[Bug 2167609] [NEW] Resolute update: upstream stable patchset 2026-09-17

[Alice C. Munduruca]

Public bug reported:


    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2026-09-17

                Ported from the following upstream stable releases:
                        v6.18.49, v6.18.50, v7.2.2, v7.2.3, v7.2.4

       from git://git.kernel.org/

fuse: fix race between interrupt and resend
fuse: fix missing barrier when checking io-uring readiness
fuse: publish io-uring queues with release semantics
fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
vlan: fix skb_under_panic and races when toggling HW VLAN offload
crypto: sun8i-ce - Remove crypto_rng interface
UBUNTU: [Config] Remove CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG
crypto: sun8i-ss - Remove crypto_rng interface
UBUNTU: [Config] Remove CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG
ASoC: tegra210_i2s: sort the register default table
ASoC: tegra210_i2s: sort the Tegra264 register default table
ASoC: tegra210_mixer: sort the register default table
ASoC: tegra: Fix the I2S enable default value
ASoC: tegra: Fix the MIXER enable default value
ASoC: tegra: Sort ADMAIF register defaults
ASoC: tegra: Sort MBDRC register defaults
ring-buffer: Fix subbuf resize race with ring buffer readers
drm/amd/display: hide Apple Studio Display secondary tile
drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
rust: time: fix as_micros_ceil() rounding near i64::MAX
alpha: don't leak hardware-fabricated FP exception bits to user space
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
clocksource/drivers/timer-sun4i: Advertise a real minimum delta
fs: fix user path of nested backing files
ovl: fix double end_creating() on the casefold-mismatch path
pidfd: hold exec_update_lock around namespace ioctl
powerpc/pseries/iommu: switch to Default DMA window during kdump
rust: fmt: fix {:p} printing stack addresses
timers/itimer: Zero-init old itimerval before copy to userspace
objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
rust: bug: skip arch-specific asm in `testlib` builds
rust: bug: fix warn_on macro build error on UML
rust: bug: prevent dead_code warning from warn_on!'s flags constant
rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
rust: kernel: list: fix incorrect pop_back example comment
objtool/rust: add one more `noreturn` Rust function
rust: num: restrict bool conversion to unsigned Bounded
rust: cfi: disable function merging if CFI is enabled
KEYS: trusted: Fix TPM teardown ordering
apparmor: fix cred UAF caused by begin_current_label_crit_section()
apparmor: fix out-of-bounds write when null terminating a label vec
include/linux/list.h: mark list_add and __list_add as __always_inline
mm, swap: ratelimit bad swap entry reports
mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd
mm/huge_memory: use folio's memcg inside __folio_split()
mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()
mm/kmemleak: avoid soft lockup when scanning task stacks
mm/madvise: skip device-private PMDs in cold and pageout walks
mm/mempolicy: skip non-present PMDs when queueing folios
mm/mglru: use the common routine for dirty/writeback reactivation
mm/mglru: fix and remove redundant unevictable folio handling
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
mm/migrate: use huge_ptep_get() in remove_migration_pte()
mm/migrate_device: clear stale mapping after freeing swapcache
mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in 
print_page_owner_memcg()
mm/page_vma_mapped: use huge_ptep_get() for hugetlb
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
mm/rmap: use huge_ptep_get() in try_to_unmap_one()
mm/rmap: use huge_ptep_get() in try_to_migrate_one()
mm/slub: fix missing debugfs entries for caches created before sysfs init
mm/slub: prevent pfmemalloc objects from entering the barn
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
mm/zswap: fix global shrinker when memory cgroup is disabled
mm: compaction: support non-movable compaction for pageblock requests
mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings
mm: memcg-v1: fix memsw and TCP failcnt accounting
mm: memcg: stop reclaim when a limit update is superseded
mm: memcontrol: update state_local when flushing NMI stats
mm: mempolicy: fix automatic numa balancing for shmem
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
mm: page_alloc: move capture_control to the page allocator
mm: page_alloc: fix non-movable reclaim storm in defrag_mode
mm: vmscan: fix node reclaim ignoring swappiness parameter
tools/compiler: match glibc 2.42 definition of __attribute_const__
x86/locking: Use sfence for wmb() if SSE is available
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
x86/tdx: Fix off-by-one in port I/O handling
x86/tdx: Fix zero-extension for 32-bit port I/O
x86/xen: fix init of balloon stats again
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
tracing/user_events: Clear copied tracing state before fork duplication
tracing: Fix crash passing ERR_PTR to kthread_stop()
tracing: Fix logged instance name on creation failure
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
tracing: Fix use-after-free with same-name named triggers
cdx: Fix double free when sysfs file creation fails
debugfs: Fix lockdown check for mmap_prepare
device property: fix infinite loop in fwnode_for_each_child_node()
misc: nsm: bound the device-reported response length
powerpc/powermac: fix OF node refcount
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
serial: imx: serialize imx_uart_ports[] lifetime
staging: greybus: hid: fix SET_REPORT return value
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race 
condition
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
USB: phy: fsl-usb: fix missing static keywords
usb: typec: hd3ss3220: fix VBUS regulator error message
usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
usb: typec: thunderbolt: Disable work before freeing tbt on remove
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
usb: gadget: midi2: remove default configfs groups on teardown
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and 
uvc_function_unbind()
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
i3c: renesas: Fix out-of-bounds access for newdevs mask
KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
media: cec: stm32: prevent out-of-bounds write on RX overflow
media: vicodec: fix out-of-bounds write in FWHT encoder
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
of: fix out-of-bounds read in of_alias_scan() stem parser
PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
phy: rockchip-samsung-dcphy: fix out-of-range max_register
ubifs: fix out-of-bounds read in signature length check
zram: fix out-of-bounds access in read_block_state()
zram: fix out-of-bounds access in writeback_store()
zram: set default primary compressor in zram_destroy_comps()
zram: validate deflate params
zsmalloc: account for handle size in class lookup
NFS/localio: fix ref leak on nfs_uuid_add_file failure
NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
NFSD: check truncate permission under inode lock
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
NFSD: Fix off-by-one in DRC bucket pruning limit
NFSD: fix up error returned by write_threads()
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
pNFS: Fix EBUSY check in pnfs_layout_need_return
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
nfsd: release path refs on follow_down() error
nfsd: Reset write verifier when async COPY writeback fails
nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
nfsd: sample writeback error cursor before async COPY loop
nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
nfsd: size fh_verify server sockaddr slot by xpt_locallen
nfsd: validate nseconds in TIME_DELEG decode paths
nfsd: validate sockaddr length per family in listener_set
nfsd: validate symlink target length in NFSv4 CREATE
nfsd: move struct nfsd_genl_rqstp to nfsctl.c
nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
nfsd: add filehandle match check to nfsd4_delegreturn()
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
nfsd: cap decoded POSIX ACL count to bound sort cost
nfsd: check client ownership when cancelling a copy-notify stateid
nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
nfsd: clear opcnt on compound arg release to prevent OOB read
nfsd: convert nfsd_net boolean flags to unsigned long flags word
nfsd: dedup nfs4_client_to_reclaim inserts
nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
nfsd: defer vfree of compound ops to fix rpc_status UAF
