** Description changed:
-
- SRU Justification
-
- Impact:
- The upstream process for stable tree updates is quite similar
- in scope to the Ubuntu SRU process, e.g., each patch has to
- demonstrably fix a bug, and each patch is vetted by upstream
- by originating either directly from a mainline/stable Linux tree or
- a minimally backported form of that patch. The following upstream
- stable patches should be included in the Ubuntu kernel:
-
- upstream stable patchset 2026-03-26
-
- Ported from the following upstream stable releases:
- v6.6.122, v6.12.67
-
- from git://git.kernel.org/
+ SRU Justification
+
+ Impact:
+ The upstream process for stable tree updates is quite similar
+ in scope to the Ubuntu SRU process, e.g., each patch has to
+ demonstrably fix a bug, and each patch is vetted by upstream
+ by originating either directly from a mainline/stable Linux tree or
+ a minimally backported form of that patch. The following upstream
+ stable patches should be included in the Ubuntu kernel:
+
+ upstream stable patchset 2026-03-26
+
+ Ported from the following upstream stable releases:
+ v6.6.122, v6.12.67, v6.12.68
+
+ from git://git.kernel.org/
firmware: imx: scu-irq: Set mu_resource_id before get handle
efi/cper: Fix cper_bits_to_str buffer handling and return value
ASoC: codecs: wsa884x: fix codec initialisation
xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
can: etas_es58x: allow partial RX URB allocation to succeed
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
btrfs: send: check for inline extents in range_is_hole_in_parent()
net: bridge: annotate data-races around fdb->{updated,used}
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
net: update netdev_lock_{type,name}
macvlan: fix possible UAF in macvlan_forward_source()
ipv4: ip_gre: make ipgre_header() robust
vsock/test: add a final full barrier after run all tests
net/mlx5e: Restore destroying state bit after profile cleanup
btrfs: store fs_info in space_info
btrfs: factor out init_space_info() from create_space_info()
btrfs: factor out check_removing_space_info() from btrfs_free_block_groups()
btrfs: introduce btrfs_space_info sub-group
btrfs: fix memory leaks in create_space_info() error paths
net: hv_netvsc: reject RSS hash key programming without RX indirection table
ipv6: Fix use-after-free in inet6_addr_del().
selftests: drv-net: fix RPS mask handling for high CPU numbers
net/sched: sch_qfq: do not free existing class in qfq_change_class()
ASoC: tlv320adcx140: fix null pointer
ASoC: tlv320adcx140: fix word length
textsearch: describe @list member in ts_ops search
mm, kfence: describe @slab parameter in __kfence_obj_info()
dmaengine: xilinx: xdma: Fix regmap max_register
dmaengine: tegra-adma: Fix use-after-free
dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth"
property is missing
phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
phy: phy-snps-eusb2: refactor constructs names
phy: drop probe registration printks
phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
phy: stm32-usphyc: Fix off by one in probe()
phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
dmaengine: omap-dma: fix dma_pool resource leak in error paths
i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
HID: usbhid: paper over wrong bNumDescriptor field
scsi: core: Fix error handler encryption support
ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
null_blk: fix kmemleak by releasing references to fault configfs items
can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon
receiving the second rts
x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
phy: rockchip: inno-usb2: fix communication disruption in gadget mode
phy: freescale: imx8m-pcie: assert phy reset during power on
phy: rockchip: inno-usb2: fix disconnection in gadget mode
phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
usb: dwc3: Check for USB4 IP_NAME
usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
USB: OHCI/UHCI: Add soft dependencies on ehci_platform
USB: serial: option: add Telit LE910 MBIM composition
USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
nvme-pci: disable secondary temp for Wodposit WPBSNM8
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
hrtimer: Fix softirq base check in update_needs_ipi()
EDAC/x38: Fix a resource leak in x38_probe1()
EDAC/i3200: Fix a resource leak in i3200_probe1()
tcpm: allow looking for role_sw device in the main node
x86/resctrl: Add missing resctrl initialization for Hygon
x86/resctrl: Fix memory bandwidth counter width for Hygon
mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
LoongArch: Fix PMU counter allocation for mixed-type event groups
drm/amd/display: Bump the HDMI clock to 340MHz
drm/amd: Clean up kfd node on surprise disconnect
drm/amdkfd: fix a memory leak in device_queue_manager_init()
drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
dmaengine: apple-admac: Add "apple,t8103-admac" compatible
dmaengine: at_hdmac: fix device leak on of_dma_xlate()
dmaengine: bcm-sba-raid: fix device leak on probe
dmaengine: dw: dmamux: fix OF node leak on route allocation failure
dmaengine: idxd: fix device leaks on compat bind and unbind
dmaengine: lpc18xx-dmamux: fix device leak on route allocation
dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
dmaengine: ti: k3-udma: fix device leak on udma lookup
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
io_uring: move local task_work in exit cancel loop
posix-clock: Store file pointer in struct posix_clock_context
ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
selftest/ptp: update ptp selftest to exercise the gettimex options
testptp: Add option to open PHC in readonly mode
arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_*
Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
ata: libata: Add cpr_log to ata_dev_print_features() early return
ata: libata-core: Introduce ata_dev_config_lpm()
ata: libata: Call ata_dev_config_lpm() for ATAPI devices
ata: libata: Print features also for ATAPI devices
ice: initialize ring_stats->syncp
ice: Avoid detrimental cleanup for bond during interface stop
igc: fix race condition in TX timestamp read for register 0
net: usb: dm9601: remove broken SR9700 support
bonding: limit BOND_MODE_8023AD to Ethernet devices
selftests: net: fib-onlink-tests: Convert to use namespaces by default
can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb()
error
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
amd-xgbe: avoid misleading per-packet error log
gue: Fix skb memleak with inner IP protocol 0.
