Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-11
Ported from the following upstream stable releases:
v6.6.137, v6.6.138, v6.6.139, v6.12.85, v6.12.86,
v6.12.87, v6.12.88
from git://git.kernel.org/
xen/privcmd: fix double free via VMA splitting
Buffer overflow in drivers/xen/sys-hypervisor.c
x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
ALSA: usb-audio: Avoid false E-MU sample-rate notifications
ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
usb: chipidea: otg: not wait vbus drop if use role_switch
usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
ALSA: usb-audio: Evaluate packsize caps at the right place
LoongArch: Add spectre boundry for syscall dispatch table
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
leds: qcom-lpg: Check for array overflow when selecting the high resolution
greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
ibmasm: fix OOB reads in command_file_write due to missing size checks
ibmasm: fix heap over-read in ibmasm_send_i2o_message()
driver core: Don't let a device probe until it's ready
firmware: google: framebuffer: Do not mark framebuffer as busy
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
device property: Make modifications of fwnode "flags" thread safe
ocfs2: split transactions in dio completion to avoid credit exhaustion
zram: do not forget to endio for partial discard requests
wifi: rtw88: check for PCI upstream bridge existence
um: drivers: call kernel_strrchr() explicitly in cow_user.c
spi: imx: fix use-after-free on unbind
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
of: unittest: fix use-after-free in testdrv_probe()
hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
media: amphion: Fix race between m2m job_abort and device_run
ALSA: control: Validate buf_len before strnlen() in
snd_ctl_elem_init_enum_names()
net: caif: clear client service pointer on teardown
net: strparser: fix skb_head leak in strp_abort_strp()
media: mtk-jpeg: fix use-after-free in release path due to uncancelled work
PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
Revert "ALSA: usb: Increase volume range that triggers a warning"
PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
lib/ts_kmp: fix integer overflow in pattern length calculation
media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
imx219_probe()
net: qrtr: ns: Fix use-after-free in driver remove()
ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
ALSA: aoa: i2sbus: fix OF node lifetime handling
ALSA: ctxfi: Add fallback to default RSR for S/PDIF
ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
erofs: fix the out-of-bounds nameoff handling for trailing dirents
jbd2: fix deadlock in jbd2_journal_cancel_revoke()
md/raid10: fix deadlock with check operation and nowait requests
mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
mtd: docg3: fix use-after-free in docg3_release()
nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
parisc: _llseek syscall is only available for 32-bit userspace
remoteproc: xlnx: Only access buffer information if IPI is buffered
sched: Use u64 for bandwidth ratio calculations
selftests/mqueue: Fix incorrectly named file
selftests/landlock: Fix format warning for __u64 in net_test
rbd: fix null-ptr-deref when device_add_disk() fails
io_uring/timeout: check unused sqe fields
iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
io_uring/poll: fix signed comparison in io_poll_get_ownership()
io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
ALSA: core: Fix potential data race at fasync handling
ALSA: caiaq: Fix control_put() result and cache rollback
ALSA: caiaq: Handle probe errors properly
ALSA: 6fire: Fix input volume change detection
ALSA: pcmtest: fix reference leak on failed device registration
ALSA: pcmtest: Fix resource leaks in module init error paths
iio: adc: ad7768-1: fix one-shot mode data acquisition
rxrpc: Fix memory leaks in rxkad_verify_response()
rxrpc: Fix re-decryption of RESPONSE packets
tools/accounting: handle truncated taskstats netlink messages
arm64: dts: marvell: uDPU: add ethernet aliases
net: qrtr: ns: Free the node during ctrl_cmd_bye()
net: rds: fix MR cleanup on copy error
net: txgbe: fix firmware version check
net/smc: avoid early lgr access in smc_clc_wait_msg
net: ks8851: Reinstate disabling of BHs around IRQ handler
net: ks8851: Avoid excess softirq scheduling
drm/arcpgu: fix device node leak
RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
ipv4: icmp: validate reply type before using icmp_pointers
libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
tpm: avoid -Wunused-but-set-variable
LoongArch: Show CPU vulnerabilites correctly
power: supply: axp288_charger: Do not cancel work before initializing it
randomize_kstack: Maintain kstack_offset per task