nfsd: don't free session slots that are still in use
nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
nfsd: fix clock domain mismatch in clients_still_reclaiming()
nfsd: fix cpntf publish race in nfs4_init_cp_state
nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
nfsd: fix FL_SLEEP being set unconditionally for all LOCK types
nfsd: fix netlink dumpit error handling for rpc_status_get
nfsd: fix nfsd_file leak on inter-server COPY setup failure
nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
nfsd: fix partial-write detection in nfsd_direct_write
nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure
nfsd: fix reply size estimate for GET_DIR_DELEGATION
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
nfsd: fix UAF in async copy cancel and shutdown
nfsd: fix version mismatch loops in nfsd_acl_init_request()
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
nfsd: gate nfs2 setacl by argp->mask
nfsd: gate nfs3 setacl by argp->mask
nfsd: hold rcu across localio cmpxchg retry
nfsd: initialize copy-notify stateid before publishing it
nfsd: initialize DRC hash table before registering shrinker
nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
nfsd: release OPEN-decoded posix ACLs via op_release
nfsd: revoke copy-notify stateids before dropping their reference
NFSD: Prevent lock owner use-after-free during client teardown
NFSD: Prevent post-shutdown use-after-free in unlock_filesystem
NFSD: Prevent client use-after-free during admin state revocation
nfsd: convert global state_lock to per-net deleg_lock
NFSD: Prevent client use-after-free during delegation revoke
NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update
libceph: validate OSD extent maps before cursor advance
libceph: reject buckets with mismatched CRUSH ids
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
ceph: fix UAF in check_new_map() on session freed during unlock
ceph: force a cap message when a deferred revoke can't be acked immediately
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
ceph: bound copied dentry name length in NFS export get_name
ceph: bound MDSCapAuth path and fs_name decode in handle_session()
ceph: bound num_export_targets array for mds info v2/v3
ceph: bound xattr value length in __build_xattrs()
ceph: cap delegated inode count in ceph_parse_deleg_inos()
ceph: do not repeat ceph_trim_dentries() if no progress possible
ceph: fix leaked inode reference on writeback abort at umount
btrfs: drop recovered reloc root refs on recovery failure
btrfs: fix extent map leak in NOCOW direct I/O write
btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
audit: avoid dropping live tree ref on fsnotify rule autoremove
smb: move some definitions from common/smb2pdu.h into common/fscc.h
smb/client: reduce fallocate zero buffer allocation
smb/client: emulate small EOF-extending mode 0 fallocate ranges
cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under 
i_rwsem
smb/client: do not account EOF extension as allocation
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix 
extensions
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed 
secondary T2
smb: client: clear ce->tgthint in free_tgts()
smb: client: fix ALIGN() overflow in symlink_data() error context loop
smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
smb: client: harden DFS cache against invalid target hints
smb: client: reject a tree connect response whose byte count is too small
smb: client: restore the data_offset bound in is_valid_oplock_break()
HID: apple: preserve keyboard backlight across T2 resume
HID: corsair-void: Check size of status and firmware events before reading them
HID: picolcd: clamp eeprom debugfs read to bytes actually received
HID: roccat: free buffered reports when destroying device
HID: sensor: custom: Fix field sysfs group cleanup on failure
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
HID: universal-pidff: stop the device when force-feedback init fails
HID: mcp2221: stop device IO before hid_hw_stop
HID: mcp2221: fix OOB write in mcp2221_raw_event()
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
HID: mcp2221: validate report size in mcp2221_raw_event()
HID: intel-thc-hid: intel-quickspi: validate report size before copy
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller 
buffer
HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
eventfs: Initialize ei->children and ei->list in init_ei()
fs/ntfs3: validate dirty page table on log replay
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
fs/ntfs3: bound page_lcns[] index by the log record
eCryptfs: bound the packet-length peek to the user buffer
ecryptfs: fix tag 11 packet exact-fit size check
ecryptfs: hold msg ctx list lock when cleaning daemon queue
ecryptfs: pass packet set buffer size to parser
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
ecryptfs: reject too-small tag 70 packets
ecryptfs: release message context on send failure
ecryptfs: show filename encryption options
efivarfs: Rate limit statfs() handler
entry: Fix seccomp bypass after ptrace with TSYNC
erofs: skip sufficiently large global buffers when resizing
ext2: Fix lost inode updates for IS_SYNC inodes
fanotify: fix use-after-free of file range info
fat: restore original value when fat_ent_write failed
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
fbdev: uvesafb: unregister connector callback on init failure
forcedeth: fix off-by-one when saving/restoring non-PCI config space
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
fsnotify: Fix stale object mask after concurrent mark updates
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
hugetlb: only adjust reservation during unmapping if mapcount is 0
accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
accel/rocket: initialize job domain before cleanup paths
accel/rocket: Fix error path handling in rocket_job_run()
acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
ACPI: APEI: Fix ERST timeout unit conversion
ACPI: APEI: GHES: fix ARM section length accounting after header
ACPI: pfr_update: fix stack buffer overflow in query_capability()
ACPI: scan: Avoid registering platform devices with resource overlaps
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
alpha: marvel: Fix lock ordering in init_io7_irqs()
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
auxdisplay: charlcd: cancel backlight work on registration failure
backlight: aw99706: Fix DT property names to match binding
backlight: aw99706: Honor the core blank state in update_status()
block: validate user space vectors during extraction
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
Bluetooth: eir: Fix OOB read in eir_get_service_data()
bnx2x: fix double free in bnx2x_init_firmware() error path
bnxt_en: Write doorbell when linearizing skb fails
bpf, x86: Fix per-CPU address resolution into an extended register
bpf: Disable preemption in __bpf_get_stack
buffer: avoid tail commit walk for uptodate folios
bpf: Harden bloom filter sizing and indexing on 32-bit kernels
dm-io: clone the source bio instead of copying its biovec
dm-io: report non-retryable errors separatedly
dm-era: fix shadowed superblock leak on take-snap failure
dm raid1: reserve space for NUL-terminator in build_constructor_string()
dm array: validate array block headers on read
dm array: reject an array block whose value size is not the caller's
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
cpufreq: apple-soc: Fix OPP table cleanup
cpufreq: schedutil: Fix rate limit overflow
cxl/features: bound fwctl command payload to the input buffer
dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding
cxl/region: Add helper to check Soft Reserved containment by CXL regions
cxl/mce: Make the MCE notifier per-region
cxl/pmem: Format the nvdimm serial number as unsigned decimal
cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Bluetooth: RFCOMM: serialize security confirmation handling
Bluetooth: hci_conn: re-enable advertising only for peripheral role
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
kasan: fix cache shrink race with CPU hotplug
jbd2: bound shrinker scans by examined checkpoint buffers
jbd2: check need_resched() when skipping busy checkpoint buffers
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
ip: orphan prefetched skbs before multicast forwarding
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
ip6_gre: fix hardware header length for NBMA tunnels
ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
ipv6: use RCU iterator to dump route exceptions
landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