tools: ynl: Specify --no-line-number in ynl-regen.sh.
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
veth: fix data race in veth_get_ethtool_stats
l2tp: avoid one data-race in l2tp_tunnel_del_work()
ipvlan: Make the addrs_lock be per port
octeontx2: cn10k: fix RX flowid TCAM mask handling
net/sched: qfq: Use cl_is_active to determine whether class is active in
qfq_rm_from_ag
serial: 8250_pci: Fix broken RS485 for F81504/508/512
comedi: dmm32at: serialize use of paged registers
w1: therm: Fix off-by-one buffer overflow in alarms_store
w1: fix redundant counter decrement in w1_attach_slave_device()
Revert "nfc/nci: Add the inconsistency check between the input data length
and count"
Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
scsi: storvsc: Process unsupported MODE_SENSE_10
scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
arm64: dts: rockchip: remove dangerous max-link-speed from helios64
arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro
x86/kfence: avoid writing L1TF-vulnerable PTEs
comedi: Fix getting range information for subdevices 16 to 255
platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
iio: adc: ad7280a: handle spi_setup() errors in probe()
interconnect: debugfs: initialize src_node and dst_node to empty strings
spi: spi-sprd-adi: Fix double free in probe error path
regmap: Fix race condition in hwspinlock irqsave routine
kconfig: fix static linking of nconf
riscv: clocksource: Fix stimecmp update hazard on RV32
scsi: core: Wake up the error handler when final completions race against
each other
scsi: qla2xxx: Sanitize payload size to prevent member overflow
ALSA: usb: Increase volume range that triggers a warning
netdevsim: fix a race issue related to the operation on bpf_bound_progs list
net: hns3: fix data race in hns3_fetch_stats
be2net: fix data race in be_get_new_eqd
net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
mISDN: annotate data-race around dev->work
ipv6: annotate data-race in ndisc_router_discovery()
usbnet: limit max_mtu based on device's hard_mtu
drm/amd/pm: Don't clear SI SMC table when setting power limit
drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
selftests: net: amt: wait longer for connection before sending packets
bonding: provide a net pointer to __skb_flow_dissect()
net: dsa: fix off-by-one in maximum bridge ID determination
octeontx2-af: Fix error handling
net: openvswitch: fix data race in ovs_vport_get_upcall_stats
vsock/virtio: fix potential underflow in virtio_transport_get_credit()
vsock/test: fix seqpacket message bounds test
vsock/virtio: cap TX credit to local buffer size
net/sched: act_ife: avoid possible NULL deref
x86: make page fault handling disable interrupts properly
leds: led-class: Only Add LED to leds_list when it is fully ready
of: fix reference count leak in of_alias_scan()
of: platform: Use default match table for /firmware
iio: accel: iis328dq: fix gain values
iio: adc: ad9467: fix ad9434 vref mask
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
iio: chemical: scd4x: fix reported channel endianness
iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
wifi: ath10k: fix dma_free_coherent() pointer
wifi: ath12k: fix dma_free_coherent() pointer
wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
wifi: rsi: Fix memory corruption due to not set vif driver data size
arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
arm64: Set __nocfi on swsusp_arch_resume()
octeontx2: Fix otx2_dma_map_page() error return code
slimbus: core: fix runtime PM imbalance on report present
slimbus: core: fix device reference leak on report present
tracing: Fix crash on synthetic stacktrace field usage
intel_th: fix device leak on output open()
uacce: fix cdev handling in the cleanup path
uacce: fix isolate sysfs check condition
uacce: implement mremap in uacce_vm_ops to return -EPERM
uacce: ensure safe queue release with state management
netrom: fix double-free in nr_route_frame()
platform/x86: hp-bioscfg: Fix automatic module loading
pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
perf/x86/intel: Do not enable BTS for guests
irqchip/gic-v3-its: Avoid truncating memory addresses
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
