Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-09-01
Ported from the following upstream stable releases:
v6.18.45, v6.18.46, v7.1.9, v7.1.10
from git://git.kernel.org/
mount: honour SB_NOUSER in the new mount API
sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug
causing scheduling lag")
selftests/bpf: Fail unbound UDP on sockmap update
drm/amd/display: Add AV mute wait frames to dce110_set_avmute
drm/amd/display: Check for tg ops in dce110_set_avmute
arm64: dts: qcom: purwa: Fix GPU IOMMU property
arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
xfs: handle NULL b_addr in xfs_buf_free
ARM: npcm: Fix OF node refcount leaks in SMP setup
selftests/sched_ext: Handle sleeping task affinity changes in numa test
pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function
pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function
ovpn: add missing rtnl_link_ops->get_size callback
ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
ovpn: skip rehash for peers already removed from by_id
ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
ovpn: ensure socket is owned by ovpn before deref sk_user_data
ovpn: zero-initialize sockaddr before learning a floated endpoint
ovpn: hash floated peer by transport identity only
ovpn: disable IPv4 redirects on MP interfaces
ovpn: ensure TCP vars are initialized first
ovpn: fix incorrect use of rcu_access_pointer()
drm/bridge: ps8640: propagate AUX transfer register errors
net: hns3: fix speed configuration residue after driver reload
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
enic: fix tx_hang_reset use-after-free on device removal
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
pds_core: keep the health thread stopped during reset
pds_core: cancel pending PCI reset work on AER recovery
netfilter: ipset: switch ext_size to atomic64_t
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
ipvs: return the csum validation for forward hook
watchdog: bd96801_wdt: Fix timeout for enabled WDG
btrfs: fix memory leak in btrfs_do_encoded_write()
bpf: Preserve pointer state for commuted arithmetic
bpf: split check_reg_sane_offset() in two parts
bpf: Propagate untrusted pointer state in commuted arithmetic
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
smc_llc_event_handler()
net/sched: cls_route: fix fastmap use-after-free on filter
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
devlink: fix net namespace reference leak in reload
net/mlx5: fw_tracer, return NULL on create error
counter: microchip-tcb-capture: Fix DT channel validation
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
vhost/vdpa: reject overflowing PA map page counts on 32-bit
vdpa/mlx5: Fix buffer length in create_direct_keys()
hwmon: (pmbus_core) Use guard() for mutex protection
hwmon: (pmbus) Fix type confusion in notification logic
tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
xsk: require at least 16 bytes of TX metadata
xsk: pass TX metadata pointer by reference
xsk: clear metadata pointer when no timestamp is requested
xsk: validate launch-time metadata size
xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
xsk: validate metadata when processing requests
udp: fix potential use-after-free in tunnel segmentation
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
vhost-scsi: Validate T10 PI scatterlist counts
vhost-scsi: reject feature changes after endpoint
net/openvswitch: check Ethernet header length in key_extract()
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs
hwmon: (nzxt-smart2) Check return value of init_device() in probe
hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
selftests/ftrace: refactor eprobes test to fix argument checks
net: stmmac: resume PHY before hardware setup when opening the interface
bnge: use int for bnge_fix_rings_count() return value
net/mlx5e: fix BQL reset on SQ re-activation
bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
bnxt_en: Determine and store default RX ring in vnic structure
bnxt_en: Refresh VNIC default ring on queue restart if needed
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
bnxt_en: Fix PTP PPS setting bug
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
tcp: fix TFO max_qlen accounting across reuseport migration
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
net: prestera: validate firmware header length
net: remove WARN_ON_ONCE() from sk_mc_loop()
net/smc: fix TOCTOU race between smc_listen_out() and listener close
net: thunderbolt: Tear down DMA paths before stopping the rings
ata: pata_sl82c105: fix bridge revision use-after-free
bnge: Fix resource leak in bnge_init_nic() error path
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
sctp: clear control chunk transport if it is being removed
tls: don't abort the connection on signal-interrupted sends
watchdog: at91sam9_wdt: prevent timer rearm during teardown
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
termination
hwmon: (ads7828) Fix external VREF regulator handling
hwmon: (ltc4282) Avoid overflow in maximum power calculation
hwmon: (ltc4282) Clamp negative current limits
hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
Input: evdev - sanitize event type index when fetching event masks
ALSA: usb-audio: fix OOB write on Type II inbound URBs
usb: core: Add quirk for 255-bytes initial config read
usb: quirks: Add ShanWan gamepad to quirk list
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
thunderbolt: icm: Preserve USB4 proxy data-valid bit
usb: cdnsp: fix incorrect endian conversions for APB timeout register
usb: gadget: f_ncm: Use unsigned int for ndp_index
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
net: usb: ipheth: fix carrier_work UAF on disconnect
vt: add permission check for KDSKBMETA ioctl
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Input: evdev - fix information leak in evdev_pass_values()
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
ima: fix out-of-bounds read in xattr_verify()
ipvs: stop estimator after disabled calc phase
ipvs: add totalconns for dest
ipvs: properly update the overload flag on dest edit
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
packet: use consistent hard_header_len in non-ring send paths
packet: use consistent hard_header_len in TX_RING send path
net/packet: reset the MAC header on the packet-socket transmit path
packet: synchronize pressure clearing with ring reconfiguration
net: fix skb length accounting after generic XDP frag adjustment
net: openvswitch: reallocate update replies for mismatched IDs
net/sched: reject overly deep qdisc hierarchies
net: octeontx2-pf: Fix UB in shift operation
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
inet: frags: publish queues before arming timer
mac802154: fix netdev use-after-free in beacon worker
igc: fix netdev not re-attached after resume if interface is down
netfilter: ebt_nflog: pin the NFLOG backend
net: bridge: mrp: fix uninitialised bytes on the wire
KVM: s390: pci: Fix aisb calculation
dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
futex: Prevent robust futex exit race some more
Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
selftests/bpf: Ensure UDP sockets are bound
selftests/bpf: Adapt sockmap update error handling
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
ipv4: fix use-after-free in fib_nhc_update_mtu()
mei: pull kvfree out of spinlock
nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
nvmem: layouts: Add fixed-layout driver
rust_binder: do not query current thread for all ioctls
serial: qcom-geni: fix TX DMA buffer flush
serial: 8250_dma: Clear stale RX state on shutdown
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
serial: amba-pl011: fix indefinite RS485 post-send delay
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
serial: amba-pl011: synchronize DMA teardown
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
staging: rtl8723bs: fix OOB read in WMM_param_handler()
staging: rtl8723bs: fix missing shared-key auth challenge length check
staging: rtl8723bs: validate monitor transmit frame lengths
misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
mm/damon/ops-common: putback folios on invalid migrate nid
samples/damon/mtier: error out for zero quota goal target values
mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
ALSA: usx2y: bound the hwdep mmap fault offset
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
ALSA: hda/tas2781: fix ACPI reference handling
ALSA: us144mkii: re-anchor capture URBs on resubmission
drm/v3d: Serialize the scheduler timeout handlers
perf/core: Fix group leader use-after-free after sibling detach
tracing: Fix race between update_event_fields and, event_define_fields
fbdev: bitblit: bound-check glyph index in bit_cursor()
ring-buffer: Prevent subbuf order change when resizing is disabled
tracing: Fix NULL pointer dereference in module event cache removal
mm/huge_memory: fix huge_zero_pfn race
net: phy: mediatek: fix TX blink masks using the RX bits
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
net/dibs: Correct freeing of dmb_clientid_arr
net/x25: fix use-after-free of the socket by its timers
net: devmem: prevent net-iov / page mixing
netfilter: bridge: release template ct on non-IP path
netfilter: nf_conntrack: defer invalid log until after unlock
net: atlantic: free stranded TX buffers on ring deinit
net: atlantic: free RX pages of consumed but not refilled buffers
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
net/sched: act_gact, act_police: range check the fallback control action
ovl: don't warn when the mount is completed from another user namespace
binfmt_misc: don't warn when the mount is completed from another user namespace
dibs: initialise dibs->lock in dibs_dev_alloc()
arm64: remove redundant concurrent ptdump UAF mitigation
x86/CPU: Add a tlbi= cmdline switch
x86/mce: Set up the polling timer before CMCI discovery
xdp: reject clones that overrun skb_shared_info tailroom
vxlan: do not arm the ageing timer on a device that is down
vsock/virtio: read virtqueues under worker locks
vsock/virtio: avoid refilling the RX queue after teardown
veth: fix skb length accounting after XDP frag adjustment
vhost: reset the vring metadata cache on vring reconfiguration
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
tls: don't leave a full plaintext sk_msg ring unpushed
tipc: read le->link under the node lock in tipc_node_link_down()
smb: client: Fix use-after-free in cifs_try_adding_channels()
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
eventfs: Fix use-after-free in eventfs_remove_rec()
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
ptp: ocp: Fix board ID over-read
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
ring-buffer: Use current_context for safe per-CPU buffer swap
mm/ptdump: always stabilise against page table freeing using init_mm
ipv6: fix Route Information option length validation
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
sched/psi: Create the psimon kthread outside of cgroup_mutex
ima: Instantiate file_truncate and path_truncate hooks
mm/filemap: __filemap_add_folio() restore index before retrying
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
fsverity: Fix silent truncation in bpf_get_fsverity_digest()
bpf, sockmap: Fix sk_redir use-after-free in send verdict
scsi: scsi_debug: Negate wrapped memcmp() result
sctp: keep chunk->transport in step with the list it is queued on
sctp: fix use-after-free of cached ASCONF chunk
sctp: clear new_transport when removing a peer
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
thunderbolt: Fix bandwidth group reservation indexing
netfilter: flowtable: ensure sufficient headroom in xmit path
selftests/bpf: Add tests for sleepable tracepoint programs
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
arm64: dts: qcom: monaco: Add default GIC address cells
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
btrfs: lzo: add error message for invalid headers
btrfs: lzo: reject inline extents without valid headers
btrfs: initialize inode mapping flags for cached inodes
accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
bpf: Fix netns reference imbalance in conntrack kfuncs
vhost_iotlb: bound map allocation in add_range
hwmon: (pmbus/core) Avoid race condition during probe
bnge: Fix NULL pointer dereference in aux device release
drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
net: qrtr: ns: Raise lookup limit to 128
rqspinlock: Reset tail when preserving queue on deadlock
hwmon: Support guard() and scoped_guard for subsystem locks
hwmon: (corsair-psu) serialize debugfs access against hwmon
usbnet: cap max_mtu for drivers without bind callback
mm: fix incorrect flush address in direct page table reclaim
ipvs: separate destination availability state
selftests/xsk: fix too-many-frags multi-buffer Tx test
selftests/xsk: account reclaimed invalid Tx descriptors
serial: sc16is7xx: enable THRI before filling TX FIFO
mm/damon/lru_sort: error out for >10000 active_mem_bp
mm/huge_memory: initialise workingset state before folio split
net: ntb_netdev: Introduce per-queue context
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
eventfs: Use children field for rcu head and add memory barriers
ring-buffer: Prevent resizing of persistent ring buffer
Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
mm/page_table_check: skip special zero mappings
fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
block: stop the timeout timer when releasing a never added disk
selinux: require every boolean value to be defined
selinux: reject a class permission count below its inherited common
selinux: do not cancel a policy conversion that never started
selinux: reject an unclaimed class value in security_get_classes()
selinux: reject a permission value exceeding the class permission count
mptcp: reclaim forward-allocated memory on RX path errors
selftests: mptcp: join: mark tests with data corruption as failed
mptcp: avoid combining some incoming suboptions
mptcp: options: reset DSS fields in case of unexpected size
mptcp: pm: fix data race in add_addr timer callback
mptcp: fastopen: only mark MPTFO subflows with SYN data
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
ASoC: cs4265: sort the register default table
ASoC: cs35l45: sort the register default table
ASoC: cs35l41: sort the register default table
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
fbdev: core: Fix pointer desynchronization in fb_io_read()
drm/panthor: skip zero-sized firmware sections
drm/amdgpu: reject oversized IBs with per-ring packet limits
drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode
drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode
drm/amdgpu: fix aperture iounmap skipped on device removal
ASoC: SOF: topology: Use acpi mach from the machine driver
Input: xpad - add support for ZENAIM LEVERLESS
Input: cs40l50-vibra - validate custom data from user space
powerpc/pseries: pci - logic bug
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Input: psxpad-spi - set driver data before use
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Input: iforce - validate input packet lengths
Input: byd - synchronize timer deletion before freeing private data
powerpc/pseries: lparcfg - fix kbuf[] underflow
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
Input: synaptics-rmi4 - zero report size on F54 work error
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: hynitron_cstxxx - validate touch count and finger IDs
crypto: starfive - use scatterlist length before DMA mapping
crypto: qce - fix error path in devm_qce_register_algs
gve: fix NULL dereference due to missing ptp adjfine
gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
selftests/ftrace: Convert ELF entry point to file offset in uprobe test
gve: fix zero-length skb frag with header-split
gpio: ml-ioh: use raw_spinlock_t for the register lock
pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0
libceph: fix multiple unsafe decodes in decode_locker()
ftrace: Protect direct_functions in ftrace_find_rec_direct
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
openrisc: signal: do not restore privileged SR bits on sigreturn
Input: sur40 - fix input device registration ordering
Input: sur40 - fix V4L error path cleanup
libceph: Avoid using invalid osd indices from primary_temp
ceph: fix MDS random selection readiness predicate
libceph: tolerate addrvecs with multiple entries of the same type
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
mmc: sdhci: unmap the bounce buffer before device release
pmdomain: mediatek: fix remaining %pOF after of_node_put()
mmc: sdhci: make tuning_err a signed int
pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
drm/connector/hdmi: Fix out of bounds memory read
mmc: loongson2: Fix sg iteration in data reorder functions
pmdomain: mediatek: Fix mt8183 hang on boot
drm/xe: Order ring writes before ring tail updates
drm/xe: Fix xe_device_probe() failure
drm/radeon: fix autosuspend cleanup during teardown
s390/vfio_ccw: Free all memory if cp_init() fails
s390/vfio_ccw: Limit the number of channel program segments
s390/vfio_ccw: Cancel existing workqueues
s390/vfio_ccw: Ensure index for read/write regions are within range
s390/vfio_ccw: Ensure first IDAW remains constant
s390/vfio_ccw: Fix out of bounds check on CCW array
s390/vfio_ccw: Move cp cleanup out of not operational
s390/vfio_ccw: Selectively expand io_mutex
s390/vfio_ccw: Calculate idal length based on idaw type
s390/vfio_ccw: Implement a crw lock
s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
drm/amdgpu: Reject UVD message with invalid number of h265 refs
drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
drm/amdgpu: check ASPM on the dGPU host link
drm/amdgpu: validate GEM_CREATE domain combinations
drm/amdgpu: Reject UVD message with dimensions above 4096
drm/amdgpu: Fix UVD min buffer sizes
drm/amdgpu: Fix UVD dpb min size calculation for H264
drm/amdgpu: Fix UVD decode image min size calculation
drm/amdgpu: disallow multiple FENCE chunks in one submit
xfs: propagate errors from xfs_rtginode_load
xfs: fix off-by-one in rtrefcount btree root level validation
xfs: bounds-check buffer log item's dirty bitmap
xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
xfs: clear zapped attr fork state when bmap repair finds no attr fork
xfs: check cowextsize in xrep_inode_cowextsize
xfs: fix transaction block reservation in xrep_rtbitmap
xfs: zero i_nlink before repair puts inode on unlinked list
xfs: only check mergeability of bnobt records
xfs: don't double-lock when deleting a self-referential directory
xfs: set the prev pointer when reinserting an inode on the unlinked list
xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
xfs: nlink scrub must take IOLOCK before determining ILOCK state
xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
xfs: fix ilock leak on error in xfs_dq_get_next_id
xfs: don't zap the attr fork on repair when there are queued pptr updates
xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
xfs: fix allocated inodes that show up in the unlinked list
xfs: fix another iunlink infinite loop bug in online fsck
xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
xfs: avoid UAF on sc->tempip in xrep_tempfile_create
xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
xfs: don't swallow dquot recovery verification errors
xfs: don't ignore runtime errors in xrep_iunlink_reload_next
xfs: check xfarray iteration errors when committing unlinked inode lists
xfs: check v5 superblock features early
ceph: avoid fs reclaim while using current->journal_info
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
ASoC: tas2562: Validate values for volume writes
futex: Fix race in futex_pivot_pending() during private hash resize
sched_ext: Update p->scx.disallow warning in scx_init_task()
sched_ext: Reorganize enable/disable path for multi-scheduler support
ring-buffer: Store bpage pointers into subbuf_ids
ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
crypto: ccm - Set rfc4309 maxauthsize from child
crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
ovpn: fix NULL dereference when killing missing key
ovpn: finish crypto callback cleanup before peer release
riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
perf: Reject exited events as group leaders
gpio: ml-ioh: share the register lock across channels
ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
netfilter: ipset: fix refcount race between list:set GC and swap
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
netfilter: flowtable: publish GC-visible tuple last
netfilter: ipset: fix list type element drift bug
netfilter: ipset: let destroy callbacks adjust ext mem size
eth: bnxt: cancel IRQ notifier before freeing affinity mask
eth: bnxt: keep the aRFS rmap updated when TPH is enabled
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
veth: fix queue index used to wake the peer txq in veth_poll
tcp: fix icsk_ack.ato bitfield overflow
net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
net: packet: fix wrong transport_header when sending VLAN-tagged frame
net: tap: fix wrong transport_header when sending VLAN-tagged frame
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
regmap: sdw-mbq: Fix swap of timeout and retry times
af_packet: Don't send zero-byte data in tpacket_snd().
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
net/sched: cls_u32: skip hash tables in u32_bind_class()
m68k: Define NR_CPUS to 1
regmap: sdw-mbq: don't call an unset readable_reg callback
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
accel/amdxdna: Skip unmapped range in aie2_populate_range()
net/sched: cls_bpf: reject dev-bound programs bound to a different device
firewire: ohci: fix NULL pointer dereference in ar_context_release
drm/xe/oa: Fix sync entry leak on OA config emit failure
drm/log: Fix out-of-bounds read on empty message length
drm/log: Fix infinite loop when scale is too large for display
spi: virtio: mark device ready before registering the controller
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
drm/shmem_helper: Check VMA boundaries for PMD mappings
fbdev: bound mode sysfs output to the sysfs buffer
fbdev: clear fb_info->mode before deleting a videomode
drm/amdgpu/userq: serialize queue map against GPU reset
drm/amd: Disable DP audio spread spectrum for Cyan Skillfish
drm/radeon: restore hardware polling in fence_is_signaled to fix performance
regression
drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode
drm/amdgpu/gmc12.1: implement tlb inv semaphore
drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush
Input: atkbd - skip deactivate for HONOR ZQC-P
pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
ftrace: Protect direct_functions in update_ftrace_direct_del
ftrace: Protect direct_functions in update_ftrace_direct_mod
libceph: fix OOB read in decode_watchers() via missing bounds check
drm/xe/guc_ads: allocate UM queues in a separate BO
drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
drm/xe/guc_ads: use uncached mapping for UM queue BO
drm/amdgpu: fix missing check in vm_flush()
drm/amdkfd: Add bounds check for CRAT subtype length
net: rename netdev_ops_assert_locked()
optee: ffa: Add NULL check in optee_ffa_lend_protmem
clk: spacemit: k3: fix USB2 bus clock
clk: spacemit: k3: set hdma clock as critical
gpiolib: Check gc->get_direction() before calling gpiod_get_direction()
regulator: fp9931: Fix VPOS/VNEG voltage selector table
af_unix: Unlink scc_entry in unix_del_edge().
scsi: core: pair EH runtime PM get and put
sctp: validate cookie AUTH state before use
ovpn: run deferred work on a module-owned workqueue
ovpn: defer key slot crypto freeing to workqueue
tick: Include ktime.h and jiffies.h in linux/tick.h
ipvs: revalidate ihl to prevent out-of-bounds access
eth: bnxt: decrease indent in bnxt_request_irq()
eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
l2tp: fix tunnel and session refcount leak on seq_file release
drm/xe/pxp: add termination on resume
drm/xe/oa: Check managed mutex initialization errors
drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
drm/xe: Fix a bug in pc_adjust_freq_bounds()
drm/log: Fix division by zero when scale module parameter is 0
UBUNTU: Upstream stable to v6.18.45, v6.18.46, v7.1.9, v7.1.10
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Resolute)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Resolute)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Resolute)
Status: New => In Progress
** Changed in: linux (Ubuntu Resolute)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-09-01
+
+ Ported from the following upstream stable releases:
+ v6.18.45, v6.18.46, v7.1.9, v7.1.10
+
from git://git.kernel.org/
+
+ mount: honour SB_NOUSER in the new mount API
+ sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug
causing scheduling lag")
+ selftests/bpf: Fail unbound UDP on sockmap update
+ drm/amd/display: Add AV mute wait frames to dce110_set_avmute
+ drm/amd/display: Check for tg ops in dce110_set_avmute
+ arm64: dts: qcom: purwa: Fix GPU IOMMU property
+ arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle
+ NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
+ arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
+ xfs: handle NULL b_addr in xfs_buf_free
+ ARM: npcm: Fix OF node refcount leaks in SMP setup
+ selftests/sched_ext: Handle sleeping task affinity changes in numa test
+ pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function
+ pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function
+ ovpn: add missing rtnl_link_ops->get_size callback
+ ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
+ ovpn: skip rehash for peers already removed from by_id
+ ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
+ ovpn: ensure socket is owned by ovpn before deref sk_user_data
+ ovpn: zero-initialize sockaddr before learning a floated endpoint
+ ovpn: hash floated peer by transport identity only
+ ovpn: disable IPv4 redirects on MP interfaces
+ ovpn: ensure TCP vars are initialized first
+ ovpn: fix incorrect use of rcu_access_pointer()
+ drm/bridge: ps8640: propagate AUX transfer register errors
+ net: hns3: fix speed configuration residue after driver reload
+ Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
+ bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
+ enic: fix tx_hang_reset use-after-free on device removal
+ net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
+ pds_core: keep the health thread stopped during reset
+ pds_core: cancel pending PCI reset work on AER recovery
+ netfilter: ipset: switch ext_size to atomic64_t
+ ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
+ ipvs: return the csum validation for forward hook
+ watchdog: bd96801_wdt: Fix timeout for enabled WDG
+ btrfs: fix memory leak in btrfs_do_encoded_write()
+ bpf: Preserve pointer state for commuted arithmetic
+ bpf: split check_reg_sane_offset() in two parts
+ bpf: Propagate untrusted pointer state in commuted arithmetic
+ net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
smc_llc_event_handler()
+ net/sched: cls_route: fix fastmap use-after-free on filter
+ net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
+ devlink: fix net namespace reference leak in reload
+ net/mlx5: fw_tracer, return NULL on create error
+ counter: microchip-tcb-capture: Fix DT channel validation
+ bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
+ vhost/vdpa: reject overflowing PA map page counts on 32-bit
+ vdpa/mlx5: Fix buffer length in create_direct_keys()
+ hwmon: (pmbus_core) Use guard() for mutex protection
+ hwmon: (pmbus) Fix type confusion in notification logic
+ tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
+ bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
+ xsk: require at least 16 bytes of TX metadata
+ xsk: pass TX metadata pointer by reference
+ xsk: clear metadata pointer when no timestamp is requested
+ xsk: validate launch-time metadata size
+ xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
+ xsk: validate metadata when processing requests
+ udp: fix potential use-after-free in tunnel segmentation
+ net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
+ vhost-scsi: Validate T10 PI scatterlist counts
+ vhost-scsi: reject feature changes after endpoint
+ net/openvswitch: check Ethernet header length in key_extract()
+ net/sched: cls_api: Always acquire rtnl_lock when destroying locked
classifiers
+ drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs
+ hwmon: (nzxt-smart2) Check return value of init_device() in probe
+ hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
+ selftests/ftrace: refactor eprobes test to fix argument checks
+ net: stmmac: resume PHY before hardware setup when opening the interface
+ bnge: use int for bnge_fix_rings_count() return value
+ net/mlx5e: fix BQL reset on SQ re-activation
+ bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
+ bnxt_en: Determine and store default RX ring in vnic structure
+ bnxt_en: Refresh VNIC default ring on queue restart if needed
+ bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
+ bnxt_en: Fix PTP PPS setting bug
+ sctp: fix addip_serial increment on ASCONF_ACK allocation failure
+ tcp: fix TFO max_qlen accounting across reuseport migration
+ netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
+ net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
+ net: prestera: validate firmware header length
+ net: remove WARN_ON_ONCE() from sk_mc_loop()
+ net/smc: fix TOCTOU race between smc_listen_out() and listener close
+ net: thunderbolt: Tear down DMA paths before stopping the rings
+ ata: pata_sl82c105: fix bridge revision use-after-free
+ bnge: Fix resource leak in bnge_init_nic() error path
+ s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
+ net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
+ sctp: clear control chunk transport if it is being removed
+ tls: don't abort the connection on signal-interrupted sends
+ watchdog: at91sam9_wdt: prevent timer rearm during teardown
+ hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
termination
+ hwmon: (ads7828) Fix external VREF regulator handling
+ hwmon: (ltc4282) Avoid overflow in maximum power calculation
+ hwmon: (ltc4282) Clamp negative current limits
+ hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
+ net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
+ Input: evdev - sanitize event type index when fetching event masks
+ ALSA: usb-audio: fix OOB write on Type II inbound URBs
+ usb: core: Add quirk for 255-bytes initial config read
+ usb: quirks: Add ShanWan gamepad to quirk list
+ usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
+ usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
+ thunderbolt: icm: Preserve USB4 proxy data-valid bit
+ usb: cdnsp: fix incorrect endian conversions for APB timeout register
+ usb: gadget: f_ncm: Use unsigned int for ndp_index
+ net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
+ net: usb: ipheth: fix carrier_work UAF on disconnect
+ vt: add permission check for KDSKBMETA ioctl
+ vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
+ Input: evdev - fix information leak in evdev_pass_values()
+ mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
+ ima: fix out-of-bounds read in xattr_verify()
+ ipvs: stop estimator after disabled calc phase
+ ipvs: add totalconns for dest
+ ipvs: properly update the overload flag on dest edit
+ ipvs: clear IPv4 options after rebasing tunnel ICMP errors
+ packet: use consistent hard_header_len in non-ring send paths
+ packet: use consistent hard_header_len in TX_RING send path
+ net/packet: reset the MAC header on the packet-socket transmit path
+ packet: synchronize pressure clearing with ring reconfiguration
+ net: fix skb length accounting after generic XDP frag adjustment
+ net: openvswitch: reallocate update replies for mismatched IDs
+ net/sched: reject overly deep qdisc hierarchies
+ net: octeontx2-pf: Fix UB in shift operation
+ net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
+ inet: frags: publish queues before arming timer
+ mac802154: fix netdev use-after-free in beacon worker
+ igc: fix netdev not re-attached after resume if interface is down
+ netfilter: ebt_nflog: pin the NFLOG backend
+ net: bridge: mrp: fix uninitialised bytes on the wire
+ KVM: s390: pci: Fix aisb calculation
+ dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
+ futex: Prevent robust futex exit race some more
+ Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
+ Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
+ selftests/bpf: Ensure UDP sockets are bound
+ selftests/bpf: Adapt sockmap update error handling
+ ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
+ ipv4: fix use-after-free in fib_nhc_update_mtu()
+ mei: pull kvfree out of spinlock
+ nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
+ nvmem: layouts: Add fixed-layout driver
+ rust_binder: do not query current thread for all ioctls
+ serial: qcom-geni: fix TX DMA buffer flush
+ serial: 8250_dma: Clear stale RX state on shutdown
+ serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
+ serial: amba-pl011: fix indefinite RS485 post-send delay
+ serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
+ serial: amba-pl011: synchronize DMA teardown
+ staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
+ staging: rtl8723bs: fix OOB read in WMM_param_handler()
+ staging: rtl8723bs: fix missing shared-key auth challenge length check
+ staging: rtl8723bs: validate monitor transmit frame lengths
+ misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
+ misc: fastrpc: fix channel ctx ref leak when session alloc fails
+ misc: fastrpc: Remove buffer from list prior to unmap operation
+ misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
+ misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
+ ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
+ mm/damon/ops-common: putback folios on invalid migrate nid
+ samples/damon/mtier: error out for zero quota goal target values
+ mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
+ ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
+ ALSA: usx2y: bound the hwdep mmap fault offset
+ ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
+ ALSA: hda/tas2781: fix ACPI reference handling
+ ALSA: us144mkii: re-anchor capture URBs on resubmission
+ drm/v3d: Serialize the scheduler timeout handlers
+ perf/core: Fix group leader use-after-free after sibling detach
+ tracing: Fix race between update_event_fields and, event_define_fields
+ fbdev: bitblit: bound-check glyph index in bit_cursor()
+ ring-buffer: Prevent subbuf order change when resizing is disabled
+ tracing: Fix NULL pointer dereference in module event cache removal
+ mm/huge_memory: fix huge_zero_pfn race
+ net: phy: mediatek: fix TX blink masks using the RX bits
+ net: smc: fix splice entry lifetime imbalance in smc_rx_splice
+ ipv6: prevent in6_dev_get() from resurrecting inet6_dev
+ net/dibs: Correct freeing of dmb_clientid_arr
+ net/x25: fix use-after-free of the socket by its timers
+ net: devmem: prevent net-iov / page mixing
+ netfilter: bridge: release template ct on non-IP path
+ netfilter: nf_conntrack: defer invalid log until after unlock
+ net: atlantic: free stranded TX buffers on ring deinit
+ net: atlantic: free RX pages of consumed but not refilled buffers
+ net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
+ net/sched: act_gact, act_police: range check the fallback control action
+ ovl: don't warn when the mount is completed from another user namespace
+ binfmt_misc: don't warn when the mount is completed from another user
namespace
+ dibs: initialise dibs->lock in dibs_dev_alloc()
+ arm64: remove redundant concurrent ptdump UAF mitigation
+ x86/CPU: Add a tlbi= cmdline switch
+ x86/mce: Set up the polling timer before CMCI discovery
+ xdp: reject clones that overrun skb_shared_info tailroom
+ vxlan: do not arm the ageing timer on a device that is down
+ vsock/virtio: read virtqueues under worker locks
+ vsock/virtio: avoid refilling the RX queue after teardown
+ veth: fix skb length accounting after XDP frag adjustment
+ vhost: reset the vring metadata cache on vring reconfiguration
+ tls: rx: restore msg_iter before TLS 1.3 optimistic retry
+ tls: don't leave a full plaintext sk_msg ring unpushed
+ tipc: read le->link under the node lock in tipc_node_link_down()
+ smb: client: Fix use-after-free in cifs_try_adding_channels()
+ KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
+ KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
+ eventfs: Fix use-after-free in eventfs_remove_rec()
+ Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
+ ptp: ocp: Fix board ID over-read
+ ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
+ ring-buffer: Use current_context for safe per-CPU buffer swap
+ mm/ptdump: always stabilise against page table freeing using init_mm
+ ipv6: fix Route Information option length validation
+ ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
+ fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
+ sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
+ sched/psi: Create the psimon kthread outside of cgroup_mutex
+ ima: Instantiate file_truncate and path_truncate hooks
+ mm/filemap: __filemap_add_folio() restore index before retrying
+ fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
+ fsverity: Fix silent truncation in bpf_get_fsverity_digest()
+ bpf, sockmap: Fix sk_redir use-after-free in send verdict
+ scsi: scsi_debug: Negate wrapped memcmp() result
+ sctp: keep chunk->transport in step with the list it is queued on
+ sctp: fix use-after-free of cached ASCONF chunk
+ sctp: clear new_transport when removing a peer
+ thunderbolt: Bound the DROM dual link port number before indexing sw->ports
+ thunderbolt: Fix bandwidth group reservation indexing
+ netfilter: flowtable: ensure sufficient headroom in xmit path
+ selftests/bpf: Add tests for sleepable tracepoint programs
+ gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
+ arm64: dts: qcom: monaco: Add default GIC address cells
+ NFS: Decrement refcounts if allocating nfs_free_stateid_data fails
+ soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
+ btrfs: lzo: add error message for invalid headers
+ btrfs: lzo: reject inline extents without valid headers
+ btrfs: initialize inode mapping flags for cached inodes
+ accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
+ accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
+ bpf: Fix netns reference imbalance in conntrack kfuncs
+ vhost_iotlb: bound map allocation in add_range
+ hwmon: (pmbus/core) Avoid race condition during probe
+ bnge: Fix NULL pointer dereference in aux device release
+ drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()
+ bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
+ net: qrtr: ns: Raise lookup limit to 128
+ rqspinlock: Reset tail when preserving queue on deadlock
+ hwmon: Support guard() and scoped_guard for subsystem locks
+ hwmon: (corsair-psu) serialize debugfs access against hwmon
+ usbnet: cap max_mtu for drivers without bind callback
+ mm: fix incorrect flush address in direct page table reclaim
+ ipvs: separate destination availability state
+ selftests/xsk: fix too-many-frags multi-buffer Tx test
+ selftests/xsk: account reclaimed invalid Tx descriptors
+ serial: sc16is7xx: enable THRI before filling TX FIFO
+ mm/damon/lru_sort: error out for >10000 active_mem_bp
+ mm/huge_memory: initialise workingset state before folio split
+ net: ntb_netdev: Introduce per-queue context
+ NTB: ntb_netdev: Preserve RX queue depth on allocation failure
+ smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
+ eventfs: Use children field for rcu head and add memory barriers
+ ring-buffer: Prevent resizing of persistent ring buffer
+ Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
+ mm/page_table_check: skip special zero mappings
+ fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
+ sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
+ block: stop the timeout timer when releasing a never added disk
+ selinux: require every boolean value to be defined
+ selinux: reject a class permission count below its inherited common
+ selinux: do not cancel a policy conversion that never started
+ selinux: reject an unclaimed class value in security_get_classes()
+ selinux: reject a permission value exceeding the class permission count
+ mptcp: reclaim forward-allocated memory on RX path errors
+ selftests: mptcp: join: mark tests with data corruption as failed
+ mptcp: avoid combining some incoming suboptions
+ mptcp: options: reset DSS fields in case of unexpected size
+ mptcp: pm: fix data race in add_addr timer callback
+ mptcp: fastopen: only mark MPTFO subflows with SYN data
+ s390/qeth: validate user buffer length in SNMP and ARP query ioctls
+ ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
+ ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
+ ASoC: cs4265: sort the register default table
+ ASoC: cs35l45: sort the register default table
+ ASoC: cs35l41: sort the register default table
+ ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
+ fbdev: core: Fix pointer desynchronization in fb_io_read()
+ drm/panthor: skip zero-sized firmware sections
+ drm/amdgpu: reject oversized IBs with per-ring packet limits
+ drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12
+ drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode
+ drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode
+ drm/amdgpu: fix aperture iounmap skipped on device removal
+ ASoC: SOF: topology: Use acpi mach from the machine driver
+ Input: xpad - add support for ZENAIM LEVERLESS
+ Input: cs40l50-vibra - validate custom data from user space
+ powerpc/pseries: pci - logic bug
+ Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
+ Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
+ Input: psxpad-spi - set driver data before use
+ Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
+ Input: iforce - validate input packet lengths
+ Input: byd - synchronize timer deletion before freeing private data
+ powerpc/pseries: lparcfg - fix kbuf[] underflow
+ powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
+ Input: synaptics-rmi4 - zero report size on F54 work error
+ Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
+ Input: synaptics-rmi4 - block s_input when F54 queue is busy
+ Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
+ Input: hynitron_cstxxx - validate touch count and finger IDs
+ crypto: starfive - use scatterlist length before DMA mapping
+ crypto: qce - fix error path in devm_qce_register_algs
+ gve: fix NULL dereference due to missing ptp adjfine
+ gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
+ selftests/ftrace: Convert ELF entry point to file offset in uprobe test
+ gve: fix zero-length skb frag with header-split
+ gpio: ml-ioh: use raw_spinlock_t for the register lock
+ pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0
+ libceph: fix multiple unsafe decodes in decode_locker()
+ ftrace: Protect direct_functions in ftrace_find_rec_direct
+ ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
+ openrisc: signal: do not restore privileged SR bits on sigreturn
+ Input: sur40 - fix input device registration ordering
+ Input: sur40 - fix V4L error path cleanup
+ libceph: Avoid using invalid osd indices from primary_temp
+ ceph: fix MDS random selection readiness predicate
+ libceph: tolerate addrvecs with multiple entries of the same type
+ mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
+ mmc: sdhci: unmap the bounce buffer before device release
+ pmdomain: mediatek: fix remaining %pOF after of_node_put()
+ mmc: sdhci: make tuning_err a signed int
+ pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE
+ mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
+ drm/connector/hdmi: Fix out of bounds memory read
+ mmc: loongson2: Fix sg iteration in data reorder functions
+ pmdomain: mediatek: Fix mt8183 hang on boot
+ drm/xe: Order ring writes before ring tail updates
+ drm/xe: Fix xe_device_probe() failure
+ drm/radeon: fix autosuspend cleanup during teardown
+ s390/vfio_ccw: Free all memory if cp_init() fails
+ s390/vfio_ccw: Limit the number of channel program segments
+ s390/vfio_ccw: Cancel existing workqueues
+ s390/vfio_ccw: Ensure index for read/write regions are within range
+ s390/vfio_ccw: Ensure first IDAW remains constant
+ s390/vfio_ccw: Fix out of bounds check on CCW array
+ s390/vfio_ccw: Move cp cleanup out of not operational
+ s390/vfio_ccw: Selectively expand io_mutex
+ s390/vfio_ccw: Calculate idal length based on idaw type
+ s390/vfio_ccw: Implement a crw lock
+ s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code
+ drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
+ drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
+ drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
+ drm/amdgpu: Reject UVD message with invalid number of h265 refs
+ drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
+ drm/amdgpu: check ASPM on the dGPU host link
+ drm/amdgpu: validate GEM_CREATE domain combinations
+ drm/amdgpu: Reject UVD message with dimensions above 4096
+ drm/amdgpu: Fix UVD min buffer sizes
+ drm/amdgpu: Fix UVD dpb min size calculation for H264
+ drm/amdgpu: Fix UVD decode image min size calculation
+ drm/amdgpu: disallow multiple FENCE chunks in one submit
+ xfs: propagate errors from xfs_rtginode_load
+ xfs: fix off-by-one in rtrefcount btree root level validation
+ xfs: bounds-check buffer log item's dirty bitmap
+ xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
+ xfs: clear zapped attr fork state when bmap repair finds no attr fork
+ xfs: check cowextsize in xrep_inode_cowextsize
+ xfs: fix transaction block reservation in xrep_rtbitmap
+ xfs: zero i_nlink before repair puts inode on unlinked list
+ xfs: only check mergeability of bnobt records
+ xfs: don't double-lock when deleting a self-referential directory
+ xfs: set the prev pointer when reinserting an inode on the unlinked list
+ xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
+ xfs: nlink scrub must take IOLOCK before determining ILOCK state
+ xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
+ xfs: fix ilock leak on error in xfs_dq_get_next_id
+ xfs: don't zap the attr fork on repair when there are queued pptr updates
+ xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
+ xfs: fix allocated inodes that show up in the unlinked list
+ xfs: fix another iunlink infinite loop bug in online fsck
+ xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
+ xfs: avoid UAF on sc->tempip in xrep_tempfile_create
+ xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
+ xfs: don't swallow dquot recovery verification errors
+ xfs: don't ignore runtime errors in xrep_iunlink_reload_next
+ xfs: check xfarray iteration errors when committing unlinked inode lists
+ xfs: check v5 superblock features early
+ ceph: avoid fs reclaim while using current->journal_info
+ ceph: fix hanging __ceph_get_caps() with stale mds_wanted
+ ASoC: tas2562: Validate values for volume writes
+ futex: Fix race in futex_pivot_pending() during private hash resize
+ sched_ext: Update p->scx.disallow warning in scx_init_task()
+ sched_ext: Reorganize enable/disable path for multi-scheduler support
+ ring-buffer: Store bpage pointers into subbuf_ids
+ ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
+ arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
+ crypto: ccm - Set rfc4309 maxauthsize from child
+ crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
+ ovpn: fix NULL dereference when killing missing key
+ ovpn: finish crypto callback cleanup before peer release
+ riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
+ perf: Reject exited events as group leaders
+ gpio: ml-ioh: share the register lock across channels
+ ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
+ netfilter: ipset: fix refcount race between list:set GC and swap
+ netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
+ netfilter: flowtable: publish GC-visible tuple last
+ netfilter: ipset: fix list type element drift bug
+ netfilter: ipset: let destroy callbacks adjust ext mem size
+ eth: bnxt: cancel IRQ notifier before freeing affinity mask
+ eth: bnxt: keep the aRFS rmap updated when TPH is enabled
+ ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
+ macvlan: inherit needed_headroom and needed_tailroom from lowerdev
+ veth: fix queue index used to wake the peer txq in veth_poll
+ tcp: fix icsk_ack.ato bitfield overflow
+ net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
+ net: packet: fix wrong transport_header when sending VLAN-tagged frame
+ net: tap: fix wrong transport_header when sending VLAN-tagged frame
+ net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
+ net/tls: Fail tls_sw_splice_read() after a failed async decrypt
+ ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
+ regmap: sdw-mbq: Fix swap of timeout and retry times
+ af_packet: Don't send zero-byte data in tpacket_snd().
+ net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
+ net/sched: cls_u32: skip hash tables in u32_bind_class()
+ m68k: Define NR_CPUS to 1
+ regmap: sdw-mbq: don't call an unset readable_reg callback
+ net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
+ accel/amdxdna: Skip unmapped range in aie2_populate_range()
+ net/sched: cls_bpf: reject dev-bound programs bound to a different device
+ firewire: ohci: fix NULL pointer dereference in ar_context_release
+ drm/xe/oa: Fix sync entry leak on OA config emit failure
+ drm/log: Fix out-of-bounds read on empty message length
+ drm/log: Fix infinite loop when scale is too large for display
+ spi: virtio: mark device ready before registering the controller
+ erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
+ ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
+ ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
+ drm/shmem_helper: Check VMA boundaries for PMD mappings
+ fbdev: bound mode sysfs output to the sysfs buffer
+ fbdev: clear fb_info->mode before deleting a videomode
+ drm/amdgpu/userq: serialize queue map against GPU reset
+ drm/amd: Disable DP audio spread spectrum for Cyan Skillfish
+ drm/radeon: restore hardware polling in fence_is_signaled to fix performance
regression
+ drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode
+ drm/amdgpu/gmc12.1: implement tlb inv semaphore
+ drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush
+ Input: atkbd - skip deactivate for HONOR ZQC-P
+ pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
+ ftrace: Protect direct_functions in update_ftrace_direct_del
+ ftrace: Protect direct_functions in update_ftrace_direct_mod
+ libceph: fix OOB read in decode_watchers() via missing bounds check
+ drm/xe/guc_ads: allocate UM queues in a separate BO
+ drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
+ drm/xe/guc_ads: use uncached mapping for UM queue BO
+ drm/amdgpu: fix missing check in vm_flush()
+ drm/amdkfd: Add bounds check for CRAT subtype length
+ net: rename netdev_ops_assert_locked()
+ optee: ffa: Add NULL check in optee_ffa_lend_protmem
+ clk: spacemit: k3: fix USB2 bus clock
+ clk: spacemit: k3: set hdma clock as critical
+ gpiolib: Check gc->get_direction() before calling gpiod_get_direction()
+ regulator: fp9931: Fix VPOS/VNEG voltage selector table
+ af_unix: Unlink scc_entry in unix_del_edge().
+ scsi: core: pair EH runtime PM get and put
+ sctp: validate cookie AUTH state before use
+ ovpn: run deferred work on a module-owned workqueue
+ ovpn: defer key slot crypto freeing to workqueue
+ tick: Include ktime.h and jiffies.h in linux/tick.h
+ ipvs: revalidate ihl to prevent out-of-bounds access
+ eth: bnxt: decrease indent in bnxt_request_irq()
+ eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
+ l2tp: fix tunnel and session refcount leak on seq_file release
+ drm/xe/pxp: add termination on resume
+ drm/xe/oa: Check managed mutex initialization errors
+ drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI
+ drm/xe: Fix a bug in pc_adjust_freq_bounds()
+ drm/log: Fix division by zero when scale module parameter is 0
+ UBUNTU: Upstream stable to v6.18.45, v6.18.46, v7.1.9, v7.1.10
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166029
Title:
Resolute update: upstream stable patchset 2026-09-01
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166029/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