mailbox: qcom-ipcc: fix duplicate channel allocation across holes
md/raid10: fix still_degraded being inverted in raid10_sync_request()
md: do overflow check for sb->bblog_shift in super_1_load()
module: validate string table section types
mpls: reload header after pskb_may_pull()
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
module/kallsyms: fix nextval for data symbol lookup
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
params: fix charp corruption on allocation failure
phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
SUNRPC: svcauth_gss: enforce krb5 token minimum length
sunrpc: route to a populated pool in svc_pool_for_cpu()
SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
SUNRPC: always drain cache_cleaner before destroying a cache_detail
SUNRPC: Check svc pool percpu counter allocation
SUNRPC: close backchannel before destroying callback service
sunrpc: defer rq_argp and rq_resp free until after RCU grace period
SUNRPC: fix gssx_dec_option_array error path bugs
sunrpc: fix use-after-free in __rpc_clnt_handle_event and 
__rpc_clnt_remove_pipedir
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
SUNRPC: harden gss_unwrap_resp_priv length checks
sunrpc: init gssp_lock before publishing proc entry
SUNRPC: reject duplicate CREDS_VALUE options
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
SUNRPC: wait for in-flight client TLS handshake callback
svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
svcrdma: Fix offset arithmetic in read_chunk_range
svcrdma: Fix pcl_for_each_segment for empty chunks
svcrdma: Fix unmatched rn_unregister on failed accept
svcrdma: Reject connection when transport allocation fails
svcrdma: Reject inline replies that overflow the pull-up buffer
svcrdma: Reject oversized Read segments at decode time
svcrdma: Reject Read lists that exceed the page budget
svcrdma: Reject Write/Reply chunks with segcount 0
svcrdma: Use svc_xprt_put to free listener on create failure
svcrdma: Validate Read chunk positions before reconstruction
udf: reject VAT indexes equal to the entry count
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
wifi: mt76: mt7925: cancel pending mlo_pm_work
staging: media: tegra-video: fix of_node_put() on VIP parse errors
staging: media: tegra-video: vi: fix probe failure on skipped last port
media: staging/ipu7: fix async notifier UAF on probe error path
sched/core: Handle pick_task() releasing the rq lock
sched_ext: Fix exit_task leak on fork failure during enable
sched_ext: Fix inverted ops.core_sched_before() invocation
sched_ext: Keep kick_sync waiting on the rq's own CPU
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
rpmsg: glink: smem: order FIFO read after availability check
Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap
arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on
arm64: dts: rockchip: fix eMMC reset polarity on PP-1516
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
arm64: dts: rockchip: fix emmc reset polarity on px30-cobra
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
arm64: dts: rockchip: Fix rk3588s-roc-pc audio description
riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage
riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage
RISC-V: KVM: Fix PMU event info array size overflow
riscv: acpi: Handle LPI architectural context loss flags
riscv: unaligned: stop using kthread for check_vector_unaligned_access()
remoteproc: scp: Fix device reference leak on failed lookup
ptp: vmclock: prevent read-only mappings from becoming writable
qede: Fix NULL pointer dereference in TPA fragment processing
RDMA/cxgb4: Cancel reg_work before freeing device on remove
RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
RDMA/ionic: Embed counter driver data in rdma_counter allocation
RDMA/ucma: Lock the handler in ucma_set_ib_path()
RDMA/ucma: Lock the handler in ucma_write_cm_event()
RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving 
dangling of_node pointer
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership 
transferred to rdata
regulator: qcom-refgen: correct the regulator type to CURRENT
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
ring-buffer: Free cpu_buffer::free_page with subbuf_order
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
PM: sleep: Unblock runtime PM when device prepare fails
orangefs: fix double-free of trailer_buf on readdir copy failure
orangefs: skip leading spaces before parsing client debug masks
ocfs2: always run deallocs on copy-on-write completion
ocfs2: bound namelen in dlm_migrate_request_handler
ocfs2: validate lengths in dlm_mig_lockres_handler
ocfs2: validate rl_used against rl_count in refcount block validator
ocfs2: validate dx_root extent list fields during block read
ocfs2: validate directory-index entry counts when reading metadata
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
ocfs2: fix cached cluster count after suballocator reclaim
ocfs2: fix readdir position truncation on 32-bit kernels
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
openvswitch: Fix CT limit teardown use-after-free
openvswitch: only skb_tx_error() a packet we are about to drop
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
arm64: compat: Fix decrementing LDM/STM alignment emulation
arm64: proton-pack: Restore the nospectre_bhb command-line option
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
ASoC: codecs: aw88261: reduce log spam
ASoC: codecs: aw88261: only check PLL and clock state at power-up
hwmon: (max6621) fix negative temperature offset and crit readings
hwmon: (max6621) fix temperature clamp range
i2c: mxs: fix DMA channel leak on probe error
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
lockd: pin next file across nlm_inspect_file lock-drop
lockd: fix NULL dereference on lockowner allocation failure
lockd: fix swapped arguments in nlmsvc_match_ip()
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
nvme: zero the discard fallback page
nvme-pci: disable controller on admin queue IRQ setup failure
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
nvme-tcp: fix host memory disclosure on R2T for a read command
nvme-tcp: reject a read that transferred too few bytes
sctp: stop processing a packet once its association is deleted
sctp: drop a chunk if its transport was removed
sctp: fix NULL deref on untransmitted RECONF completion
sctp: distinguish sequence zero from wildcard in reconf lookup
sctp: fix stream->outcnt underflow on duplicate RECONF responses
power: supply: bq24257: fix use-after-free on remove
power: supply: bq256xx: drain usb_work before freeing the charger
power: supply: bq25890: Fix power_supply reference leak
power: supply: charger-manager: register regulators before exposing sysfs
power: supply: cros_usbpd-charger: bound the EC-reported port count
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
power: supply: lp8788-charger: fix use-after-free on remove
power: supply: pf1550: enable charging when battery profile exists
power: supply: qcom_battmgr: fix use-after-free
power: supply: qcom_battmgr: terminate the strings from firmware
power: supply: rt9455: quiesce delayed work before teardown
power: supply: twl4030_charger: cancel workers via devm
power: supply: ucs1002: fix use-after-free on remove
power: supply: max17040: propagate register read errors
power: supply: max17040: drop incorrect I2C functionality check
power: supply: max17040: synchronize work cancellation on suspend
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
s390/dasd: Do not complete a failed ESE read as successful
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
s390/dasd: Propagate partial completion length across ERP recovery
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
PCI: meson: Fix GPIO state while requesting PERST#
PCI: starfive: Fix resource leaks on error paths in host_init()
PCI: plda: Fix use-after-free of event IRQs during teardown
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
PCI/sysfs: Fix read byte order in pci_read_legacy_io()
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
PCI/AER: Emit TLP Log only for unmasked errors
PCI/AER: Fix mapping of errors to agent & layer
PCI/ASPM: Avoid L0s for Realtek RTS525A
PCI/MSI: Enable memory decoding before restoring MSI-X messages
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
PCI/proc: Use file_ns_capable() when checking config space read access
PCI/proc: Warn on writes to kernel-exclusive config space regions
iommu/amd: Put PCI device after handling PPR faults
iommu/msm: Unwind probe state on registration failure