migrate: correct lock ordering for hugetlb file folios
selftests/bpf: Check for timeout in perf_link test
bpf: Do not let BPF test infra emit invalid GSO types to stack
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup
failure
mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
iio: core: add missing mutex_destroy in iio_dev_release()
iio: core: add separate lockdep class for info_exist_lock
mm/rmap: fix two comments related to huge_pmd_unshare()
arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
ALSA: scarlett2: Fix buffer overflow in config retrieval
iio: adc: exynos_adc: fix OF populate on driver rebind
dmaengine: stm32: dmamux: fix device leak on route allocation
dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
mm/page_alloc: prevent pcp corruption with SMP=n
mm: kmsan: fix poisoning of high-order non-compound pages
phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
ASoC: codecs: wsa881x: Drop unused version readout
ASoC: codecs: wsa881x: fix unnecessary initialisation
ASoC: codecs: wsa883x: fix unnecessary initialisation
nvme-fc: rename free_ctrl callback to match name pattern
nvme-pci: do not directly handle subsys reset fallout
nvme: fix PCIe subsystem reset controller state transition
ksmbd: fix use-after-free in ksmbd_session_rpc_open
fs/ntfs3: Initialize allocated memory before use
wifi: ath11k: fix RCU stall while reaping monitor destination ring
x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
net: phy: fix phy_uses_state_machine()
pNFS: Fix a deadlock when returning a delegation during open()
NFS: Fix a deadlock involving nfs_release_folio()
pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
net/mlx5e: Fix crash on profile change rollback failure
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type
selftests/landlock: Fix TCP bind(AF_UNSPEC) test case
xfs: Fix the return value of xfs_rtcopy_summary()
phy: ti: gmii-sel: fix regmap leak on probe failure
LoongArch: dts: loongson-2k0500: Add default interrupt controller address
cells
LoongArch: dts: loongson-2k1000: Add default interrupt controller address
cells
LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names
LoongArch: dts: loongson-2k2000: Add default interrupt controller address
cells
HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume
blocking
HID: intel-ish-hid: Fix -Wcast-function-type-strict in
devm_ishtp_alloc_workqueue()
xfs: set max_agbno to allow sparse alloc of last full inode chunk
bpf: Reject narrower access to pointer ctx fields
selftests/bpf: Test invalid narrower ctx load
mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
mm/page_alloc: batch page freeing in decay_pcp_high
ata: libata-sata: Improve link_power_management_supported sysfs attribute
igc: Restore default Qbv schedule when changing channels
vsock/virtio: Coalesce only linear skb
platform/x86/amd: Fix memory leak in wbrf_record()
drm/imagination: Wait for FW trace update command completion
ice: Fix persistent failure in ice_get_rxfh
sched/fair: Fix pelt clock sync when entering idle
drm/nouveau: add missing DCB connector types
drm/nouveau: implement missing DCB connector types; gracefully handle unknown
connectors
dpll: Prevent duplicate registrations
mei: trace: treat reg parameter as string
s390/ap: Fix wrong APQN fill calculation
net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
gpio: cdev: Correct return code on memory allocation failure
dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA
exfat: fix refcount leak in exfat_find
accel/ivpu: Fix race condition when unbinding BOs
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
vsock/virtio: Rename virtio_vsock_alloc_skb()
vsock/virtio: Move SKB allocation lower-bound check to callers
vsock/virtio: Rename virtio_vsock_skb_rx_put()
vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
net: Introduce skb_copy_datagram_from_iter_full()
vsock/virtio: Fix message iterator handling on transmit path
- UBUNTU: Upstream stable to v6.6.122, v6.12.67
+ UBUNTU: Upstream stable to v6.6.122, v6.12.67, v6.12.68
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2146465
Title:
Noble update: upstream stable patchset 2026-03-26
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2146465/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
