This bug was fixed in the package linux - 7.0.0-31.31
---------------
linux (7.0.0-31.31) resolute; urgency=medium
* resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)
* Backport: "firmware: arm_ffa: Respect firmware advertised RX/TX buffer
size limits" (LP: #2162012)
- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
* Backlight regression (LP: #2161309)
- Revert "drm/i915/backlight: Remove try_vesa_interface"
* Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)
- SAUCE: Reapply "serial: 8250: Switch to nbcon console"
- SAUCE: Reapply "serial: 8250: Revert "drop lockdep annotation from
serial8250_clear_IER()""
- Real-time patchset 7.0.1-rt2
* Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the
A400 is on by remote controller . (LP: #2161385)
- SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3
* Camera output is vague and color is abnormal (LP: #2156972)
- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for
overlapping ranges
* [SRU] Fix incorrect boot_display reporting on multi-GPU systems
(LP: #2161036)
- x86/video: Only fall back to vga_default_device() without screen info
* Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)
- perf/core: out-of-line and export perf_allow_cpu/tracepoint()
- drm/xe: gate observation streams with perf_allow_cpu()
* Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)
- ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255
* Drop DEP-8 tests from kernel packages (LP: #2160302)
- [Packaging] Drop DEP-8 tests from kernel source
* The screen will show garbages by running glxgears fullscreen.
(LP: #2158605)
- SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external
dma-bufs
* Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec
(LP: #2156313)
- ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B
* TPM2 key creation commands time out on some Infineon modules
(LP: #2158883)
- tpm: restore timeout for key creation commands
* Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)
- ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops
* Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure
(LP: #2158462)
- SAUCE: (no-up) hv: Fix supplied vendor ID
* [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7
(LP: #2156867)
- ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio
- ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED
- ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11
* iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)
- wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2
- wifi: iwlwifi: mvm: avoid oversized UATS command copy
* MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)
- SAUCE: Revert "wifi: mt76: mt7925: add rfkill_poll for hardware rfkill"
* Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)
- rust: str: use the "kernel vertical" imports style
- rust: str: clean unused import for Rust >= 1.98
- userfaultfd: gate must_wait writability check on pte_present()
- device property: initialize the remaining fields of fwnode_handle in
fwnode_init()
- f2fs: fix potential deadlock in f2fs_balance_fs()
- f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
- f2fs: fix listxattr handling of corrupted xattr entries
- net/sched: dualpi2: fix GSO backlog accounting
- mm/khugepaged: write all dirty file folios when collapsing
- slab: recognize @GFP parameter as optional in kernel-doc
- perf trace beauty fcntl: Fix build with older kernel headers
- KVM: x86: Move update_cr8_intercept() to lapic.c
- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest
mode
- KVM: x86: Unconditionally recompute CR8 intercept on PPR update
- ACPI: CPPC: Suppress UBSAN warning caused by field misuse
- ACPI: NFIT: core: Fix possible NULL pointer dereference
- platform/x86: intel-hid: Protect ACPI notify handler against recursion
- LoongArch: Add PIO for early access before ACPI PCI root register
- rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
- rust: block: fix GenDisk cleanup paths
- rust: doctest: fix incorrect pattern in replacement
- rust: Kbuild: set frame-pointer llvm module flag for
CONFIG_FRAME_POINTER
- futex/requeue: Revert "Prevent NULL pointer dereference in
remove_waiter() on self-deadlock""
- perf/core: Detach event groups during remove_on_exec
- rust: kasan: KASAN+RUST requires clang
- fscrypt: Replace mk_users keyring with simple list
- usb: gadget: function: rndis: add length check to response query
- usb: gadget: function: rndis: add length check for header
- iio: accel: bmc150: clamp the device-reported FIFO frame count
- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
- iio: adc: ad7380: select REGMAP
- iio: adc: ad7768-1: Select GPIOLIB
- iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
- iio: adc: ad_sigma_delta: fix clear_pending_event for registerless
devices
- iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
- iio: adc: lpc32xx: Initialize completion before requesting IRQ
- iio: adc: spear: Initialize completion before requesting IRQ
- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
- iio: adc: ti-ads124s08: Return reset GPIO lookup errors
- iio: backend: fix uninitialized data in debugfs
- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
- iio: common: st_sensors: honour channel endianness in read_axis_data
- iio: core: fix uninitialized data in debugfs
- iio: dac: ad3552r-hs: fix uninitialized data ni
ad3552r_hs_write_data_source()
- iio: event: Fix event FIFO reset race
- iio: gyro: bmg160: bail out when bandwidth/filter is not in table
- iio: gyro: bmg160: wait full startup time after mode change at probe
- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
- iio: imu: inv_icm42600: fix timestamp clock period by using lower value
- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
- iio: imu: st_lsm6dsx: deselect shub page before reading whoami
- iio: light: al3000a: add missing REGMAP_I2C to Kconfig
- iio: light: al3010: add missing REGMAP_I2C to Kconfig
- iio: light: al3010: fix incorrect scale for the highest gain range
- iio: light: al3010: read both ALS ADC registers again
- iio: light: al3320a: add missing REGMAP_I2C to Kconfig
- iio: light: al3320a: read both ALS ADC registers again
- iio: light: gp2ap002: fix runtime PM leak on read error
- iio: light: opt3001: fix missing state reset on timeout
- iio: light: tsl2591: return actual error from probe IRQ failure
- iio: light: veml6030: fix channel type when pushing events
- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
- iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
- iio: pressure: mpl115: fix runtime PM leak on read error
- iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
- iio: resolver: ad2s1210: notify trigger and clear state on fault read
error
- iio: temperature: Build mlx90635 with CONFIG_MLX90635
- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
- iio: temperature: ltc2983: Fix reinit_completion() called after
conversion start
- iio: temperature: tmp006: use devm_iio_trigger_register
- ALSA: usx2y: us144mkii: fix work UAF on disconnect
- ALSA: virtio: Add missing 384 kHz PCM rate mapping
- ALSA: virtio: Validate control metadata from the device
- ALSA: ymfpci: check snd_ctl_new1() return value
- ALSA: aoa: check snd_ctl_new1() return value
- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input
parser
- ALSA: cmipci: check snd_ctl_new1() return value
- ALSA: compress: Fix task creation error unwind
- ALSA: es1938: check snd_ctl_new1() return value
- ALSA: FCP: Add Focusrite ISA C8X support
- ALSA: firewire: isight: bound the sample count to the packet payload
- ALSA: gus: check snd_ctl_new1() return value
- ALSA: hda/cs35l41: Fix firmware load work teardown
- ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
- ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
- ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
- ALSA: ice1712: check snd_ctl_new1() return value
- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
- ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts
anchor list on each resubmission
- ALSA: usb-audio: avoid kobject path lookup in DualSense match
- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch
put callbacks
- ALSA: usb-audio: Roll back quirk control caches on write errors