iommu/sva: Set handle->dev before the SVA handle is visible
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
iommu/arm-smmu-v3: Add HAFT support for SVA
iommu/arm-smmu-v3: Manage teardown with devm
iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add
iommu/vt-d: Fix no_iommu to disable platform opt-in
iommu/vt-d: Force requesting ACS when tboot is enabled
iommupt: Return zero for invalid iova_to_phys() ranges
iommufd: Avoid locking internal accesses during unmap
iommufd: Release current IOAS on xa_store() failure
iommufd: Fix UAF in selftest IOPF reporting
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
platform/x86: ISST: Validate level in perf mask ioctls
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
mmc: via-sdmmc: cancel card-detect work on remove
mmc: via-sdmmc: stop card-detect handling on probe failure
platform/x86: ISST: Add a NULL check for sst_inst[]
platform/x86: ISST: Just allow 2 bits for SST feature enable
platform/x86: ISST: Use PP level enable mask
platform/x86: ISST: Validate logical CPU id and clos id
platform/x86: ISST: Validate max level for set feature
platform/x86: ISST: Validate parameter for core power state
platform/x86: ISST: Validate parameter for frequency and priority
platform/x86: ISST: Return error during profile addition
platform/x86: int1092: Fix potential memory leak in sar_probe()
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response
platform/x86: think-lmi: Fix certificate thumbprint sysfs output
platform/x86: think-lmi: Free system certificate signatures
platform/x86: think-lmi: Fix current password length check
platform/chrome: sensorhub: Bound the EC-reported sensor number
platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
platform/x86: hp-bioscfg: advance elem past consumed array elements
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
platform/x86: hp-bioscfg: fix heap OOB read on empty password write
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
platform/x86: hp-bioscfg: pass validated element count to package parsers
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
io_uring/waitid: honor task_work cancellation
io_uring/waitid: avoid siginfo copy during ring teardown
io_uring/query: cap user size passed to copy_struct_to_user
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
ipmi: ipmb: validate write message length
ipmi: Remove all sysfs files on registration failure
ipmi: si: Fix NULL pointer dereference after failed registration
ipmi:msghandler: Cancel work cleanly on an error
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
xdp: fix zero-copy frame layout
slip: fix use-after-free in sl_sync()
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
net: tun: bound receive headroom
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
net: ibm: emac: mal: fix NAPI locking
net: ipa: fix stalled modem TX queue after runtime resume
net: l2tp: do not propagate multicast notification errors
net: openvswitch: fix flow mask use-after-free on flow deletion
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
net: phylink: correctly validate returned PCS in phylink_inband_caps
net: ravb: avoid dereferencing an invalid PTP clock
net: ravb: serialize PTP clock teardown
net: thunderbolt: Release the Rx HopID that was handed out on mismatch
net: thunderbolt: Mark the connection down when bringing it up fails
NTB: ntb_transport: Recycle TX entries before client callbacks
NTB: ntb_transport: Fail TX enqueue when the QP link is down
NTB: ntb_transport: Reject oversized TX buffers
net: ntb_netdev: Fix TX busy and drop handling
net: ntb_netdev: Avoid double-accounting netif_rx() drops
net: ntb_netdev: Count packets dropped on RX refill failure
net/mlx5e: SHAMPO, Always calculate page size
net/mlx5e: do not HW-GRO coalesce small frames
net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
net/smc: do not dereference an unset send buffer on the SMC-D teardown path
net/smc: fix socket refcount leak in smc_switch_conns()
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
net/smc: stop killed, freed and out_of_sync sharing a byte
net/smc: unregister the connection before draining the rx tasklet
net: cap advertised IP tunnel headroom
net: fix spurious TX timeout after dev_activate()
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
seg6: reset IP6CB after IPv6 decapsulation
hwrng: stm32 - Fix runtime PM cleanup on registration failure
mfd: cgbc: Fix teardown ordering in cgbc_remove()
mfd: qnap-mcu: keep the reply buffer alive past a command timeout
mfd: sm501: Fix potential memory leaks during remove
ALSA: 6fire: bound the MIDI event length from the device
ALSA: aloop: Check card index validity at probe
ALSA: bcd2000: clear the URB pointers on disconnect
ALSA: FCP: do not copy out an uninitialised init response
ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
ALSA: mpu401: Check card index validity at probe
ALSA: mts64: Check card index validity at probe
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
ALSA: portman2x4: Check card index validity at probe
ALSA: serial-u16550: Check card index validity at probe
ALSA: virmidi: Check card index validity at probe
ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
dm-stats: fix a crash if allocation of per-cpu data fails
dm-switch: use WRITE_ONCE() in switch_region_table_write()
dm-pcache: validate geometry fields from on-disk cache_info
dm-pcache: validate kset key_num and intra-segment bounds
dm-pcache: validate on-media seg_num against the cache device size
dm-pcache: bound the persisted tail-position offset
dm-pcache: clamp the tail kset read to the segment data region
dm-pcache: detect a cycle in the last-kset chain during replay
dm-pcache: only hand out initialized cache segments
dm-pcache: fix implicit u8 truncation of gc_percent in message handler
dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
i3c: Fix unlocked dereference of dev->desc in 
i3c_device_get_supported_xfer_mode()
i3c: master: adi: initialize the lock before enabling interrupts
i3c: master: Fix info leak and UAF in device unregister path
i3c: master: svc: bound IBI payload to the requested max_payload_len
i3c: renesas: Check that the transfer is valid before accessing it
i3c: renesas: Clean DATBAS register on detach
i3c: renesas: Follow the reset deassert order used in probe
i3c: renesas: Reconfigure the DATBAS register on re-attach
i3c: renesas: Reset the controller on resume
i3c: renesas: Restore STDBR and EXTBR registers on resume
i3c: renesas: Perform Dynamic Address Assignment on resume
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
fuse-uring: refactor io-uring header copying to ring
fuse-uring: refactor io-uring header copying from ring
fuse-uring: use enum types for header copying
fuse-uring: refactor setting up copy state for payload copying
fuse-uring: use named constants for io-uring iovec indices
fuse: copy request headers via a stack buffer for io-uring
crypto: iaa - unmap dst before software fallback on decompress
crypto: atmel-ecc - clean up and improve ECDH comments
crypto: atmel-ecc - avoid stale fallback key after set_secret failure
mm/kmemleak: stop the task stack scan early when interrupted
mm/kmemleak: report RCU-tasks quiescent states during the scan
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
wifi: rtw88: pci: fix resource leak on failed NAPI setup
wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
wifi: mt76: mt7925: cancel mlo_pm_work on stop
wifi: mt76: add external EEPROM support for mt799x chipsets
wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
wifi: mt76: mt7996: validate default EEPROM firmware size
vsock/virtio: flush works in dependency order
w1: ds28e17: reject an oversize length on an I2C block read
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
zloop: truncate finished zones to zone capacity
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
sticon/parisc: Detect default STI graphics card for console output
signal: avoid shared siginfo namespace rewrites
smack: fix cred UAF in smack_file_send_sigiotask()
taskstats: fix cpumask parsing cutting off the last character
timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
timer: Keep debugobjects state consistent in migrate_timer_list()
udf: Fix i_lenExtents truncation on 32-bit kernels
selftests/mm: fix on-fault-limit false failure under sudo-rs
resource: Add __resource_contains_unbound() for internal contains checks
ACPI: scan: Do not combine resources that overlap completely
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
UBUNTU: Upstream stable to v6.18.49, v6.18.50, v7.2.2, v7.2.3, v7.2.4

