bpf, arm64: Reject out-of-range B.cond targets
nfsd: release layout stid on setlease failure
Bluetooth: btmtk: apply the common btmtk_fw_get_filename
Bluetooth: btusb: mediatek: reset the controller before downloading the fw
Bluetooth: btusb: mediatek: add MT7922 subsystem reset
Bluetooth: btusb: mediatek: remove the unnecessary goto tag
Bluetooth: btusb: mediatek: return error for failed reg access
Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c
Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
userfaultfd: gate must_wait writability check on pte_present()
perf: Fix dangling cgroup pointer in cpuctx backport
Bluetooth: btmtk: Fix btmtk.c undefined reference build error
device property: initialize the remaining fields of fwnode_handle in
fwnode_init()
f2fs: validate orphan inode entry count
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
f2fs: fix potential deadlock in f2fs_balance_fs()
f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
f2fs: fix listxattr handling of corrupted xattr entries
block: Avoid mounting the bdev pseudo-filesystem in userspace
i2c: core: fix irq domain leak on adapter registration failure
i2c: core: fix hang on adapter registration failure
i2c: core: fix NULL-deref on adapter registration failure
i2c: core: fix adapter debugfs creation
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
NFSv4/flexfiles: reject zero filehandle version count
locking/rtmutex: Make sure we wake anything on the wake_q when we release the
lock->wait_lock
bonding: fix xfrm offload feature setup on active-backup mode
mm/vmscan: flush deferred TLB before freeing large folios
perf trace beauty fcntl: Fix build with older kernel headers
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
ACPI: NFIT: core: Fix possible NULL pointer dereference
perf/core: Detach event groups during remove_on_exec
arm64: sysreg: Add layout for ID_AA64MMFR4_EL1
virtio_net: Support dynamic rss indirection table size
LoongArch: Add PIO for early access before ACPI PCI root register
usb: gadget: function: rndis: add length check to response query
usb: gadget: function: rndis: add length check for header
iio: accel: bmc150: clamp the device-reported FIFO frame count
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
iio: adc: lpc32xx: Initialize completion before requesting IRQ
iio: adc: ti-ads124s08: Return reset GPIO lookup errors
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
iio: event: Fix event FIFO reset race
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
iio: gyro: bmg160: wait full startup time after mode change at probe
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
iio: imu: st_lsm6dsx: deselect shub page before reading whoami
iio: light: al3010: fix incorrect scale for the highest gain range
iio: light: gp2ap002: fix runtime PM leak on read error
iio: light: opt3001: fix missing state reset on timeout
iio: light: tsl2591: return actual error from probe IRQ failure
iio: light: veml6030: fix channel type when pushing events
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
ALSA: virtio: Add missing 384 kHz PCM rate mapping
ALSA: ymfpci: check snd_ctl_new1() return value
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
ALSA: cmipci: check snd_ctl_new1() return value
ALSA: es1938: check snd_ctl_new1() return value
ALSA: firewire: isight: bound the sample count to the packet payload
ALSA: gus: check snd_ctl_new1() return value
ALSA: ice1712: check snd_ctl_new1() return value
ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
ALSA: usb-audio: avoid kobject path lookup in DualSense match
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put
callbacks
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
vfio/pci: Use a private flag to prevent power state change with VFs
...skipping...
NFSv4/pnfs: defer return_range callbacks until after inode unlock
nfs: keep PG_UPTODATE clear after read errors in page groups
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
PCI: meson: Propagate devm_add_action_or_reset() failure
fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
PCI: rcar-host: Remove unused LIST_HEAD(res)
xprtrdma: Check frwr_wp_create() during connect
xprtrdma: Document and assert reply-handler invariants
xprtrdma: Resize reply buffers before reposting receives
xprtrdma: Fix bcall rep leak and unbounded peek
xprtrdma: Sanitize the reply credit grant after parsing
xprtrdma: Repost Receive buffers for malformed replies
xprtrdma: Return sendctx slot after Send preparation failure
tools lib api: Fix missing null termination in filename__read_int/ull()
tools lib api: Fix filename__write_int() writing uninitialized stack data
tools lib api: Fix mount_overload() snprintf truncation and toupper range
PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
PCI: mediatek: Use actual physical address instead of virt_to_phys()
security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()
apparmor: aa_label_alloc use aa_label_free on alloc failure
apparmor: fix rawdata_f_data implicit flex array
apparmor: fix potential UAF in aa_replace_profiles
apparmor: aa_getprocattr free procattr leak on format failure
apparmor: put secmark label after secid lookup
i3c: master: Prevent reuse of dynamic address on device add failure
apparmor: fix label can not be immediately before a declaration
sparc: led: avoid trimming a newline from empty writes
gpio: mlxbf3: fail probe if gpiochip registration fails
spi: dw: fix wrong BAUDR setting after resume
xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path
xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
xfrm: validate selector family and prefixlen during match
ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
net: psample: fix info leak in PSAMPLE_ATTR_DATA
sctp: hold socket lock when dumping endpoints in sctp_diag
PCI: iproc: Restore .map_irq() for the platform bus driver
spi: rpc-if: Use correct device for hardware reinitialization on resume
virtio-net: fix len check in receive_big()
devlink: Fix parent ref leak in devl_rate_node_create()
flow_dissector: check device type before reading ETH_ADDRS
ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
thermal: intel: Fix dangling resources on thermal_throttle_online() failure
ACPI: resource: Amend kernel-doc style
ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
ieee802154: fix kernel-infoleak in dgram_recvmsg()
md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
netfilter: ipset: Fix data race between add and dump in all hash types
netfilter: ipset: annotate "pos" for concurrent readers/writers
netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
netfilter: nf_reject: skip iphdr options when looking for icmp header
netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
irqchip/crossbar: Fix parent domain resource leak
selftests/mm: clarify alternate unmapping in compaction_test
selftests/mm: allow PUD-level entries in compound testcase of hmm tests
selftests/mm: fix exclusive_cow test fork() handling
net: marvell: prestera: initialize err in prestera_port_sfp_bind
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
octeontx2-af: mcs: Fix unsupported secy stats read
octeontx2-pf: Clear stats of all resources when freeing resources
octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
...skipping...
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
tpm: fix event_size output in tpm1_binary_bios_measurements_show
tpm: Make the TPM character devices non-seekable
time: Fix off-by-one in compat settimeofday() usec validation
spi: uniphier: Fix completion initialization order before devm_request_irq()
sctp: validate STALE_COOKIE cause length before reading staleness
nvmet-rdma: handle inline data with a nonzero offset
can: esd_usb: kill anchored URBs before freeing netdevs
can: isotp: use unconditional synchronize_rcu() in isotp_release()
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-09-10
+
+ Ported from the following upstream stable releases:
+ v6.6.145, v6.12.96, v6.12.97
+
from git://git.kernel.org/
+
+ can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
+ can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
+ can: bcm: add missing rcu list annotations and operations
+ bpf,fork: wipe ->bpf_storage before bailouts that access it
+ bpf: Add missing access_ok call to copy_user_syms
+ net: sparx5: unregister blocking notifier on init failure
+ dm thin metadata: fix superblock refcount leak on snapshot shadow failure
+ dm thin metadata: fix metadata snapshot consistency on commit failure
+ dm era: fix out-of-bounds memory access for non-zero start sector
+ dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
+ dm-ioctl: fix a possible overflow in list_version_get_info
+ dm-log: fix a bitset_size overflow on 32bit machines
+ dm-stats: fix dm_jiffies_to_msec64
+ dm-stats: fix merge accounting
+ dm_early_create: fix freeing used table on dm_resume failure
+ dm-integrity: don't increment hash_offset twice
+ dm-verity: fix a possible NULL pointer dereference
+ dm-verity: increase sprintf buffer size
+ scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
+ scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
+ scsi: sg: Report request-table problems when any status is set
+ scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
+ scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
+ scsi: target: Bound PR-OUT TransportID parsing to the received buffer
+ scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
+ scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
+ scsi: elx: efct: Fix I/O leak on unsupported additional CDB
+ Input: ims-pcu - fix use-after-free and double-free in disconnect
+ Input: ims-pcu - release data interface on disconnect
+ Input: ims-pcu - validate control endpoint type
+ Input: ims-pcu - add response length checks
+ Input: ims-pcu - fix DMA mapping violation in line setup
+ Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
+ Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
+ Input: ims-pcu - fix race condition in reset_device sysfs callback
+ Input: ims-pcu - fix type confusion in CDC union descriptor parsing
+ net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
+ posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
+ cpu: hotplug: Preserve per instance callback errors
+ cpu: hotplug: Bound hotplug states sysfs output
+ gpio-f7188x: Add support for NCT6126D version B
+ gpios: palmas: add .get_direction() op
+ net: sit: require CAP_NET_ADMIN in the device netns for changelink
+ net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
+ net: ixp4xx_hss: fix duplicate HDLC netdev allocation
+ net/sched: act_ct: preserve tc_skb_cb across defragmentation
+ net: ena: clean up XDP TX queues when regular TX setup fails
+ net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
+ net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
+ net: ipip: require CAP_NET_ADMIN in the device netns for changelink
+ net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
+ ieee802154: admin-gate legacy LLSEC dump operations
+ ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
+ ieee802154: ca8210: fix cas_ctl leak on spi_async failure
+ ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
+ net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
+ batman-adv: retrieve ethhdr after potential skb realloc on RX
+ batman-adv: ensure minimal ethernet header on TX
+ batman-adv: clean untagged VLAN on netdev registration failure
+ LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
+ espintcp: use sk_msg_free_partial to fix partial send
+ bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
+ rtc: mpfs: fix counter upload completion condition
+ hwmon: (w83627hf) remove VID sysfs files on error and remove
+ hwmon: (w83793) remove vrm sysfs file on probe failure
+ net: liquidio: fix BAR resource leak on PF number failure
+ hwmon: (occ) unregister sysfs devices outside occ lock
+ fsl/fman: Free init resources on KeyGen failure in fman_init()
+ net: lan743x: Initialize eth_syslock spinlock before use
+ net/sched: sch_multiq: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
+ net/sched: sch_taprio: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
+ tracing/probes: Fix double addition of offset for @+FOFFSET
+ orangefs: keep the readdir entry size 64-bit in fill_from_part()
+ ata: pata_pxa: Fix DMA channel leak on probe error
+ net: wwan: iosm: bound device offsets in the MUX downlink decoder
+ hwmon: (asus_atk0110) Check package count before accessing element
+ riscv: probes: save original sp in rethook trampoline
+ s390/monwriter: Reject buffer reuse with different data length
+ mac802154: remove interfaces with RCU list deletion
+ llc: fix SAP refcount leak in llc_ui_autobind()
+ ipvs: use parsed transport offset in SCTP state lookup
+ ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
+ macsec: don't read an unset MAC header in macsec_encrypt()
+ drbd: reject data replies with an out-of-range payload size
+ riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
+ tracing/osnoise: Call synchronize_rcu() when unregistering
+ cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
+ pmdomain: imx: Fix i.MX8MP power notifier
+ pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
+ powerpc/pseries: fix memory leak on krealloc failure in papr_init
+ wifi: rt2x00: avoid full teardown before work setup in probe
+ wifi: mac80211: fix memory leak in ieee80211_register_hw()
+ regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
+ Bluetooth: btrtl: validate firmware patch bounds
+ llc: fix SAP refcount leak when creating incoming sockets
+ macsec: fix promiscuity refcount leak in macsec_dev_open()
+ memstick: ms_block: reject a card that reports too many blocks
+ ipvs: fix more places with wrong ipv6 transport offsets
+ ipvs: reload ip header after head reallocation
+ reset: sunxi: fix memory region leak on ioremap failure
+ powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
+ wifi: mac80211: free ack status frame on TX header build failure
+ wifi: mwifiex: fix permanently busy scans after multiple roam iterations
+ mtd: onenand: samsung: report DMA completion timeouts
+ mtd: mchp23k256: use SPI match data for chip caps
+ mmc: vub300: defer reset until cmd_mutex is unlocked
+ mtd: rawnand: fsl_ifc: return errors for failed page reads
+ mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
+ mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
+ perf/x86/amd/brs: Fix kernel address leakage
+ ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
+ ACPI: bus: Introduce devm_acpi_install_notify_handler()
+ ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
+ ACPI: NFIT: core: Fix possible deadlock and missing notifications
+ iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
+ iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
+ iio: invensense: remove redundant initialization of variable period
+ iio: invensense: fix timestamp glitches when switching frequency
+ iio: imu: inv_icm42600: stabilized timestamp in interrupt
+ iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
+ iio: pressure: mpl115: fix runtime PM leak on read error
+ bitops: make BYTES_TO_BITS() treewide-available
+ iio: common: st_sensors: honour channel endianness in read_axis_data
+ ALSA: aoa: check snd_ctl_new1() return value
+ PCI: altera: Fix resource leaks on probe failure
+ vfio/mlx5: Fix racy bitfields and tighten struct layout
+ PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
+ PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
+ PCI: mediatek: Convert bool to single quirks entry and bitmap
+ PCI: mediatek: Use generic MACRO for TPVPERL delay
+ PCI: mediatek: Fix IRQ domain leak when port fails to enable
+ PCI: Prevent resource tree corruption when BAR resize fails
+ PCI: Free saved list without holding pci_bus_sem
+ PCI: Fix restoring BARs on BAR resize rollback path
+ PCI: Add kerneldoc for pci_resize_resource()
+ PCI: Move Resizable BAR code to rebar.c
+ PCI: Skip Resizable BAR restore on read error
+ staging: rtl8723bs: core: move constants to right side in comparison
+ staging: rtl8723bs: fix spaces around binary operators
+ staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and
rtw_get_wps_attr()
+ crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
+ Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
+ mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
+ coresight: etb10: restore atomic_t for shared reading state
+ gpio: sch: use raw_spinlock_t in the irq startup path
+ media: nxp: imx8-isi: Convert to platform remove callback returning void
+ media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
+ media: nxp: imx8-isi: Fix use-after-free on remove
+ netfilter: ebtables: Use vmalloc_array() to improve code
+ netfilter: ebtables: zero chainstack array
+ Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
+ Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
+ Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
+ smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
+ smb: client: resolve SWN tcon from live registrations
+ ksmbd: use opener credentials for FSCTL mutations
+ ksmbd: centralize ksmbd_conn final release to plug transport leak
+ ksmbd: track the connection owning a byte-range lock
+ proc: rename proc_setattr to proc_nochmod_setattr
+ proc: protect ptrace_may_access() with exec_update_lock (FD links)
+ writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
+ perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
+ HID: add haptics page defines
+ HID: multitouch: fix out-of-bounds bit access on mt_io_flags
+ mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
+ seqlock: Introduce scoped_seqlock_read()
+ seqlock: Change do_task_stat() to use scoped_seqlock_read()
+ proc: protect ptrace_may_access() with exec_update_lock (part 1)
+ treewide: Switch/rename to timer_delete[_sync]()
+ HID: appleir: fix UAF on pending key_up_timer in remove()
+ serial: 8250_mid: Disable DMA for selected platforms
+ hfs/hfsplus: prevent getting negative values of offset/length
+ hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
+ bpf: Consistently use bpf_rcu_lock_held() everywhere
+ bpf: Allow LPM map access from sleepable BPF programs
+ usb: iowarrior: remove inherent race with minor number
+ usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
+ usb: typec: tcpm: Fix VDM type for Enter Mode commands
+ crypto: atmel - Drop explicit initialization of struct
i2c_device_id::driver_data to 0
+ crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
+ usb: gadget: f_fs: initialize reset_work at allocation time
+ nvmet: return DHCHAP status codes from nvmet_setup_auth()
+ nvmet-auth: validate reply message payload bounds against transfer length
+ usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
+ btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
+ crypto: qat - fix restarting state leak on allocation failure
+ audit: add audit_log_nf_skb helper function
+ audit: fix potential integer overflow in audit_log_n_hex()
+ regulator: scmi: Simplify with scoped for each OF child loop
+ regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
+ mm: do file ownership checks with the proper mount idmap
+ exfat: move free cluster out of exfat_init_ext_entry()
+ exfat: remove unnecessary read entry in __exfat_rename()
+ exfat: rename argument name for exfat_move_file and exfat_rename_file
+ exfat: add exfat_get_dentry_set_by_ei() helper
+ exfat: move exfat_chain_set() out of __exfat_resolve_path()
+ exfat: preserve benign secondary entries during rename and move
+ btrfs: fix false IO failure after falling back to buffered write
+ btrfs: fix incorrect buffered IO fallback for append direct writes
+ Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
+ Bluetooth: separate CIS_LINK and BIS_LINK link types
+ Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
+ KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
+ seqlock: fix scoped_seqlock_read kernel-doc
+ Bluetooth: hci_core: Remove check of BDADDR_ANY in
hci_conn_hash_lookup_big_state
+ Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
+ Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
+ selftests/hid: ensure CKI can compile our new tests on old kernels
+ Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder
+ Bluetooth: btmtk: remove #ifdef around declarations
+ writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
+ jiffies: Define secs_to_jiffies()
+ jiffies: Cast to unsigned long in secs_to_jiffies() conversion
+ driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
+ driver core: Guard deferred probe timeout extension with
delayed_work_pending()
+ tools/testing: add linux/args.h header and fix radix, VMA tests
+ selftests/bpf: Add simple strscpy() implementation
+ bcachefs: avoid truncating fiemap extent length
+ gpio: rockchip: change the GPIO version judgment logic
+ gpio: rockchip: teardown bugs and resource leaks
+ gpio: rockchip: fix generic IRQ chip leak on remove
+ NFSv4/flexfiles: Remove cred local variable dependency
+ iio: resolver: ad2s1210: notify trigger and clear state on fault read error
+ iio: temperature: Build mlx90635 with CONFIG_MLX90635
+ vfio: Remove device debugfs before releasing devres
+ PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000
series
+ netpoll: fix a use-after-free on shutdown path
+ mm: shrinker: fix shrinker_info teardown race with expansion
+ NFSv4/flexfiles: Add data structure support for striped layouts
+ mm/khugepaged: write all dirty file folios when collapsing
+ platform/x86: intel-hid: Protect ACPI notify handler against recursion
+ Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
+ Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
+ fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
+ ksmbd: use __GFP_RETRY_MAYFAIL
+ ksmbd: use opener credentials for ADS I/O
+ cpufreq: Make cpufreq_driver->exit() return void
+ cpufreq: qcom-cpufreq-hw: Fix possible double free
+ nvme: target: rdma: fix ndev refcount leak on queue connect
+ nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
+ crypto: qat - keep VFs enabled during reset
+ crypto: qat - notify fatal error before AER reset preparation
+ crypto: qat - protect service table iterations with service_lock
+ selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
+ iommufd: Set upper bounds on cache invalidation entry_num and entry_len
+ iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
+ dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
+ i2c: core: fix adapter probe deferral loop
+ xfs: fix null pointer dereference in tracepoint
+ xfs: don't wrap around quota ids in dqiterate
+ xfs: clamp timestamp nanoseconds correctly
+ xfs: don't zap bmbt forks if they are MAXLEVELS tall
+ iommu/vt-d: Clear Present bit before tearing down context entry
+ iommu: Pass old domain to set_dev_pasid op
+ iommu/vt-d: Cleanup intel_context_flush_present()
+ iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry
+ vsock/virtio: fix zerocopy completion for multi-skb sends
+ vsock/virtio: bind uarg before filling zerocopy skb
+ iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family
0x19
+ iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19
+ net: dropreason: Gather SOCKET_ drop reasons.
+ af_unix: Set drop reason in unix_release_sock().
+ af_unix: Set drop reason in manage_oob().
+ af_unix: Set drop reason in unix_stream_read_skb().
+ af_unix/scm: fix whitespace errors
+ af_unix: Don't hold unix_state_lock() in __unix_dgram_recvmsg().
+ af_unix: Don't check SOCK_DEAD in unix_stream_read_skb().
+ af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb().
+ af_unix: Drop all SCM attributes for SOCKMAP.
+ time/jiffies: Change register_refined_jiffies() to void __init
+ media: uvcvideo: Fix dev_sof filtering in hw timestamp
+ media: uvcvideo: Relax the constrains for interpolating the hw clock
+ media: uvcvideo: Do not add clock samples with small sof delta
+ serial: max310x: replace bare use of 'unsigned' with 'unsigned int'
(checkpatch)
+ serial: max310x: implement gpio_chip::get_direction()
+ drm/gpuvm: Do not prepare NULL objects
+ selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern
+ soc: xilinx: Shutdown and free rx mailbox channel
+ crypto: qat - fix heartbeat error injection
+ memory: tegra: Wire up system sleep PM ops
+ drm/gpuvm: take refcount on DRM device
+ ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD
+ RDMA/hns: Initialize seqfile before creating file
+ selftests/bpf: Reject unsupported -k option in vmtest.sh
+ media: atomisp: gc2235: fix UAF and memory leak
+ staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy()
+ arm64: dts: qcom: sm8650: Add power-domain and iface clk for ice node
+ Revert "treewide: Fix probing of devices in DT overlays"
+ RDMA/hns: Fix log flood after cmd_mbox failure
+ net: introduce page_frag_cache_drain()
+ nvmet-tcp: fix page fragment cache leak in error path
+ amba: use generic driver_override infrastructure
+ cdx: use generic driver_override infrastructure
+ Drivers: hv: vmbus: use generic driver_override infrastructure
+ driver core: Use system_percpu_wq instead of system_wq
+ tick/sched: Fix TOCTOU in nohz idle time fetch
+ vhost: fix vhost_get_avail_idx for a non empty ring
+ perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems
+ x86/cpu/amd: Provide a separate accessor for Node ID
+ perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
+ xfrm: fix NAT-related field inheritance in SA migration
+ netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper
flags
+ netfilter: synproxy: drop packets if timestamp adjustment fails
+ netfilter: synproxy: adjust duplicate timestamp options
+ netfilter: synproxy: fix unaligned memory access in timestamp adjustment
+ RDMA/siw: Fix endpoint/socket association handling
+ riscv: cpu_ops: Change return value type of cpu_is_stopped() to bool
+ wifi: mt76: mt7925: clean up DMA on probe failure
+ wifi: mt76: mt7925: fix potential tx_retries underflow
+ wifi: mt76: mt7996: fix potential tx_retries underflow
+ btrfs: fix deadlock cloning inline extent when using flushoncommit
+ virtio_console: read size from config space during device init
+ ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
+ Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
+ Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
+ net: dsa: qca8k: fix led devicename when using external mdio bus
+ ALSA: seq: Drop superfluous filter argument of get_event_dest_client()
+ ALSA: seq: Fix kernel heap address leak in bounce_error_event()
+ net: ethernet: mtk_wed: fix loading WO firmware for MT7986
+ octeontx2-af: npc: Fix size of entry2cntr_map
+ net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show()
+ dpll: add reference-sync netlink attribute
+ dpll: move xa_erase() call in to match dpll_pin_alloc() error path order
+ dpll: add reference sync get/set
+ dpll: Allow associating dpll pin with a firmware node
+ dpll: Add notifier chain for dpll events
+ dpll: Support dynamic pin index allocation
+ dpll: Enhance and consolidate reference counting logic
+ dpll: fix stale iteration in dpll_pin_on_pin_unregister()
+ dpll: send delete notification before unregister in on-pin rollback
+ dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
+ dpll: guard sync-pair removal on full pin unregister
+ dpll: balance create/delete notifications in __dpll_pin_(un)register
+ landlock: Fix unmarked concurrent access to socket family
+ selftests/bpf: Fix typo in verify_umulti_link_info
+ udf: fix nls leak on udf_fill_super() failure
+ mfd: rsmu: Fix page register setup
+ eventpoll: expand top-of-file overview / locking doc
+ eventpoll: rename attach_epitem() to ep_attach_file()
+ eventpoll: rename ep_remove_safe() back to ep_remove()
+ eventpoll: split ep_insert() into alloc + register stages
+ eventpoll: extract ep_deliver_event() from ep_send_events()
+ eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
+ eventpoll: rename epi->next and txlist for clarity
+ eventpoll: Fix epoll_wait() report false negative
+ gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
+ coresight: Fix source not disabled on idr_alloc_u32 failure
+ PCI: qcom: Disable ASPM L0s for SA8775P
+ dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
+ PCI: meson: Add missing remove callback
+ xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
+ Revert "PCI/MSI: Unmap MSI-X region on error"
+ apparmor: remove or add symlinks to rawdata according to export_binary
+ workqueue: Add new WQ_PERCPU flag
+ i3c: master: add WQ_PERCPU to alloc_workqueue users
+ i3c: master: Make hot-join workqueue freezable to block hot-join during
suspend
+ xfrm: Fix xfrm state cache insertion race
+ mac802154: Prevent overwrite return code in mac802154_perform_association()
+ netfilter: ipset: make sure gc is properly stopped
+ mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
+ selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap
+ selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap
+ selftests/mm: hugetlb_reparenting_test: do not unmount
+ selftests/mm: save and restore nr_hugepages value
+ selftests/mm: restore default nr_hugepages value via exit trap in
charge_reserved_hugetlb.sh
+ net/sched: act_ct: fix nf_connlabels leak on two error paths
+ ipv6: annotate data-races around cnf.forwarding
+ ipv6/addrconf: annotate data-races around devconf fields (II)
+ ipv6: ndisc: fix NULL deref in accept_untracked_na()
+ dpaa2-switch: do not accept VLAN uppers while bridged
+ bpftool: Fix vmlinux BTF leak in cgroup commands
+ ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
+ ice: dpll: fix memory leak in ice_dpll_init_info error paths
+ net: bnxt: use ethtool string helpers
+ eth: bnxt: gather and report HW-GRO stats
+ eth: bnxt: rename ring_err_stats -> ring_drv_stats
+ eth: bnxt: improve the timing of stats
+ md/raid5: use stripe state snapshot in break_stripe_batch_list()
+ md/raid5: avoid R5_Overlap races while breaking stripe batches
+ gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
+ ipv6: Add __in6_dev_get_rtnl_net().
+ octeontx2-af: Validate NIX maximum LFs correctly
+ udp_tunnel: remove rtnl_lock dependency
+ net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
+ net: hisilicon: hns3: use ethtool string helpers
+ net: hns3: use string choices helper
+ net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary middle
layer conversion
+ net: hns3: use hns3_get_ops() helper to reduce the unnecessary middle layer
conversion
+ net: hns3: clear hns alarm: comparison of integer expressions of different
signedness
+ net: hns3: unify copper port ksettings configuration path
+ net: hns3: refactor MAC autoneg and speed configuration
+ net: hns3: fix permanent link down deadlock after reset
+ net: hns3: differentiate autoneg default values between copper and fiber
+ rtnetlink: Add per-netns RTNL.
+ UBUNTU: [Config] Set CONFIG_DEBUG_NET_SMALL_RTNL=n
+ rtnetlink: Add assertion helpers for per-netns RTNL.
+ rtnetlink: Define rtnl_net_trylock().
+ ipv6: Convert net.ipv6.conf.${DEV}.XXX sysctl to per-netns RTNL.
+ ipv6: fix missing notification for ignore_routes_with_linkdown
+ ACPI: processor_idle: Mark LPI enter functions as __cpuidle
+ afs: Remove erroneous seq |= 1 in volume lookup loop
+ afs: Make /afs/.<cell> as well as /afs/<cell> mountpoints
+ afs: Add rootcell checks
+ afs: Make /afs/@cell and /afs/.@cell symlinks
+ afs: Fix afs_atcell_get_link() to handle RCU pathwalk
+ afs: Remove the "autocell" mount option
+ afs: Change dynroot to create contents on demand
+ afs: Fix misplaced inc of net->cells_outstanding
+ afs: Fix missing NULL pointer check in afs_break_some_callbacks()
+ ovl: fix comment about locking order
+ ata: libata-scsi: limit simulated SCSI command copy to response length
+ net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
+ ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
+ afs: Convert comma to semicolon
+ afs: Fix double netfs initialisation in afs_root_iget()
+ drm/xe: Add warn when level can not be zero.
+ drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
+ drm/xe/hw_engine: Fix double-free of managed BO in error path
+ HID: bpf: Fix hid_bpf_get_data() range check
+ drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
+ perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
+ genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips()
+ gpio: mvebu: free generic chips on unbind
+ netfilter: nft_lookup: fix catchall element handling with inverted lookups
+ drm/xe: remove duplicate <kunit/test-bug.h> include
+ LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
+ LoongArch: KVM: Check the return values for put_user()
+ LoongArch: KVM: Fix FPU register width with user access API
+ LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr()
+ KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
+ fbdev: efifb: fix memory leak in efifb_probe()
+ netfilter: nft_set_pipapo: don't leak bad clone into future transaction
+ selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
+ batman-adv: mcast: avoid OOB read of num_dests header
+ mm/memory_hotplug: fix incorrect altmap passing in error path
+ fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
+ fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
+ mtd: spi-nor: spansion: use die erase for multi-die devices only
+ mtd: rawnand: Pause continuous reads at block boundaries
+ taskstats: retain dead thread stats in TGID queries
+ platform/x86: dell-laptop: fix missing cleanups in init error path
+ platform/x86/amd/pmc: Don't log during intermediate wakeups
+ NFS: Charge unstable writes by request size, not folio size
+ netdev-genl: report NAPI thread PID in the caller's pid namespace
+ dm-verity: avoid double increment of &use_bh_wq_enabled
+ dm-verity: make error counter atomic
+ accel/ivpu: Reject firmware log with size smaller than header
+ firmware_loader: introduce __free() cleanup hanler
+ Input: ims-pcu - fix firmware leak in async update
+ tracing/user_events: Fix use-after-free in user_event_mm_dup()
+ gpio: tegra: do not call pinctrl for GPIO direction
+ platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
+ s390: Revert support for DCACHE_WORD_ACCESS
+ UBUNTU: [Config] Set CONFIG_DCACHE_WORD_ACCESS=- for s390x
+ selftests: net: make busywait timeout clock portable
+ ata: libata: Use QUIRK instead of HORKAGE
+ ata: libata-core: Skip HPA resize for locked drives
+ mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
+ ALSA: hda/cs35l41: Fix firmware load work teardown
+ io_uring/rw: ensure reissue path is correctly handled for IOPOLL
+ io_uring/rw: preserve partial result for iopoll
+ Bluetooth: L2CAP: Fix not tracking outstanding TX ident
+ mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
+ ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name
+ vfs: make LAST_XXX private to fs/namei.c
+ ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
+ HID: pidff: Fix missing blank lines after declarations
+ HID: pidff: Add missing spaces
+ HID: pidff: Rework pidff_upload_effect
+ HID: pidff: Use correct effect type in effect update
+ bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()
+ USB: iowarrior: fix use-after-free on disconnect race
+ crypto: atmel-sha204a - fail on hwrng registration error in probe path
+ btrfs: concentrate the error handling of submit_one_sector()
+ btrfs: remove folio parameter from ordered io related functions
+ btrfs: remove the COW fixup mechanism
+ slab: Introduce kmalloc_obj() and family
+ slab: Introduce kmalloc_flex() and family
+ add default_gfp() helper macro and use it in the new *alloc_obj() helpers
+ default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
+ slab: recognize @GFP parameter as optional in kernel-doc
+ fscrypt: Fix key setup in edge case with multiple data unit sizes
+ fscrypt: Replace mk_users keyring with simple list
+ KVM: arm64: Ensure level is always initialized when relaxing perms
+ KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
+ bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
+ rtnetlink: Make per-netns RTNL dereference helpers to macro.
+ afs: Fix afs_atcell_get_link() to check if ws_cell is unset first
+ afs: Fix afs_dynroot_readdir() to not use the RCU read lock
+ udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv()
+ i40e: drop udp_tunnel_get_rx_info() call from i40e_open()
+ ice: drop udp_tunnel_get_rx_info() call from ndo_open()
+ Bluetooth: L2CAP: Fix regressions caused by reusing ident
+ Bluetooth: L2CAP: fix tx ident leak for commands without a response
+ dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
+ perf: Reject exited events as group leaders
+ serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
platforms
+ usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
+ proc: Fix broken error paths for namespace links
+ UBUNTU: Upstream stable to v6.6.145, v6.12.96, v6.12.97
** Description changed:
+ SRU Justification
- SRU Justification
+ Impact:
+ The upstream process for stable tree updates is quite similar
+ in scope to the Ubuntu SRU process, e.g., each patch has to
+ demonstrably fix a bug, and each patch is vetted by upstream
+ by originating either directly from a mainline/stable Linux tree or
+ a minimally backported form of that patch. The following upstream
+ stable patches should be included in the Ubuntu kernel:
- Impact:
- The upstream process for stable tree updates is quite similar
- in scope to the Ubuntu SRU process, e.g., each patch has to
- demonstrably fix a bug, and each patch is vetted by upstream
- by originating either directly from a mainline/stable Linux tree or
- a minimally backported form of that patch. The following upstream
- stable patches should be included in the Ubuntu kernel:
+ upstream stable patchset 2026-09-10
- upstream stable patchset 2026-09-10
+ Ported from the following upstream stable releases:
+ v6.6.145, v6.12.96, v6.12.97
- Ported from the following upstream stable releases:
- v6.6.145, v6.12.96, v6.12.97
+ from git://git.kernel.org/
- from git://git.kernel.org/
-
+ [...]
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
can: bcm: add missing rcu list annotations and operations
bpf,fork: wipe ->bpf_storage before bailouts that access it
bpf: Add missing access_ok call to copy_user_syms
net: sparx5: unregister blocking notifier on init failure
dm thin metadata: fix superblock refcount leak on snapshot shadow failure
dm thin metadata: fix metadata snapshot consistency on commit failure
dm era: fix out-of-bounds memory access for non-zero start sector
dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
dm-ioctl: fix a possible overflow in list_version_get_info
dm-log: fix a bitset_size overflow on 32bit machines
dm-stats: fix dm_jiffies_to_msec64
dm-stats: fix merge accounting
dm_early_create: fix freeing used table on dm_resume failure
dm-integrity: don't increment hash_offset twice
dm-verity: fix a possible NULL pointer dereference
dm-verity: increase sprintf buffer size
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
scsi: sg: Report request-table problems when any status is set
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
scsi: target: Bound PR-OUT TransportID parsing to the received buffer
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
scsi: elx: efct: Fix I/O leak on unsupported additional CDB
Input: ims-pcu - fix use-after-free and double-free in disconnect
Input: ims-pcu - release data interface on disconnect
Input: ims-pcu - validate control endpoint type
Input: ims-pcu - add response length checks
Input: ims-pcu - fix DMA mapping violation in line setup
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
Input: ims-pcu - fix race condition in reset_device sysfs callback
Input: ims-pcu - fix type confusion in CDC union descriptor parsing
net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
cpu: hotplug: Preserve per instance callback errors
cpu: hotplug: Bound hotplug states sysfs output
gpio-f7188x: Add support for NCT6126D version B
gpios: palmas: add .get_direction() op
net: sit: require CAP_NET_ADMIN in the device netns for changelink
net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
net: ixp4xx_hss: fix duplicate HDLC netdev allocation
net/sched: act_ct: preserve tc_skb_cb across defragmentation
net: ena: clean up XDP TX queues when regular TX setup fails
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
net: ipip: require CAP_NET_ADMIN in the device netns for changelink
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
ieee802154: admin-gate legacy LLSEC dump operations
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
ieee802154: ca8210: fix cas_ctl leak on spi_async failure
ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
batman-adv: retrieve ethhdr after potential skb realloc on RX
batman-adv: ensure minimal ethernet header on TX
batman-adv: clean untagged VLAN on netdev registration failure
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
espintcp: use sk_msg_free_partial to fix partial send
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
rtc: mpfs: fix counter upload completion condition
hwmon: (w83627hf) remove VID sysfs files on error and remove
hwmon: (w83793) remove vrm sysfs file on probe failure
net: liquidio: fix BAR resource leak on PF number failure
hwmon: (occ) unregister sysfs devices outside occ lock
fsl/fman: Free init resources on KeyGen failure in fman_init()
net: lan743x: Initialize eth_syslock spinlock before use
net/sched: sch_multiq: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
net/sched: sch_taprio: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
tracing/probes: Fix double addition of offset for @+FOFFSET
orangefs: keep the readdir entry size 64-bit in fill_from_part()
ata: pata_pxa: Fix DMA channel leak on probe error
net: wwan: iosm: bound device offsets in the MUX downlink decoder
hwmon: (asus_atk0110) Check package count before accessing element
riscv: probes: save original sp in rethook trampoline
s390/monwriter: Reject buffer reuse with different data length
mac802154: remove interfaces with RCU list deletion
llc: fix SAP refcount leak in llc_ui_autobind()
ipvs: use parsed transport offset in SCTP state lookup
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
macsec: don't read an unset MAC header in macsec_encrypt()
drbd: reject data replies with an out-of-range payload size
riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
tracing/osnoise: Call synchronize_rcu() when unregistering
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
pmdomain: imx: Fix i.MX8MP power notifier
pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
powerpc/pseries: fix memory leak on krealloc failure in papr_init
wifi: rt2x00: avoid full teardown before work setup in probe
wifi: mac80211: fix memory leak in ieee80211_register_hw()
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
Bluetooth: btrtl: validate firmware patch bounds
llc: fix SAP refcount leak when creating incoming sockets
macsec: fix promiscuity refcount leak in macsec_dev_open()
memstick: ms_block: reject a card that reports too many blocks
ipvs: fix more places with wrong ipv6 transport offsets
ipvs: reload ip header after head reallocation
reset: sunxi: fix memory region leak on ioremap failure
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
wifi: mac80211: free ack status frame on TX header build failure
wifi: mwifiex: fix permanently busy scans after multiple roam iterations
mtd: onenand: samsung: report DMA completion timeouts
mtd: mchp23k256: use SPI match data for chip caps
mmc: vub300: defer reset until cmd_mutex is unlocked
mtd: rawnand: fsl_ifc: return errors for failed page reads
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
perf/x86/amd/brs: Fix kernel address leakage
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
ACPI: bus: Introduce devm_acpi_install_notify_handler()
ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
ACPI: NFIT: core: Fix possible deadlock and missing notifications
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
iio: invensense: remove redundant initialization of variable period
iio: invensense: fix timestamp glitches when switching frequency
iio: imu: inv_icm42600: stabilized timestamp in interrupt
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
iio: pressure: mpl115: fix runtime PM leak on read error
bitops: make BYTES_TO_BITS() treewide-available
iio: common: st_sensors: honour channel endianness in read_axis_data
ALSA: aoa: check snd_ctl_new1() return value
PCI: altera: Fix resource leaks on probe failure
vfio/mlx5: Fix racy bitfields and tighten struct layout
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
PCI: mediatek: Convert bool to single quirks entry and bitmap
PCI: mediatek: Use generic MACRO for TPVPERL delay
PCI: mediatek: Fix IRQ domain leak when port fails to enable
PCI: Prevent resource tree corruption when BAR resize fails
PCI: Free saved list without holding pci_bus_sem
PCI: Fix restoring BARs on BAR resize rollback path
PCI: Add kerneldoc for pci_resize_resource()
PCI: Move Resizable BAR code to rebar.c
PCI: Skip Resizable BAR restore on read error
staging: rtl8723bs: core: move constants to right side in comparison
staging: rtl8723bs: fix spaces around binary operators
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and
rtw_get_wps_attr()
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
coresight: etb10: restore atomic_t for shared reading state
gpio: sch: use raw_spinlock_t in the irq startup path
media: nxp: imx8-isi: Convert to platform remove callback returning void
media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
media: nxp: imx8-isi: Fix use-after-free on remove
netfilter: ebtables: Use vmalloc_array() to improve code
netfilter: ebtables: zero chainstack array
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
smb: client: resolve SWN tcon from live registrations
ksmbd: use opener credentials for FSCTL mutations
ksmbd: centralize ksmbd_conn final release to plug transport leak
ksmbd: track the connection owning a byte-range lock
proc: rename proc_setattr to proc_nochmod_setattr
proc: protect ptrace_may_access() with exec_update_lock (FD links)
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
HID: add haptics page defines
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
seqlock: Introduce scoped_seqlock_read()
seqlock: Change do_task_stat() to use scoped_seqlock_read()
proc: protect ptrace_may_access() with exec_update_lock (part 1)
treewide: Switch/rename to timer_delete[_sync]()
HID: appleir: fix UAF on pending key_up_timer in remove()
serial: 8250_mid: Disable DMA for selected platforms
hfs/hfsplus: prevent getting negative values of offset/length
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
bpf: Consistently use bpf_rcu_lock_held() everywhere
bpf: Allow LPM map access from sleepable BPF programs
usb: iowarrior: remove inherent race with minor number
usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
usb: typec: tcpm: Fix VDM type for Enter Mode commands
crypto: atmel - Drop explicit initialization of struct
i2c_device_id::driver_data to 0
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
usb: gadget: f_fs: initialize reset_work at allocation time
nvmet: return DHCHAP status codes from nvmet_setup_auth()
nvmet-auth: validate reply message payload bounds against transfer length
usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
crypto: qat - fix restarting state leak on allocation failure
audit: add audit_log_nf_skb helper function
audit: fix potential integer overflow in audit_log_n_hex()
regulator: scmi: Simplify with scoped for each OF child loop
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
mm: do file ownership checks with the proper mount idmap
exfat: move free cluster out of exfat_init_ext_entry()
exfat: remove unnecessary read entry in __exfat_rename()
exfat: rename argument name for exfat_move_file and exfat_rename_file
exfat: add exfat_get_dentry_set_by_ei() helper
exfat: move exfat_chain_set() out of __exfat_resolve_path()
exfat: preserve benign secondary entries during rename and move
btrfs: fix false IO failure after falling back to buffered write
btrfs: fix incorrect buffered IO fallback for append direct writes
Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
Bluetooth: separate CIS_LINK and BIS_LINK link types
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
seqlock: fix scoped_seqlock_read kernel-doc
Bluetooth: hci_core: Remove check of BDADDR_ANY in
hci_conn_hash_lookup_big_state
Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
selftests/hid: ensure CKI can compile our new tests on old kernels
Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder
Bluetooth: btmtk: remove #ifdef around declarations
writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
jiffies: Define secs_to_jiffies()
jiffies: Cast to unsigned long in secs_to_jiffies() conversion
driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
driver core: Guard deferred probe timeout extension with
delayed_work_pending()
tools/testing: add linux/args.h header and fix radix, VMA tests
selftests/bpf: Add simple strscpy() implementation
bcachefs: avoid truncating fiemap extent length
gpio: rockchip: change the GPIO version judgment logic
gpio: rockchip: teardown bugs and resource leaks
gpio: rockchip: fix generic IRQ chip leak on remove
NFSv4/flexfiles: Remove cred local variable dependency
iio: resolver: ad2s1210: notify trigger and clear state on fault read error
iio: temperature: Build mlx90635 with CONFIG_MLX90635
vfio: Remove device debugfs before releasing devres
PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000
series
netpoll: fix a use-after-free on shutdown path
mm: shrinker: fix shrinker_info teardown race with expansion
NFSv4/flexfiles: Add data structure support for striped layouts
mm/khugepaged: write all dirty file folios when collapsing
platform/x86: intel-hid: Protect ACPI notify handler against recursion
Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
ksmbd: use __GFP_RETRY_MAYFAIL
ksmbd: use opener credentials for ADS I/O
cpufreq: Make cpufreq_driver->exit() return void
cpufreq: qcom-cpufreq-hw: Fix possible double free
nvme: target: rdma: fix ndev refcount leak on queue connect
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
crypto: qat - keep VFs enabled during reset
crypto: qat - notify fatal error before AER reset preparation
crypto: qat - protect service table iterations with service_lock
selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
iommufd: Set upper bounds on cache invalidation entry_num and entry_len
iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
i2c: core: fix adapter probe deferral loop
xfs: fix null pointer dereference in tracepoint
xfs: don't wrap around quota ids in dqiterate
xfs: clamp timestamp nanoseconds correctly
xfs: don't zap bmbt forks if they are MAXLEVELS tall
iommu/vt-d: Clear Present bit before tearing down context entry
iommu: Pass old domain to set_dev_pasid op
iommu/vt-d: Cleanup intel_context_flush_present()
iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry
vsock/virtio: fix zerocopy completion for multi-skb sends
vsock/virtio: bind uarg before filling zerocopy skb
iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family
0x19
iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19
net: dropreason: Gather SOCKET_ drop reasons.
af_unix: Set drop reason in unix_release_sock().
af_unix: Set drop reason in manage_oob().
af_unix: Set drop reason in unix_stream_read_skb().
af_unix/scm: fix whitespace errors
af_unix: Don't hold unix_state_lock() in __unix_dgram_recvmsg().
af_unix: Don't check SOCK_DEAD in unix_stream_read_skb().
af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb().
af_unix: Drop all SCM attributes for SOCKMAP.
time/jiffies: Change register_refined_jiffies() to void __init
media: uvcvideo: Fix dev_sof filtering in hw timestamp
media: uvcvideo: Relax the constrains for interpolating the hw clock
media: uvcvideo: Do not add clock samples with small sof delta
serial: max310x: replace bare use of 'unsigned' with 'unsigned int'
(checkpatch)
serial: max310x: implement gpio_chip::get_direction()
drm/gpuvm: Do not prepare NULL objects
selftests/bpf: Use local type for bpf_fou_encap in test_tunnel_kern
soc: xilinx: Shutdown and free rx mailbox channel
crypto: qat - fix heartbeat error injection
memory: tegra: Wire up system sleep PM ops
drm/gpuvm: take refcount on DRM device
ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD
RDMA/hns: Initialize seqfile before creating file
selftests/bpf: Reject unsupported -k option in vmtest.sh
media: atomisp: gc2235: fix UAF and memory leak
staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy()
arm64: dts: qcom: sm8650: Add power-domain and iface clk for ice node
Revert "treewide: Fix probing of devices in DT overlays"
RDMA/hns: Fix log flood after cmd_mbox failure
net: introduce page_frag_cache_drain()
nvmet-tcp: fix page fragment cache leak in error path
amba: use generic driver_override infrastructure
cdx: use generic driver_override infrastructure
Drivers: hv: vmbus: use generic driver_override infrastructure
driver core: Use system_percpu_wq instead of system_wq
tick/sched: Fix TOCTOU in nohz idle time fetch
vhost: fix vhost_get_avail_idx for a non empty ring
perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems
x86/cpu/amd: Provide a separate accessor for Node ID
perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
xfrm: fix NAT-related field inheritance in SA migration
netfilter: nfnetlink_cthelper: use {READ,WRITE}_ONCE for accessing helper
flags
netfilter: synproxy: drop packets if timestamp adjustment fails
netfilter: synproxy: adjust duplicate timestamp options
netfilter: synproxy: fix unaligned memory access in timestamp adjustment
RDMA/siw: Fix endpoint/socket association handling
riscv: cpu_ops: Change return value type of cpu_is_stopped() to bool
wifi: mt76: mt7925: clean up DMA on probe failure
wifi: mt76: mt7925: fix potential tx_retries underflow
wifi: mt76: mt7996: fix potential tx_retries underflow
btrfs: fix deadlock cloning inline extent when using flushoncommit
virtio_console: read size from config space during device init
ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
net: dsa: qca8k: fix led devicename when using external mdio bus
ALSA: seq: Drop superfluous filter argument of get_event_dest_client()
ALSA: seq: Fix kernel heap address leak in bounce_error_event()
net: ethernet: mtk_wed: fix loading WO firmware for MT7986
octeontx2-af: npc: Fix size of entry2cntr_map
net: ethernet: mtk_wed: debugfs: correct index in wed_amsdu_show()
dpll: add reference-sync netlink attribute
dpll: move xa_erase() call in to match dpll_pin_alloc() error path order
dpll: add reference sync get/set
dpll: Allow associating dpll pin with a firmware node
dpll: Add notifier chain for dpll events
dpll: Support dynamic pin index allocation
dpll: Enhance and consolidate reference counting logic
dpll: fix stale iteration in dpll_pin_on_pin_unregister()
dpll: send delete notification before unregister in on-pin rollback
dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister()
dpll: guard sync-pair removal on full pin unregister
dpll: balance create/delete notifications in __dpll_pin_(un)register
landlock: Fix unmarked concurrent access to socket family
selftests/bpf: Fix typo in verify_umulti_link_info
udf: fix nls leak on udf_fill_super() failure
mfd: rsmu: Fix page register setup
eventpoll: expand top-of-file overview / locking doc
eventpoll: rename attach_epitem() to ep_attach_file()
eventpoll: rename ep_remove_safe() back to ep_remove()
eventpoll: split ep_insert() into alloc + register stages
eventpoll: extract ep_deliver_event() from ep_send_events()
eventpoll: wrap EP_UNACTIVE_PTR in typed sentinel helpers
eventpoll: rename epi->next and txlist for clarity
eventpoll: Fix epoll_wait() report false negative
gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
coresight: Fix source not disabled on idr_alloc_u32 failure
PCI: qcom: Disable ASPM L0s for SA8775P
dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor
PCI: meson: Add missing remove callback
xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
Revert "PCI/MSI: Unmap MSI-X region on error"
apparmor: remove or add symlinks to rawdata according to export_binary
workqueue: Add new WQ_PERCPU flag
i3c: master: add WQ_PERCPU to alloc_workqueue users
i3c: master: Make hot-join workqueue freezable to block hot-join during
suspend
xfrm: Fix xfrm state cache insertion race
mac802154: Prevent overwrite return code in mac802154_perform_association()
netfilter: ipset: make sure gc is properly stopped
mailbox: imx: Forward the timeout/ error in imx_mu_generic_tx()
selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap
selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap
selftests/mm: hugetlb_reparenting_test: do not unmount
selftests/mm: save and restore nr_hugepages value
selftests/mm: restore default nr_hugepages value via exit trap in
charge_reserved_hugetlb.sh
net/sched: act_ct: fix nf_connlabels leak on two error paths
ipv6: annotate data-races around cnf.forwarding
ipv6/addrconf: annotate data-races around devconf fields (II)
ipv6: ndisc: fix NULL deref in accept_untracked_na()
dpaa2-switch: do not accept VLAN uppers while bridged
bpftool: Fix vmlinux BTF leak in cgroup commands
ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
ice: dpll: fix memory leak in ice_dpll_init_info error paths
net: bnxt: use ethtool string helpers
eth: bnxt: gather and report HW-GRO stats
eth: bnxt: rename ring_err_stats -> ring_drv_stats
eth: bnxt: improve the timing of stats
md/raid5: use stripe state snapshot in break_stripe_batch_list()
md/raid5: avoid R5_Overlap races while breaking stripe batches
gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
ipv6: Add __in6_dev_get_rtnl_net().
octeontx2-af: Validate NIX maximum LFs correctly
udp_tunnel: remove rtnl_lock dependency
net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
net: hisilicon: hns3: use ethtool string helpers
net: hns3: use string choices helper
net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary middle
layer conversion
net: hns3: use hns3_get_ops() helper to reduce the unnecessary middle layer
conversion
net: hns3: clear hns alarm: comparison of integer expressions of different
signedness
net: hns3: unify copper port ksettings configuration path
net: hns3: refactor MAC autoneg and speed configuration
net: hns3: fix permanent link down deadlock after reset
net: hns3: differentiate autoneg default values between copper and fiber
rtnetlink: Add per-netns RTNL.
UBUNTU: [Config] Set CONFIG_DEBUG_NET_SMALL_RTNL=n
rtnetlink: Add assertion helpers for per-netns RTNL.
rtnetlink: Define rtnl_net_trylock().
ipv6: Convert net.ipv6.conf.${DEV}.XXX sysctl to per-netns RTNL.
ipv6: fix missing notification for ignore_routes_with_linkdown
ACPI: processor_idle: Mark LPI enter functions as __cpuidle
afs: Remove erroneous seq |= 1 in volume lookup loop
afs: Make /afs/.<cell> as well as /afs/<cell> mountpoints
afs: Add rootcell checks
afs: Make /afs/@cell and /afs/.@cell symlinks
afs: Fix afs_atcell_get_link() to handle RCU pathwalk
afs: Remove the "autocell" mount option
afs: Change dynroot to create contents on demand
afs: Fix misplaced inc of net->cells_outstanding
afs: Fix missing NULL pointer check in afs_break_some_callbacks()
ovl: fix comment about locking order
ata: libata-scsi: limit simulated SCSI command copy to response length
net/mlx5: LAG, MPESW, Fix missing complete() on devcom error
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
afs: Convert comma to semicolon
afs: Fix double netfs initialisation in afs_root_iget()
drm/xe: Add warn when level can not be zero.
drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
drm/xe/hw_engine: Fix double-free of managed BO in error path
HID: bpf: Fix hid_bpf_get_data() range check
drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips()
gpio: mvebu: free generic chips on unbind
netfilter: nft_lookup: fix catchall element handling with inverted lookups
drm/xe: remove duplicate <kunit/test-bug.h> include
LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
LoongArch: KVM: Check the return values for put_user()
LoongArch: KVM: Fix FPU register width with user access API
LoongArch: KVM: Return full old CSR value from kvm_emu_xchg_csr()
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
fbdev: efifb: fix memory leak in efifb_probe()
netfilter: nft_set_pipapo: don't leak bad clone into future transaction
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
batman-adv: mcast: avoid OOB read of num_dests header
mm/memory_hotplug: fix incorrect altmap passing in error path
fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
mtd: spi-nor: spansion: use die erase for multi-die devices only
mtd: rawnand: Pause continuous reads at block boundaries
taskstats: retain dead thread stats in TGID queries
platform/x86: dell-laptop: fix missing cleanups in init error path
platform/x86/amd/pmc: Don't log during intermediate wakeups
NFS: Charge unstable writes by request size, not folio size
netdev-genl: report NAPI thread PID in the caller's pid namespace
dm-verity: avoid double increment of &use_bh_wq_enabled
dm-verity: make error counter atomic
accel/ivpu: Reject firmware log with size smaller than header
firmware_loader: introduce __free() cleanup hanler
Input: ims-pcu - fix firmware leak in async update
tracing/user_events: Fix use-after-free in user_event_mm_dup()
gpio: tegra: do not call pinctrl for GPIO direction
platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
s390: Revert support for DCACHE_WORD_ACCESS
UBUNTU: [Config] Set CONFIG_DCACHE_WORD_ACCESS=- for s390x
selftests: net: make busywait timeout clock portable
ata: libata: Use QUIRK instead of HORKAGE
ata: libata-core: Skip HPA resize for locked drives
mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method
ALSA: hda/cs35l41: Fix firmware load work teardown
io_uring/rw: ensure reissue path is correctly handled for IOPOLL
io_uring/rw: preserve partial result for iopoll
Bluetooth: L2CAP: Fix not tracking outstanding TX ident
mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name
vfs: make LAST_XXX private to fs/namei.c
ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
HID: pidff: Fix missing blank lines after declarations
HID: pidff: Add missing spaces
HID: pidff: Rework pidff_upload_effect
HID: pidff: Use correct effect type in effect update
bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4()
USB: iowarrior: fix use-after-free on disconnect race
crypto: atmel-sha204a - fail on hwrng registration error in probe path
btrfs: concentrate the error handling of submit_one_sector()
btrfs: remove folio parameter from ordered io related functions
btrfs: remove the COW fixup mechanism
slab: Introduce kmalloc_obj() and family
slab: Introduce kmalloc_flex() and family
add default_gfp() helper macro and use it in the new *alloc_obj() helpers
default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
slab: recognize @GFP parameter as optional in kernel-doc
fscrypt: Fix key setup in edge case with multiple data unit sizes
fscrypt: Replace mk_users keyring with simple list
KVM: arm64: Ensure level is always initialized when relaxing perms
KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms()
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
rtnetlink: Make per-netns RTNL dereference helpers to macro.
afs: Fix afs_atcell_get_link() to check if ws_cell is unset first
afs: Fix afs_dynroot_readdir() to not use the RCU read lock
udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv()
i40e: drop udp_tunnel_get_rx_info() call from i40e_open()
ice: drop udp_tunnel_get_rx_info() call from ndo_open()
Bluetooth: L2CAP: Fix regressions caused by reusing ident
Bluetooth: L2CAP: fix tx ident leak for commands without a response
dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
perf: Reject exited events as group leaders
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
platforms
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
proc: Fix broken error paths for namespace links
UBUNTU: Upstream stable to v6.6.145, v6.12.96, v6.12.97
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166995
Title:
Noble update: upstream stable patchset 2026-09-10
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166995/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