- ALSA: usb-audio: Update Babyface Pro control caches only after
successful writes
- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful
writes
- vfio/pci: Use a private flag to prevent power state change with VFs
- vfio/pci: Latch disable_idle_d3 per device
- vfio/pci: Release the VGA arbiter client on register_device() failure
- vfio/pci: Fix racy bitfields and tighten struct layout
- vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
- vfio: Remove device debugfs before releasing devres
- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
- Bluetooth: btusb: fix use-after-free on registration failure
- Bluetooth: btusb: fix use-after-free on marvell probe failure
- Bluetooth: btusb: fix wakeup source leak on probe failure
- binder: fix UAF in binder_thread_release()
- binder: fix UAF in binder_free_transaction()
- rust_binder: use a u64 stride when cleaning up the offsets array
- rust_binder: reject context manager self-transaction
- rust_binder: synchronize Rust Binder stats with freeze commands
- rust_binder: clear freeze listener on node removal
- usb: xhci: Fix sleep in atomic context in xhci_free_streams()
- xhci: sideband: fix ring sg table pages leak
- usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
- PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000
series
- PCI: altera: Do not dispose parent IRQ mapping
- PCI: altera: Fix resource leaks on probe failure
- PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
- PCI: host-common: Request bus reassignment when not probe-only
- PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
- PCI: mediatek: Fix IRQ domain leak when port fails to enable
- PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
- PCI/IOV: Skip VF Resizable BAR restore on read error
- tcp: restore RCU grace period in tcp_ao_destroy_sock
- mm/damon/ops-common: handle extreme intervals in damon_hot_score()
- netfilter: ipset: fix race between dump and ip_set_list resize
- virtio_pci: fix vq info pointer lookup via wrong index
- virtio-mmio: fix device release warning on module unload
- hwrng: virtio: clamp device-reported used.len at copy_data()
- USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
- usb: dwc3: run gadget disconnect from sleepable suspend context
- usb: misc: usbio: fix disconnect UAF in client teardown
- 6lowpan: fix NHC entry use-after-free on error path
- tipc: fix out-of-bounds read in broadcast Gap ACK blocks
- staging: vme_user: bound slave read/write to the kern_buf size
- smb: client: restrict implied bcc[0] exemption to responses without data
area
- staging: vme_user: fix location monitor leak in fake bridge
- staging: vme_user: fix location monitor leak in tsi148 bridge
- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
- staging: media: atomisp: reduce load_primary_binaries() stack usage
- staging: media: ipu7: fix double-free and use-after-free in error paths
- staging: rtl8723bs: fix heap buffer overflow in
rtw_cfg80211_set_wpa_ie()
- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
join_cmd_hdl()
- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
- staging: rtl8723bs: fix OOB write in HT_caps_handler()
- crypto: amlogic - avoid double cleanup in meson_crypto_probe()
- crypto: krb5 - filter out async aead implementations at alloc
- ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then
SMB2_CANCEL
- net: af_key: initialize alg_key_len for IPComp states
- audit: Fix data races of skb_queue_len() readers on audit_queue
- Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
- Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
- coresight: etb10: restore atomic_t for shared reading state
- debugobjects: Plug race against a concurrent OOM disable
- fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
- NTB: epf: Avoid calling pci_irq_vector() from hardirq context
- gpio: eic-sprd: use raw_spinlock_t in the irq startup path
- gpio: sch: use raw_spinlock_t in the irq startup path
- io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
- io_uring/rw: preserve partial result for iopoll
- netpoll: fix a use-after-free on shutdown path
- ipv4: igmp: remove multicast group from hash table on device destruction
- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
- mfd: cros_ec: Delay dev_set_drvdata() until probe success
- mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
- mm: shrinker: fix shrinker_info teardown race with expansion
- mm: shrinker: fix NULL pointer dereference in debugfs
- mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless
host
- mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent
softlockup
- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
- netfilter: handle unreadable frags
- netfilter: ebtables: zero chainstack array
- netfilter: ebtables: module names must be null-terminated
- netfilter: ebtables: terminate table name before find_table_lock()
- netfilter: flowtable: fix offloaded ct timeout never being extended
- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
- Bluetooth: bnep: pin L2CAP connection during netdev registration
- Bluetooth: btnxpuart: Fix out-of-bounds firmware read in
nxp_recv_fw_req_v3()
- Bluetooth: fix UAF in bt_accept_dequeue()
- Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
- Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
- Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
- Bluetooth: L2CAP: validate option length before reading conf opt value
- coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
- smb: client: resolve SWN tcon from live registrations
- smb/client: Fix error code in smb2_aead_req_alloc()
- ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
- ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
- ksmbd: serialize QUERY_DIRECTORY requests per file
- ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock
cancellation
- ksmbd: require source read access for duplicate extents
- ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
- ksmbd: run set info with opener credentials
- ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
- ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
- ksmbd: use opener credentials for delete-on-close
- ksmbd: use opener credentials for ADS I/O
- smb: client: fix query directory replay double-free
- smb: client: fix query_info() replay double-free
- smb: client: fix double-free in SMB2_ioctl() replay
- smb: client: fix change notify replay double-free
- smb: client: fix double-free in SMB2_flush() replay
- smb: client: fix double-free in SMB2_open() replay
- smb: client: fix double-free in SMB2_close() replay
- smb: client: Fix next buffer leak in receive_encrypted_standard()
- smb: client: use unaligned reads in parse_posix_ctxt()
- smb: client: harden POSIX SID length parsing
- smb: client: fix atime clamp check in read completion
- smb: client: mask server-provided mode to 07777 in modefromsid
- writeback: fix race between cgroup_writeback_umount() and
inode_switch_wbs()
- OPP: of: Fix potential memory leak in opp_parse_supplies()
- cpufreq: qcom-cpufreq-hw: Fix possible double free
- firmware_loader: fix device reference leak in firmware_upload_register()
- libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
- perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
- cpufreq: intel_pstate: Sync policy->cur during CPU offline
- sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
- cpufreq: Fix hotplug-suspend race during reboot
- cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
- time/jiffies: Register jiffies clocksource before usage
- clocksource/drivers/timer-tegra186: Fix support for multiple watchdog
instances
- s390: Revert support for DCACHE_WORD_ACCESS
- [Config] Disable DCACHE_WORK_ACCESS for s390x
- perf/arm-cmn: Fix DVM node events
- X.509: Fix validation of ASN.1 certificate header
- mm/slab: do not limit zeroing to orig_size when only red zoning is
enabled
- tools/mm/slabinfo: Fix trace disable logic inversion
- tools/mm/slabinfo: fix total_objects attribute name
- HID: hid-goodix-spi: validate report size to prevent stack buffer
overflow
- HID: uhid: convert to hid_safe_input_report()
- HID: wacom: stop hardware after post-start probe failures
- HID: pidff: Use correct effect type in effect update
- HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
- HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
- HID: letsketch: fix UAF on inrange_timer at driver unbind
- HID: multitouch: fix out-of-bounds bit access on mt_io_flags
- HID: appleir: fix UAF on pending key_up_timer in remove()
- HID: lg-g15: cancel pending work on remove to fix a use-after-free
- HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte
reads
- hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
- nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
- media: mtk-jpeg: cancel workqueue on release for supported platforms
only
- serial: 8250_mid: Disable DMA for selected platforms
- xfs: use null daddr for unset first bad log block
- xfs: release dquot buffer after dqflush failure
- xfs: fix unreachable BIGTIME check in dquot flush validation
- xfs: fix pointer arithmetic error on 32-bit systems
- xfs: fix exchmaps reservation limit check
- xfs: fix memory leak in xfs_dqinode_metadir_create()
- bpf: Reject fragmented frames in devmap
- bpf: Restore sysctl new-value from 1 to 0
- bpf: Validate BTF repeated field counts before expansion
- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
- usb: cdc_acm: Add quirk for Uniden BC125AT scanner
- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
- usb: free iso schedules on failed submit
- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
- usb: gadget: udc: Fix use-after-free in gadget_match_driver
- usb: gadget: f_printer: take kref only for successful open
- USB: idmouse: fix use-after-free on disconnect race
- USB: ldusb: fix use-after-free on disconnect race
- USB: iowarrior: fix use-after-free on disconnect
- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
- USB: legousbtower: fix use-after-free on disconnect race
- usb: sl811-hcd: disable controller wakeup on remove
- USB: storage: include US_FL_NO_SAME in quirks mask
- usb: misc: usbio: bound bulk IN response length to the received transfer
- USB: misc: uss720: unregister parport on probe failure
- usb: mtu3: unmap request DMA on queue failure
- USB: serial: keyspan_pda: fix information leak
- USB: serial: option: add Telit Cinterion FE990D50 compositions
- USB: serial: digi_acceleport: fix broken rx after throttle
- USB: serial: digi_acceleport: fix hard lockup on disconnect
- USB: serial: digi_acceleport: fix write buffer corruption
- USB: ulpi: fix memory leak on registration failure
- USB: usb-storage: ene_ub6250: restore media-ready check
- usbip: tools: support SuperSpeedPlus devices
- usbip: vudc: fix NULL deref in vep_dequeue()
- usb: typec: anx7411: use devm_pm_runtime_enable()
- usb: typec: class: drop PD lookup reference
- usb: typec: tcpm: Fix VDM type for Enter Mode commands
- usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
- usb: typec: ucsi: Invert DisplayPort role assignment
- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt
mode
- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
- usb: typec: ucsi: cancel pending work on system suspend
- usb: gadget: f_fs: Fix DMA fence leak
- block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
- x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when
SNC enabled
- ontext]
- rust_binder: fix BINDER_GET_EXTENDED_ERROR
- bpf: Support for hardening against JIT spraying
- x86/bugs: Enable IBPB flush on BPF JIT allocation
- bpf: Restrict JIT predictor flush to cBPF
- bpf: Skip redundant IBPB in pack allocator
- bpf: Prefer packs that won't trigger an IBPB flush on allocation
- bpf: Prefer dirty packs for eBPF allocations
- udf: validate free block extents against the partition length
- udf: validate VAT header length against the VAT inode size
- udf: validate sparing table length as an entry count, not a byte count
- hwrng: jh7110 - fix refcount leak in starfive_trng_read()
- crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
- nvme: target: rdma: fix ndev refcount leak on queue connect
- block: partitions: fix of_node refcount leak in of_partition()
- dm-ioctl: report an error if a device has no table
- nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace
disks
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
- nvmet-auth: validate reply message payload bounds against transfer
length
- btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
- btrfs: do not trim a device which is not writeable
- partitions: aix: bound the pp_count scan to the ppe array
- isofs: bound Rock Ridge symlink components to the SL record
- crypto: af_alg - Remove zero-copy support from skcipher and aead
- crypto: caam - use print_hex_dump_devel to guard key hex dumps
- crypto: caam - use print_hex_dump_devel to guard key hex dumps again
- crypto: chacha20poly1305 - validate poly1305 template argument
- crypto: crypto4xx - Remove insecure and unused rng_alg
- crypto: ecc - Fix carry overflow in vli multiplication
- crypto: hisi-trng - Remove crypto_rng interface
- crypto: pcrypt - restore callback for non-parallel fallback
- crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
- crypto: loongson - Select CRYPTO_RNG
- crypto: ccp - Do not initialize SNP for SEV ioctls
- crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
- crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
- crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
- crypto: drbg - Fix returning success on failure in CTR_DRBG
- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
- crypto: drbg - Fix the fips_enabled priority boost
- crypto: qat - centralize bus master enable
- crypto: qat - handle sysfs-triggered reset callbacks
- crypto: qat - keep VFs enabled during reset
- crypto: qat - notify fatal error before AER reset preparation
- crypto: qat - protect service table iterations with service_lock
- crypto: qat - skip restart for down devices
- crypto: qat - validate RSA CRT component lengths
- crypto: qat - factor out AER reset helpers
- crypto: talitos - use dma_sync_single_for_cpu() before reading
descriptor header
- crypto: talitos - add chaining of arbitrary number of descriptor for the
SEC1
- crypto: talitos - move dma unmapping code in flush_channel() into a
standalone dma_unmap_request() function
- crypto: talitos - move dma mapping code in talitos_submit() into a
standalone dma_map_request() function
- crypto: talitos - move code in current_desc_hdr() into a standalone
function
- crypto: talitos/hash - prepare SEC1 descriptor chaining, remove
additional descriptor
- crypto: talitos/hash - use descriptor chaining for SEC1 instead of
workqueue
- crypto: talitos/hash - drop workqueue mechanism for SEC1
- crypto: talitos/hash - rename first_desc/last_desc to
first_request/last_request
- crypto: talitos/hash - remove useless wrapper
- crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
- arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
- spi: fsl-lpspi: replace dmaengine_terminate_all() with
dmaengine_terminate_sync()
- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
- x86/mm: Fix freeing of PMD-sized vmemmap pages
- EDAC/i10nm: Don't fail probing if ADXL is missing
- watchdog: apple: Add "apple,t8103-wdt" compatible
- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
- i2c: core: fix hang on adapter registration failure
- perf/aux: Fix page UAF in map_range()
- tracing: Prevent out-of-bounds read in glob matching
- audit: fix potential integer overflow in audit_log_n_hex()
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
- rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
- module: decompress: check return value of module_extend_max_pages()
- exfat: bound uniname advance in exfat_find_dir_entry()
- NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
- riscv: mm: Define DIRECT_MAP_PHYSMEM_END
- riscv: mm: Unconditionally sfence.vma for spurious fault
- mm: fix mmap errno value when MAP_DROPPABLE is not supported
- selftests: mm: fix and speedup "droppable" test
- mm: page_ext: add count limit to page_ext_iter_next to prevent invalid
PFN access
- mm: do file ownership checks with the proper mount idmap
- selftests/mm: pagemap_ioctl: use the correct page size for
transact_test()
- crypto: loongson - Remove broken and unused loongson-rng
- iommu/vt-d: Avoid WARNING in sva unbind path
- iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
- iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
- iommufd: Fix data_len byte-count vs element-count mismatch
- iommufd: Set veventq_depth upper bound
- iommufd: Rewind header length in done if iommufd_veventq_fops_read()
fails
- iommufd: Reject invalid read count in iommufd_veventq_fops_read()
- iommufd: Reject invalid read count in iommufd_fault_fops_read()
- iommufd: Break the loop on failure in iommufd_fault_fops_read()
- iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
- iommufd: Set upper bounds on cache invalidation entry_num and entry_len
- audit: fix removal of dangling executable rules
- landlock: Set audit_net.sk for socket access checks
- selftests/landlock: Filter dealloc records in audit_count_records()
- KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
- LoongArch: KVM: Add missing slots_lock for device register/unregister
- KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
- KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
- KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually
supports
- KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are
accelerated
- KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
- KVM: VMX: Handle bad values on proxied writes to LBR MSRs
- KVM: x86: Ensure vendor's exit handler runs before fastpath userspace
exits
- KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
- udmabuf: fix DMA direction mismatch in release_udmabuf()
- dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
- fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
- i2c: core: fix irq domain leak on adapter registration failure
- i2c: core: fix NULL-deref on adapter registration failure
- i2c: core: fix adapter probe deferral loop
- i2c: core: fix adapter debugfs creation
- i2c: core: fix adapter deregistration race
- i2c: mpc: Fix timeout calculations
- i2c: davinci: Unregister cpufreq notifier on probe failure
- i2c: stm32f7: truncate clock period instead of rounding it
- i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
- i2c: i801: fix hardware state machine corruption in error path
- Input: synaptics-rmi4 - unregister function handlers on physical driver
registration failure
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
- Input: elan_i2c - prevent division by zero and arithmetic underflow
- Input: goodix - clamp the device-reported contact count
- Input: iforce - bound the device-reported force-feedback effect index
- Input: mms114 - fix touch indexing for MMS134S and MMS136
- Input: ads7846 - don't use scratch for tx_buf when clearing register
- Input: touchwin - reset the packet index on every complete packet
- Input: mms114 - reject an oversized device packet size
- Input: gscps2 - advance receive buffer write index
- Input: maplemouse - fix NULL pointer dereference in open()
- Input: mms114 - fix multi-touch slot corruption
- Input: maple_keyb - set driver data before registering input device
- Input: maplemouse - set driver data before registering input device
- Input: maplecontrol - set driver data before registering input device
- RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
- RDMA/core: Fix broadcast address falsely detected as local
- RDMA/siw: bound Read Response placement to the RREAD length
- fuse: back uncached readdir buffers with pages
- fuse: avoid 32-bit prune notification count wrap
- fuse: fix device node leak in cuse_process_init_reply()
- fuse: re-lock request before returning from fuse_ref_folio()
- fuse: fix io-uring background queue dispatch on request completion
- fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
- fuse-uring: fix EFAULT clobber in fuse_uring_commit
- fuse-uring: fix data races on ring->ready
- fuse-uring: fix moving cancelled entry to ent_in_userspace list
- fuse-uring: end fuse_req on io-uring cancel task work
- fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
- fuse-uring: Avoid queue->stopped races and set/read that value under
lock
- fuse-uring: make a fuse_req on SQE commit only findable after memcpy
- fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL
deref
- usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction
checks
- timekeeping: Register default clocksource before taking tk_core.lock
- Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote
netdev
- smb: client: reject overlapping data areas in SMB2 responses
- xfs: fix null pointer dereference in tracepoint
- xfs: fail recovery on a committed log item with no regions
- xfs: resample the data fork mapping after cycling ILOCK
- xfs: don't wrap around quota ids in dqiterate
- xfs: grab rtrmap btree when checking rgsuper
- xfs: use the rt version of the cow staging checker
- xfs: set xfarray killable sort correctly
- xfs: handle non-inode owners for rtrmap record checking
- xfs: clamp timestamp nanoseconds correctly
- xfs: fully check the parent handle when it points to the rootdir
- xfs: don't zap bmbt forks if they are MAXLEVELS tall
- xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
- xfs: write the rg superblock when fixing it
- xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
- ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
- rust: pci: use 'static lifetime for PCI BAR resource names
- iio: adc: ad4062: add GPIOLIB dependency
- iio: adc: nxp-sar-adc: Fix the delay calculation in
nxp_sar_adc_wait_for()
- ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8
- vfio/mlx5: Fix racy bitfields and tighten struct layout
- riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers
- PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
- PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95
- PCI: Skip Resizable BAR restore on read error
- tracing: Fix NULL pointer dereference in func_set_flag()
- staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()
- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),
rtw_get_wapi_ie(), and rtw_get_wps_attr()
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
- media: nxp: imx8-isi: Fix use-after-free on remove
- netfilter: flowtable: IPIP tunnel hardware offload is not yet support
- ksmbd: prevent path traversal bypass by restricting caseless retry
- ksmbd: centralize ksmbd_conn final release to plug transport leak
- ksmbd: track the connection owning a byte-range lock
- ksmbd: validate NTLMv2 response before updating session key
- smb/client: fix chown/chgrp with SMB3 POSIX Extensions
- smb/server: do not require delete access for non-replacing links
- proc: protect ptrace_may_access() with exec_update_lock (FD links)
- proc: protect ptrace_may_access() with exec_update_lock (part 1)
- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- xfs: pass back updated nb from xfs_growfs_compute_deltas
- xfs: only log freed extents for the current RTG in zoned growfs
- xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
- bpf: Keep dynamic inner array lookups nullable
- bpf: Allow LPM map access from sleepable BPF programs
- USB: iowarrior: fix use-after-free on disconnect race
- usb: typec: ps883x: Fix DP+USB3 configuration
- usb: gadget: f_fs: initialize reset_work at allocation time
- usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
- crypto: atmel-sha204a - fail on hwrng registration error in probe path
- btrfs: fix false IO failure after falling back to buffered write
- btrfs: fix incorrect buffered IO fallback for append direct writes
- crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG
- crypto: drbg - Fix ineffective sanity check
- crypto: qat - fix restarting state leak on allocation failure
- liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name
length
- selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION
calls with invalid length
- exfat: fix incorrect directory checksum after rename to shorter name
- exfat: preserve benign secondary entries during rename and move
- lib/test_hmm: use kvfree() to free kvcalloc() allocations
- selftests/mm: fix ksft_process_madv.sh test category
- nouveau/vmm: fix another SPT/LPT race
- bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is
uninitialized
- iommufd: Move vevent memory allocation outside spinlock
- iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
- selftests/landlock: Fix socket file descriptor leaks in audit helpers
- selftests/landlock: Explicitly disable audit in teardowns
- landlock: Account all audit data allocations to user space
- selftests/landlock: Increase default audit socket timeout
- KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
- KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
- KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB
- KVM: TDX: Account all non-transient page allocations for per-TD
structures
- KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
- Revert "fuse: fix conversion of fuse_reverse_inval_entry() to
start_removing()"
- fuse: do not use start_removing_noperm()
- ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY
- ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
- Upstream stable to v6.18.39, v7.1.4
* Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)
- Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command
Completion support"
- batman-adv: tp_meter: keep unacked list in ascending ordered
- batman-adv: tp_meter: initialize dup_acks explicitly
- batman-adv: tp_meter: initialize dec_cwnd explicitly
- batman-adv: tp_meter: avoid window underflow
- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
- batman-adv: tp_meter: fix fast recovery precondition
- batman-adv: tp_meter: handle seqno wrap-around for fast recovery
detection
- batman-adv: tp_meter: add only finished tp_vars to lists
- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
- batman-adv: prevent ELP transmission interval underflow
- batman-adv: tp_meter: initialize last_recv_time during init
- batman-adv: gw: don't deselect gateway with active hardif
- batman-adv: ensure bcast is writable before modifying TTL
- batman-adv: fix (m|b)cast csum after decrementing TTL
- batman-adv: frag: ensure fragment is writable before modifying TTL
- batman-adv: frag: avoid underflow of TTL
- batman-adv: v: prevent OGM aggregation on disabled hardif
- batman-adv: tp_meter: restrict number of unacked list entries
- batman-adv: tp_meter: annotate last_recv_time access with
READ/WRITE_ONCE
- batman-adv: tp_meter: prevent parallel modifications of last_recv
- batman-adv: tp_meter: handle overlapping packets
- batman-adv: tt: don't merge change entries with different VIDs
- batman-adv: tt: track roam count per VID
- batman-adv: dat: prevent false sharing between VLANs
- batman-adv: tvlv: enforce 2-byte alignment
- batman-adv: tvlv: avoid race of cifsnotfound handler state
- ipv4: account for fraggap on the paged allocation path
- ntfs3: reject direct userspace writes to reserved $LX* xattrs
- wifi: mt76: add wcid publish check in mt76_sta_add
- mac802154: llsec: add skb_cow_data() before in-place crypto
- net: skmsg: preserve sg.copy across SG transforms
- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
- apparmor: mediate the implicit connect of TCP fast open sendmsg
- apparmor: fix use-after-free in rawdata dedup loop
- NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG
share BAR
- fbdev: fix use-after-free in store_modes()
- kernel/fork: clear PF_BLOCK_TS in copy_process()
- block: invalidate cached plug timestamp after task switch
- KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
- err.h: use __always_inline on all error pointer helpers
- gcov: use atomic counter updates to fix concurrent access crashes
- KEYS: fix overflow in keyctl_pkey_params_get_2()
- keys: Pin request_key_auth payload in instantiate paths
- userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
- wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
- wifi: ath11k: fix warning when unbinding
- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
- wifi: rtw88: increase TX report timeout to fix race condition
- wifi: rtw88: usb: fix memory leaks on USB write failures
- wifi: iwlwifi: mvm: fix race condition in PTP removal
- wifi: iwlwifi: mld: fix race condition in PTP removal
- wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session
handlers
- f2fs: pass correct iostat type for single node writes
- f2fs: validate orphan inode entry count
- f2fs: validate compress cache inode only when enabled
- f2fs: fix to round down start offset of fallocate for pin file
- f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
- f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
- f2fs: keep atomic write retry from zeroing original data
- block: Avoid mounting the bdev pseudo-filesystem in userspace
- bpf: use kvfree() for replaced sysctl write buffer
- MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
- exfat: fix potential use-after-free in exfat_find_dir_entry()
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping
level
- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
get_unaligned()
- crypto: nx - fix nx_crypto_ctx_exit argument
- gfs2: fix use-after-free in gfs2_qd_dealloc
- pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
- hdlc_ppp: sync per-proto timers before freeing hdlc state
- blk-cgroup: fix UAF in __blkcg_rstat_flush()
- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
- LoongArch: Report dying CPU to RCU in stop_this_cpu()
- pNFS: Fix use-after-free in pnfs_update_layout()
- irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup
on remove
- fpga: region: fix use-after-free in child_regions_with_firmware()
- rpmsg: char: Fix use-after-free on probe error path
- ocfs2: reject oversized group bitmap descriptors
- 9p: avoid putting oldfid in p9_client_walk() error path
- MIPS: smp: report dying CPU to RCU in stop_this_cpu()
- KVM: x86: hyper-v: Bound the bank index when querying sparse banks
- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
- power: reset: linkstation-poweroff: fix use-after-free in the
linkstation_poweroff_init()
- riscv: mm: Extract helper mark_new_valid_map()
- riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
fb_videomode_to_var
- fbdev: modedb: fix a possible UAF in fb_find_mode()
- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- i2c: core: fix adapter registration race
- NFSD: Fix SECINFO_NO_NAME decode error cleanup
- nfsd: fix posix_acl leak on SETACL decode failure
- nfsd: fix inverted cp_ttl check in async copy reaper
- nfsd: check get_user() return when reading princhashlen
- nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
- nfsd: reset write verifier on deferred writeback errors
- NFSv4/flexfiles: reject zero filehandle version count
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- NFSv4: clear exception state on successful mkdir retry
- NFS: Prevent resource leak in nfs_alloc_server()
- ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
- net/tcp-ao: fix use-after-free of key in del_async path
- apparmor: advertise the tcp fast open fix is applied
- PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist
- fscrypt: Fix key setup in edge case with multiple data unit sizes
- wifi: rtl8xxxu: Detect the maximum supported channel width
- f2fs: fix missing read bio submission on large folio error
- f2fs: reject setattr size changes on large folio files
- f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
- f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
- f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
- Revert "f2fs: remove non-uptodate folio from the page cache in
move_data_block"
- f2fs: read COW data with the original inode during atomic write
- sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
- fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
- fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
- fbdev: omap2: fix use-after-free in omapfb_mmap
- nfsd: release layout stid on setlease failure
- nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
- nfsd: fix dead ACL conflict guard in nfsd4_create
- Upstream stable to v6.18.38, v7.1.3
* Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //
CVE-2026-53361
- af_unix: Set gc_in_progress to true in unix_gc().
* Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //
CVE-2026-53362
- ipv6: account for fraggap on the paged allocation path
* Resolute update: v7.0.14 upstream stable release (LP: #2158815)
- io_uring/net: Avoid msghdr on op_connect/op_bind async data
- arm64/entry: Fix arm64-specific rseq brokenness
- lockd: fix TEST handling when not all permissions are available.
- firmware: exynos-acpm: Count number of commands in acpm_xfer
- firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
- firmware: samsung: acpm: Fix cross-thread RX length corruption
- firmware: samsung: acpm: Fix false timeouts and Use-After-Free in
polling
- firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
- fuse: re-lock request before replacing page cache folio
- Revert "NFSD: Defer sub-object cleanup in export put callbacks"
- RDMA/bnxt_re: zero shared page before exposing to userspace
- i2c: stub: Reject I2C block transfers with invalid length
- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
- rose: fix dev_put() leak in rose_loopback_timer()
- rose: hold loopback neighbour reference across timer callback
- rose: fix race between loopback timer and module removal
- rose: clear neighbour pointer after rose_neigh_put() in state machines
- rose: guard rose_neigh_put() against NULL in timer expiry
- rose: fix netdev double-hold in rose_rx_call_request()
- rose: fix notifier unregistered too early in rose_exit()
- rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
- rose: disconnect orphaned STATE_2 sockets when device is gone
- rose: fix netdev double-hold in rose_make_new()
- rose: release netdev ref and destroy orphaned incoming sockets
- rose: drop CALL_REQUEST in loopback timer when device is not running
- rose: cancel neighbour timers in rose_neigh_put() before freeing
- rose: clear neighbour pointer in rose_kill_by_device()
- rose: don't free fd-owned sockets when reaping in the heartbeat
- net: export netif_open for self_test usage
- net: net_failover: Fix the deadlock in slave register
- iio: light: veml6075: add bounds check to veml6075_it_ms index
- iio: adc: ti-ads1298: add bounds check to pga_settings index
- crypto: qat - remove unused character device and IOCTLs
- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
vcs_write
- serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
- serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
- drivers/base/memory: set mem->altmap after successful device
registration
- ksmbd: reject non-VALID session in compound request branch
- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- virtiofs: fix UAF on submount umount
- Linux 7.0.14
* Resolute update: v7.0.14 upstream stable release (LP: #2158815) //
CVE-2026-53325
- agp/amd64: Fix broken error propagation in agp_amd64_probe()
* Resolute update: v7.0.14 upstream stable release (LP: #2158815) //
CVE-2026-52938
- bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
* Resolute update: v7.0.13 upstream stable release (LP: #2158003)
- bpf: Free reuseport cBPF prog after RCU grace period.
- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
- Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer
- ipv6: mcast: Fix use-after-free when processing MLD queries
- net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
- tee: optee: prevent use-after-free when the client exits before the
supplicant
- soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
- arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and
reserve its pins
- ARM: dts: microchip: sam9x7: fix GMAC clock configuration
- soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
- tee: fix tee_ioctl_object_invoke_arg padding
- tee: qcomtee: add missing va_end in early return
qcomtee_object_user_init()
- s390/bug: Always emit format word in __BUG_ENTRY
- ARM: dts: gemini: Fix partition offsets
- erofs: fix use-after-free on sbi->sync_decompress
- wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
- ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
- netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
- ipvs: clear the svc scheduler ptr early on edit
- netfilter: synproxy: add mutex to guard hook reference counting
- netfilter: conntrack_irc: fix possible out-of-bounds read
- netfilter: nft_ct: bail out on template ct in get eval
- netfilter: bridge: make ebt_snat ARP rewrite writable
- dm cache policy smq: check allocation under invalidate lock
- net/sched: act_api: use RCU with deferred freeing for action lifecycle
- 6lowpan: fix off-by-one in multicast context address compression
- l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
- devlink: Release nested relation on devlink free
- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
- wifi: mac80211: limit injected antenna index in
ieee80211_parse_tx_radiotap
- pcnet32: stop holding device spin lock during napi_complete_done
- net: Annotate sk->sk_write_space() for UDP SOCKMAP.
- hsr: Remove WARN_ONCE() in hsr_addr_is_self().
- net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
- net: lan743x: permit VLAN-tagged packets up to configured MTU
- net: fec: fix pinctrl default state restore order on resume
- ipv6: anycast: insert aca into global hash under idev->lock
- wifi: fix leak if split 6 GHz scanning fails
- wifi: cfg80211: add support to handle incumbent signal detected event
from mac80211/driver
- wifi: nl80211: split out UHR operation information
- wifi: cfg80211: enforce HE/EHT cap/oper consistency
- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
- Bluetooth: MGMT: validate advertising TLV before type checks
- Bluetooth: RFCOMM: validate skb length in MCC handlers
- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()
extension handling
- Bluetooth: bnep: reject short frames before parsing
- Bluetooth: fix memory leak in error path of hci_alloc_dev()
- Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
- Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
- Bluetooth: MGMT: Fix backward compatibility with userspace
- xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
- octeontx2-pf: Fix NDC sync operation errors
- octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
- af_unix: Fix inq_len update problem in partial read
- ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
- ptp: vclock: Switch from RCU to SRCU
- net: airoha: Fix use-after-free in metadata dst teardown
- geneve: fix length used in GRO hint UDP checksum adjustment
- octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
- vxlan: vnifilter: send notification on VNI add
- vxlan: vnifilter: fix spurious notification on VNI update
- ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
- net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
- bonding: annotate data-races arcound churn variables
- fwctl/bnxt_en: Move common definitions to include/linux/bnxt/
- fwctl/bnxt_en: Refactor aux bus functions to be more generic
- Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path"
- Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
- drm/hyperv: During panic do VMBus unload after frame buffer is flushed
- selftests: harness: fix pidfd leak in __wait_for_test
- signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
- regulator: mt6363: select CONFIG_IRQ_DOMAIN
- hyperv: Clean up and fix the guest ID comment in hvgdk.h
- VFS: fix possible failure to unlock in nfsd4_create_file()
- crypto: s390 - add select CRYPTO_AEAD for aes
- rseq: Fix using an uninitialized stack variable in
rseq_exit_user_update()
- time: Fix off-by-one in settimeofday() usec validation
- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
streams
- ALSA: seq: dummy: fix UMP event stack overread
- x86/resctrl: Only check Intel systems for SNC
- cpufreq/amd-pstate: drop stale @epp_cached kdoc
- rtla: Fix parsing of multi-character short options
- tools/rv: Ensure monitor name and desc are NUL-terminated
- tools/rv: Fix substring match bug in monitor name search
- tools/rv: Fix substring match when listing container monitors
- tools/rv: Fix cleanup after failed trace setup
- verification/rvgen: Fix options shared among commands
- verification/rvgen: Fix ltl2k writing True as a literal
- riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
- riscv: cfi: reject unknown flags in PR_SET_CFI
- xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
- dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
- dma-debug: fix physical address retrieval in
debug_dma_sync_sg_for_device
- xfrm: policy: fix use-after-free on inexact bin in
xfrm_policy_bysel_ctx()
- ice: fix missing priority callbacks for U.FL DPLL pins
- idpf: fix mailbox capability for set device clock time
- net: ena: PHC: Add missing barrier
- bnge: fix context mem iteration
- netlabel: validate unlabeled address and mask attribute lengths
- gpio: mvebu: fix NULL pointer dereference in suspend/resume
- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
- tcp: restrict SO_ATTACH_FILTER to priv users
- net: add pskb_may_pull() to skb_gro_receive_list()
- net/mlx4: avoid GCC 10 __bad_copy_from() false positive
- net: ibm: emac: Fix use-after-free during device removal
- netdev: fix double-free in netdev_nl_bind_rx_doit()
- net: phy: clean the sfp upstream if phy probing fails
- net: phy: remove phy ports upon probe failure
- net: phy: Clean the phy_ports after unregistering the downstream SFP bus
- net: phy: don't try to setup PHY-driven SFP cages when using genphy
- net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
- net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
- net/mlx5: Use effective affinity mask for IRQ selection
- net: openvswitch: fix possible kfree_skb of ERR_PTR
- r8152: handle the return value of usb_reset_device()
- gpio: zynq: fix runtime PM leak on remove
- gpio: rockchip: fix generic IRQ chip leak on remove
- net: mctp: usb: fix race between urb completion and rx_retry
cancellation
- net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
- esp: fix page frag reference leak on skb_to_sgvec failure
- ASoC: SOF: amd: fix for ipc flags check
- ip6_vti: set netns_immutable on the fallback device.
- net: guard timestamp cmsgs to real error queue skbs
- net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
completion
- tun: zero the whole vnet header in tun_put_user()
- ptp: ocp: fix resource freeing order
- rds: mark snapshot pages dirty in rds_info_getsockopt()
- spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
- netfilter: revalidate bridge ports
- netfilter: nf_conntrack: destroy stale expectfn expectations on
unregister
- netfilter: x_tables: avoid leaking percpu counter pointers
- netfilter: nf_log: validate MAC header was set before dumping it
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
- net: mvpp2: sync RX data at the hardware packet offset
- net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
- net: txgbe: initialize module info buffer
- net: txgbe: distinguish module types by checking identifier
- net: txgbe: initialize PHY interface to 0
- ipv6: Fix a potential NPD in cleanup_prefix_route()
- ASoC: SDCA: fix NULL pointer dereference in
sdca_dev_unregister_functions
- clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting
parked
- clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
- clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
- drm/i915/edp: Check supported link rates DPCD read
- drm/virtio: Fix driver removal with disabled KMS
- drm/vc4: fix krealloc() memory leak
- drm/colorop: Remove read-only comments from interpolation fields
- drm/colorop: make lut(1/3)d_interpolation props correctly behave as
mutable
- drm/atomic: track individual colorop updates
- drm/amd/display: use plane color_mgmt_changed to track colorop changes
- drm/xe: fix refcount leak in xe_range_fence_insert()
- drm/xe: fix job timeout recovery for unstarted jobs and kernel queues
- accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
- namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories
- netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
- tee: shm: fix shm leak in register_shm_helper()
- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
- soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
- mm/memory-failure: fix hugetlb_lock AA deadlock in
get_huge_page_for_hwpoison
- Revert "drm/xe/nvls: Define GuC firmware for NVL-S"
- accel/ivpu: Add bounds check for firmware runtime memory
- accel/ivpu: Add bounds checks for firmware log indices
- firmware: stratix10-svc: Don't fail probe when async ops unsupported
- firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported
- firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in
probe
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl
- accel/ivpu: Fix signed integer truncation in IPC receive
- tracing: Fix CFI violation in probestub being called by tprobes
- tracing/probes: Point the error offset correctly for eprobe argument
error
- cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask
calculation
- Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during
suspend"
- rust: x86: support Rust >= 1.98.0 target spec
- ARM: Do not select HAVE_RUST when KASAN is enabled
- rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
- rust: kasan/kbuild: fix rustc-option when cross-compiling
- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
- cfi: Include uaccess.h for get_kernel_nofault()
- mshv: add a missing padding field
- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
- KVM: SEV: Decouple the need to sync the GHCB SA from the need to free
the SA
- KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
- KVM: arm64: Correctly identify executable PTEs at stage-2
- KVM: arm64: Restore POR_EL0 access to host EL0
- drm/i915/gem: Fix phys BO pread/pwrite with offset
- hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
- pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
- ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
- xfrm: espintcp: do not reuse an in-progress partial send
- xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
- USB: serial: io_ti: fix heap overflow in get_manuf_info()
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
- USB: serial: option: add usb-id for Dell Wireless DW5826e-m
- USB: serial: kl5kusb105: fix bulk-out buffer overflow
- ALSA: timer: Forcibly close timer instances at closing
- ALSA: timer: Fix UAF at snd_timer_user_params()
- io_uring/wait: fix min_timeout behavior
- io_uring/kbuf: don't truncate end buffer for bundles
- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
- drm/virtio: fix dma_fence refcount leak on error in
virtio_gpu_dma_fence_wait()
- drm/amd/display: Reject gpio_bitshift >= 32 in
bios_parser_get_gpio_pin_info()
- mm/huge_memory: update file PMD counter before folio_put()
- mm/damon/ops-common: call folio_test_lru() after folio_get()
- mm/huge_memory: update file PUD counter before folio_put()
- RDMA/core: Validate the passed in fops for ib_get_ucaps()
- RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
- zram: fix use-after-free in zram_bvec_write_partial()
- udp: clear skb->dev before running a sockmap verdict
- ARM: socfpga: Fix OF node refcount leak in SMP setup
- ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
- ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
- arm64: mm: call pagetable dtor when freeing hot-removed page tables
- mptcp: fix missing wakeups in edge scenarios
- mptcp: fix retransmission loop when csum is enabled
- mptcp: close TOCTOU race while computing rcv_wnd
- mptcp: allow subflow rcv wnd to shrink
- mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
- mptcp: check desc->count in read_sock
- mptcp: sockopt: check timestamping ret value
- mptcp: sockopt: set sockopt on all subflows
- selftests: mptcp: add test for extra_subflows underflow on userspace PM
- mptcp: add-addr: always drop other suboptions
- xfs: fix error returns in CoW fork repair
- xfs: fix rtgroup cleanup in CoW fork repair
- wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
- wifi: nl80211: reject oversized EMA RNR lists
- vsock/vmci: fix sk_ack_backlog leak on failed handshake
- timers/migration: Fix livelock in tmigr_handle_remote_up()
- spi: qcom-geni: Fix cs_change handling on the last transfer
- staging: rtl8723bs: fix buffer over-read in rtw_update_protection
- staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length
subtraction
- ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
- bnxt_en: Fix NULL pointer dereference
- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
- fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
- hv: utils: handle and propagate errors in kvp_register
- pidfd: refuse access to tasks that have started exiting harder
- accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()
- accel/ethosu: fix IFM region index out-of-bounds in command stream
parser
- accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85
- accel/ethosu: fix arithmetic issues in dma_length()
- accel/ethosu: reject DMA commands with uninitialized length
- accel/ethosu: reject NPU_OP_RESIZE commands from userspace
- fs/qnx6: fix pointer arithmetic in directory iteration
- fuse: reject fuse_notify() pagecache ops on directories
- fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on
self-deadlock
- i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
- i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
- i2c: tegra: Fix NOIRQ suspend/resume
- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
- Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
- iomap: avoid potential null folio->mapping deref during error reporting
- iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
- ipc/shm: serialize orphan cleanup with shm_nattch updates
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
- memcg: use round-robin victim selection in refill_stock
