** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-11-04
+
+ Ported from the following upstream stable releases:
+ v6.6.161, v6.12.115
+
from git://git.kernel.org/
+
+ mptcp: move the OoO check back into __mptcp_try_fallback()
+ power: supply: Fix maintenance charge table kernel-doc
+ power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
+ Drivers: hv: Avoid infinite retry loop in init_vp_index()
+ Drivers: hv: Don't reset VMBus connection state on error/exit paths
+ pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13
+ power: supply: generic-adc-battery: Fix temperature IIO channel conversion
+ pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12
+ vsock: treat TCP_CLOSING as once-established
+ net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
+ ASoC: Intel: avs: Reset the stream unless it is already prepared
+ ASoC: stm32: spdifrx: fix synchronization state check
+ ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
+ ASoC: cs42l52: Fix the NG Type Switch bit
+ ASoC: pcm3168a: Fix the DAC zero flag polarity bit
+ ASoC: max98371: Fix the Speaker DHT Min Volume bits
+ ASoC: wm8978: Fix the 128x oversampling switch bits
+ ASoC: nau8822: Fix the 128x oversampling switch bits
+ netlink: reset skb headers before unicast and multicast filtering
+ spi: tegra114: assert CS GPIO for every transfer in a message
+ nios2: fix __wsum type degradation in csum_fold()
+ scsi: st: Save the visited block for the partition the drive is in
+ scsi: target: iscsi: Fix race in discovery auth updates
+ ocfs2/dlm: Protect the recovery list during debugfs reads
+ samples: pidfd: fix userprogs typo
+ pipe: preserve existing fasync readers on writer setup failure
+ tracing: probes: error if BTF is required but unavailable
+ scsi: libsas: Fix SMP IO deadlock during HA resume
+ netlink: avoid hashing the network namespace pointer
+ net: bcmgenet: unshare the skb before writing the control block
+ net/ipv6: Introduce payload_len helpers
+ calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
+ gpio: mxc: use lock guards for the generic GPIO chip lock
+ gpio: mxc: fix both_edges bit operations
+ gpio: mxc: use BIT() macro
+ gpio: mxc: fix wakeup_pads bit operations
+ perf: Fix perf_pmu_migrate_context() leaving events behind
+ autofs: ignore notification errors from a replaced pipe
+ unicode: free the map after a grace period
+ KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for
!VM-Entry
+ fsnotify: prevent mark additions during connector teardown
+ eventfs: Free the eventfs_inode after an rcu grace period too
+ net/sched: fix use-after-free in __tcf_action_put()
+ net: rds: fix uninitialized trans dereference in CM event handler
+ pinctrl: amd: Clear S4 wake bits when firmware has _AEI
+ sctp: revalidate output stream after association connect wait
+ tools: gpio: fix building from the top level with O=
+ tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace
fields
+ i2c: qcom-cci: Fix HALT_ACK reset request being dropped
+ perf: Update cgroup time when rotating multiplexed events
+ scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
+ scsi: libiscsi: Reject a negative task index from parse_pdu_itt
+ scsi: libiscsi: Validate the ITT reflected in a Reject PDU
+ scsi: libiscsi: Validate the task named by a management response
+ drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
+ drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
+ tracing: Fix the shift out of bounds in the log2 histogram modifier
+ tracing: Check operator stack capacity before pushing
+ tracing: Do not initialize tracefs work if tracing is disabled
+ tracing: Fix hist trigger timestamps for buffered events
+ wifi: p54: validate firmware record lengths
+ tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
+ tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
+ cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
+ dm cache: fix demotion stats in passthrough mode
+ dm cache: fix issue with background work locking
+ dm-crypt: fix a tiny race condition in crypt_dec_pending
+ dm-ebs: fix incorrect device offset check in ebs_ctr()
+ net/iucv: fix the recvmsg window update
+ xfs: fix capability check in xfs
+ tipc: protect node reset trace dump with node lock
+ sctp: validate chunk length in the inqueue parser
+ page_pool: keep frag_offset aligned for odd-sized requests
+ s390/ctcm: Prevent XID null dereference
+ s390/pci: Fix leak of uninitialized kernel data in SCLP report
+ ipv4: avoid divide by zero in fib_rebalance