mmc: block: use single block write in retry
mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
xfs: fix a resource leak in xfs_alloc_buftarg()
firmware: google: framebuffer: Do not unregister platform device
crypto: talitos - fix SEC1 32k ahash request limitation
crypto: talitos - rename first/last to first_desc/last_desc
tpm: tpm_tis: add error logging for data transfer
tpm: tpm_tis: stop transmit if retries are exhausted
rtc: ntxec: fix OF node reference imbalance
mm/damon/core: use time_in_range_open() for damos quota window start
userfaultfd: allow registration of ranges below mmap_min_addr
KVM: x86: Defer non-architectural deliver of exception payload to userspace read
KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
KVM: nSVM: Add missing consistency check for nCR3 validity
KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
KVM: nSVM: Always intercept VMMCALL when L2 is active
io_uring/poll: fix multishot recv missing EOF on wakeup race
perf annotate: Use jump__delete when freeing LoongArch jumps
ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
mtd: spi-nor: sst: Fix write enable before AAI sequence
amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
md/raid5: fix soft lockup in retry_aligned_read()
md/raid5: validate payload size before accessing journal metadata
check-uapi: link into shared objects
HID: apple: ensure the keyboard backlight is off if suspending
inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
wifi: rtl8xxxu: fix potential use of uninitialized value
tcp: call sk_data_ready() after listener migration
taskstats: set version in TGID exit notifications
apparmor: use target task's context in apparmor_getprocattr()
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
can: ucan: fix devres lifetime
crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
crypto: atmel-ecc - Release client on allocation failure
crypto: hisilicon - Fix dma_unmap_single() direction
crypto: ccree - fix a memory leak in cc_mac_digest()
crypto: atmel-tdes - fix DMA sync direction
crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
dm mirror: fix integer overflow in create_dirty_log()
ceph: only d_add() negative dentries when they are unhashed
IB/core: Fix zero dmac race in neighbor resolution
ktest: Fix the month in the name of the failure directory
ntfs3: add buffer boundary checks to run_unpack()
ntfs3: fix integer overflow in run_unpack() volume boundary check
rtmutex: Use waiter::task instead of current in remove_waiter()
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
smb: client: validate the whole DACL before rewriting it in cifsacl
f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
lib: test_hmm: evict device pages on file close to avoid use-after-free
f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
ksmbd: use msleep instaed of schedule_timeout_interruptible()
ksmbd: replace connection list with hash table
ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
thermal: core: Fix thermal zone governor cleanup issues
wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
ALSA: aoa: Use guard() for mutex locks
ALSA: aoa: i2sbus: clear stale prepared state
mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
media: rc: ttusbir: respect DMA coherency rules
ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
media: rc: igorplugusb: heed coherency rules
RDMA/mana_ib: Disable RX steering on RSS QP destroy
block: relax pgmap check in bio_add_page for compatible zone device pages
iio: frequency: admv1013: add dev variable
iio: frequency: admv1013: fix NULL pointer dereference on str
net: qrtr: ns: Limit the maximum server registration per node
net: qrtr: ns: Limit the maximum number of lookups
net: bridge: use a stable FDB dst snapshot in RCU readers
net: mctp: fix don't require received header reserved bits to be zero
net: qrtr: ns: Limit the total number of nodes
spi: fix resource leaks on device setup failure
crypto: authencesn - reject short ahash digests during instance creation
driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
ALSA: caiaq: Don't abort when no input device is available
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
drm/amdgpu: fix zero-size GDS range init on RDNA4
ALSA: caiaq: fix usb_dev refcount leak on probe failure
net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
netfilter: reject zero shift in nft_bitwise
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
ipmi: Add limits to event and receive message requests
ipmi: Check event message buffer response for bad data
ipmi:si: Return state to normal if message allocation fails
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
ACPI: scan: Use acpi_dev_put() in object add error paths
ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