** Affects: linux (Ubuntu)
     Importance: Undecided
         Status: Invalid

** Affects: linux (Ubuntu Resolute)
     Importance: Medium
     Assignee: Alice C. Munduruca (cremfuelled)
         Status: In Progress


** Tags: kernel-stable-tracking-bug

** Changed in: linux (Ubuntu)
       Status: New => Confirmed

** Also affects: linux (Ubuntu Resolute)
   Importance: Undecided
       Status: New

** Changed in: linux (Ubuntu)
       Status: Confirmed => Invalid

** Changed in: linux (Ubuntu Resolute)
   Importance: Undecided => Medium

** Changed in: linux (Ubuntu Resolute)
       Status: New => In Progress

** Changed in: linux (Ubuntu Resolute)
     Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)

** Description changed:

  
      SRU Justification
  
      Impact:
         The upstream process for stable tree updates is quite similar
         in scope to the Ubuntu SRU process, e.g., each patch has to
         demonstrably fix a bug, and each patch is vetted by upstream
         by originating either directly from a mainline/stable Linux tree or
         a minimally backported form of that patch. The following upstream
         stable patches should be included in the Ubuntu kernel:
  
         upstream stable patchset 2026-09-17
+ 
+                 Ported from the following upstream stable releases:
+                         v6.18.49, v6.18.50, v7.2.2, v7.2.3, v7.2.4
+ 
         from git://git.kernel.org/
+ 
+ fuse: fix race between interrupt and resend
+ fuse: fix missing barrier when checking io-uring readiness
+ fuse: publish io-uring queues with release semantics
+ fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
+ vlan: fix skb_under_panic and races when toggling HW VLAN offload
+ crypto: sun8i-ce - Remove crypto_rng interface
+ UBUNTU: [Config] Remove CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG
+ crypto: sun8i-ss - Remove crypto_rng interface
+ UBUNTU: [Config] Remove CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG
+ ASoC: tegra210_i2s: sort the register default table
+ ASoC: tegra210_i2s: sort the Tegra264 register default table
+ ASoC: tegra210_mixer: sort the register default table
+ ASoC: tegra: Fix the I2S enable default value
+ ASoC: tegra: Fix the MIXER enable default value
+ ASoC: tegra: Sort ADMAIF register defaults
+ ASoC: tegra: Sort MBDRC register defaults
+ ring-buffer: Fix subbuf resize race with ring buffer readers
+ drm/amd/display: hide Apple Studio Display secondary tile
+ drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile
+ alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
+ rust: time: fix as_micros_ceil() rounding near i64::MAX
+ alpha: don't leak hardware-fabricated FP exception bits to user space
+ clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
+ clocksource/drivers/timer-sun4i: Advertise a real minimum delta
+ fs: fix user path of nested backing files
+ ovl: fix double end_creating() on the casefold-mismatch path
+ pidfd: hold exec_update_lock around namespace ioctl
+ powerpc/pseries/iommu: switch to Default DMA window during kdump
+ rust: fmt: fix {:p} printing stack addresses
+ timers/itimer: Zero-init old itimerval before copy to userspace
+ objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
+ rust: bug: skip arch-specific asm in `testlib` builds
+ rust: bug: fix warn_on macro build error on UML
+ rust: bug: prevent dead_code warning from warn_on!'s flags constant
+ rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22
+ rust: kernel: list: fix incorrect pop_back example comment
+ objtool/rust: add one more `noreturn` Rust function
+ rust: num: restrict bool conversion to unsigned Bounded
+ rust: cfi: disable function merging if CFI is enabled
+ KEYS: trusted: Fix TPM teardown ordering
+ apparmor: fix cred UAF caused by begin_current_label_crit_section()
+ apparmor: fix out-of-bounds write when null terminating a label vec
+ include/linux/list.h: mark list_add and __list_add as __always_inline
+ mm, swap: ratelimit bad swap entry reports
+ mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios()
+ mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd
+ mm/huge_memory: use folio's memcg inside __folio_split()
+ mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
+ mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()
+ mm/kmemleak: avoid soft lockup when scanning task stacks
+ mm/madvise: skip device-private PMDs in cold and pageout walks
+ mm/mempolicy: skip non-present PMDs when queueing folios
+ mm/mglru: use the common routine for dirty/writeback reactivation
+ mm/mglru: fix and remove redundant unevictable folio handling
+ mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
+ mm/migrate: use huge_ptep_get() in remove_migration_pte()
+ mm/migrate_device: clear stale mapping after freeing swapcache
+ mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
+ mm/page_owner: use memcg_data snapshot to avoid TOCTOU in 
print_page_owner_memcg()
+ mm/page_vma_mapped: use huge_ptep_get() for hugetlb
+ mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
+ mm/rmap: use huge_ptep_get() in try_to_unmap_one()
+ mm/rmap: use huge_ptep_get() in try_to_migrate_one()
+ mm/slub: fix missing debugfs entries for caches created before sysfs init
+ mm/slub: prevent pfmemalloc objects from entering the barn
+ mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
+ mm/zswap: fix global shrinker when memory cgroup is disabled
+ mm: compaction: support non-movable compaction for pageblock requests
+ mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings
+ mm: memcg-v1: fix memsw and TCP failcnt accounting
+ mm: memcg: stop reclaim when a limit update is superseded
+ mm: memcontrol: update state_local when flushing NMI stats
+ mm: mempolicy: fix automatic numa balancing for shmem
+ mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
+ mm: page_alloc: move capture_control to the page allocator
+ mm: page_alloc: fix non-movable reclaim storm in defrag_mode
+ mm: vmscan: fix node reclaim ignoring swappiness parameter
+ tools/compiler: match glibc 2.42 definition of __attribute_const__
+ x86/locking: Use sfence for wmb() if SSE is available
+ x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
+ x86/tdx: Fix off-by-one in port I/O handling
+ x86/tdx: Fix zero-extension for 32-bit port I/O
+ x86/xen: fix init of balloon stats again
+ hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
+ tracing/user_events: Clear copied tracing state before fork duplication
+ tracing: Fix crash passing ERR_PTR to kthread_stop()
+ tracing: Fix logged instance name on creation failure
+ tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
+ tracing: Fix use-after-free with same-name named triggers
+ cdx: Fix double free when sysfs file creation fails
+ debugfs: Fix lockdown check for mmap_prepare
+ device property: fix infinite loop in fwnode_for_each_child_node()
+ misc: nsm: bound the device-reported response length
+ powerpc/powermac: fix OF node refcount
+ rapidio: mport_cdev: fix use-after-free in dma_req_free()
+ Revert "media: v4l2-dev: fix error handling in __video_register_device()"
+ serial: imx: serialize imx_uart_ports[] lifetime
+ staging: greybus: hid: fix SET_REPORT return value
+ usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
+ usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to 
race condition
+ usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
+ USB: phy: fsl-usb: fix missing static keywords
+ usb: typec: hd3ss3220: fix VBUS regulator error message
+ usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
+ usb: typec: thunderbolt: Disable work before freeing tbt on remove
+ usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
+ usb: gadget: u_audio: Fix use-after-free on sound card disconnect
+ usb: gadget: snps_udc_plat: clean up PHY on probe deferral
+ usb: gadget: midi2: remove default configfs groups on teardown
+ usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
+ usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
+ usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and 
uvc_function_unbind()
+ usb: gadget: f_fs: Prevent deadlock during ep0 read loop
+ cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read
+ fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
+ HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
+ i3c: renesas: Fix out-of-bounds access for newdevs mask
+ KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
+ lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
+ media: cec: stm32: prevent out-of-bounds write on RX overflow
+ media: vicodec: fix out-of-bounds write in FWHT encoder
+ nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
+ of: fix out-of-bounds read in of_alias_scan() stem parser
+ PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
+ phy: rockchip-samsung-dcphy: fix out-of-range max_register
+ ubifs: fix out-of-bounds read in signature length check
+ zram: fix out-of-bounds access in read_block_state()
+ zram: fix out-of-bounds access in writeback_store()
+ zram: set default primary compressor in zram_destroy_comps()
+ zram: validate deflate params
+ zsmalloc: account for handle size in class lookup
+ NFS/localio: fix ref leak on nfs_uuid_add_file failure
+ NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails
+ NFSD: check truncate permission under inode lock
+ NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
+ NFSD: Fix off-by-one in DRC bucket pruning limit
+ NFSD: fix up error returned by write_threads()
+ NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
+ NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
+ nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
+ NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
+ pNFS: Fix EBUSY check in pnfs_layout_need_return
+ lockd, nfsd: RCU-protect nlmsvc_ops dispatch
+ nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
+ nfsd: release path refs on follow_down() error
+ nfsd: Reset write verifier when async COPY writeback fails
+ nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
+ nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
+ nfsd: sample writeback error cursor before async COPY loop
+ nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
+ nfsd: size fh_verify server sockaddr slot by xpt_locallen
+ nfsd: validate nseconds in TIME_DELEG decode paths
+ nfsd: validate sockaddr length per family in listener_set
+ nfsd: validate symlink target length in NFSv4 CREATE
+ nfsd: move struct nfsd_genl_rqstp to nfsctl.c
+ nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
+ nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
+ nfsd: add filehandle match check to nfsd4_delegreturn()
+ nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
+ nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
+ nfsd: cap decoded POSIX ACL count to bound sort cost
+ nfsd: check client ownership when cancelling a copy-notify stateid
+ nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
+ nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
+ nfsd: clear opcnt on compound arg release to prevent OOB read
+ nfsd: convert nfsd_net boolean flags to unsigned long flags word
+ nfsd: dedup nfs4_client_to_reclaim inserts
+ nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper
+ nfsd: defer vfree of compound ops to fix rpc_status UAF
+ nfsd: don't free session slots that are still in use
+ nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
+ nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file
+ nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
+ nfsd: fix clock domain mismatch in clients_still_reclaiming()
+ nfsd: fix cpntf publish race in nfs4_init_cp_state
+ nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
+ nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
+ nfsd: fix FL_SLEEP being set unconditionally for all LOCK types
+ nfsd: fix netlink dumpit error handling for rpc_status_get
+ nfsd: fix nfsd_file leak on inter-server COPY setup failure
+ nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
+ nfsd: fix partial-write detection in nfsd_direct_write
+ nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
+ nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure
+ nfsd: fix reply size estimate for GET_DIR_DELEGATION
+ nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
+ nfsd: fix UAF in async copy cancel and shutdown
+ nfsd: fix version mismatch loops in nfsd_acl_init_request()
+ nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
+ nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
+ nfsd: gate nfs2 setacl by argp->mask
+ nfsd: gate nfs3 setacl by argp->mask
+ nfsd: hold rcu across localio cmpxchg retry
+ nfsd: initialize copy-notify stateid before publishing it
+ nfsd: initialize DRC hash table before registering shrinker
+ nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
+ nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
+ nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
+ nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
+ nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
+ nfsd: release OPEN-decoded posix ACLs via op_release
+ nfsd: revoke copy-notify stateids before dropping their reference
+ NFSD: Prevent lock owner use-after-free during client teardown
+ NFSD: Prevent post-shutdown use-after-free in unlock_filesystem
+ NFSD: Prevent client use-after-free during admin state revocation
+ nfsd: convert global state_lock to per-net deleg_lock
+ NFSD: Prevent client use-after-free during delegation revoke
+ NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
+ nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update
+ libceph: validate OSD extent maps before cursor advance
+ libceph: reject buckets with mismatched CRUSH ids
+ ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
+ ceph: fix UAF in check_new_map() on session freed during unlock
+ ceph: force a cap message when a deferred revoke can't be acked immediately
+ ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
+ ceph: bound copied dentry name length in NFS export get_name
+ ceph: bound MDSCapAuth path and fs_name decode in handle_session()
+ ceph: bound num_export_targets array for mds info v2/v3
+ ceph: bound xattr value length in __build_xattrs()
+ ceph: cap delegated inode count in ceph_parse_deleg_inos()
+ ceph: do not repeat ceph_trim_dentries() if no progress possible
+ ceph: fix leaked inode reference on writeback abort at umount
+ btrfs: drop recovered reloc root refs on recovery failure
+ btrfs: fix extent map leak in NOCOW direct I/O write
+ btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag
+ audit: avoid dropping live tree ref on fsnotify rule autoremove
+ smb: move some definitions from common/smb2pdu.h into common/fscc.h
+ smb/client: reduce fallocate zero buffer allocation
+ smb/client: emulate small EOF-extending mode 0 fallocate ranges
+ cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under 
i_rwsem
+ smb/client: do not account EOF extension as allocation
+ cifs: call pagecache_isize_extended() in cifs_setsize() when extending
+ cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
+ cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
+ cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
+ smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix 
extensions
+ smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed 
secondary T2
+ smb: client: clear ce->tgthint in free_tgts()
+ smb: client: fix ALIGN() overflow in symlink_data() error context loop
+ smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
+ smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
+ smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
+ smb: client: harden DFS cache against invalid target hints
+ smb: client: reject a tree connect response whose byte count is too small
+ smb: client: restore the data_offset bound in is_valid_oplock_break()
+ HID: apple: preserve keyboard backlight across T2 resume
+ HID: corsair-void: Check size of status and firmware events before reading 
them
+ HID: picolcd: clamp eeprom debugfs read to bytes actually received
+ HID: roccat: free buffered reports when destroying device
+ HID: sensor: custom: Fix field sysfs group cleanup on failure
+ HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
+ HID: universal-pidff: stop the device when force-feedback init fails
+ HID: mcp2221: stop device IO before hid_hw_stop
+ HID: mcp2221: fix OOB write in mcp2221_raw_event()
+ HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
+ HID: mcp2221: validate report size in mcp2221_raw_event()
+ HID: intel-thc-hid: intel-quickspi: validate report size before copy
+ HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller 
buffer
+ HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown
+ HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown
+ eventfs: Initialize ei->children and ei->list in init_ei()
+ fs/ntfs3: validate dirty page table on log replay
+ fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
+ fs/ntfs3: bound page_lcns[] index by the log record
+ eCryptfs: bound the packet-length peek to the user buffer
+ ecryptfs: fix tag 11 packet exact-fit size check
+ ecryptfs: hold msg ctx list lock when cleaning daemon queue
+ ecryptfs: pass packet set buffer size to parser
+ ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
+ ecryptfs: reject too-small tag 70 packets
+ ecryptfs: release message context on send failure
+ ecryptfs: show filename encryption options
+ efivarfs: Rate limit statfs() handler
+ entry: Fix seccomp bypass after ptrace with TSYNC
+ erofs: skip sufficiently large global buffers when resizing
+ ext2: Fix lost inode updates for IS_SYNC inodes
+ fanotify: fix use-after-free of file range info
+ fat: restore original value when fat_ent_write failed
+ fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
+ fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
+ fbdev: ssd1307fb: defer I2C transfers from damage callbacks
+ fbdev: uvesafb: unregister connector callback on init failure
+ forcedeth: fix off-by-one when saving/restoring non-PCI config space
+ fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
+ fsnotify: Fix stale object mask after concurrent mark updates
+ hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
+ hugetlb: only adjust reservation during unmapping if mapcount is 0
+ accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
+ accel/rocket: initialize job domain before cleanup paths
+ accel/rocket: Fix error path handling in rocket_job_run()
+ acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
+ ACPI: APEI: Fix ERST timeout unit conversion
+ ACPI: APEI: GHES: fix ARM section length accounting after header
+ ACPI: pfr_update: fix stack buffer overflow in query_capability()
+ ACPI: scan: Avoid registering platform devices with resource overlaps
+ alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
+ alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
+ alpha: marvel: Fix lock ordering in init_io7_irqs()
+ ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
+ ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
+ auxdisplay: charlcd: cancel backlight work on registration failure
+ backlight: aw99706: Fix DT property names to match binding
+ backlight: aw99706: Honor the core blank state in update_status()
+ block: validate user space vectors during extraction
+ block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
+ Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
+ Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
+ Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
+ Bluetooth: eir: Fix OOB read in eir_get_service_data()
+ bnx2x: fix double free in bnx2x_init_firmware() error path
+ bnxt_en: Write doorbell when linearizing skb fails
+ bpf, x86: Fix per-CPU address resolution into an extended register
+ bpf: Disable preemption in __bpf_get_stack
+ buffer: avoid tail commit walk for uptodate folios
+ bpf: Harden bloom filter sizing and indexing on 32-bit kernels
+ dm-io: clone the source bio instead of copying its biovec
+ dm-io: report non-retryable errors separatedly
+ dm-era: fix shadowed superblock leak on take-snap failure
+ dm raid1: reserve space for NUL-terminator in build_constructor_string()
+ dm array: validate array block headers on read
+ dm array: reject an array block whose value size is not the caller's
+ coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
+ cpufreq: apple-soc: Fix OPP table cleanup
+ cpufreq: schedutil: Fix rate limit overflow
+ cxl/features: bound fwctl command payload to the input buffer
+ dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding
+ cxl/region: Add helper to check Soft Reserved containment by CXL regions
+ cxl/mce: Make the MCE notifier per-region
+ cxl/pmem: Format the nvdimm serial number as unsigned decimal
+ cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register
+ Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
+ Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
+ Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
+ Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
+ Bluetooth: RFCOMM: serialize security confirmation handling
+ Bluetooth: hci_conn: re-enable advertising only for peripheral role
+ Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
+ Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
+ Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
+ Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
+ Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
+ kasan: fix cache shrink race with CPU hotplug
+ jbd2: bound shrinker scans by examined checkpoint buffers
+ jbd2: check need_resched() when skipping busy checkpoint buffers
+ ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
+ ip: orphan prefetched skbs before multicast forwarding
+ ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
+ ip6_gre: fix hardware header length for NBMA tunnels
+ ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
+ ipv6: use RCU iterator to dump route exceptions
+ landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
+ libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
+ mailbox: qcom-ipcc: fix duplicate channel allocation across holes
+ md/raid10: fix still_degraded being inverted in raid10_sync_request()
+ md: do overflow check for sb->bblog_shift in super_1_load()
+ module: validate string table section types
+ mpls: reload header after pskb_may_pull()
+ mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
+ module/kallsyms: fix nextval for data symbol lookup
+ nouveau/gem: reserve the bo in the info ioctl around the vma lookup
+ params: fix charp corruption on allocation failure
+ phy: fsl-imx8mq-usb: fix typec switch leak on probe error path
+ SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
+ SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
+ SUNRPC: svcauth_gss: enforce krb5 token minimum length
+ sunrpc: route to a populated pool in svc_pool_for_cpu()
+ SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode
+ SUNRPC: always drain cache_cleaner before destroying a cache_detail
+ SUNRPC: Check svc pool percpu counter allocation
+ SUNRPC: close backchannel before destroying callback service
+ sunrpc: defer rq_argp and rq_resp free until after RCU grace period
+ SUNRPC: fix gssx_dec_option_array error path bugs
+ sunrpc: fix use-after-free in __rpc_clnt_handle_event and 
__rpc_clnt_remove_pipedir
+ SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
+ SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
+ SUNRPC: harden gss_unwrap_resp_priv length checks
+ sunrpc: init gssp_lock before publishing proc entry
+ SUNRPC: reject duplicate CREDS_VALUE options
+ SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
+ SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
+ SUNRPC: wait for in-flight client TLS handshake callback
+ svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
+ svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
+ svcrdma: Fix offset arithmetic in read_chunk_range
+ svcrdma: Fix pcl_for_each_segment for empty chunks
+ svcrdma: Fix unmatched rn_unregister on failed accept
+ svcrdma: Reject connection when transport allocation fails
+ svcrdma: Reject inline replies that overflow the pull-up buffer
+ svcrdma: Reject oversized Read segments at decode time
+ svcrdma: Reject Read lists that exceed the page budget
+ svcrdma: Reject Write/Reply chunks with segcount 0
+ svcrdma: Use svc_xprt_put to free listener on create failure
+ svcrdma: Validate Read chunk positions before reconstruction
+ udf: reject VAT indexes equal to the entry count
+ wifi: ath6kl: clamp assoc request/response lengths before subtracting IE 
offsets
+ wifi: mt76: mt7925: cancel pending mlo_pm_work
+ staging: media: tegra-video: fix of_node_put() on VIP parse errors
+ staging: media: tegra-video: vi: fix probe failure on skipped last port
+ media: staging/ipu7: fix async notifier UAF on probe error path
+ sched/core: Handle pick_task() releasing the rq lock
+ sched_ext: Fix exit_task leak on fork failure during enable
+ sched_ext: Fix inverted ops.core_sched_before() invocation
+ sched_ext: Keep kick_sync waiting on the rq's own CPU
+ scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
+ scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
+ rpmsg: glink: smem: order FIFO read after availability check
+ Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro"
+ arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap
+ arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags
+ arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on
+ arm64: dts: rockchip: fix eMMC reset polarity on PP-1516
+ arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
+ arm64: dts: rockchip: fix emmc reset polarity on px30-cobra
+ arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
+ arm64: dts: rockchip: Fix rk3588s-roc-pc audio description
+ riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage
+ riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage
+ RISC-V: KVM: Fix PMU event info array size overflow
+ riscv: acpi: Handle LPI architectural context loss flags
+ riscv: unaligned: stop using kthread for check_vector_unaligned_access()
+ remoteproc: scp: Fix device reference leak on failed lookup
+ ptp: vmclock: prevent read-only mappings from becoming writable
+ qede: Fix NULL pointer dereference in TPA fragment processing
+ RDMA/cxgb4: Cancel reg_work before freeing device on remove
+ RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
+ RDMA/ionic: Embed counter driver data in rdma_counter allocation
+ RDMA/ucma: Lock the handler in ucma_set_ib_path()
+ RDMA/ucma: Lock the handler in ucma_write_cm_event()
+ RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR
+ regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving 
dangling of_node pointer
+ regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership 
transferred to rdata
+ regulator: qcom-refgen: correct the regulator type to CURRENT
+ ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
+ ring-buffer: Free cpu_buffer::free_page with subbuf_order
+ ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
+ ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
+ PM: sleep: Unblock runtime PM when device prepare fails
+ orangefs: fix double-free of trailer_buf on readdir copy failure
+ orangefs: skip leading spaces before parsing client debug masks
+ ocfs2: always run deallocs on copy-on-write completion
+ ocfs2: bound namelen in dlm_migrate_request_handler
+ ocfs2: validate lengths in dlm_mig_lockres_handler
+ ocfs2: validate rl_used against rl_count in refcount block validator
+ ocfs2: validate dx_root extent list fields during block read
+ ocfs2: validate directory-index entry counts when reading metadata
+ ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
+ ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
+ ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
+ ocfs2: fix cached cluster count after suballocator reclaim
+ ocfs2: fix readdir position truncation on 32-bit kernels
+ openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
+ openvswitch: Fix CT limit teardown use-after-free
+ openvswitch: only skb_tx_error() a packet we are about to drop
+ ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
+ arm64: compat: Fix decrementing LDM/STM alignment emulation
+ arm64: proton-pack: Restore the nospectre_bhb command-line option
+ ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
+ ASoC: codecs: aw88261: reduce log spam
+ ASoC: codecs: aw88261: only check PLL and clock state at power-up
+ hwmon: (max6621) fix negative temperature offset and crit readings
+ hwmon: (max6621) fix temperature clamp range
+ i2c: mxs: fix DMA channel leak on probe error
+ ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
+ lockd: pin next file across nlm_inspect_file lock-drop
+ lockd: fix NULL dereference on lockowner allocation failure
+ lockd: fix swapped arguments in nlmsvc_match_ip()
+ nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
+ nvme: zero the discard fallback page
+ nvme-pci: disable controller on admin queue IRQ setup failure
+ nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
+ nvme-tcp: fix host memory disclosure on R2T for a read command
+ nvme-tcp: reject a read that transferred too few bytes
+ sctp: stop processing a packet once its association is deleted
+ sctp: drop a chunk if its transport was removed
+ sctp: fix NULL deref on untransmitted RECONF completion
+ sctp: distinguish sequence zero from wildcard in reconf lookup
+ sctp: fix stream->outcnt underflow on duplicate RECONF responses
+ power: supply: bq24257: fix use-after-free on remove
+ power: supply: bq256xx: drain usb_work before freeing the charger
+ power: supply: bq25890: Fix power_supply reference leak
+ power: supply: charger-manager: register regulators before exposing sysfs
+ power: supply: cros_usbpd-charger: bound the EC-reported port count
+ power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
+ power: supply: lp8727: fix use-after-free in lp8727_release_irq()
+ power: supply: lp8788-charger: fix use-after-free on remove
+ power: supply: pf1550: enable charging when battery profile exists
+ power: supply: qcom_battmgr: fix use-after-free
+ power: supply: qcom_battmgr: terminate the strings from firmware
+ power: supply: rt9455: quiesce delayed work before teardown
+ power: supply: twl4030_charger: cancel workers via devm
+ power: supply: ucs1002: fix use-after-free on remove
+ power: supply: max17040: propagate register read errors
+ power: supply: max17040: drop incorrect I2C functionality check
+ power: supply: max17040: synchronize work cancellation on suspend
+ s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
+ s390/dasd: Do not complete a failed ESE read as successful
+ s390/dasd: Guard sysfs discipline callbacks against unallocated private data
+ s390/dasd: Propagate partial completion length across ERP recovery
+ PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
+ PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
+ PCI: meson: Fix GPIO state while requesting PERST#
+ PCI: starfive: Fix resource leaks on error paths in host_init()
+ PCI: plda: Fix use-after-free of event IRQs during teardown
+ PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
+ PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
+ PCI/sysfs: Fix read byte order in pci_read_legacy_io()
+ PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
+ PCI/AER: Emit TLP Log only for unmasked errors
+ PCI/AER: Fix mapping of errors to agent & layer
+ PCI/ASPM: Avoid L0s for Realtek RTS525A
+ PCI/MSI: Enable memory decoding before restoring MSI-X messages
+ PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
+ PCI/proc: Use file_ns_capable() when checking config space read access
+ PCI/proc: Warn on writes to kernel-exclusive config space regions
+ iommu/amd: Put PCI device after handling PPR faults
+ iommu/msm: Unwind probe state on registration failure