+ drm/amdgpu: Fix VCE 3 ring align_mask
+ KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
+ mm, madvise: fix potential workingset node list_lru leaks
+ net: bridge: mcast: don't truncate the port group walk on teardown
+ ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
+ ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
+ ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
+ net/sched: cls_flower: validate mask pointer after nla_next()
+ smb: client: fix heap overflow in cifs_do_set_acl()
+ smb: client: fix multiuser mount with krb5
+ scsi: st: Fix use-after-free race between st_remove() and st_open()
+ perf: Track the perf mlock gift separately
+ eventfs: fix SRCU read lock leak in eventfs_iterate()
+ kernel/watch_queue: Use pipe_buf() to retrieve the pipe buffer
+ watch_queue: Fix note pool publication race in watch_queue_set_size()
+ ntfs3: free the sbi after a grace period
+ ext4: free the sbi after a grace period
+ scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
+ drm/exec: don't immediately add prelocked obj to array of locked objs
+ pid_namespace: make zap_pid_ns_processes() freezable
+ ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
+ tracing: Keep the predicate limit separate from program capacity
+ dm-integrity: require stable writes for internal hash modes
+ io_uring/cancel: don't spin on local work the task can't run
+ vsock/virtio: validate packet source for connected sockets
+ ipv4: udp: Create exceptions before socket matching
+ i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
+ futex: Fix mm reuse handling for FUT_OFF_MMSHARED
+ drm/i915/dmc: Harden DMC firmware payload parsing
+ drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
+ dm-integrity: fix infinite loop on discard with large tag size
+ cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
+ xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
+ Revert "srcu: Use irq_work to start GP in tiny SRCU"
+ net_sched: codel: fix stale state for empty flows in fq_codel
+ Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
+ tracing: Reject incomplete event filter expressions
+ tracing: Save the event file instead of the compatible histogram
+ tracing: Unregister field variable histograms when the command fails
+ tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
+ tracing/histograms: Verify event_call identity when updating synth_event
refcount
+ io-wq: order the exit bit against worker creation task work
+ io_uring/wait: don't spin on a stuck overflow list
+ io_uring/io-wq: don't lose the signal that ends work
+ io_uring/io-wq: don't hide a link from cancellations
+ io_uring: don't flood a cancelling task with task_work
+ io_uring/io-wq: don't strand work when a worker exits
+ io_uring/io-wq: don't exit with a creation pending
+ io_uring/io-wq: let cancel find picked up hashed work
+ io_uring/poll: don't lose a cancel as io-wq arms poll
+ io_uring/cancel: don't forget that the work was running
+ io_uring/cancel: recognize "no timeout" on 32-bit
+ io_uring/cancel: don't default to setting req->work.cancel_seq
+ io_uring/cancel: let CANCEL_ALL find parked requests
+ io_uring: wake ring pollers for local task_work
+ io_uring/wait: look at all CQ waiters on wake up
+ io_uring/poll: drop stale double poll entry on rearm
+ io_uring/timeout: don't skip over reached sequences
+ io_uring/timeout: keep repeat count on multishot update
+ io_uring/sqpoll: let the thread sleep on disabled rings
+ io_uring: don't pass restart error codes to userspace
+ io_uring/timeout: no ABS update of multishot timeouts
+ io_uring: look up the file before queueing to io-wq
+ io_uring/poll: avoid retry wakeup loss when dropping ownership
+ io_uring/timeout: don't put a sequence target behind the last flush
+ io_uring/timeout: don't flush with the sequence behind the last flush
+ io_uring/timeout: don't lose a cancel as io-wq arms a timeout
+ io_uring/poll: don't loop on HUP with multiple references
+ keys: Avoid the owner account dereference in named keyring lookup
+ keys: Check the authorization payload in process keyring searches
+ keys: Protect the type name while describing a key
+ keys: make keyring indexes independent of kernel addresses
+ keys: Protect the read method check against type removal
+ KEYS: Fix key_reject_and_link() race with keyring restriction
+ KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
+ keys/trusted_keys: return immediately after TPM unseal failure
+ asymmetric_keys: reject trust keys without IDs
+ ftrace: Initialize modname and offset in print_rec()
+ coredump: hold RCU while releasing parked threads
+ signal: don't retarget shared signals in a dying thread group
+ signal: only SIGKILL and the freezers interrupt a coredumping task
+ ptrace: refuse to change the signal mask of a user worker
+ signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
+ pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
+ rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
+ rose: disconnect orphaned STATE_2 sockets when device is gone
+ rose: release netdev ref and destroy orphaned incoming sockets
+ rose: clear neighbour pointer in rose_kill_by_device()
+ rose: don't free fd-owned sockets when reaping in the heartbeat
+ rose: keep the route needed for routing loop detection
+ rose: guard rose_transmit_link() against a NULL neighbour
+ rose: use timer_shutdown_sync() for t0timer teardown
+ rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3
+ rose: hold a reference on incoming sockets queued for accept()
+ ax25: bound REJ-driven fast retransmits with the existing N2 counter
+ rose: purge rose_neigh->queue on final teardown
+ fat: stop reading directory entries past the end-of-directory marker
+ x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
+ drm/vc4: hdmi: Move packet RAM enable to PM runtime
+ regcache: Add ->populate() callback to separate from ->init()
+ regcache: Do not overwrite error code when finalizing cache after error
+ regmap: Drop map lock during cache init and exit
+ gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
+ PCI: Rename CRS Completion Status to RRS
+ PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
+ afs: free the super info after a grace period
+ x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
+ mac802154: fix data race and NULL deref on local->assoc_dev
+ Revert "s390/mm: Add missing secure storage access fixups for donated memory"
+ netfilter: nft_byteorder: remove multi-register support
+ net: add getsockopt_iter callback to proto_ops
+ net: call getsockopt_iter if available
+ drm/xe: Bump LRU for external objects on exec and rebind
+ rose: clear stale N(R)/N(S) before (re)transmitting a data frame
+ netrom: linearize and validate lengths in nr_rx_frame()
+ netrom: require full NET/ROM headers in nr_route_frame()
+ net: netrom: validate source address in nr_find_socket()
+ netrom: bound fragment reassembly in nr_queue_rx_frame()
+ ax25: fix OOB read after address header strip in ax25_rcv()
+ ax25: check frame length in ax25_decode() and ax25_rx_iframe()
+ net: ax25: fix integer overflow in ax25_rx_fragment()
+ netrom: use a single lock for the node and neighbour lists
+ netrom: look up and update routes in one critical section
+ netrom: fix reference count leak in nr_rt_device_down
+ netrom: clear nr_neigh->ax25 under the routing lock in nr_link_failed()
+ netrom: fix nr_node leak when nr_del_node() removes the last route
+ rose: clear through routes when a neighbour is removed from the tables
+ rose: restart the link of a neighbour created over a live AX.25 connection
+ ax25: serialise the transmission of I frames on a connection
+ rose: process received frames and send with the socket locked
+ ax25: don't create two connections for the same link in ax25_send_frame()
+ ax25: read the connection's ax25_dev only once when walking ax25_list
+ ax25: wait for ax25_send_frame() before detaching the connections of a device
+ ax25: don't accept frames on a device that is going down
+ ax25: send a private copy of each I frame
+ rose: clear the circuits of a neighbour that restarts the link
+ ax25: send unacknowledged I frames again when a link is re-established
+ rose: bring up the link of the preferred route passed over by a connect
request
+ ax25: don't free an incoming SABM skb left on the listener's queue
+ mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
+ io_uring/waitid: own the request before clearing ->head
+ io_uring/cmd: don't leave list poison in ->hash_node
+ io_uring: don't lose a cancel as io-wq parks a request
+ io_uring/timeout: don't end a linked timeout with 1
+ io_uring/waitid: prevent cancel reference wrap
+ UBUNTU: Upstream stable to v6.6.161, v6.12.115
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172890
Title:
Noble update: upstream stable patchset 2026-11-04
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172890/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