ACPI: video: force native backlight on HP OMEN 16 (8A44)
iommufd: Fix a race with concurrent allocation and unmap
ASoC: SOF: Don't allow pointer operations on unconfigured streams
spi: rockchip: fix controller deregistration
ksmbd: rewrite stop_sessions() with restartable iteration
x86: shadow stacks: proper error handling for mmap lock
x86/shstk: Prevent deadlock during shstk sigreturn
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
iommu/amd: Use atomic64_inc_return() in iommu.c
iommu/amd: serialize sequence allocation under concurrent TLB invalidations
flow_dissector: do not dissect PPPoE PFC frames
net: txgbe: fix RTNL assertion warning when remove module
net: af_key: zero aligned sockaddr tail in PF_KEY exports
KVM: SVM: check validity of VMCB controls when returning from SMM
net/sched: sch_red: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
exit: prevent preemption of oopsing TASK_DEAD task
wifi: mt76: mt7925: fix incorrect length field in txpower command
wifi: mt76: mt7921: fix a potential clc buffer length underflow
wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
wifi: b43legacy: enforce bounds check on firmware key index in RX path
wifi: mac80211: drop stray 'static' from fast-RX rx_result
wifi: rsi: fix kthread lifetime race between self-exit and external-stop
wifi: ath5k: do not access array OOB
wifi: mac80211: remove station if connection prep fails
wifi: b43: enforce bounds check on firmware key index in b43_rx()
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
usb: usblp: fix heap leak in IEEE 1284 device ID via short response
usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
ALSA: usb-audio: midi2: Restart output URBs on resume
ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
ALSA: usb-audio: Fix UAC3 cluster descriptor size check
USB: omap_udc: DMA: Don't enable burst 4 mode
USB: serial: option: add Telit Cinterion LE910Cx compositions
ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
ALSA: firewire-tascam: Do not drop unread control events
powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
xfrm: provide message size for XFRM_MSG_MAPPING
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
xfrm: ah: account for ESN high bits in async callbacks
selinux: don't reserve xattr slot when we won't fill it
selinux: shrink critical section in sel_write_load()
selinux: prune /sys/fs/selinux/disable
LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
Bluetooth: virtio_bt: clamp rx length before skb_put
Bluetooth: virtio_bt: validate rx pkt_type header length
Bluetooth: hci_event: Fix OOB read and infinite loop in
hci_le_create_big_complete_evt
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
spi: syncuacer: fix controller deregistration
spi: sun4i: fix controller deregistration
spi: ti-qspi: fix controller deregistration
spi: sun6i: fix controller deregistration
spi: zynqmp-gqspi: fix controller deregistration
spi: s3c64xx: fix NULL-deref on driver unbind
staging: vme_user: fix root device leak on init failure
fanotify: fix false positive on permission events
mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
rtnl_fill_vfinfo
sound: ua101: fix division by zero at probe
net: libwx: fix VF illegal register access
ip6_gre: Use cached t->net in ip6erspan_changelink().
net/rds: handle zerocopy send cleanup before the message is queued
net: wwan: t7xx: validate port_count against message length in
t7xx_port_enum_msg_handler
parisc: Fix IRQ leak in LASI driver
hwmon: (ltc2992) Clamp threshold writes to hardware range
hwmon: (ltc2992) Fix u32 overflow in power read path
clk: rk808: fix OF node reference imbalance
hwmon: (corsair-psu) Close HID device on probe errors
block: add pgmap check to biovec_phys_mergeable
cifs: abort open_cached_dir if we don't request leases
cifs: change_conf needs to be called for session setup
extcon: ptn5150: handle pending IRQ events during system resume
gpio: of: clear OF_POPULATED on hog nodes in remove path
hv_sock: fix ARM64 support
ibmveth: Disable GSO for packets with small MSS
spi: microchip-core-qspi: fix controller deregistration
udf: reject descriptors with oversized CRC length
thermal: core: Free thermal zone ID later during removal
thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
spi: topcliff-pch: fix controller deregistration
spi: topcliff-pch: fix use-after-free on unbind
clk: imx: imx8-acm: fix flags for acm clocks
clk: microchip: mpfs-ccc: fix out of bounds access during output registration
cpuidle: powerpc: avoid double clear when breaking snooze
ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table
ASoC: fsl_easrc: fix comment typo
ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
ASoC: qcom: q6apm: remove child devices when apm is removed
btrfs: fix double free in create_space_info() error path
