Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-05-28
Ported from the following upstream stable releases:
v6.6.129, v6.6.130, v6.12.76, v6.12.77
from git://git.kernel.org/
drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
scsi: lpfc: Properly set WC for DPP mapping
scsi: pm8001: Fix use-after-free in pm8001_queue_command()
ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
rseq: Clarify rseq registration rseq_size bound check comment
scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
ALSA: usb-audio: Cap the packet size pre-calculations
ALSA: usb-audio: Use inclusive terms
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
ALSA: pci: hda: use snd_kcontrol_chip()
ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
btrfs: fix incorrect key offset in error message in check_dev_extent_item()
btrfs: fix objectid value in error message in check_extent_data_ref()
btrfs: fix warning in scrub_verify_one_metadata()
btrfs: fix compat mask in error messages in btrfs_check_features()
bpf: Fix stack-out-of-bounds write in devmap
PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
memory: mtk-smi: fix device leaks on common probe
memory: mtk-smi: fix device leak on larb probe
resource: Add resource set range and size helpers
PCI: Use resource_set_range() that correctly sets ->end
KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED
media: tegra-video: Fix memory leak in __tegra_channel_try_format()
KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject
KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
drm/tegra: dsi: fix device leak on probe
ext4: get rid of ppath in ext4_find_extent()
ext4: get rid of ppath in ext4_ext_create_new_leaf()
ext4: get rid of ppath in ext4_ext_insert_extent()
ext4: get rid of ppath in ext4_split_extent_at()
ext4: subdivide EXT4_EXT_DATA_VALID1
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
ext4: get rid of ppath in ext4_split_extent()
ext4: get rid of ppath in ext4_split_convert_extents()
ext4: get rid of ppath in ext4_convert_unwritten_extents_endio()
ext4: get rid of ppath in ext4_ext_convert_to_initialized()
ext4: get rid of ppath in ext4_ext_handle_unwritten_extents()
ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
ext4: drop extent cache when splitting extent fails
mailbox: Use of_property_match_string() instead of open-coding
mailbox: don't protect of_parse_phandle_with_args with con_mutex
mailbox: sort headers alphabetically
mailbox: remove unused header files
mailbox: Use dev_err when there is error
mailbox: Use guard/scoped_guard for con_mutex
mailbox: Allow controller specific mapping using fwnode
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
ext4: convert bd_bitmap_page to bd_bitmap_folio
ext4: convert bd_buddy_page to bd_buddy_folio
ext4: fix e4b bitmap inconsistency reports
arm64: dts: rockchip: Fix rk356x PCIe range mappings
clk: tegra: tegra124-emc: fix device leak on set_rate()
usb: cdns3: remove redundant if branch
usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
usb: cdns3: fix role switching during resume
drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced
race
ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
net: arcnet: com20020-pci: fix support for 2.5Mbit cards
eventpoll: Fix integer overflow in ep_loop_check_proc()
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
nfc: pn533: properly drop the usb interface reference on disconnect
net: usb: kaweth: validate USB endpoints
net: usb: kalmia: validate USB endpoints
net: usb: pegasus: validate USB endpoints
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
can: usb: f81604: correctly anchor the urb in the read bulk callback
can: ucan: Fix infinite loop from zero-length messages
can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
can: usb: f81604: handle short interrupt urb messages properly
can: usb: f81604: handle bulk write errors properly
HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
x86/efi: defer freeing of boot services memory
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
platform/x86: dell-wmi: Add audio/mic mute key codes
ALSA: usb-audio: Use correct version for UAC3 header validation
wifi: radiotap: reject radiotap with unknown bits
wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
net/sched: ets: fix divide by zero in the offload path
scsi: target: Fix recursive locking in __configfs_open_file()
Squashfs: check metadata block offset is within range
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
drbd: fix null-pointer dereference on local read error
smb: client: fix cifs_pick_channel when channels are equally loaded
smb: client: fix broken multichannel with krb5+signing
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
scsi: core: Fix refcount leak for tagset_refcnt
selftests: mptcp: more stable simult_flows tests
selftests: mptcp: join: check removing signal+subflow endp
ARM: clean up the memset64() C wrapper
hwmon: (aht10) Add support for dht20
hwmon: (aht10) Fix initialization commands for AHT20
pinctrl: equilibrium: rename irq_chip function callbacks
pinctrl: equilibrium: fix warning trace on load
platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
hwmon: (it87) Check the it87_lock() return value
e1000e: clear DPG_EN after reset to avoid autonomous power-gating
drm/solomon: Fix page start when updating rectangle in page addressing mode
net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE
table
xsk: Get rid of xdp_buff_xsk::xskb_list_node
xsk: s/free_list_node/list_node/
xsk: Fix fragment node deletion to prevent buffer leak
xsk: Fix zero-copy AF_XDP fragment drop
dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
can: bcm: fix locking for bcm_op runtime updates
can: mcp251x: fix deadlock in error path of mcp251x_open
rust: kunit: fix warning when !CONFIG_PRINTK
kunit: tool: copy caller args in run_kernel to prevent mutation
net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
octeon_ep: Relocate counter updates before NAPI
octeon_ep: avoid compiler and IQ/OQ reordering
wifi: cw1200: Fix locking in error paths
wifi: wlcore: Fix a locking bug
wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
indirect_call_wrapper: do not reevaluate function pointer
net/rds: Fix circular locking dependency in rds_tcp_tune
xen/acpi-processor: fix _CST detection using undersized evaluation buffer
bpf: export bpf_link_inc_not_zero.
bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info()
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
amd-xgbe: fix sleep while atomic on suspend/resume
drm/sched: Fix kernel-doc warning for drm_sched_job_done()
nvme: reject invalid pr_read_keys() num_keys values
nvme: fix memory allocation in nvme_pr_read_keys()
net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
net: nfc: nci: Fix zero-length proprietary notifications
nfc: nci: free skb on nci_transceive early error paths
nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
nfc: rawsock: cancel tx_work before socket teardown
net: stmmac: Fix error handling in VLAN add and delete paths
net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
mtk_xdp_setup()
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
net/sched: act_ife: Fix metalist update behavior
xdp: use modulo operation to calculate XDP frag tailroom
xsk: introduce helper to determine rxq->frag_size
i40e: fix registering XDP RxQ info
i40e: use xdp.frame_sz as XDP RxQ info frag_size
xdp: produce a warning when calculated tailroom is negative
selftest/arm64: Fix sve2p1_sigill() to hwcap test
tracing: Add NULL pointer check to trigger_data_free()
net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
net: tcp: accept old ack during closing
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
ACPI: PM: Save NVS memory on Lenovo G70-35
scsi: mpi3mr: Add NULL checks when resetting request and reply queues
unshare: fix unshare_fs() handling
wifi: mac80211: set default WMM parameters on all links
ACPI: OSI: Add DMI quirk for Acer Aspire One D255
scsi: ses: Fix devices attaching to different hosts
ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
ASoC: cs42l43: Report insert for exotic peripherals
scsi: ufs: core: Fix possible NULL pointer dereference in
ufshcd_add_command_trace()
scsi: ufs: core: Fix shift out of bounds when MAXQ=32
ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
ALSA: usb-audio: Check max frame size for implicit feedback mode, too
powerpc/uaccess: Fix inline assembly for clang build on PPC32
remoteproc: sysmon: Correct subsys_name_len type in QMI request
powerpc: 83xx: km83xx: Fix keymile vendor prefix
xprtrdma: Decrement re_receiving on the early exit paths
net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations
drm/msm/dsi: fix pclk rate calculation for bonded dsi
bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
net/mlx5: IFC updates for disabled host PF
net/mlx5: Query to see if host PF is disabled
net/mlx5: Fix deadlock between devlink lock and esw->wq
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave
xmit
ASoC: soc-core: drop delayed_work_pending() check before flush
ASoC: soc-core: flush delayed work before removing DAIs and widgets
ASoC: simple-card-utils: use __free(device_node) for device node
ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
net: sfp: improve Huawei MA5671a fixup
serial: caif: hold tty->link reference in ldisc_open and ser_release
mctp: i2c: fix skb memory leak in receive path
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
mctp: route: hold key->lock in mctp_flow_prepare_output()
amd-xgbe: fix link status handling in xgbe_rx_adaptation
amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
netfilter: x_tables: guard option walkers against 1-byte tail reads
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
regulator: pca9450: Make IRQ optional
regulator: pca9450: Correct interrupt type
sched: idle: Make skipping governor callbacks more consistent
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
nvme-pci: Fix race bug in nvme_poll_irqdisable()
i40e: fix src IP mask checks and memcpy argument names in cloud filter
e1000/e1000e: Fix leak in DMA error cleanup
ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
ASoC: detect empty DMI strings
net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
octeontx2-af: devlink: fix NIX RAS reporter recovery condition
octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
usb: gadget: f_mass_storage: Fix potential integer overflow in
check_command_size_in_blocks()
cgroup: fix race between task migration and iteration
ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
net: usb: lan78xx: fix silent drop of packets with checksum errors
net: usb: lan78xx: fix TX byte statistics for small packets
net: usb: lan78xx: skip LTM configuration for LAN7850
ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
USB: add QUIRK_NO_BOS for video capture several devices
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
usb: xhci: Fix memory leak in xhci_disable_slot()
usb: xhci: Prevent interrupt storm on host controller error (HCE)
usb: yurex: fix race in probe
usb: dwc3: pci: add support for the Intel Nova Lake -H
usb: misc: uss720: properly clean up reference in uss720_probe()
usb: core: don't power off roothub PHYs if phy_set_mode() fails
usb: cdc-acm: Restore CAP_BRK functionnality to CH343
usb: roles: get usb role switch from parent only for usb-b-connector
USB: usbcore: Introduce usb_bulk_msg_killable()
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
USB: core: Limit the length of unkillable synchronous timeouts
usb: class: cdc-wdm: fix reordering issue in read code path
usb: renesas_usbhs: fix use-after-free in ISR during device removal
usb: mdc800: handle signal and read racing
usb: image: mdc800: kill download URB on timeout
mm/tracing: rss_stat: ensure curr is false from kthread context
mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
mm/kfence: disable KFENCE upon KASAN HW tags enablement
mmc: core: Avoid bitfield RMW for claim/retune flags
ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
tipc: fix divide-by-zero in tipc_sk_filter_connect()
kprobes: avoid crash when rmmod/insmod after ftrace killed
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
libceph: reject preamble if control segment is empty
libceph: prevent potential out-of-bounds reads in process_message_header()
libceph: Use u32 for non-negative values in ceph_monmap_decode()
libceph: admit message frames only in CEPH_CON_S_OPEN state
ceph: fix i_nlink underrun during async unlink
ceph: fix memory leaks in ceph_mdsc_build_path()
time/jiffies: Mark jiffies_64_to_clock_t() notrace
i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec
scsi: hisi_sas: Use macro instead of magic number
scsi: hisi_sas: Fix NULL pointer exception during user_scan()
Revert "tcpm: allow looking for role_sw device in the main node"
drm/bridge: samsung-dsim: Fix memory leak in error path
drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
device property: Allow secondary lookup in fwnode_get_next_child_node()
irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS
supports
ice: reintroduce retry mechanism for indirect AQ
ixgbevf: fix link setup issue
staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
media: dvb-net: fix OOB access in ULE extension header tables
net: mana: Ring doorbell at 4 CQ wraparounds
ice: fix retry for AQ command 0x06EE
tracing: Fix syscall events activation by ensuring refcount hits zero
batman-adv: Avoid double-rtnl_lock ELP metric worker
parisc: Increase initial mapping to 64 MB with KALLSYMS
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
parisc: Fix initial page table creation for boot
parisc: Check kernel mapping earlier at bootup
pmdomain: bcm: bcm2835-power: Fix broken reset status read
smb: server: fix use-after-free in smb2_open()
net: ncsi: fix skb leak in error paths
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
net: dsa: microchip: Fix error path in PTP IRQ setup
drm/amdgpu: Fix use-after-free race in VM acquire
drm/amd: Set num IP blocks to 0 if discovery fails
drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
drm/i915: Fix potential overflow of shmem scatterlist length
tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