+ iommu/sva: Set handle->dev before the SVA handle is visible
+ iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
+ iommu/arm-smmu-v3: Add HAFT support for SVA
+ iommu/arm-smmu-v3: Manage teardown with devm
+ iommu: Fix dev_iommu memory leak when device_add fails in 
iommu_mock_device_add
+ iommu/vt-d: Fix no_iommu to disable platform opt-in
+ iommu/vt-d: Force requesting ACS when tboot is enabled
+ iommupt: Return zero for invalid iova_to_phys() ranges
+ iommufd: Avoid locking internal accesses during unmap
+ iommufd: Release current IOAS on xa_store() failure
+ iommufd: Fix UAF in selftest IOPF reporting
+ platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
+ platform/x86: ISST: Validate level in perf mask ioctls
+ platform/x86: ISST: Validate socket ID in clos_assoc ioctl
+ mmc: via-sdmmc: cancel card-detect work on remove
+ mmc: via-sdmmc: stop card-detect handling on probe failure
+ platform/x86: ISST: Add a NULL check for sst_inst[]
+ platform/x86: ISST: Just allow 2 bits for SST feature enable
+ platform/x86: ISST: Use PP level enable mask
+ platform/x86: ISST: Validate logical CPU id and clos id
+ platform/x86: ISST: Validate max level for set feature
+ platform/x86: ISST: Validate parameter for core power state
+ platform/x86: ISST: Validate parameter for frequency and priority
+ platform/x86: ISST: Return error during profile addition
+ platform/x86: int1092: Fix potential memory leak in sar_probe()
+ platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
+ platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query 
response
+ platform/x86: think-lmi: Fix certificate thumbprint sysfs output
+ platform/x86: think-lmi: Free system certificate signatures
+ platform/x86: think-lmi: Fix current password length check
+ platform/chrome: sensorhub: Bound the EC-reported sensor number
+ platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
+ platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
+ platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
+ platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2()
+ platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
+ platform/x86: hp-bioscfg: advance elem past consumed array elements
+ platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
+ platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
+ platform/x86: hp-bioscfg: fix heap OOB read on empty password write
+ platform/x86: hp-bioscfg: fix new_password_store() overwriting 
current_password
+ platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
+ platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
+ platform/x86: hp-bioscfg: pass validated element count to package parsers
+ platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
+ io_uring/waitid: honor task_work cancellation
+ io_uring/waitid: avoid siginfo copy during ring teardown
+ io_uring/query: cap user size passed to copy_struct_to_user
+ interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
+ ipmi: ipmb: validate write message length
+ ipmi: Remove all sysfs files on registration failure
+ ipmi: si: Fix NULL pointer dereference after failed registration
+ ipmi:msghandler: Cancel work cleanly on an error
+ net/iucv: filter frames in afiucv_hs_rcv() by ingress device
+ xdp: fix zero-copy frame layout
+ slip: fix use-after-free in sl_sync()
+ net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
+ net: tun: bound receive headroom
+ net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
+ net: ibm: emac: mal: fix NAPI locking
+ net: ipa: fix stalled modem TX queue after runtime resume
+ net: l2tp: do not propagate multicast notification errors
+ net: openvswitch: fix flow mask use-after-free on flow deletion
+ net: openvswitch: fix nf_connlabels leak in ovs_ct_init
+ net: phylink: correctly validate returned PCS in phylink_inband_caps
+ net: ravb: avoid dereferencing an invalid PTP clock
+ net: ravb: serialize PTP clock teardown
+ net: thunderbolt: Release the Rx HopID that was handed out on mismatch
+ net: thunderbolt: Mark the connection down when bringing it up fails
+ NTB: ntb_transport: Recycle TX entries before client callbacks
+ NTB: ntb_transport: Fail TX enqueue when the QP link is down
+ NTB: ntb_transport: Reject oversized TX buffers
+ net: ntb_netdev: Fix TX busy and drop handling
+ net: ntb_netdev: Avoid double-accounting netif_rx() drops
+ net: ntb_netdev: Count packets dropped on RX refill failure
+ net/mlx5e: SHAMPO, Always calculate page size
+ net/mlx5e: do not HW-GRO coalesce small frames
+ net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
+ net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
+ net/smc: do not dereference an unset send buffer on the SMC-D teardown path
+ net/smc: fix socket refcount leak in smc_switch_conns()
+ net/smc: fix use-after-free in smc_rx_pipe_buf_release()
+ net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
+ net/smc: stop killed, freed and out_of_sync sharing a byte
+ net/smc: unregister the connection before draining the rx tasklet
+ net: cap advertised IP tunnel headroom
+ net: fix spurious TX timeout after dev_activate()
+ net: skbuff: don't touch shared zerocopy state in skb_tx_error()
+ seg6: reset IP6CB after IPv6 decapsulation
+ hwrng: stm32 - Fix runtime PM cleanup on registration failure
+ mfd: cgbc: Fix teardown ordering in cgbc_remove()
+ mfd: qnap-mcu: keep the reply buffer alive past a command timeout
+ mfd: sm501: Fix potential memory leaks during remove
+ ALSA: 6fire: bound the MIDI event length from the device
+ ALSA: aloop: Check card index validity at probe
+ ALSA: bcd2000: clear the URB pointers on disconnect
+ ALSA: FCP: do not copy out an uninitialised init response
+ ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
+ ALSA: mpu401: Check card index validity at probe
+ ALSA: mts64: Check card index validity at probe
+ ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
+ ALSA: portman2x4: Check card index validity at probe
+ ALSA: serial-u16550: Check card index validity at probe
+ ALSA: virmidi: Check card index validity at probe
+ ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
+ ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG
+ ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering
+ arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
+ dm-stats: fix a crash if allocation of per-cpu data fails
+ dm-switch: use WRITE_ONCE() in switch_region_table_write()
+ dm-pcache: validate geometry fields from on-disk cache_info
+ dm-pcache: validate kset key_num and intra-segment bounds
+ dm-pcache: validate on-media seg_num against the cache device size
+ dm-pcache: bound the persisted tail-position offset
+ dm-pcache: clamp the tail kset read to the segment data region
+ dm-pcache: detect a cycle in the last-kset chain during replay
+ dm-pcache: only hand out initialized cache segments
+ dm-pcache: fix implicit u8 truncation of gc_percent in message handler
+ dm-pcache: fix use-after-free and invalid seg operations in kset_replay()
+ i3c: Fix unlocked dereference of dev->desc in 
i3c_device_get_supported_xfer_mode()
+ i3c: master: adi: initialize the lock before enabling interrupts
+ i3c: master: Fix info leak and UAF in device unregister path
+ i3c: master: svc: bound IBI payload to the requested max_payload_len
+ i3c: renesas: Check that the transfer is valid before accessing it
+ i3c: renesas: Clean DATBAS register on detach
+ i3c: renesas: Follow the reset deassert order used in probe
+ i3c: renesas: Reconfigure the DATBAS register on re-attach
+ i3c: renesas: Reset the controller on resume
+ i3c: renesas: Restore STDBR and EXTBR registers on resume
+ i3c: renesas: Perform Dynamic Address Assignment on resume
+ wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
+ wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
+ wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
+ fuse-uring: refactor io-uring header copying to ring
+ fuse-uring: refactor io-uring header copying from ring
+ fuse-uring: use enum types for header copying
+ fuse-uring: refactor setting up copy state for payload copying
+ fuse-uring: use named constants for io-uring iovec indices
+ fuse: copy request headers via a stack buffer for io-uring
+ crypto: iaa - unmap dst before software fallback on decompress
+ crypto: atmel-ecc - clean up and improve ECDH comments
+ crypto: atmel-ecc - avoid stale fallback key after set_secret failure
+ mm/kmemleak: stop the task stack scan early when interrupted
+ mm/kmemleak: report RCU-tasks quiescent states during the scan
+ wifi: mwifiex: Detach sync cmd buffer on interrupted wait
+ wifi: rtl818x: initialize eeprom_93cx6 struct to zero
+ wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
+ wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()
+ wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
+ wifi: rtw88: pci: fix resource leak on failed NAPI setup
+ wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
+ wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
+ wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
+ wifi: mt76: mt7925: cancel mlo_pm_work on stop
+ wifi: mt76: add external EEPROM support for mt799x chipsets
+ wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
+ wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
+ wifi: mt76: mt7996: validate default EEPROM firmware size
+ vsock/virtio: flush works in dependency order
+ w1: ds28e17: reject an oversize length on an I2C block read
+ xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
+ zloop: truncate finished zones to zone capacity
+ tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
+ sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
+ sticon/parisc: Detect default STI graphics card for console output
+ signal: avoid shared siginfo namespace rewrites
+ smack: fix cred UAF in smack_file_send_sigiotask()
+ taskstats: fix cpumask parsing cutting off the last character
+ timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
+ timer: Keep debugobjects state consistent in migrate_timer_list()
+ udf: Fix i_lenExtents truncation on 32-bit kernels
+ selftests/mm: fix on-fault-limit false failure under sudo-rs
+ resource: Add __resource_contains_unbound() for internal contains checks
+ ACPI: scan: Do not combine resources that overlap completely
+ platform/chrome: sensorhub: Fix dropped timestamp events and log spam
+ UBUNTU: Upstream stable to v6.18.49, v6.18.50, v7.2.2, v7.2.3, v7.2.4

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167609

Title:
  Resolute update: upstream stable patchset 2026-09-17

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167609/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs