Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-08-31
Ported from the following upstream stable releases:
v6.18.44, v7.1.8
from git://git.kernel.org/
kunit: tool: skip stty when stdin is not a tty
kunit: tool: Terminate kernel under test on SIGINT
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
net: mpls: initialize rtm_tos in mpls_getroute()
ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1
HID: logitech-dj: Standardise hid_report_enum variable nomenclature
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
mm/slab: prevent unbounded recursion in free path with new kmalloc type
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
pinctrl: qcom: Unconditionally mark gpio as wakeup enable
pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE
Revert "UBUNTU: SAUCE: selftests/seccomp fix compilation issue for amd64"
selftests/seccomp: Fix pointer type mismatch build error
ata: sata_mv: accept 1 or 2 resources in platform probe
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
phy: qcom: m31-eusb2: Fix return value of init call
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
of: reserved_mem: prevent OOB when too many dynamic regions are defined
btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
btrfs: zoned: fix deadlock between metadata writeback and transaction commit
btrfs: zoned: reset meta_write_pointer on zone reset
btrfs: raid56: fix an incorrect csum skip during scrub
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
phy: zynqmp: fix runtime PM leak on probe allocation failure
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
drm/mediatek: Check CRTC state before freeing
Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
mshv: Fix duplicate GSI detection for GSI 0
mshv: Fix sleeping under spinlock in mshv_portid_alloc
KVM: arm64: Reject guest_memfd memslots when the VM has MTE
KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
keys: fix out-of-bounds read in keyring_get_key_chunk()
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
assoc_array: trim the final shortcut word using the current chunk end
netfilter: nf_tables: make nft_object rhltable per table
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
ipvs: fix the checksum validations
ipvs: fix places with wrong packet offsets
ipvs: do not mangle ICMP replies for non-first fragments
netfilter: nft_payload: fix mask build for partial field offload
ASoC: SDCA: Ensure that Control Range is large enough for header
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
af_unix: fix listen() succeeding on sockets in the wrong state
selftests/net/af_unix: test listen() rejects wrong socket states
xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
xsk: drain continuation descs after overflow in xsk_build_skb()
pinctrl-amd: Don't clear S4 wake bits at probe
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
smb: client: fix buffer leaks in SMB1 read and write
ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
hwmon: (ina2xx) Make it easier to add more devices
hwmon: (ina2xx) Add support for INA234
hwmon: (ina2xx) Shift INA234 shunt and current registers
hwmon: (ina2xx) Fix various overflow issues
hwmon: (ltc4282) Fix reading the minimum alarm voltage
hwmon: (sht3x) Fix unaligned accesses
hwmon: (lm90) Only report alarms if driver is ready
hwmon: (nzxt-smart2) DMA-align output buffer
net: do not send ICMP/NDISC Redirects when peer allocation fails
hwmon: (nct6775-core) Prevent access to unsupported weight registers
net: bridge: mrp: fix Option TLV length in MRP_Test frames
forcedeth: fix UAF of txrx_stats in nv_remove
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
hwmon: (adt7470) Fix cache updated before hardware write on I2C error
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
hwmon: (adt7470) Use cached PWM frequency value
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
rtase: fix double free of multi-frag skb on DMA map failure
powerpc/boot: Fix simpleboot CPU node lookup check
powerpc/boot: Fix treeboot-currituck CPU node lookup check
powerpc/boot: Fix treeboot-akebono CPU node lookup check
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
wifi: mac80211: validate individual TWT params before driver setup
netfs: clear PG_private_2 on copy-to-cache append failure
netfs: handle single writeback rolling buffer allocation failure
netfs: release readahead folios on iterator preparation failure
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
idpf: adjust TxQ ring count minimum
idpf: Fix mailbox IRQ name leak on request failure
ice: suppress DPLL errors during reset recovery
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
Bluetooth: ISO: lock sk in iso_sock_getname
Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
Bluetooth: ISO: lock sk in iso_connect_ind
Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
Bluetooth: ISO: hold sk properly in iso_conn_ready
Bluetooth: ISO: fix leaking sk after socket release
Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
Bluetooth: ISO: fix refcounting of iso_conn
Bluetooth: btintel: Validate length before parsing diagnostics TLV
Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
x86/boot: Add volatile, clobbers and zero-length test in memcmp()
net: phylink: put link_gpio if phylink_create fails
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
scsi: ufs: core: Cancel RTC work in active-active suspend
scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command
scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded
IRQ handler"
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
scsi: target: Clear cmd_cnt when initial counter enrollment fails
net: sxgbe: free TX rings on RX allocation failure
net: sxgbe: check descriptor ring allocation failures
can: isotp: check register_netdevice_notifier() error in module init
drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder
fprobe: Fix module reference count leak on error in register_fprobe()
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
accel/qaic: use sizeof(*trans_hdr) for transaction length check
riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
ptp: netc: fix potential interrupt storm caused by incorrect unbind order
net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
octeontx2-pf: Set correct sequence for carrier off and tx queue stop
sched/deadline: Use revised wakeup rule only for running dl_server
spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs
qede: sync udp_tunnel ports outside qede_lock in the recovery path
drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status
ksmbd: return success for deferred final close
ksmbd: fix use-after-free in __close_file_table_ids()
iomap: add a separate bio_set for iomap_split_ioend
mshv: Fix race in mshv_irqfd_deassign
mshv: Fix level-triggered check on uninitialized data
mshv: Order pt_vp_array publish against irqfd assertion path
iommufd/viommu: Release the igroup lock on the vdevice_size error path
iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
iommu/iommufd: Fix IOPF group ownership UAF
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
pinctrl: devicetree: don't free uninitialized dev_name on error path
erofs: cap LZMA stream pool size
UBUNTU: [Config] Add EROFS_FS_LZMA_DEFAULT_MAX_STREAMS
pinctrl: bm1880: add missing select GENERIC_PINCONF
fortify: Disable -Wstringop-overread in tests
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
mm/util: don't read __page_2 for order-1 folios in snapshot_page()
selftest: fix headers in fclog.c
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
mm/hugetlb: fix list corruption in allocate_file_region_entries()
mm/vmstat: fold stranded per-cpu node stats when a node comes online
tracing/probes: Reject $arg0 in meta argument expansion
tracing/fprobe: Roll back on enable_trace_fprobe() failure
KVM: VMX: add memory clobber to asm for VMX instructions
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
KVM: s390: pci: Fix missing error codes and memory unaccounting
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
sctp: validate Adaptation Indication parameter length
audit: fix potential integer overflow in audit_log_n_string()
audit: fix potential use-after-free in audit_del_rule()
Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
Bluetooth: mgmt: fix pending command UAF in EIR updates
Bluetooth: SCO: give the socket its own sco_conn reference
Bluetooth: mgmt: fix UAF in pair command cancellation
Bluetooth: hci_sync: Fix advertising data UAFs
Bluetooth: HIDP: reject frames without a transaction header
Bluetooth: HIDP: validate numbered report payloads
bpf: lwt: Fix dst reference leak on reroute failure
afs: Fix afs_fs_fetch_data() to set call->async
afs: Fix afs_fs_fetch_data() to subtract transferred from len
afs: Fix UAF when sending a message
ALSA: 6fire: Fix UAF at error handling during probe
ALSA: hda/realtek: Add quirk for TongFang X6SP45xU
ALSA: lx6464es: fix period byte count for 16-bit streams
ALSA: pcm: wake linked drain waiters on unlink
ALSA: seq: Fix division by zero in initialize_timer()
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
ALSA: ump: fix double free of out_cvts on rawmidi error
ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return
ASoC: tas2562: fix DVC coefficient write order
ASoC: tas2562: fix broken entries in the volume lookup table
ata: libata-eh: Increase STANDBY IMMEDIATE timeout
ata: libata-sata: fix ata_scsi_lpm_supported() iteration
ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
ALSA: usb-audio: fix stack info leak in RME Digiface status
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
e1000: fix memory leak in e1000_probe()
igbvf: Fix leak in TX DMA error cleanup
igc: remove napi_synchronize() in igc_down()
ipvs: do not propagate one-packet flag to synced conns
ksmbd: reject repeated SMB2 NEGOTIATE requests
mshv: fix hv_input_get_system_property struct
net/smc: fix socket use-after-free during link group termination
netfilter: ipset: do not update comments from kernel-side hash adds
of/address: Fix NULL bus dereference in of_pci_range_parser_one()
tipc: avoid use-after-free in poll trace queue dumps
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
binfmt_misc: restore write access when removing an entry
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
binfmt_misc: reject a flag character as the field delimiter
binfmt_misc: don't let an 'F' entry pin its own instance
io_uring/net: initialize mshot_len for send
mm/page_reporting: use system_freezable_wq to fix UAF during suspend
mm: memcg: initialize *locked in memcg1_oom_prepare() stub
net: bridge: stop fast-leave after deleting a port group
net: ipv6: clear suppressed fib6 rule result
net: pktgen: fix proc entry use-after-free
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
um: vector: fix use-after-free in vector_mmsg_rx()
uprobes: Fix NULL pointer dereference in hprobe_expire()
veth: convert frag_list skbs before running XDP
vxlan: re-fetch eth header after route_shortcircuit()
vxlan: unclone skb head before modifying eth header in route_shortcircuit()
vxlan: use neigh_ha_snapshot() in route_shortcircuit()
vxlan: use pskb_network_may_pull() for transmit path header pulls
vxlan: use pskb_network_may_pull() in route_shortcircuit()
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
tracing: Check return value of __register_event() in trace_module_add_events()
tracing/filters: Fix false positive match in regex_match_full()
spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
selftests/mm: fix potential wild pointer access of getline due to missing init
selftests/clone3: fix wild pointer access of getline due to missing init
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
sctp: reject stale cookies with mismatched verification tags
sctp: prevent peer transport count overflow
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
i2c: amd-mp2: Unregister callback on adapter add failure
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
gpio: pch: use raw_spinlock_t for the register lock
cifs: add fscache_resize_cookie() to cifs_setsize()
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
power: supply: bq25890: fix the -10 C NTC lookup entry
power: supply: max17040: handle missing status supplier
s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
s390/qeth: Check CAP_NET_ADMIN for private ioctls
s390/dasd: Fix potential NULL pointer dereference
s390/dasd: Fix undersized format-check buffer
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
s390/zcrypt: Validate length for CCA AES cipher key requests
s390/zcrypt: Validate length for CCA ECC private key requests
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
phy: zynqmp: use read-modify-write for SERDES scrambler bypass
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
net: openvswitch: fix potential UAF on meter attach failure
net: openvswitch: fix skb leak on flow key update failure during recirculation
net: openvswitch: fix skb leak on flow key update failure during ct
ice: wait for reset completion in ice_resume()
ice: fix VF interrupts cleanup
ice: fix memory leak in ice_lbtest_prepare_rings()
i2c: spacemit: request IRQ after controller initialization
i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
i2c: iproc: reset bus after timeout if START_BUSY is stuck
i2c: imx: mark I2C adapter when hardware is powered down
i2c: imx: Fix slave registration race and error handling
i2c: imx: Cancel hrtimer before clearing slave pointer
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming
is configured
can: ems_usb: validate CPC message lengths
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit
failure
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation
failure
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
kvaser_usb_hydra_get_busparams()
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command
extents
can: softing: fw_parse(): validate firmware record spans
can: peak_usb: add bounds check for USB channel index
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
submit error
can: peak_usb: validate uCAN receive record lengths
can: ctucanfd: add missing MODULE_DEVICE_TABLE()
can: ctucanfd: use self-test mode for PRESUME_ACK
can: ctucanfd: unmap BAR0 using base address
can: ctucanfd: handle bus error interrupts
can: ctucanfd: mark error-active controller status valid
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
drm/vc4: Zero the tile state data array before each BIN job
drm/bridge: display-connector: Fix I2C adapter resource leak
drm/panthor: reject firmware sections with oversized data
drm/panthor: validate firmware interface structure sizes
drm/mediatek: ovl_adaptor: balance component registrations
drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
drm/amdgpu: restore UMD profile pstate after runtime resume
drm/amdgpu: cap GTT size to physical RAM on APUs
drm/amd/pm: fix torn gpu metrics reads
drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
drm/amd/display: use proper context for logging
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
drm/amdkfd: fix QID bit leak in pqm_create_queue()
drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
drm/amdkfd: Handle invalid event type in CRIU event restore
drm/amdkfd: hold event_mutex while checkpointing CRIU events
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
drm/vmwgfx: reject DX_BIND_QUERY without a DX context
drm/vmwgfx: clamp dirty-page range with min, not max
drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
drm/vmwgfx: bound DMA command body size against suffix pointer
drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
drm/vmwgfx: enforce cursor size limits for MOB cursors
drm/vmwgfx: use check_add_overflow for shader size+offset bound
drm/vmwgfx: validate external BO copy bounds for both stride paths
HID: logitech-dj: Fix maxfield check in DJ short report validation
drm/xe/rtp: Maintain OA whitelists separately
drm/xe/rtp: Keep track of non-OA nonpriv slots
drm/xe/rtp: Generalize whitelist_apply_to_hwe
drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
drm/xe/rtp: Ensure locking/ref counting for OA whitelists
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
net/handshake: Close the submit-side sock_hold race
usb: typec: ucsi: split connector lock classes
usb: typec: ucsi: Fix race condition and ordering in port unregistration
media: chips-media: wave5: Support CBP profile
drm/amd/display: check GRPH_FLIP status before sending event
drm/amd/display: Exit idle optimizations before programming
drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support
drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo
drm/xe/vm: Prevent binding of purged buffer objects
drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
drm/xe: Wait on external BO kernel fences in exec IOCTL
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT
ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
dmaengine: idxd: fix double free of wq, engine, and group structs
btrfs: warn about extent buffer that can not be released
btrfs: skip global block reserve accounting for rescue mounts
btrfs: zoned: skip fully truncated ordered extents at zone finish
rtla/timerlat_top: Fix on-threshold actions firing on signal
selftests: netfilter: nft_flowtable.sh: fix offload counter verification for
tunnel tests
netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()
ipvs: clear the nfct flag under lock
ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
ASoC: SDCA: Always free firmware in FDL path
ASoC: SDCA: Make UMP message size check more robust
nexthop: take nh->lock for f6i_list walks in replace check and notify
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
xsk: provide sufficient space in pool->tx_descs
xsk: reclaim invalid Tx descriptors in ZC batch path
net/sched: sch_cake: skip clearing unused tins during rate adjustment
erofs: clean up erofs_ishare_fill_inode()
erofs: remove fscache backend entirely
UBUNTU: [Config] Remove EROFS_FS_ONDEMAND
erofs: ensure valid f_path for page cache sharing
wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
ethtool: Embed FEC hist ranges as buffer in struct
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
idpf: bound interrupt-vector register fill to the allocated array
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
Bluetooth: hci_sync: hold conn in hci_past_sync() callback
Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync
scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
drm/xe/pt: check no-DMA huge-pte cases before DMA segment test
ipv6: release fib6_null_entry on subtree failure
riscv: vdso: Only try to install vDSO when present
net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
net: stmmac: Fix E2E delay mechanism
net: mana: Create separate EQs for each vPort
net: mana: Return error code from mana_create_rxq()
ksmbd: use memcmp() to compare ClientGUIDs
mshv: Fix missing error code on VP allocation failure
mshv: Publish VP to pt_vp_array before installing the file descriptor
iommufd: Reject DMABUF pages from the access pin path
btrfs: raid56: fix scrub read assembly submitting no reads
btrfs: zoned: fix missing chunk metadata reservation
ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset
userfaultfd: wait on source PMD during UFFDIO_MOVE
KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
KVM: s390: pci: Fix resource leak on IRQ registration failure
Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
ata: libata-scsi: terminate deferred commands on time out
ata: libata-scsi: schedule deferred atapi command
fou: Fix use-after-free in fou_create()
PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work
around hardware bug
binfmt_misc: don't leak the user namespace when the mount fails
io_uring: preserve task restrictions across exec
scsi: libsas: terminate deferred commands on time out
scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
s390/zcrypt: Close speculative mem read possibility
can: rcar_canfd: change the initializing flow for clocks and resets
drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
drm/amd/pm: fix pptable use-after-free
drm/amd/pm: hide pp_table sysfs on APUs
drm/amd/pm: use milliwatts for GPU power sensors
drm/amd/display: check if dml21_add_phantom_plane() is successful
drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
drm/xe: Drop unused param from xe_device_create()
drm/xe: Move xe->info.force_execlist initialization
drm/xe: Move xe->info.devid|revid initialization
drm/xe: Drop unnecessary goto in xe_device_create
drm/xe: Separate early xe_device initialization
drm/xe: Set TTM device beneficial_order to 9 (2M)
UBUNTU: Upstream stable to v6.18.44, v7.1.8
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Resolute)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Resolute)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Resolute)
Status: New => In Progress
** Changed in: linux (Ubuntu Resolute)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-08-31
+
+ Ported from the following upstream stable releases:
+ v6.18.44, v7.1.8
+
from git://git.kernel.org/
+
+ kunit: tool: skip stty when stdin is not a tty
+ kunit: tool: Terminate kernel under test on SIGINT
+ netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
+ net: mpls: initialize rtm_tos in mpls_getroute()
+ ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1
+ HID: logitech-dj: Standardise hid_report_enum variable nomenclature
+ HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
+ HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
+ lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
+ mm/slab: prevent unbounded recursion in free path with new kmalloc type
+ thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
+ pinctrl: qcom: Unconditionally mark gpio as wakeup enable
+ pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
+ dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
+ dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
+ iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
+ gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
+ selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE
+ Revert "UBUNTU: SAUCE: selftests/seccomp fix compilation issue for amd64"
+ selftests/seccomp: Fix pointer type mismatch build error
+ ata: sata_mv: accept 1 or 2 resources in platform probe
+ ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
+ phy: qcom: m31-eusb2: Fix return value of init call
+ ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
+ ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
+ of: reserved_mem: prevent OOB when too many dynamic regions are defined
+ btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
+ btrfs: zoned: fix deadlock between metadata writeback and transaction commit
+ btrfs: zoned: reset meta_write_pointer on zone reset
+ btrfs: raid56: fix an incorrect csum skip during scrub
+ phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
+ phy: zynqmp: fix runtime PM leak on probe allocation failure
+ netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
+ drm/mediatek: Check CRTC state before freeing
+ Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