cifs: make default value of retrans as zero
xfs: fix undersized l_iclog_roundoff values
s390/dasd: Move quiesce state with pprc swap
s390/dasd: Copy detected format information to secondary device
lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
scsi: core: Fix error handling for scsi_alloc_sdev()
x86/apic: Disable x2apic on resume if the kernel expects so
lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
lib/bootconfig: check bounds before writing in __xbc_open_brace()
smb: client: fix atomic open with O_DIRECT & O_SYNC
smb: client: fix in-place encryption corruption in SMB2_write()
smb: client: fix iface port assignment in parse_server_interfaces
btrfs: abort transaction on failure to update root in the received subvol ioctl
iio: dac: ds4424: reject -128 RAW value
iio: frequency: adf4377: Fix duplicated soft reset mask
iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
iio: potentiometer: mcp4131: fix double application of wiper shift
iio: chemical: bme680: Fix measurement wait duration calculation
iio: buffer: Fix wait_queue not being removed
iio: gyro: mpu3050-core: fix pm_runtime error handling
iio: gyro: mpu3050-i2c: fix pm_runtime error handling
iio: imu: inv_icm42600: fix odr switch to the same value
i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
gve: defer interrupt enabling until NAPI registration
ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
wifi: libertas: fix use-after-free in lbs_free_adapter()
platform/x86: hp-bioscfg: Support allocations of larger data
x86/sev: Allow IBPB-on-Entry feature for SNP guests
gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
mptcp: pm: avoid sending RM_ADDR over same subflow
mptcp: pm: in-kernel: always mark signal+subflow endp as used
selftests: mptcp: add a check for 'add_addr_accepted'
selftests: mptcp: join: check RM_ADDR not sent over same subflow
kbuild: Leave objtool binary around with 'make clean'
net/sched: act_gate: snapshot parameters with RCU on replace
can: gs_usb: gs_can_open(): always configure bitrates before starting device
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids
KVM: SVM: Add a helper to look up the max physical ID for AVIC
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
mm/kfence: fix KASAN hardware tag faults during late enablement
iomap: reject delalloc mappings during writeback
ksmbd: Don't log keys in SMB3 signing and encryption key generation
drm/msm: Fix dma_free_attrs() buffer size
drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
net: macb: Shuffle the tx ring before enabling tx
cifs: open files should not hold ref on superblock
crypto: atmel-sha204a - Fix OOM ->tfm_count leak
xfs: fix integer overflow in bmap intent sort comparator
xfs: ensure dquot item is deleted from AIL only after log shutdown
smb: client: Compare MACs in constant time
ksmbd: Compare MACs in constant time
net/tcp-md5: Fix MAC comparison to be constant-time
f2fs: fix to avoid migrating empty section
ext4: fix dirtyclusters double decrement on fs shutdown
btrfs: always fallback to buffered write if the inode requires checksum
net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz
arm64: mm: Don't remap pgtables per-cont(pte|pmd) block
arm64: mm: Batch dsb and isb when populating pgtables
arm64: mm: Don't remap pgtables for allocate vs populate
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
ext4: always allocate blocks only from groups inode can use
rxrpc: Fix recvmsg() unconditional requeue
dm-verity: disable recursive forward error correction
ipv6: use RCU in ip6_xmit()
rxrpc: Fix data-race warning and potential load/store tearing
btrfs: do not strictly require dirty metadata threshold for metadata writepages
riscv: Sanitize syscall table indexing under speculation
dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
tracing: Add recursion protection in kernel stack trace recording
net: add support for segmenting TCP fraglist GSO packets
net: gso: fix tcp fraglist segmentation after pull from frag_list
net: fix segmentation of forwarding fraglist GRO
net: dsa: properly keep track of conduit reference
drm/amd/display: Add pixel_clock to amd_pp_display_configuration
drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
drm/amdgpu: Add basic validation for RAS header
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
drm/exynos: vidi: fix to avoid directly dereferencing user pointer
drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables
related to memory alloc/free
x86/uprobes: Fix XOL allocation failure for 32-bit tasks
platform/x86/amd/pmc: Add support for Van Gogh SoC
binfmt_misc: restore write access before closing files opened by open_exec()
net: stmmac: remove support for lpi_intr_o
mptcp: pm: in-kernel: always set ID as avail when rm endp
s390/xor: Fix xor_xc_2() inline assembly constraints
s390/stackleak: Fix __stackleak_poison() inline assembly constraint
s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node()
io_uring/kbuf: check if target buffer list is still legacy on recycle
NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
sunrpc: fix cache_request leak in cache_release
nvdimm/bus: Fix potential use after free in asynchronous initialization
LoongArch: Give more information if kmem access failed
NFC: nxp-nci: allow GPIOs to sleep
net: macb: fix use-after-free access to PTP clock
parisc: Flush correct cache in cacheflush() syscall
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
smb: client: fix krb5 mount with username option
ksmbd: unset conn->binding on failed binding request
kprobes: Remove unneeded goto
kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
btrfs: fix transaction abort when snapshotting received subvolumes
btrfs: fix transaction abort on set received ioctl due to item overflow
btrfs: fix transaction abort on file creation due to name hash collision
iio: light: bh1780: fix PM runtime leak on error path
batman-adv: avoid OGM aggregation when skb tailroom is insufficient
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
net: macb: queue tie-off or disable during WOL suspend
net: macb: Introduce gem_init_rx_ring()
net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
mmc: sdhci: fix timing selection for 1-bit bus width
pmdomain: bcm: bcm2835-power: Increase ASB control timeout
spi: fix use-after-free on controller registration failure
spi: fix statistics allocation
mtd: rawnand: pl353: make sure optimal timings are applied
mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
cadence_nand_init()
mtd: Avoid boot crash in RedBoot partition table parser
iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
serial: 8250_pci: add support for the AX99100
serial: 8250: Fix TX deadlock when using DMA
serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
serial: uartlite: fix PM runtime usage count underflow on probe
drm/amdgpu/gmc9.0: add bounds checking for cid
drm/amdgpu/mmhub2.0: add bounds checking for cid
drm/amdgpu/mmhub2.3: add bounds checking for cid
drm/amdgpu/mmhub3.0.1: add bounds checking for cid
drm/amdgpu/mmhub3.0.2: add bounds checking for cid
drm/amdgpu/mmhub3.0: add bounds checking for cid
drm/radeon: apply state adjust rules to some additional HAINAN vairants
drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END}
btrfs: log new dentries when logging parent dir of a conflicting inode
btrfs: tree-checker: fix misleading root drop_level error message
cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
soc: fsl: qbman: fix race condition in qman_destroy_fq
wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
firmware: arm_scpi: Fix device_node reference leak in probe path
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
Bluetooth: ISO: Fix defer tests being unstable
Bluetooth: hci_sync: Fix hci_le_create_conn_sync
Bluetooth: HIDP: Fix possible UAF
Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