dm-thin: fix metadata refcount underflow
dm: don't report warning when doing deferred remove
dm: fix a buffer overflow in ioctl processing
eventfs: Hold eventfs_mutex and SRCU when remount walks events
dm-verity-fec: correctly reject too-small FEC devices
dm-verity-fec: correctly reject too-small hash devices
isofs: validate Rock Ridge CE continuation extent against volume size
isofs: validate block number from NFS file handle in isofs_export_iget
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
lib/scatterlist: fix length calculations in extract_kvec_to_sg
lib/scatterlist: fix temp buffer in extract_user_to_sg()
libceph: Fix slab-out-of-bounds access in auth message processing
md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
nvme-apple: drop invalid put of admin queue reference count
nvmet-tcp: fix race between ICReq handling and queue teardown
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
openvswitch: vport: fix self-deadlock on release of tunnel ports
pmdomain: core: Fix detach procedure for virtual devices in genpd
RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
s390/debug: Reject zero-length input in debug_input_flush_fn()
smb/client: fix out-of-bounds read in symlink_data()
smb: client: use kzalloc to zero-initialize security descriptor buffer
smb: client: validate dacloffset before building DACL pointers
KVM: x86: check for nEPT/nNPT in slow flush hypercalls
mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
PCI: Update saved_config_space upon resource assignment
PCI/AER: Clear only error bits in PCIe Device Status
PCI/AER: Stop ruling out unbound devices as error source
PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
power: supply: max17042: avoid overflow when determining health
RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
RDMA/mana: Validate rx_hash_key_len
RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
RDMA/rxe: Reject unknown opcodes before ICRC processing
RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
mptcp: fastclose msk when linger time is 0
mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
mptcp: sockopt: set timestamp flags on subflow socket, not msk
mptcp: fix scheduling with atomic in timestamp sockopt
f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
f2fs: fix fiemap boundary handling when read extent cache is incomplete
f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
f2fs: fix node_cnt race between extent node destroy and writeback
KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS
LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software
LoongArch: KVM: Move unconditional delay into timer clear scenery
LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()
LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
fs: prepare for adding LSM blob to backing_file
dma-mapping: drop unneeded includes from dma-mapping.h
dma-mapping: add __dma_from_device_group_begin()/end()
hwmon: (powerz) Avoid cacheline sharing for DMA buffer
mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
udf: fix partition descriptor append bookkeeping
mtd: spinand: winbond: Declare the QE bit on W25NxxJW
hfsplus: fix uninit-value by validating catalog record size
hfsplus: fix held lock freed on hfsplus_fill_super()
gtp: disable BH before calling udp_tunnel_xmit_skb()
printk: add print_hex_dump_devel()
crypto: caam - guard HMAC key hex dumps in hash_digest_key
ALSA: aloop: Fix peer runtime UAF during format-change stop
net: stmmac: avoid shadowing global buf_sz
net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
net: stmmac: Prevent NULL deref when RX memory exhausted
wifi: mt76: mt7925: fix incorrect TLV length in CLC command
tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
KVM: arm64: Wake-up from WFI when iqrchip is in userspace
ksmbd: validate inherited ACE SID length
UBUNTU: Upstream stable to v6.6.137, v6.6.138, v6.6.139, v6.12.85, v6.12.86,
v6.12.87, v6.12.88
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-11
+
+ Ported from the following upstream stable releases:
+ v6.6.137, v6.6.138, v6.6.139, v6.12.85, v6.12.86,
v6.12.87, v6.12.88
+
from git://git.kernel.org/
+
+ xen/privcmd: fix double free via VMA splitting
+ Buffer overflow in drivers/xen/sys-hypervisor.c
+ x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
+ ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
+ ALSA: usb-audio: Avoid false E-MU sample-rate notifications
+ ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
+ usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
+ usb: chipidea: otg: not wait vbus drop if use role_switch
+ usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change
+ ALSA: usb-audio: Evaluate packsize caps at the right place
+ LoongArch: Add spectre boundry for syscall dispatch table
+ drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
+ leds: qcom-lpg: Check for array overflow when selecting the high resolution
+ greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
+ misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
+ ibmasm: fix OOB reads in command_file_write due to missing size checks
+ ibmasm: fix heap over-read in ibmasm_send_i2o_message()
+ driver core: Don't let a device probe until it's ready
+ firmware: google: framebuffer: Do not mark framebuffer as busy
+ arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
+ drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array
+ drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
+ device property: Make modifications of fwnode "flags" thread safe
+ ocfs2: split transactions in dio completion to avoid credit exhaustion
+ zram: do not forget to endio for partial discard requests
+ wifi: rtw88: check for PCI upstream bridge existence
+ um: drivers: call kernel_strrchr() explicitly in cow_user.c
+ spi: imx: fix use-after-free on unbind
+ crypto: pcrypt - Fix handling of MAY_BACKLOG requests
+ of: unittest: fix use-after-free in testdrv_probe()
+ hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
+ media: amphion: Fix race between m2m job_abort and device_run
+ ALSA: control: Validate buf_len before strnlen() in
snd_ctl_elem_init_enum_names()
+ net: caif: clear client service pointer on teardown
+ net: strparser: fix skb_head leak in strp_abort_strp()
+ media: mtk-jpeg: fix use-after-free in release path due to uncancelled work
+ PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
+ Revert "ALSA: usb: Increase volume range that triggers a warning"
+ PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
+ lib/ts_kmp: fix integer overflow in pattern length calculation
+ media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
imx219_probe()
+ net: qrtr: ns: Fix use-after-free in driver remove()
+ ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
+ ALSA: aoa: i2sbus: fix OF node lifetime handling
+ ALSA: ctxfi: Add fallback to default RSR for S/PDIF
+ ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
+ erofs: fix the out-of-bounds nameoff handling for trailing dirents
+ jbd2: fix deadlock in jbd2_journal_cancel_revoke()
+ md/raid10: fix deadlock with check operation and nowait requests
+ mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
+ mtd: docg3: fix use-after-free in docg3_release()
+ nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
+ nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
+ parisc: _llseek syscall is only available for 32-bit userspace
+ remoteproc: xlnx: Only access buffer information if IPI is buffered
+ sched: Use u64 for bandwidth ratio calculations
+ selftests/mqueue: Fix incorrectly named file
+ selftests/landlock: Fix format warning for __u64 in net_test
+ rbd: fix null-ptr-deref when device_add_disk() fails
+ io_uring/timeout: check unused sqe fields
+ iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
+ io_uring/poll: fix signed comparison in io_poll_get_ownership()
+ io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
+ ALSA: core: Fix potential data race at fasync handling
+ ALSA: caiaq: Fix control_put() result and cache rollback
+ ALSA: caiaq: Handle probe errors properly
+ ALSA: 6fire: Fix input volume change detection
+ ALSA: pcmtest: fix reference leak on failed device registration
+ ALSA: pcmtest: Fix resource leaks in module init error paths
+ iio: adc: ad7768-1: fix one-shot mode data acquisition
+ rxrpc: Fix memory leaks in rxkad_verify_response()
+ rxrpc: Fix re-decryption of RESPONSE packets
+ tools/accounting: handle truncated taskstats netlink messages
+ arm64: dts: marvell: uDPU: add ethernet aliases
+ net: qrtr: ns: Free the node during ctrl_cmd_bye()
+ net: rds: fix MR cleanup on copy error
+ net: txgbe: fix firmware version check
+ net/smc: avoid early lgr access in smc_clc_wait_msg
+ net: ks8851: Reinstate disabling of BHs around IRQ handler
+ net: ks8851: Avoid excess softirq scheduling
+ drm/arcpgu: fix device node leak
+ RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
+ ipv4: icmp: validate reply type before using icmp_pointers
+ libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
+ extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
+ tpm: avoid -Wunused-but-set-variable
+ LoongArch: Show CPU vulnerabilites correctly
+ power: supply: axp288_charger: Do not cancel work before initializing it
+ randomize_kstack: Maintain kstack_offset per task
+ mmc: block: use single block write in retry
+ mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
+ arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
+ xfs: fix a resource leak in xfs_alloc_buftarg()
+ firmware: google: framebuffer: Do not unregister platform device
+ crypto: talitos - fix SEC1 32k ahash request limitation
+ crypto: talitos - rename first/last to first_desc/last_desc
+ tpm: tpm_tis: add error logging for data transfer
+ tpm: tpm_tis: stop transmit if retries are exhausted
+ rtc: ntxec: fix OF node reference imbalance
+ mm/damon/core: use time_in_range_open() for damos quota window start
+ userfaultfd: allow registration of ranges below mmap_min_addr
+ KVM: x86: Defer non-architectural deliver of exception payload to userspace
read
+ KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
+ KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
+ KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
+ KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
+ KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
+ KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
+ KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
+ KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
+ KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
+ KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
+ KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
+ KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
+ KVM: nSVM: Add missing consistency check for nCR3 validity
+ KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
+ KVM: nSVM: Always intercept VMMCALL when L2 is active
+ io_uring/poll: fix multishot recv missing EOF on wakeup race
+ perf annotate: Use jump__delete when freeing LoongArch jumps
+ ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
+ ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
+ mtd: spi-nor: sst: Fix write enable before AAI sequence
+ amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
+ md/raid5: fix soft lockup in retry_aligned_read()
+ md/raid5: validate payload size before accessing journal metadata
+ check-uapi: link into shared objects
+ HID: apple: ensure the keyboard backlight is off if suspending
+ inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
+ wifi: rtl8xxxu: fix potential use of uninitialized value
+ tcp: call sk_data_ready() after listener migration
+ taskstats: set version in TGID exit notifications
+ apparmor: use target task's context in apparmor_getprocattr()
+ Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
+ bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays
+ can: ucan: fix devres lifetime
+ crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
+ crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
+ crypto: atmel-ecc - Release client on allocation failure
+ crypto: hisilicon - Fix dma_unmap_single() direction
+ crypto: ccree - fix a memory leak in cc_mac_digest()
+ crypto: atmel-tdes - fix DMA sync direction
+ crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
+ dm mirror: fix integer overflow in create_dirty_log()
+ ceph: only d_add() negative dentries when they are unhashed
+ IB/core: Fix zero dmac race in neighbor resolution
+ ktest: Fix the month in the name of the failure directory
+ ntfs3: add buffer boundary checks to run_unpack()
+ ntfs3: fix integer overflow in run_unpack() volume boundary check
+ rtmutex: Use waiter::task instead of current in remove_waiter()
+ scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
+ seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
+ smb: client: validate the whole DACL before rewriting it in cifsacl
+ f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
+ lib: test_hmm: evict device pages on file close to avoid use-after-free
+ f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
+ ksmbd: use msleep instaed of schedule_timeout_interruptible()
+ ksmbd: replace connection list with hash table
+ ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
+ thermal: core: Fix thermal zone governor cleanup issues
+ wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
+ wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
+ wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
+ ALSA: aoa: Use guard() for mutex locks
+ ALSA: aoa: i2sbus: clear stale prepared state
+ mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
+ media: rc: ttusbir: respect DMA coherency rules
+ ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
+ media: rc: igorplugusb: heed coherency rules
+ RDMA/mana_ib: Disable RX steering on RSS QP destroy
+ block: relax pgmap check in bio_add_page for compatible zone device pages
+ iio: frequency: admv1013: add dev variable
+ iio: frequency: admv1013: fix NULL pointer dereference on str
+ net: qrtr: ns: Limit the maximum server registration per node
+ net: qrtr: ns: Limit the maximum number of lookups
+ net: bridge: use a stable FDB dst snapshot in RCU readers
+ net: mctp: fix don't require received header reserved bits to be zero
+ net: qrtr: ns: Limit the total number of nodes
+ spi: fix resource leaks on device setup failure
+ crypto: authencesn - reject short ahash digests during instance creation
+ driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
+ ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
+ ALSA: caiaq: Don't abort when no input device is available
+ ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
+ drm/amdgpu: fix zero-size GDS range init on RDNA4
+ ALSA: caiaq: fix usb_dev refcount leak on probe failure
+ net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
+ netfilter: reject zero shift in nft_bitwise
+ scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
+ ipmi: Add limits to event and receive message requests
+ ipmi: Check event message buffer response for bad data
+ ipmi:si: Return state to normal if message allocation fails
+ fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
+ ACPI: scan: Use acpi_dev_put() in object add error paths
+ ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
+ ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
+ ACPI: video: force native backlight on HP OMEN 16 (8A44)
+ iommufd: Fix a race with concurrent allocation and unmap
+ ASoC: SOF: Don't allow pointer operations on unconfigured streams
+ spi: rockchip: fix controller deregistration
+ ksmbd: rewrite stop_sessions() with restartable iteration
+ x86: shadow stacks: proper error handling for mmap lock
+ x86/shstk: Prevent deadlock during shstk sigreturn
+ KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
+ iommu/amd: Use atomic64_inc_return() in iommu.c
+ iommu/amd: serialize sequence allocation under concurrent TLB invalidations
+ flow_dissector: do not dissect PPPoE PFC frames
+ net: txgbe: fix RTNL assertion warning when remove module
+ net: af_key: zero aligned sockaddr tail in PF_KEY exports
+ KVM: SVM: check validity of VMCB controls when returning from SMM
+ net/sched: sch_red: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
+ Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
+ exit: prevent preemption of oopsing TASK_DEAD task
+ wifi: mt76: mt7925: fix incorrect length field in txpower command
+ wifi: mt76: mt7921: fix a potential clc buffer length underflow
+ wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
+ wifi: b43legacy: enforce bounds check on firmware key index in RX path
+ wifi: mac80211: drop stray 'static' from fast-RX rx_result
+ wifi: rsi: fix kthread lifetime race between self-exit and external-stop
+ wifi: ath5k: do not access array OOB
+ wifi: mac80211: remove station if connection prep fails
+ wifi: b43: enforce bounds check on firmware key index in b43_rx()
+ wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
+ usb: usblp: fix heap leak in IEEE 1284 device ID via short response
+ usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
+ ALSA: usb-audio: midi2: Restart output URBs on resume
+ ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
+ ALSA: usb-audio: Fix UAC3 cluster descriptor size check
+ USB: omap_udc: DMA: Don't enable burst 4 mode
+ USB: serial: option: add Telit Cinterion LE910Cx compositions
+ ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
+ ALSA: firewire-tascam: Do not drop unread control events
+ powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
+ xfrm: provide message size for XFRM_MSG_MAPPING
+ xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
+ ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
+ xfrm: ah: account for ESN high bits in async callbacks
+ selinux: don't reserve xattr slot when we won't fill it
+ selinux: shrink critical section in sel_write_load()
+ selinux: prune /sys/fs/selinux/disable
+ LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
+ Bluetooth: virtio_bt: clamp rx length before skb_put
+ Bluetooth: virtio_bt: validate rx pkt_type header length
+ Bluetooth: hci_event: Fix OOB read and infinite loop in
hci_le_create_big_complete_evt
+ Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
+ Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
+ spi: syncuacer: fix controller deregistration
+ spi: sun4i: fix controller deregistration
+ spi: ti-qspi: fix controller deregistration
+ spi: sun6i: fix controller deregistration
+ spi: zynqmp-gqspi: fix controller deregistration
+ spi: s3c64xx: fix NULL-deref on driver unbind
+ staging: vme_user: fix root device leak on init failure
+ fanotify: fix false positive on permission events
+ mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
+ LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
+ net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
rtnl_fill_vfinfo
+ sound: ua101: fix division by zero at probe
+ net: libwx: fix VF illegal register access
+ ip6_gre: Use cached t->net in ip6erspan_changelink().
+ net/rds: handle zerocopy send cleanup before the message is queued
+ net: wwan: t7xx: validate port_count against message length in
t7xx_port_enum_msg_handler
+ parisc: Fix IRQ leak in LASI driver
+ hwmon: (ltc2992) Clamp threshold writes to hardware range
+ hwmon: (ltc2992) Fix u32 overflow in power read path
+ clk: rk808: fix OF node reference imbalance
+ hwmon: (corsair-psu) Close HID device on probe errors
+ block: add pgmap check to biovec_phys_mergeable
+ cifs: abort open_cached_dir if we don't request leases
+ cifs: change_conf needs to be called for session setup
+ extcon: ptn5150: handle pending IRQ events during system resume
+ gpio: of: clear OF_POPULATED on hog nodes in remove path
+ hv_sock: fix ARM64 support
+ ibmveth: Disable GSO for packets with small MSS
+ spi: microchip-core-qspi: fix controller deregistration
+ udf: reject descriptors with oversized CRC length
+ thermal: core: Free thermal zone ID later during removal
+ thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata
+ thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp
+ spi: topcliff-pch: fix controller deregistration
+ spi: topcliff-pch: fix use-after-free on unbind
+ clk: imx: imx8-acm: fix flags for acm clocks
+ clk: microchip: mpfs-ccc: fix out of bounds access during output registration
+ cpuidle: powerpc: avoid double clear when breaking snooze
+ ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table
+ ASoC: fsl_easrc: fix comment typo
+ ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
+ ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
+ ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
+ ASoC: qcom: q6apm: remove child devices when apm is removed
+ btrfs: fix double free in create_space_info() error path
+ dm-thin: fix metadata refcount underflow
+ dm: don't report warning when doing deferred remove
+ dm: fix a buffer overflow in ioctl processing
+ eventfs: Hold eventfs_mutex and SRCU when remount walks events
+ dm-verity-fec: correctly reject too-small FEC devices
+ dm-verity-fec: correctly reject too-small hash devices
+ isofs: validate Rock Ridge CE continuation extent against volume size
+ isofs: validate block number from NFS file handle in isofs_export_iget
+ lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
+ lib/scatterlist: fix length calculations in extract_kvec_to_sg
+ lib/scatterlist: fix temp buffer in extract_user_to_sg()
+ libceph: Fix slab-out-of-bounds access in auth message processing
+ md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
+ nvme-apple: drop invalid put of admin queue reference count
+ nvmet-tcp: fix race between ICReq handling and queue teardown
+ nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
+ openvswitch: vport: fix self-deadlock on release of tunnel ports
+ pmdomain: core: Fix detach procedure for virtual devices in genpd
+ RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
+ s390/debug: Reject zero-length input in debug_input_flush_fn()
+ smb/client: fix out-of-bounds read in symlink_data()
+ smb: client: use kzalloc to zero-initialize security descriptor buffer
+ smb: client: validate dacloffset before building DACL pointers
+ KVM: x86: check for nEPT/nNPT in slow flush hypercalls
+ mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
+ PCI: Update saved_config_space upon resource assignment
+ PCI/AER: Clear only error bits in PCIe Device Status
+ PCI/AER: Stop ruling out unbound devices as error source
+ PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
+ power: supply: max17042: avoid overflow when determining health
+ RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
+ RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
+ RDMA/mana: Validate rx_hash_key_len
+ RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
+ RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
+ RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
+ RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
+ RDMA/rxe: Reject unknown opcodes before ICRC processing
+ RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
+ mptcp: fastclose msk when linger time is 0
+ mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
+ mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
+ mptcp: sockopt: set timestamp flags on subflow socket, not msk
+ mptcp: fix scheduling with atomic in timestamp sockopt
+ f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
+ f2fs: fix fiemap boundary handling when read extent cache is incomplete
+ f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
+ f2fs: fix node_cnt race between extent node destroy and writeback
+ KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
+ KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
+ LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
+ LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS
+ LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software
+ LoongArch: KVM: Move unconditional delay into timer clear scenery
+ LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()
+ LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
+ fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
+ fs: prepare for adding LSM blob to backing_file
+ dma-mapping: drop unneeded includes from dma-mapping.h
+ dma-mapping: add __dma_from_device_group_begin()/end()
+ hwmon: (powerz) Avoid cacheline sharing for DMA buffer
+ mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
+ udf: fix partition descriptor append bookkeeping
+ mtd: spinand: winbond: Declare the QE bit on W25NxxJW
+ hfsplus: fix uninit-value by validating catalog record size
+ hfsplus: fix held lock freed on hfsplus_fill_super()
+ gtp: disable BH before calling udp_tunnel_xmit_skb()
+ printk: add print_hex_dump_devel()
+ crypto: caam - guard HMAC key hex dumps in hash_digest_key
+ ALSA: aloop: Fix peer runtime UAF during format-change stop
+ net: stmmac: avoid shadowing global buf_sz
+ net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
+ net: stmmac: Prevent NULL deref when RX memory exhausted
+ wifi: mt76: mt7925: fix incorrect TLV length in CLC command
+ tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
+ KVM: arm64: Wake-up from WFI when iqrchip is in userspace
+ ksmbd: validate inherited ACE SID length
+ UBUNTU: Upstream stable to v6.6.137, v6.6.138, v6.6.139, v6.12.85, v6.12.86,
v6.12.87, v6.12.88
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2156549
Title:
Noble update: upstream stable patchset 2026-06-11
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2156549/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