- memory: atmel-ebi: Allow deferred probing
- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
- misc: fastrpc: fix use-after-free race in fastrpc_map_create
- misc: fastrpc: fix DMA address corruption due to find_vma misuse
- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
- firmware: samsung: acpm: Fix mailbox channel leak on probe error
- net/mlx5: Reorder completion before putting command entry in
cmd_work_handler
- net: airoha: Add NULL check for of_reserved_mem_lookup() in
airoha_qdma_init_hfwd_queues()
- net: bonding: fix NULL pointer dereference in bond_do_ioctl()
- net: mv643xx: fix OF node refcount
- net: phonet: free phonet_device after RCU grace period
- net: rds: clear i_sends on setup unwind
- net: sfp: initialize i2c_block_size at adapter configure time
- nvmem: core: fix use-after-free bugs in error paths
- nvmem: layouts: onie-tlv: fix hang on unknown types
- octeontx2-af: fix memory leak in rvu_setup_hw_resources()
- pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
- mm/cma: fix reserved page leak on activation failure
- mm/cma_debug: fix invalid accesses for inactive CMA areas
- mm/damon/lru_sort: handle ctx allocation failure
- mm/damon/reclaim: handle ctx allocation failure
- mm/huge_memory: use correct flags for device private PMD entry
- mm/hugetlb: avoid false positive lockdep assertion
- mm/hugetlb: restore reservation on error in hugetlb folio copy paths
- mm/list_lru: drain before clearing xarray entry on reparent
- mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
- mmc: core: Fix host controller programming for fixed driver type
- mmc: dw_mmc-rockchip: Add missing private data for very old controllers
- mmc: litex_mmc: Set mandatory idle clocks before CMD0
- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
- mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin
EIC7700
- mmc: sdhci: add signal voltage switch in sdhci_resume_host
- pmdomain: imx: fix OF node refcount
- pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup
source
- rtase: Avoid sleeping in get_stats64()
- rtase: Reset TX subqueue when clearing TX ring
- sctp: diag: reject stale associations in dump_one path
- sctp: stream: fully roll back denied add-stream state
- thunderbolt: Reject zero-length property entries in validator
- thunderbolt: Bound root directory content to block size
- thunderbolt: Clamp XDomain response data copy to allocation size
- thunderbolt: Validate XDomain request packet size before type cast
- thunderbolt: Limit XDomain response copy to actual frame size
- slimbus: qcom-ngd-ctrl: fix OF node refcount
- slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
- slimbus: qcom-ngd-ctrl: Fix probe error path ordering
- slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
- slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
- slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
- slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
- slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
- drm/gem: Try to fix change_handle ioctl, attempt 4
- drm/i915: Fix color blob reference handling in intel_plane_state
- drm/amdkfd: fix NULL dereference in get_queue_ids()
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on
GFX11
- drm/xe/display: fix oops in suspend/shutdown without display
- drm/xe/multi_queue: skip submit when primary queue is suspended
- drm/xe: Clear pending_disable before signaling suspend fence
- drm/v3d: Wait for pending L2T flush before cleaning caches
- drm/v3d: Fix global performance monitor reference counting
- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
- drm/v3d: Skip CSD when it has zeroed workgroups
- drm/amdgpu: fix waiting for all submissions for userptrs
- drm/amdgpu: restart the CS if some parts of the VM are still invalidated
- drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
- drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems
- drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload
- drm/amd/pm: fix smu13 power limit default/cap calculation
- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
set_soft_freq_limited_range
- drm/amd/display: Bound VBIOS record-chain walk loops
- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
- drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
- drm/amd/display: Use krealloc_array() in dal_vector_reserve()
- fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
- driver core: faux: fix root device registration
- driver core: reject devices with unregistered buses
- RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register
- sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
- wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-
strict mode
- wifi: mac80211: tests: mark HT check strict
- RDMA/umem: fix kernel-doc warnings
- RDMA: Move DMA block iterator logic into dedicated files
- RDMA/umem: Fix truncation for block sizes >= 4G
- vsock/virtio: fix potential unbounded skb queue
- vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
- debugobjects: Do not fill_pool() if pi_blocked_on
- debugobjects: Don't call fill_pool() in early boot hardirq context
- arm64: cputype: Add C1-Ultra definitions
- arm64: cputype: Add C1-Premium definitions
- arm64: errata: Mitigate TLBI errata on various Arm CPUs
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
- [Config] Add TLBI Erratum for Azure Cobalt 100.
- vsock/virtio: fix skb overhead overflow on 32-bit builds
- Linux 7.0.13
* Resolute update: v7.0.13 upstream stable release (LP: #2158003) //
CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
* Resolute update: v7.0.13 upstream stable release (LP: #2158003) //
CVE-2026-46300: when fragments backed by read-only page-cache pages are
- xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
* CVE-2026-64531
- net: openvswitch: reject oversized nested action attrs
* CVE-2026-46331
- net/sched: fix pedit partial COW leading to page cache corruption
* CVE-2026-53212
- netfilter: nft_tunnel: fix use-after-free on object destroy
* CVE-2026-53359
- KVM: x86: Fix shadow paging use-after-free due to unexpected role
* CVE-2026-53131
- netfilter: require Ethernet MAC header before using eth_hdr()
* CVE-2026-53151
- rxrpc: Fix the ACK parser to extract the SACK table for parsing
* CVE-2026-53175
- inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
* CVE-2026-53176
- IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
* CVE-2026-53186
- RDMA/srp: bound SRP_RSP sense copy by the received length
* CVE-2026-53215
- net: mvpp2: refill RX buffers before XDP or skb use
* CVE-2026-53216
- net: mvpp2: limit XDP frame size to the RX buffer
* CVE-2026-53221
- ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
* CVE-2026-53224
- sctp: validate embedded INIT chunk and address list lengths in cookie
* CVE-2026-53225
- sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
* CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads
* CVE-2026-52924
- sctp: purge outqueue on stale COOKIE-ECHO handling
* CVE-2026-53246
- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
* CVE-2026-53247
- net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
* CVE-2026-53260
- tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
* INVALID or PRIVATE BUG (LP: #2158267)
- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
* Packaging resync (LP: #1786013)
- [Packaging] update annotations scripts
-- Edoardo Canepa <[email protected]> Sat, 01 Aug 2026
04:09:29 +0200
** Changed in: linux (Ubuntu Resolute)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162012
Title:
Backport: "firmware: arm_ffa: Respect firmware advertised RX/TX buffer
size limits"
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2162012/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