Bluetooth: qca: fix ROM version reading on WCN3998 chips
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
mpls: add missing unregister_netdevice_notifier to mpls_init
netfilter: ctnetlink: remove refcounting in expectation dumpers
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
netfilter: nft_ct: drop pending enqueued packets on removal
netfilter: xt_CT: drop pending enqueued packets on template removal
netfilter: xt_time: use unsigned int for monthday bit shift
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
net: bcmgenet: increase WoL poll timeout
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering
teardown
sched: idle: Consolidate the handling of two special cases
PM: runtime: Fix a race condition related to device removal
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
net/sched: teql: Fix double-free in teql_master_xmit
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
clsact: Fix use-after-free in init/destroy rollback asymmetry
net: usb: aqc111: Do not perform PM inside suspend callback
igc: fix missing update of skb->tail in igc_xmit_frame()
iavf: fix VLAN filter lost on add/delete race
wifi: mac80211: fix NULL deref in mesh_matches_local()
wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
net: macb: fix uninitialized rx_fs_lock
net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
net/mlx5e: Prevent concurrent access to IPSec ASO context
net/mlx5e: Fix race condition during IPSec ESN update
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
net: bonding: fix NULL deref in bond_debug_rlb_hash_show
netfilter: bpf: defer hook memory release until rcu readers are done
netfilter: nf_tables: release flowtable after rcu grace period on error
nfnetlink_osf: validate individual option lengths in fingerprints
net: mvpp2: guard flow control update with global_tx_fc in buffer switching
net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
icmp: fix NULL pointer dereference in icmp_tag_validation()
hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
USB: serial: f81232: fix incomplete serial port generation
i2c: fsi: Fix a potential leak in fsi_i2c_probe()
i2c: pxa: defer reset on Armada 3700 when recovery is used
x86/platform/uv: Handle deconfigured sockets
i2c: cp2615: fix serial string NULL-deref at probe
mtd: rawnand: serialize lock/unlock against other NAND operations
mtd: rawnand: brcmnand: skip DMA during panic write
drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr()
ksmbd: fix use-after-free of share_conf in compound request
drm/i915/gt: Check set_default_submission() before deferencing
lib/bootconfig: check xbc_init_node() return in override path
tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
xen/privcmd: restrict usage in unprivileged domU
xen/privcmd: add boot control for restricted usage in domU
cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
update_cpumasks_hier()
s390/idle: Fix cpu idle exit cpu time accounting
s390/vtime: Fix virtual timer forwarding
PCI: endpoint: Introduce pci_epc_function_is_valid()
PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr() operation
PCI: dwc: ep: Use align addr function for dw_pcie_ep_raise_{msi,msix}_irq()
PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
drm/amdgpu: Fix locking bugs in error paths
btrfs: print correct subvol num if active swapfile prevents deletion
bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
x86/acpi/boot: Correct acpi_is_processor_usable() check again
PCI: dw-rockchip: Don't wait for link since we can detect Link Up
Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up"
ata: libata-scsi: Refactor ata_scsi_simulate()
ata: libata-scsi: Refactor ata_scsiop_read_cap()
ata: libata-scsi: Refactor ata_scsiop_maint_in()
ata: libata-scsi: Document all VPD page inquiry actors
ata: libata-scsi: Remove struct ata_scsi_args
ata: libata: Remove ATA_DFLAG_ZAC device flag
ata: libata: Introduce ata_port_eh_scheduled()
ata: libata-scsi: avoid Non-NCQ command starvation
workqueue: Add system_percpu_wq and system_dfl_wq
Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
Input: synaptics_i2c - guard polling restart in resume
arm64: dts: rockchip: Fix rk3588 PCIe range mappings
ima: kexec: silence RCU list traversal warning
ima: rename variable the seq_file "file" to "ima_kexec_file"
ima: define and call ima_alloc_kexec_file_buf()
kexec: define functions to map and unmap segments
ima: kexec: define functions to copy IMA log at soft boot
ima: verify the previous kernel's IMA buffer lies in addressable RAM
of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
btrfs: zoned: fix alloc_offset calculation for partly conventional block groups
btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
btrfs: zoned: fixup last alloc pointer after extent removal for DUP
btrfs: zoned: fix stripe width calculation
btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
ksmbd: check return value of xa_store() in krb5_authenticate
ksmbd: add chann_lock to protect ksmbd_chann_list xarray
ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro
360
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra
ALSA: hda/realtek: Refactor and simplify Samsung Galaxy Book init
ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang
< 18
nvme: fix admin queue leak on controller reset
HID: multitouch: add quirks for Lenovo Yoga Book 9i
HID: multitouch: new class MT_CLS_EGALAX_P80H84
idpf: change IRQ naming to match netdev and ethtool queue numbering
i40e: Fix preempt count leak in napi poll tracepoint
drm/xe: Do not preempt fence signaling CS instructions
wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
drm/xe/reg_sr: Fix leak on xa_store failure
net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
ata: libata-core: fix cancellation of a port deferred qc work
ata: libata-eh: correctly handle deferred qc timeouts
ata: libata: cancel pending work after clearing deferred_qc
ata: libata-eh: Fix detection of deferred qc timeouts
ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()
ext4: handle wraparound when searching for blocks for indirect mapped blocks
UBUNTU: Upstream stable to v6.6.129, v6.6.130, v6.12.76, v6.12.77
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-05-28
+
+ Ported from the following upstream stable releases:
+ v6.6.129, v6.6.130, v6.12.76, v6.12.77
+
from git://git.kernel.org/
+
+ drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
+ drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
+ drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
+ irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
+ scsi: lpfc: Properly set WC for DPP mapping
+ scsi: pm8001: Fix use-after-free in pm8001_queue_command()
+ ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
+ rseq: Clarify rseq registration rseq_size bound check comment
+ scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
+ ALSA: usb-audio: Cap the packet size pre-calculations
+ ALSA: usb-audio: Use inclusive terms
+ perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
+ ALSA: pci: hda: use snd_kcontrol_chip()
+ ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
+ btrfs: fix incorrect key offset in error message in check_dev_extent_item()
+ btrfs: fix objectid value in error message in check_extent_data_ref()
+ btrfs: fix warning in scrub_verify_one_metadata()
+ btrfs: fix compat mask in error messages in btrfs_check_features()
+ bpf: Fix stack-out-of-bounds write in devmap
+ PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
+ memory: mtk-smi: fix device leaks on common probe
+ memory: mtk-smi: fix device leak on larb probe
+ resource: Add resource set range and size helpers
+ PCI: Use resource_set_range() that correctly sets ->end
+ KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED
+ media: tegra-video: Fix memory leak in __tegra_channel_try_format()
+ KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject
+ KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
+ drm/tegra: dsi: fix device leak on probe
+ ext4: get rid of ppath in ext4_find_extent()
+ ext4: get rid of ppath in ext4_ext_create_new_leaf()
+ ext4: get rid of ppath in ext4_ext_insert_extent()
+ ext4: get rid of ppath in ext4_split_extent_at()
+ ext4: subdivide EXT4_EXT_DATA_VALID1
+ ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
+ ext4: get rid of ppath in ext4_split_extent()
+ ext4: get rid of ppath in ext4_split_convert_extents()
+ ext4: get rid of ppath in ext4_convert_unwritten_extents_endio()
+ ext4: get rid of ppath in ext4_ext_convert_to_initialized()
+ ext4: get rid of ppath in ext4_ext_handle_unwritten_extents()
+ ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
+ ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
+ ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
+ ext4: drop extent cache when splitting extent fails
+ mailbox: Use of_property_match_string() instead of open-coding
+ mailbox: don't protect of_parse_phandle_with_args with con_mutex
+ mailbox: sort headers alphabetically
+ mailbox: remove unused header files
+ mailbox: Use dev_err when there is error
+ mailbox: Use guard/scoped_guard for con_mutex
+ mailbox: Allow controller specific mapping using fwnode
+ mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
+ ext4: convert bd_bitmap_page to bd_bitmap_folio
+ ext4: convert bd_buddy_page to bd_buddy_folio
+ ext4: fix e4b bitmap inconsistency reports
+ arm64: dts: rockchip: Fix rk356x PCIe range mappings
+ clk: tegra: tegra124-emc: fix device leak on set_rate()
+ usb: cdns3: remove redundant if branch
+ usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
+ usb: cdns3: fix role switching during resume
+ drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
+ ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
+ hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced
race
+ ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
+ net: arcnet: com20020-pci: fix support for 2.5Mbit cards
+ eventpoll: Fix integer overflow in ep_loop_check_proc()
+ media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
+ nfc: pn533: properly drop the usb interface reference on disconnect
+ net: usb: kaweth: validate USB endpoints
+ net: usb: kalmia: validate USB endpoints
+ net: usb: pegasus: validate USB endpoints
+ can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
message
+ can: usb: f81604: correctly anchor the urb in the read bulk callback
+ can: ucan: Fix infinite loop from zero-length messages
+ can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
+ can: usb: f81604: handle short interrupt urb messages properly
+ can: usb: f81604: handle bulk write errors properly
+ HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
+ x86/efi: defer freeing of boot services memory
+ platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
+ platform/x86: dell-wmi: Add audio/mic mute key codes
+ ALSA: usb-audio: Use correct version for UAC3 header validation
+ wifi: radiotap: reject radiotap with unknown bits
+ wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
+ wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
+ wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
+ IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
+ RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
+ net/sched: ets: fix divide by zero in the offload path
+ scsi: target: Fix recursive locking in __configfs_open_file()
+ Squashfs: check metadata block offset is within range
+ drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
+ drbd: fix null-pointer dereference on local read error
+ smb: client: fix cifs_pick_channel when channels are equally loaded
+ smb: client: fix broken multichannel with krb5+signing
+ smb: client: Don't log plaintext credentials in cifs_set_cifscreds
+ scsi: core: Fix refcount leak for tagset_refcnt
+ selftests: mptcp: more stable simult_flows tests
+ selftests: mptcp: join: check removing signal+subflow endp
+ ARM: clean up the memset64() C wrapper
+ hwmon: (aht10) Add support for dht20
+ hwmon: (aht10) Fix initialization commands for AHT20
+ pinctrl: equilibrium: rename irq_chip function callbacks
+ pinctrl: equilibrium: fix warning trace on load
+ platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
+ pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
+ hwmon: (it87) Check the it87_lock() return value
+ e1000e: clear DPG_EN after reset to avoid autonomous power-gating
+ drm/solomon: Fix page start when updating rectangle in page addressing mode
+ net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in
ALE table
+ xsk: Get rid of xdp_buff_xsk::xskb_list_node
+ xsk: s/free_list_node/list_node/
+ xsk: Fix fragment node deletion to prevent buffer leak
+ xsk: Fix zero-copy AF_XDP fragment drop
+ dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
+ atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
+ amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
+ can: bcm: fix locking for bcm_op runtime updates
+ can: mcp251x: fix deadlock in error path of mcp251x_open
+ rust: kunit: fix warning when !CONFIG_PRINTK
+ kunit: tool: copy caller args in run_kernel to prevent mutation
+ net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value
+ bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
+ octeon_ep: Relocate counter updates before NAPI
+ octeon_ep: avoid compiler and IQ/OQ reordering
+ wifi: cw1200: Fix locking in error paths
+ wifi: wlcore: Fix a locking bug
+ wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
+ wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
+ indirect_call_wrapper: do not reevaluate function pointer
+ net/rds: Fix circular locking dependency in rds_tcp_tune
+ xen/acpi-processor: fix _CST detection using undersized evaluation buffer
+ bpf: export bpf_link_inc_not_zero.
+ bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
+ smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
+ smb/client: fix buffer size for smb311_posix_qinfo in
SMB311_posix_query_info()
+ ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
+ amd-xgbe: fix sleep while atomic on suspend/resume
+ drm/sched: Fix kernel-doc warning for drm_sched_job_done()
+ nvme: reject invalid pr_read_keys() num_keys values
+ nvme: fix memory allocation in nvme_pr_read_keys()
+ net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
+ net: nfc: nci: Fix zero-length proprietary notifications
+ nfc: nci: free skb on nci_transceive early error paths
+ nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
+ nfc: rawsock: cancel tx_work before socket teardown
+ net: stmmac: Fix error handling in VLAN add and delete paths
+ net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
mtk_xdp_setup()
+ net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
+ net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
+ net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
+ net/sched: act_ife: Fix metalist update behavior
+ xdp: use modulo operation to calculate XDP frag tailroom
+ xsk: introduce helper to determine rxq->frag_size
+ i40e: fix registering XDP RxQ info
+ i40e: use xdp.frame_sz as XDP RxQ info frag_size
+ xdp: produce a warning when calculated tailroom is negative
+ selftest/arm64: Fix sve2p1_sigill() to hwcap test
+ tracing: Add NULL pointer check to trigger_data_free()
+ net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
blocks
+ net: tcp: accept old ack during closing
+ scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
+ ACPI: PM: Save NVS memory on Lenovo G70-35
+ scsi: mpi3mr: Add NULL checks when resetting request and reply queues
+ unshare: fix unshare_fs() handling
+ wifi: mac80211: set default WMM parameters on all links
+ ACPI: OSI: Add DMI quirk for Acer Aspire One D255
+ scsi: ses: Fix devices attaching to different hosts
+ ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
+ ASoC: cs42l43: Report insert for exotic peripherals
+ scsi: ufs: core: Fix possible NULL pointer dereference in
ufshcd_add_command_trace()
+ scsi: ufs: core: Fix shift out of bounds when MAXQ=32
+ ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
+ ALSA: usb-audio: Check max frame size for implicit feedback mode, too
+ powerpc/uaccess: Fix inline assembly for clang build on PPC32
+ remoteproc: sysmon: Correct subsys_name_len type in QMI request
+ powerpc: 83xx: km83xx: Fix keymile vendor prefix
+ xprtrdma: Decrement re_receiving on the early exit paths
+ net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets
+ drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations
+ drm/msm/dsi: fix pclk rate calculation for bonded dsi
+ bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
+ net/mlx5: IFC updates for disabled host PF
+ net/mlx5: Query to see if host PF is disabled
+ net/mlx5: Fix deadlock between devlink lock and esw->wq
+ net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
+ net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave
xmit
+ ASoC: soc-core: drop delayed_work_pending() check before flush
+ ASoC: soc-core: flush delayed work before removing DAIs and widgets
+ ASoC: simple-card-utils: use __free(device_node) for device node
+ ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
+ net: sfp: improve Huawei MA5671a fixup
+ serial: caif: hold tty->link reference in ldisc_open and ser_release
+ mctp: i2c: fix skb memory leak in receive path
+ can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
+ mctp: route: hold key->lock in mctp_flow_prepare_output()
+ amd-xgbe: fix link status handling in xgbe_rx_adaptation
+ amd-xgbe: prevent CRC errors during RX adaptation with AN disabled
+ netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
+ netfilter: x_tables: guard option walkers against 1-byte tail reads
+ netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
+ netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
+ regulator: pca9450: Make IRQ optional
+ regulator: pca9450: Correct interrupt type
+ sched: idle: Make skipping governor callbacks more consistent
+ nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
+ nvme-pci: Fix race bug in nvme_poll_irqdisable()
+ i40e: fix src IP mask checks and memcpy argument names in cloud filter
+ e1000/e1000e: Fix leak in DMA error cleanup
+ ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
+ ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
+ ASoC: detect empty DMI strings
+ net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
+ octeontx2-af: devlink: fix NIX RAS reporter recovery condition
+ octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status
+ usb: gadget: f_mass_storage: Fix potential integer overflow in
check_command_size_in_blocks()
+ cgroup: fix race between task migration and iteration
+ ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
+ ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
+ net: usb: lan78xx: fix silent drop of packets with checksum errors
+ net: usb: lan78xx: fix TX byte statistics for small packets
+ net: usb: lan78xx: skip LTM configuration for LAN7850
+ ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
+ KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
+ USB: add QUIRK_NO_BOS for video capture several devices
+ usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
+ USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
+ usb: xhci: Fix memory leak in xhci_disable_slot()
+ usb: xhci: Prevent interrupt storm on host controller error (HCE)
+ usb: yurex: fix race in probe
+ usb: dwc3: pci: add support for the Intel Nova Lake -H
+ usb: misc: uss720: properly clean up reference in uss720_probe()
+ usb: core: don't power off roothub PHYs if phy_set_mode() fails
+ usb: cdc-acm: Restore CAP_BRK functionnality to CH343
+ usb: roles: get usb role switch from parent only for usb-b-connector
+ USB: usbcore: Introduce usb_bulk_msg_killable()
+ USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
+ USB: core: Limit the length of unkillable synchronous timeouts
+ usb: class: cdc-wdm: fix reordering issue in read code path
+ usb: renesas_usbhs: fix use-after-free in ISR during device removal
+ usb: mdc800: handle signal and read racing
+ usb: image: mdc800: kill download URB on timeout
+ mm/tracing: rss_stat: ensure curr is false from kthread context
+ mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
+ mm/kfence: disable KFENCE upon KASAN HW tags enablement
+ mmc: core: Avoid bitfield RMW for claim/retune flags
+ ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
+ tipc: fix divide-by-zero in tipc_sk_filter_connect()
+ kprobes: avoid crash when rmmod/insmod after ftrace killed
+ libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
+ libceph: reject preamble if control segment is empty
+ libceph: prevent potential out-of-bounds reads in process_message_header()
+ libceph: Use u32 for non-negative values in ceph_monmap_decode()
+ libceph: admit message frames only in CEPH_CON_S_OPEN state
+ ceph: fix i_nlink underrun during async unlink
+ ceph: fix memory leaks in ceph_mdsc_build_path()
+ time/jiffies: Mark jiffies_64_to_clock_t() notrace
+ i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
+ scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
+ scsi: hisi_sas: Add time interval between two H2D FIS following soft reset
spec
+ scsi: hisi_sas: Use macro instead of magic number
+ scsi: hisi_sas: Fix NULL pointer exception during user_scan()
+ Revert "tcpm: allow looking for role_sw device in the main node"
+ drm/bridge: samsung-dsim: Fix memory leak in error path
+ drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
+ device property: Allow secondary lookup in fwnode_get_next_child_node()
+ irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS
supports
+ ice: reintroduce retry mechanism for indirect AQ
+ ixgbevf: fix link setup issue
+ staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
+ staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
+ media: dvb-net: fix OOB access in ULE extension header tables
+ net: mana: Ring doorbell at 4 CQ wraparounds
+ ice: fix retry for AQ command 0x06EE
+ tracing: Fix syscall events activation by ensuring refcount hits zero
+ batman-adv: Avoid double-rtnl_lock ELP metric worker
+ parisc: Increase initial mapping to 64 MB with KALLSYMS
+ nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
+ arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
+ hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
+ parisc: Fix initial page table creation for boot
+ parisc: Check kernel mapping earlier at bootup
+ pmdomain: bcm: bcm2835-power: Fix broken reset status read
+ smb: server: fix use-after-free in smb2_open()
+ net: ncsi: fix skb leak in error paths
+ net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
+ net: dsa: microchip: Fix error path in PTP IRQ setup
+ drm/amdgpu: Fix use-after-free race in VM acquire
+ drm/amd: Set num IP blocks to 0 if discovery fails
+ drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
+ drm/i915: Fix potential overflow of shmem scatterlist length
+ tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
+ cifs: make default value of retrans as zero
+ xfs: fix undersized l_iclog_roundoff values
+ s390/dasd: Move quiesce state with pprc swap
+ s390/dasd: Copy detected format information to secondary device
+ lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
+ scsi: core: Fix error handling for scsi_alloc_sdev()
+ x86/apic: Disable x2apic on resume if the kernel expects so
+ lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
+ lib/bootconfig: check bounds before writing in __xbc_open_brace()
+ smb: client: fix atomic open with O_DIRECT & O_SYNC
+ smb: client: fix in-place encryption corruption in SMB2_write()
+ smb: client: fix iface port assignment in parse_server_interfaces
+ btrfs: abort transaction on failure to update root in the received subvol
ioctl
+ iio: dac: ds4424: reject -128 RAW value
+ iio: frequency: adf4377: Fix duplicated soft reset mask
+ iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
+ iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
+ iio: potentiometer: mcp4131: fix double application of wiper shift
+ iio: chemical: bme680: Fix measurement wait duration calculation
+ iio: buffer: Fix wait_queue not being removed
+ iio: gyro: mpu3050-core: fix pm_runtime error handling
+ iio: gyro: mpu3050-i2c: fix pm_runtime error handling
+ iio: imu: inv_icm42600: fix odr switch to the same value
+ i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
+ i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
+ i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
+ drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
+ gve: defer interrupt enabling until NAPI registration
+ ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
+ wifi: libertas: fix use-after-free in lbs_free_adapter()
+ platform/x86: hp-bioscfg: Support allocations of larger data
+ x86/sev: Allow IBPB-on-Entry feature for SNP guests
+ gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
+ net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
+ drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
+ mptcp: pm: avoid sending RM_ADDR over same subflow
+ mptcp: pm: in-kernel: always mark signal+subflow endp as used
+ selftests: mptcp: add a check for 'add_addr_accepted'
+ selftests: mptcp: join: check RM_ADDR not sent over same subflow
+ kbuild: Leave objtool binary around with 'make clean'
+ net/sched: act_gate: snapshot parameters with RCU on replace
+ can: gs_usb: gs_can_open(): always configure bitrates before starting device
+ usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
+ KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids
+ KVM: SVM: Add a helper to look up the max physical ID for AVIC
+ KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
+ mm/kfence: fix KASAN hardware tag faults during late enablement
+ iomap: reject delalloc mappings during writeback
+ ksmbd: Don't log keys in SMB3 signing and encryption key generation
+ drm/msm: Fix dma_free_attrs() buffer size
+ drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
+ net: macb: Shuffle the tx ring before enabling tx
+ cifs: open files should not hold ref on superblock
+ crypto: atmel-sha204a - Fix OOM ->tfm_count leak
+ xfs: fix integer overflow in bmap intent sort comparator
+ xfs: ensure dquot item is deleted from AIL only after log shutdown
+ smb: client: Compare MACs in constant time
+ ksmbd: Compare MACs in constant time
+ net/tcp-md5: Fix MAC comparison to be constant-time
+ f2fs: fix to avoid migrating empty section
+ ext4: fix dirtyclusters double decrement on fs shutdown
+ btrfs: always fallback to buffered write if the inode requires checksum
+ net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz
+ arm64: mm: Don't remap pgtables per-cont(pte|pmd) block
+ arm64: mm: Batch dsb and isb when populating pgtables
+ arm64: mm: Don't remap pgtables for allocate vs populate
+ dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
+ ext4: always allocate blocks only from groups inode can use
+ rxrpc: Fix recvmsg() unconditional requeue
+ dm-verity: disable recursive forward error correction
+ ipv6: use RCU in ip6_xmit()
+ rxrpc: Fix data-race warning and potential load/store tearing
+ btrfs: do not strictly require dirty metadata threshold for metadata
writepages
+ riscv: Sanitize syscall table indexing under speculation
+ dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
+ tracing: Add recursion protection in kernel stack trace recording
+ net: add support for segmenting TCP fraglist GSO packets
+ net: gso: fix tcp fraglist segmentation after pull from frag_list
+ net: fix segmentation of forwarding fraglist GRO
+ net: dsa: properly keep track of conduit reference
+ drm/amd/display: Add pixel_clock to amd_pp_display_configuration
+ drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
+ drm/amdgpu: Add basic validation for RAS header
+ drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
+ drm/exynos: vidi: fix to avoid directly dereferencing user pointer
+ drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
variables related to memory alloc/free
+ x86/uprobes: Fix XOL allocation failure for 32-bit tasks
+ platform/x86/amd/pmc: Add support for Van Gogh SoC
+ binfmt_misc: restore write access before closing files opened by open_exec()
+ net: stmmac: remove support for lpi_intr_o
+ mptcp: pm: in-kernel: always set ID as avail when rm endp
+ s390/xor: Fix xor_xc_2() inline assembly constraints
+ s390/stackleak: Fix __stackleak_poison() inline assembly constraint
+ s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
+ mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node()
+ io_uring/kbuf: check if target buffer list is still legacy on recycle
+ NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
+ sunrpc: fix cache_request leak in cache_release
+ nvdimm/bus: Fix potential use after free in asynchronous initialization
+ LoongArch: Give more information if kmem access failed
+ NFC: nxp-nci: allow GPIOs to sleep
+ net: macb: fix use-after-free access to PTP clock
+ parisc: Flush correct cache in cacheflush() syscall
+ Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
+ Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
+ smb: client: fix krb5 mount with username option
+ ksmbd: unset conn->binding on failed binding request
+ kprobes: Remove unneeded goto
+ kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
+ btrfs: fix transaction abort when snapshotting received subvolumes
+ btrfs: fix transaction abort on set received ioctl due to item overflow
+ btrfs: fix transaction abort on file creation due to name hash collision
+ iio: light: bh1780: fix PM runtime leak on error path
+ batman-adv: avoid OGM aggregation when skb tailroom is insufficient
+ nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
+ net: macb: queue tie-off or disable during WOL suspend
+ net: macb: Introduce gem_init_rx_ring()
+ net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
resume
+ mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
+ mmc: sdhci: fix timing selection for 1-bit bus width
+ pmdomain: bcm: bcm2835-power: Increase ASB control timeout
+ spi: fix use-after-free on controller registration failure
+ spi: fix statistics allocation
+ mtd: rawnand: pl353: make sure optimal timings are applied
+ mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
cadence_nand_init()
+ mtd: Avoid boot crash in RedBoot partition table parser
+ iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
+ serial: 8250_pci: add support for the AX99100
+ serial: 8250: Fix TX deadlock when using DMA
+ serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
+ serial: uartlite: fix PM runtime usage count underflow on probe
+ drm/amdgpu/gmc9.0: add bounds checking for cid
+ drm/amdgpu/mmhub2.0: add bounds checking for cid
+ drm/amdgpu/mmhub2.3: add bounds checking for cid
+ drm/amdgpu/mmhub3.0.1: add bounds checking for cid
+ drm/amdgpu/mmhub3.0.2: add bounds checking for cid
+ drm/amdgpu/mmhub3.0: add bounds checking for cid
+ drm/radeon: apply state adjust rules to some additional HAINAN vairants
+ drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
+ drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END}
+ btrfs: log new dentries when logging parent dir of a conflicting inode
+ btrfs: tree-checker: fix misleading root drop_level error message
+ cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
+ soc: fsl: qbman: fix race condition in qman_destroy_fq
+ wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
+ wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
+ firmware: arm_scpi: Fix device_node reference leak in probe path
+ Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
+ Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
+ Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
+ Bluetooth: ISO: Fix defer tests being unstable
+ Bluetooth: hci_sync: Fix hci_le_create_conn_sync
+ Bluetooth: HIDP: Fix possible UAF
+ Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
+ Bluetooth: qca: fix ROM version reading on WCN3998 chips
+ net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
+ mpls: add missing unregister_netdevice_notifier to mpls_init
+ netfilter: ctnetlink: remove refcounting in expectation dumpers
+ netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
+ netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
sip_help_tcp()
+ netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
+ netfilter: nft_ct: drop pending enqueued packets on removal
+ netfilter: xt_CT: drop pending enqueued packets on template removal
+ netfilter: xt_time: use unsigned int for monthday bit shift
+ netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
+ net: bcmgenet: increase WoL poll timeout
+ net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering
teardown
+ sched: idle: Consolidate the handling of two special cases
+ PM: runtime: Fix a race condition related to device removal
+ net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
+ net/sched: teql: Fix double-free in teql_master_xmit
+ net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
+ net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
+ clsact: Fix use-after-free in init/destroy rollback asymmetry
+ net: usb: aqc111: Do not perform PM inside suspend callback
+ igc: fix missing update of skb->tail in igc_xmit_frame()
+ iavf: fix VLAN filter lost on add/delete race
+ wifi: mac80211: fix NULL deref in mesh_matches_local()
+ wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
headroom
+ ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
+ net: macb: fix uninitialized rx_fs_lock
+ net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
+ net/mlx5e: Prevent concurrent access to IPSec ASO context
+ net/mlx5e: Fix race condition during IPSec ESN update
+ udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
+ net: bonding: fix NULL deref in bond_debug_rlb_hash_show
+ netfilter: bpf: defer hook memory release until rcu readers are done
+ netfilter: nf_tables: release flowtable after rcu grace period on error
+ nfnetlink_osf: validate individual option lengths in fingerprints
+ net: mvpp2: guard flow control update with global_tx_fc in buffer switching
+ net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
+ icmp: fix NULL pointer dereference in icmp_tag_validation()
+ hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
+ hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
+ Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
+ USB: serial: f81232: fix incomplete serial port generation
+ i2c: fsi: Fix a potential leak in fsi_i2c_probe()
+ i2c: pxa: defer reset on Armada 3700 when recovery is used
+ x86/platform/uv: Handle deconfigured sockets
+ i2c: cp2615: fix serial string NULL-deref at probe
+ mtd: rawnand: serialize lock/unlock against other NAND operations
+ mtd: rawnand: brcmnand: skip DMA during panic write
+ drm/amd/display: Fix DisplayID not-found handling in
parse_edid_displayid_vrr()
+ ksmbd: fix use-after-free of share_conf in compound request
+ drm/i915/gt: Check set_default_submission() before deferencing
+ lib/bootconfig: check xbc_init_node() return in override path
+ tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
+ xen/privcmd: restrict usage in unprivileged domU
+ xen/privcmd: add boot control for restricted usage in domU
+ cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
update_cpumasks_hier()
+ s390/idle: Fix cpu idle exit cpu time accounting
+ s390/vtime: Fix virtual timer forwarding
+ PCI: endpoint: Introduce pci_epc_function_is_valid()
+ PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
+ PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr() operation
+ PCI: dwc: ep: Use align addr function for dw_pcie_ep_raise_{msi,msix}_irq()
+ PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
+ drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
+ drm/amdgpu: Fix locking bugs in error paths
+ btrfs: print correct subvol num if active swapfile prevents deletion
+ bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
+ x86/acpi/boot: Correct acpi_is_processor_usable() check again
+ PCI: dw-rockchip: Don't wait for link since we can detect Link Up
+ Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up"
+ ata: libata-scsi: Refactor ata_scsi_simulate()
+ ata: libata-scsi: Refactor ata_scsiop_read_cap()
+ ata: libata-scsi: Refactor ata_scsiop_maint_in()
+ ata: libata-scsi: Document all VPD page inquiry actors
+ ata: libata-scsi: Remove struct ata_scsi_args
+ ata: libata: Remove ATA_DFLAG_ZAC device flag
+ ata: libata: Introduce ata_port_eh_scheduled()
+ ata: libata-scsi: avoid Non-NCQ command starvation
+ workqueue: Add system_percpu_wq and system_dfl_wq
+ Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
+ Input: synaptics_i2c - guard polling restart in resume
+ arm64: dts: rockchip: Fix rk3588 PCIe range mappings
+ ima: kexec: silence RCU list traversal warning
+ ima: rename variable the seq_file "file" to "ima_kexec_file"
+ ima: define and call ima_alloc_kexec_file_buf()
+ kexec: define functions to map and unmap segments
+ ima: kexec: define functions to copy IMA log at soft boot
+ ima: verify the previous kernel's IMA buffer lies in addressable RAM
+ of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
+ drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
+ btrfs: zoned: fix alloc_offset calculation for partly conventional block
groups
+ btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
+ btrfs: zoned: fixup last alloc pointer after extent removal for DUP
+ btrfs: zoned: fix stripe width calculation
+ btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
+ btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
+ ksmbd: check return value of xa_store() in krb5_authenticate
+ ksmbd: add chann_lock to protect ksmbd_chann_list xarray
+ ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
+ ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro
360
+ ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra
+ ALSA: hda/realtek: Refactor and simplify Samsung Galaxy Book init
+ ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
+ ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with
clang < 18
+ nvme: fix admin queue leak on controller reset
+ HID: multitouch: add quirks for Lenovo Yoga Book 9i
+ HID: multitouch: new class MT_CLS_EGALAX_P80H84
+ idpf: change IRQ naming to match netdev and ethtool queue numbering
+ i40e: Fix preempt count leak in napi poll tracepoint
+ drm/xe: Do not preempt fence signaling CS instructions
+ wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
+ i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
+ drm/xe/reg_sr: Fix leak on xa_store failure
+ net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
+ ata: libata-core: fix cancellation of a port deferred qc work
+ ata: libata-eh: correctly handle deferred qc timeouts
+ ata: libata: cancel pending work after clearing deferred_qc
+ ata: libata-eh: Fix detection of deferred qc timeouts
+ ASoC: simple-card-utils: Don't use __free(device_node) at
graph_util_parse_dai()
+ ext4: handle wraparound when searching for blocks for indirect mapped blocks
+ UBUNTU: Upstream stable to v6.6.129, v6.6.130, v6.12.76, v6.12.77
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2154496
Title:
Noble update: upstream stable patchset 2026-05-28
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2154496/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