+ mshv: Fix duplicate GSI detection for GSI 0
+ mshv: Fix sleeping under spinlock in mshv_portid_alloc
+ KVM: arm64: Reject guest_memfd memslots when the VM has MTE
+ KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
+ keys: fix out-of-bounds read in keyring_get_key_chunk()
+ keys: make keyring key-chunk byte order agree with keyring_diff_objects()
+ assoc_array: trim the final shortcut word using the current chunk end
+ netfilter: nf_tables: make nft_object rhltable per table
+ netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
+ ipvs: fix the checksum validations
+ ipvs: fix places with wrong packet offsets
+ ipvs: do not mangle ICMP replies for non-first fragments
+ netfilter: nft_payload: fix mask build for partial field offload
+ ASoC: SDCA: Ensure that Control Range is large enough for header
+ rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
+ af_unix: fix listen() succeeding on sockets in the wrong state
+ selftests/net/af_unix: test listen() rejects wrong socket states
+ xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
+ xsk: drain continuation descs after overflow in xsk_build_skb()
+ pinctrl-amd: Don't clear S4 wake bits at probe
+ scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
+ scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
+ scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
+ smb: client: fix buffer leaks in SMB1 read and write
+ ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
+ spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
+ hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
+ hwmon: (ina2xx) Make it easier to add more devices
+ hwmon: (ina2xx) Add support for INA234
+ hwmon: (ina2xx) Shift INA234 shunt and current registers
+ hwmon: (ina2xx) Fix various overflow issues
+ hwmon: (ltc4282) Fix reading the minimum alarm voltage
+ hwmon: (sht3x) Fix unaligned accesses
+ hwmon: (lm90) Only report alarms if driver is ready
+ hwmon: (nzxt-smart2) DMA-align output buffer
+ net: do not send ICMP/NDISC Redirects when peer allocation fails
+ hwmon: (nct6775-core) Prevent access to unsupported weight registers
+ net: bridge: mrp: fix Option TLV length in MRP_Test frames
+ forcedeth: fix UAF of txrx_stats in nv_remove
+ hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
+ hwmon: (adt7470) Fix cache updated before hardware write on I2C error
+ hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
+ hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
+ hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
+ hwmon: (adt7470) Use cached PWM frequency value
+ hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
+ hwmon: (adt7470) Fix PWM auto temp state array and bounds check
+ rtase: fix double free of multi-frag skb on DMA map failure
+ powerpc/boot: Fix simpleboot CPU node lookup check
+ powerpc/boot: Fix treeboot-currituck CPU node lookup check
+ powerpc/boot: Fix treeboot-akebono CPU node lookup check
+ net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
+ wifi: mac80211: validate individual TWT params before driver setup
+ netfs: clear PG_private_2 on copy-to-cache append failure
+ netfs: handle single writeback rolling buffer allocation failure
+ netfs: release readahead folios on iterator preparation failure
+ net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
+ hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
+ idpf: adjust TxQ ring count minimum
+ idpf: Fix mailbox IRQ name leak on request failure
+ ice: suppress DPLL errors during reset recovery
+ Bluetooth: ISO: clear iso_data always when detaching conn from hcon
+ Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
+ Bluetooth: ISO: lock sk in iso_sock_getname
+ Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
+ Bluetooth: ISO: lock sk in iso_connect_ind
+ Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
+ Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
+ Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
+ Bluetooth: ISO: hold sk properly in iso_conn_ready
+ Bluetooth: ISO: fix leaking sk after socket release
+ Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
+ Bluetooth: ISO: ensure no dangling hcon references in iso_conn
+ Bluetooth: ISO: fix refcounting of iso_conn
+ Bluetooth: btintel: Validate length before parsing diagnostics TLV
+ Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
+ Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
+ Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
+ x86/boot: Add volatile, clobbers and zero-length test in memcmp()
+ net: phylink: put link_gpio if phylink_create fails
+ scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
+ scsi: ufs: core: Cancel RTC work in active-active suspend
+ scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command
+ scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded
IRQ handler"
+ scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
+ scsi: target: Clear cmd_cnt when initial counter enrollment fails
+ net: sxgbe: free TX rings on RX allocation failure
+ net: sxgbe: check descriptor ring allocation failures
+ can: isotp: check register_netdevice_notifier() error in module init
+ drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder
+ fprobe: Fix module reference count leak on error in register_fprobe()
+ tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
+ tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
+ riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
+ accel/qaic: use sizeof(*trans_hdr) for transaction length check
+ riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
+ net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
+ net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
+ ptp: netc: fix potential interrupt storm caused by incorrect unbind order
+ net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
+ octeontx2-pf: Set correct sequence for carrier off and tx queue stop
+ sched/deadline: Use revised wakeup rule only for running dl_server
+ spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported
SoCs
+ qede: sync udp_tunnel ports outside qede_lock in the recovery path
+ drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status
+ ksmbd: return success for deferred final close
+ ksmbd: fix use-after-free in __close_file_table_ids()
+ iomap: add a separate bio_set for iomap_split_ioend
+ mshv: Fix race in mshv_irqfd_deassign
+ mshv: Fix level-triggered check on uninitialized data
+ mshv: Order pt_vp_array publish against irqfd assertion path
+ iommufd/viommu: Release the igroup lock on the vdevice_size error path
+ iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
+ iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
+ iommu/iommufd: Fix IOPF group ownership UAF
+ pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
+ pinctrl: devicetree: don't free uninitialized dev_name on error path
+ erofs: cap LZMA stream pool size
+ UBUNTU: [Config] Add EROFS_FS_LZMA_DEFAULT_MAX_STREAMS
+ pinctrl: bm1880: add missing select GENERIC_PINCONF
+ fortify: Disable -Wstringop-overread in tests
+ mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
+ mm/util: don't read __page_2 for order-1 folios in snapshot_page()
+ selftest: fix headers in fclog.c
+ fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
+ mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
+ mm/hugetlb: fix list corruption in allocate_file_region_entries()
+ mm/vmstat: fold stranded per-cpu node stats when a node comes online
+ tracing/probes: Reject $arg0 in meta argument expansion
+ tracing/fprobe: Roll back on enable_trace_fprobe() failure
+ KVM: VMX: add memory clobber to asm for VMX instructions
+ KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
+ KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
+ KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
+ KVM: s390: pci: Fix missing error codes and memory unaccounting
+ KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
+ KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
+ dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
+ sctp: validate Adaptation Indication parameter length
+ audit: fix potential integer overflow in audit_log_n_string()
+ audit: fix potential use-after-free in audit_del_rule()
+ Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
+ Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
+ Bluetooth: mgmt: fix pending command UAF in EIR updates
+ Bluetooth: SCO: give the socket its own sco_conn reference
+ Bluetooth: mgmt: fix UAF in pair command cancellation
+ Bluetooth: hci_sync: Fix advertising data UAFs
+ Bluetooth: HIDP: reject frames without a transaction header
+ Bluetooth: HIDP: validate numbered report payloads
+ bpf: lwt: Fix dst reference leak on reroute failure
+ afs: Fix afs_fs_fetch_data() to set call->async
+ afs: Fix afs_fs_fetch_data() to subtract transferred from len
+ afs: Fix UAF when sending a message
+ ALSA: 6fire: Fix UAF at error handling during probe
+ ALSA: hda/realtek: Add quirk for TongFang X6SP45xU
+ ALSA: lx6464es: fix period byte count for 16-bit streams
+ ALSA: pcm: wake linked drain waiters on unlink
+ ALSA: seq: Fix division by zero in initialize_timer()
+ ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
+ ALSA: ump: fix double free of out_cvts on rawmidi error
+ ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
+ ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return
+ ASoC: tas2562: fix DVC coefficient write order
+ ASoC: tas2562: fix broken entries in the volume lookup table
+ ata: libata-eh: Increase STANDBY IMMEDIATE timeout
+ ata: libata-sata: fix ata_scsi_lpm_supported() iteration
+ ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
+ ALSA: usb-audio: fix stack info leak in RME Digiface status
+ ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
+ ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
+ ALSA: usb-audio: Clamp frame size in implicit-feedback mode
+ dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
+ e1000: fix memory leak in e1000_probe()
+ igbvf: Fix leak in TX DMA error cleanup
+ igc: remove napi_synchronize() in igc_down()
+ ipvs: do not propagate one-packet flag to synced conns
+ ksmbd: reject repeated SMB2 NEGOTIATE requests
+ mshv: fix hv_input_get_system_property struct
+ net/smc: fix socket use-after-free during link group termination
+ netfilter: ipset: do not update comments from kernel-side hash adds
+ of/address: Fix NULL bus dereference in of_pci_range_parser_one()
+ tipc: avoid use-after-free in poll trace queue dumps
+ wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
+ binfmt_misc: restore write access when removing an entry
+ binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
+ binfmt_misc: reject a flag character as the field delimiter
+ binfmt_misc: don't let an 'F' entry pin its own instance
+ io_uring/net: initialize mshot_len for send
+ mm/page_reporting: use system_freezable_wq to fix UAF during suspend
+ mm: memcg: initialize *locked in memcg1_oom_prepare() stub
+ net: bridge: stop fast-leave after deleting a port group
+ net: ipv6: clear suppressed fib6 rule result
+ net: pktgen: fix proc entry use-after-free
+ powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
+ um: vector: fix use-after-free in vector_mmsg_rx()
+ uprobes: Fix NULL pointer dereference in hprobe_expire()
+ veth: convert frag_list skbs before running XDP
+ vxlan: re-fetch eth header after route_shortcircuit()
+ vxlan: unclone skb head before modifying eth header in route_shortcircuit()
+ vxlan: use neigh_ha_snapshot() in route_shortcircuit()
+ vxlan: use pskb_network_may_pull() for transmit path header pulls
+ vxlan: use pskb_network_may_pull() in route_shortcircuit()
+ ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
+ tracing: Check return value of __register_event() in trace_module_add_events()
+ tracing/filters: Fix false positive match in regex_match_full()
+ spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
+ spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
+ selftests/mm: fix potential wild pointer access of getline due to missing init
+ selftests/clone3: fix wild pointer access of getline due to missing init
+ scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
+ sctp: reject stale cookies with mismatched verification tags
+ sctp: prevent peer transport count overflow
+ hwmon: (npcm750-pwm-fan): stop fan timer on device detach
+ hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
+ i2c: amd-mp2: Unregister callback on adapter add failure
+ gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
+ gpio: pch: use raw_spinlock_t for the register lock
+ cifs: add fscache_resize_cookie() to cifs_setsize()
+ cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
+ cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
+ power: supply: bq25890: fix the -10 C NTC lookup entry
+ power: supply: max17040: handle missing status supplier
+ s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
+ s390/qeth: Check CAP_NET_ADMIN for private ioctls
+ s390/dasd: Fix potential NULL pointer dereference
+ s390/dasd: Fix undersized format-check buffer
+ s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
+ s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
+ s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
+ s390/zcrypt: Validate length for CCA AES cipher key requests
+ s390/zcrypt: Validate length for CCA ECC private key requests
+ phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
+ phy: zynqmp: use read-modify-write for SERDES scrambler bypass
+ phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
+ net: openvswitch: fix potential UAF on meter attach failure
+ net: openvswitch: fix skb leak on flow key update failure during recirculation
+ net: openvswitch: fix skb leak on flow key update failure during ct
+ ice: wait for reset completion in ice_resume()
+ ice: fix VF interrupts cleanup
+ ice: fix memory leak in ice_lbtest_prepare_rings()
+ i2c: spacemit: request IRQ after controller initialization
+ i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
+ i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock
deadlock
+ i2c: iproc: reset bus after timeout if START_BUSY is stuck
+ i2c: imx: mark I2C adapter when hardware is powered down
+ i2c: imx: Fix slave registration race and error handling
+ i2c: imx: Cancel hrtimer before clearing slave pointer
+ can: c_can: c_can_chip_config(): keep controller in init mode until bittiming
is configured
+ can: ems_usb: validate CPC message lengths
+ can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB
resubmit failure
+ can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation
failure
+ can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
+ can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
+ can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
kvaser_usb_hydra_get_busparams()
+ can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command
extents
+ can: softing: fw_parse(): validate firmware record spans
+ can: peak_usb: add bounds check for USB channel index
+ can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
submit error
+ can: peak_usb: validate uCAN receive record lengths
+ can: ctucanfd: add missing MODULE_DEVICE_TABLE()
+ can: ctucanfd: use self-test mode for PRESUME_ACK
+ can: ctucanfd: unmap BAR0 using base address
+ can: ctucanfd: handle bus error interrupts
+ can: ctucanfd: mark error-active controller status valid
+ drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
+ drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
+ drm/vc4: Zero the tile state data array before each BIN job
+ drm/bridge: display-connector: Fix I2C adapter resource leak
+ drm/panthor: reject firmware sections with oversized data
+ drm/panthor: validate firmware interface structure sizes
+ drm/mediatek: ovl_adaptor: balance component registrations
+ drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
+ drm/amdgpu: restore UMD profile pstate after runtime resume
+ drm/amdgpu: cap GTT size to physical RAM on APUs
+ drm/amd/pm: fix torn gpu metrics reads
+ drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
+ drm/amd/display: use proper context for logging
+ drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
+ drm/amdkfd: fix QID bit leak in pqm_create_queue()
+ drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
+ drm/amdkfd: Handle invalid event type in CRIU event restore
+ drm/amdkfd: hold event_mutex while checkpointing CRIU events
+ drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
+ drm/vmwgfx: reject DX_BIND_QUERY without a DX context
+ drm/vmwgfx: clamp dirty-page range with min, not max
+ drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
+ drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
+ drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
+ drm/vmwgfx: bound DMA command body size against suffix pointer
+ drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
+ drm/vmwgfx: enforce cursor size limits for MOB cursors
+ drm/vmwgfx: use check_add_overflow for shader size+offset bound
+ drm/vmwgfx: validate external BO copy bounds for both stride paths
+ HID: logitech-dj: Fix maxfield check in DJ short report validation
+ drm/xe/rtp: Maintain OA whitelists separately
+ drm/xe/rtp: Keep track of non-OA nonpriv slots
+ drm/xe/rtp: Generalize whitelist_apply_to_hwe
+ drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
+ drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
+ drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
+ drm/xe/rtp: Ensure locking/ref counting for OA whitelists
+ mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
+ fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
+ mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
+ net/handshake: Close the submit-side sock_hold race
+ usb: typec: ucsi: split connector lock classes
+ usb: typec: ucsi: Fix race condition and ordering in port unregistration
+ media: chips-media: wave5: Support CBP profile
+ drm/amd/display: check GRPH_FLIP status before sending event
+ drm/amd/display: Exit idle optimizations before programming
+ drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support
+ drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo
+ drm/xe/vm: Prevent binding of purged buffer objects
+ drm/exec: Remove the index parameter from
drm_exec_for_each_locked_obj[_reverse]
+ drm/xe: Wait on external BO kernel fences in exec IOCTL
+ can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
+ usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
+ mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT
+ ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05)
+ KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context
+ dmaengine: idxd: fix double free of wq, engine, and group structs
+ btrfs: warn about extent buffer that can not be released
+ btrfs: skip global block reserve accounting for rescue mounts
+ btrfs: zoned: skip fully truncated ordered extents at zone finish
+ rtla/timerlat_top: Fix on-threshold actions firing on signal
+ selftests: netfilter: nft_flowtable.sh: fix offload counter verification for
tunnel tests
+ netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()
+ mshv_vtl: fix fd leak in mshv_ioctl_create_vtl()
+ ipvs: clear the nfct flag under lock
+ ASoC: SDCA: Correct pointer passed to devm_acpi_table_put
+ ASoC: SDCA: Always free firmware in FDL path
+ ASoC: SDCA: Make UMP message size check more robust
+ nexthop: take nh->lock for f6i_list walks in replace check and notify
+ nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
+ xsk: provide sufficient space in pool->tx_descs
+ xsk: reclaim invalid Tx descriptors in ZC batch path
+ net/sched: sch_cake: skip clearing unused tins during rate adjustment
+ erofs: clean up erofs_ishare_fill_inode()
+ erofs: remove fscache backend entirely
+ UBUNTU: [Config] Remove EROFS_FS_ONDEMAND
+ erofs: ensure valid f_path for page cache sharing
+ wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()
+ ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set()
+ ethtool: Embed FEC hist ranges as buffer in struct
+ net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
+ netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
+ idpf: bound interrupt-vector register fill to the allocated array
+ Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
+ Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
+ Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
+ Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
+ Bluetooth: hci_sync: hold conn in hci_past_sync() callback
+ Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync
+ scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
+ scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
+ drm/xe/pt: check no-DMA huge-pte cases before DMA segment test
+ ipv6: release fib6_null_entry on subtree failure
+ riscv: vdso: Only try to install vDSO when present
+ net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
+ net: stmmac: Fix E2E delay mechanism
+ net: mana: Create separate EQs for each vPort
+ net: mana: Return error code from mana_create_rxq()
+ ksmbd: use memcmp() to compare ClientGUIDs
+ mshv: Fix missing error code on VP allocation failure
+ mshv: Publish VP to pt_vp_array before installing the file descriptor
+ iommufd: Reject DMABUF pages from the access pin path
+ btrfs: raid56: fix scrub read assembly submitting no reads
+ btrfs: zoned: fix missing chunk metadata reservation
+ ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset
+ userfaultfd: wait on source PMD during UFFDIO_MOVE
+ KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
+ KVM: s390: pci: Fix resource leak on IRQ registration failure
+ Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
+ ata: libata-scsi: terminate deferred commands on time out
+ ata: libata-scsi: schedule deferred atapi command
+ fou: Fix use-after-free in fou_create()
+ PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work
around hardware bug
+ binfmt_misc: don't leak the user namespace when the mount fails
+ io_uring: preserve task restrictions across exec
+ scsi: libsas: terminate deferred commands on time out
+ scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
+ s390/zcrypt: Close speculative mem read possibility
+ can: rcar_canfd: change the initializing flow for clocks and resets
+ drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2
+ drm/amd/pm: fix pptable use-after-free
+ drm/amd/pm: hide pp_table sysfs on APUs
+ drm/amd/pm: use milliwatts for GPU power sensors
+ drm/amd/display: check if dml21_add_phantom_plane() is successful
+ drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero
viewport
+ drm/xe: Drop unused param from xe_device_create()
+ drm/xe: Move xe->info.force_execlist initialization
+ drm/xe: Move xe->info.devid|revid initialization
+ drm/xe: Drop unnecessary goto in xe_device_create
+ drm/xe: Separate early xe_device initialization
+ drm/xe: Set TTM device beneficial_order to 9 (2M)
+ UBUNTU: Upstream stable to v6.18.44, v7.1.8
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165942
Title:
Resolute update: upstream stable patchset 2026-08-31
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165942/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
