radeon/r600_cs: clean up of dead code in r600_cs
+ f2fs: fix condition in __allow_reserved_blocks()
+ drm/bridge: it6505: select REGMAP_I2C
+ media: zoran: Remove zoran_fh structure
+ phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
+ usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
+ usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
+ serial: max310x: Add error checking in probe()
+ drm/amd/display: Remove redundant semicolons
+ crypto: keembay - Add missing check after sg_nents_for_len()
+ hwrng: nomadik - add ARM_AMBA dependency
+ scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+ scsi: myrs: Fix dma_alloc_coherent() error check
+ media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+ RDMA/mlx5: Fix vport loopback forcing for MPV device
+ ALSA: lx_core: use int type to store negative error codes
+ media: st-delta: avoid excessive stack usage
+ crypto: hisilicon/zip - remove unnecessary validation for high-performance
mode configurations
+ crypto: hisilicon - re-enable address prefetch after device resuming
+ crypto: hisilicon/qm - check whether the input function and PF are on the
same device
+ inet: ping: check sock_net() in ping_get_port() and ping_lookup()
+ coresight: Only register perf symlink for sinks with alloc_buffer
+ drm/amdgpu: Power up UVD 3 for FW validation (v2)
+ drm/amd/pm: Disable ULV even if unsupported (v3)
+ drm/amd/pm: Fix si_upload_smc_data (v3)
+ drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
+ drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
+ drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
+ drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
+ wifi: mwifiex: send world regulatory domain to driver
+ PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
+ tcp: fix __tcp_close() to only send RST when required
+ drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
+ usb: phy: twl6030: Fix incorrect type for ret
+ usb: gadget: configfs: Correctly set use_os_string at bind
+ tty: n_gsm: Don't block input queue by waiting MSC
+ misc: genwqe: Fix incorrect cmd field being reported in error
+ pps: fix warning in pps_register_cdev when register device fail
+ ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+ ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+ ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+ drm/msm/dpu: fix incorrect type for ret
+ fs: ntfs3: Fix integer overflow in run_unpack()
+ fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
+ iio: consumers: Fix handling of negative channel scale in
iio_convert_raw_to_processed()
+ iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+ netfilter: ipset: Remove unused htable_bits in macro ahash_region
+ ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
+ watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
+ drivers/base/node: handle error properly in register_one_node()
+ RDMA/cm: Rate limit destroy CM ID timeout error message
+ wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+ f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
+ f2fs: fix to truncate first page in error path of f2fs_truncate()
+ f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
+ ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+ scsi: qla2xxx: edif: Fix incorrect sign of error code
+ scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
+ scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
+ f2fs: fix zero-sized extent for precache extents
+ RDMA/core: Resolve MAC of next-hop device without ARP support
+ IB/sa: Fix sa_local_svc_timeout_ms read race
+ Documentation: trace: historgram-design: Separate sched_waking histogram
section heading and the following diagram
+ wifi: mac80211: fix Rx packet handling when pubsta information is not
available
+ sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
+ sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
III
+ sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
+ sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+ sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+ vfio/pds: replace bitmap_free with vfree
+ crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
+ RDMA/rxe: Fix race in do_task() when draining
+ wifi: rtw89: avoid circular locking dependency in ser_state_run()
+ PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
+ remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+ coresight-etm4x: Conditionally access register TRCEXTINSELR
+ coresight: etm4x: Support atclk
+ coresight: trbe: Return NULL pointer for allocation failures
+ NFSv4.1: fix backchannel max_resp_sz verification check
+ scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+ usb: vhci-hcd: Prevent suspending virtually attached devices
+ RDMA/siw: Always report immediate post SQ errors
+ net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+ vhost: vringh: Fix copy_to_iter return value check
+ Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
+ Bluetooth: ISO: Fix possible UAF on iso_conn_free
+ Bluetooth: ISO: don't leak skb in ISO_CONT RX
+ Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
+ KEYS: X.509: Fix Basic Constraints CA flag parsing
+ hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+ ocfs2: fix double free in user_cluster_connect()
+ drivers/base/node: fix double free in register_one_node()
+ mtd: rawnand: atmel: Fix error handling path in
atmel_nand_controller_add_nands
+ nfp: fix RSS hash key size when RSS is not supported
+ net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
configurable
+ net: dlink: handle copy_thresh allocation failure
+ net/mlx5: Stop polling for command response if interface goes down
+ net/mlx5: pagealloc: Fix reclaim race during command interface teardown
+ net/mlx5: fw reset, add reset timeout work
+ smb: client: fix crypto buffers in non-linear memory
+ vhost: vringh: Modify the return value check
+ bpf: Reject negative offsets for ALU ops
+ Squashfs: fix uninit-value in squashfs_get_parent
+ uio_hv_generic: Let userspace take care of interrupt mask
+ ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
+ ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
+ fs: udf: fix OOB read in lengthAllocDescs handling
+ net: nfc: nci: Add parameter validation for packet data
+ mfd: rz-mtu3: Fix MTU5 NFCR register offset
+ mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
+ dm: fix queue start/stop imbalance under suspend/load/resume races
+ dm: fix NULL pointer dereference in __dm_suspend()
+ LoongArch: Automatically disable kaslr if boot from kexec_file
+ ksmbd: fix error code overwriting in smb2_get_info_filesystem()
+ ext4: fix checks for orphan inodes
+ mm: hugetlb: avoid soft lockup when mprotect to large memory area
+ nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
+ misc: fastrpc: Fix fastrpc_map_lookup operation
+ misc: fastrpc: fix possible map leak in fastrpc_put_args
+ misc: fastrpc: Skip reference for DMA handles
+ Input: atmel_mxt_ts - allow reset GPIO to sleep
+ Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
+ sunrpc: fix null pointer dereference on zero-length checksum
+ remoteproc: pru: Fix potential NULL pointer dereference in
pru_rproc_set_ctable()
+ pinctrl: check the return value of pinmux_ops::get_function_name()
+ bus: fsl-mc: Check return value of platform_get_resource()
+ net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
+ usb: typec: tipd: Clear interrupts first
+ arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
+ usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
+ wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
+ Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
+ wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
+ netfs: Prevent duplicate unlocking
+ nvmem: layouts: fix automatic module loading
+ uprobes: uprobe_warn should use passed task
+ lsm: CONFIG_LSM can depend on CONFIG_SECURITY
+ vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
+ selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO
+ PM / devfreq: rockchip-dfi: double count on RK3588
+ soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
+ soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
+ pwm: tiehrpwm: Don't drop runtime PM reference in .free()
+ pwm: tiehrpwm: Make code comment in .free() more useful
+ pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation
+ riscv, bpf: Sign extend struct ops return values properly
+ spi: fix return code when spi device has too many chipselects
+ bpf: Mark kfuncs as __noclone
+ crypto: octeontx2 - Call strscpy() with correct size argument
+ RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
+ idpf: fix Rx descriptor ready check barrier in splitq
+ wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
+ wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
+ HID: hidraw: tighten ioctl command parsing
+ wifi: ath12k: fix wrong logging ID used for CE
+ iommu/vt-d: debugfs: Fix legacy mode page table dump logic
+ coresight: tmc: Move ACPI support from AMBA driver to platform driver
+ coresight: tmc: Support atclk
+ coresight: catu: Move ACPI support from AMBA driver to platform driver
+ coresight: catu: Support atclk
+ coresight: Fix incorrect handling for return value of devm_kzalloc
+ PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
+ PCI: rcar-gen4: Assure reset occurs before DBI access
+ iommu/vt-d: Disallow dirty tracking if incoherent page walk
+ ptp: Add a upper bound on max_vclocks
+ Bluetooth: ISO: free rx_skb if not consumed
+ PCI: j721e: Fix incorrect error message in probe()
+ io_uring/waitid: always prune wait queue entry in io_waitid_wait()
+ fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
+ tee: fix register_shm_helper()
+ UBUNTU: Upstream stable to v6.6.111, v6.6.112, v6.12.52, v6.12.53
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2139072
Title:
Noble update: upstream stable patchset 2026-01-26
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2139072/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
