This bug was fixed in the package linux-oem-7.0 - 7.0.0-1018.18
---------------
linux-oem-7.0 (7.0.0-1018.18) resolute; urgency=medium
* resolute/linux-oem-7.0: 7.0.0-1018.18 -proposed tracker (LP:
#2171659)
[ Ubuntu: 7.0.0-43.43 ]
* resolute/linux: 7.0.0-43.43 -proposed tracker (LP: #2171676)
* HMC error triggers cascading PF resets and tears down RDMA connections
(LP: #2167995)
- RDMA/irdma: Suppress PF reset on HMC error
* Loading certificate with --import enrolls it into the platform keyring
instead of the machine keyring (LP: #2131181)
- SAUCE: integrity: Load MokListRT certs into the machine keyring
* Intel Bluetooth stops working on some cold boots on Dell systems
(LP: #2170908)
- Bluetooth: btintel_pcie: treat boot stage bit 12 as warning
* Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)
- ASoC: tas2783-sdw: add firmware download status check
* Dell XPS 13 9340: OV02C10 front camera image upside down (missing ipu-
bridge DMI quirk) (LP: #2169185)
- SAUCE: media: ipu-bridge: fix rotation quirk for XPS 13 9340/14 9440
* AMD system hangs on resume when a Thunderbolt dock is plugged in during
s2idle (LP: #2168944)
- platform/x86/amd: Stop counting intermediate cycles with metrics table
* ath12k: WCN7850 MLO double DMA-unmap/free of REO queue buffer on firmware
restart corrupts memory (needs upstream 4a1b53417739) (LP: #2169101)
- wifi: ath12k: prepare REO update element only for primary link
* amdkfd kernel crash when KFD procfs creation fails after execve
(LP: #2168705)
- drm/amdkfd: fix kernel crash on releasing NULL sysfs entry
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601)
- bnxt_en: fix DMA mapping length for padded small packets
- fs: Free any excess xarray nodes in clear_inode()
- net/mlx5e: Prevent stale XSK buffer release on refill retry
- net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
- net: mana: Skip WQ object destruction for uninitialized RXQ
- accel/amdxdna: Bound the sync_bo flush range to the BO size
- net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
- ipv6: Fix redirect exception creation for UDP/RAW sockets
- ipv4: validate checksum_start before completing checksum
- rust_binder: reschedule node refcount update on thread exit
- ipv4: stop PMTU walk when nexthop group shrinks
- ipv4: stop exception dump when nexthop group shrinks
- ipv4: stop route notification sizing when nexthop group shrinks
- ipv4: do not warn on route notification size race
- ipv6: do not warn on route notification size race
- Input: ati_remote2 - fix type confusion in device attribute handlers
- Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
- Input: xpad - add support for Corsair Novablade Pro
- ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
- ALSA: hda/tas2781: Accept V1 calibration data without CRC
- arm64: irq: exclude the softirq stack switch from KCOV
- ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
- btrfs: scrub: fix local_root reference leak in
scrub_print_warning_inode()
- cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
- cipso: adjust cached option offsets when removing CIPSO
- dm ioctl: don't let data_start run past the buffer
- usb: f81604: fix struct f81604_int_data size mismatch
- wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
- wifi: mt76: mt7603: initialize global station WCID
- wifi: mt76: mt7996: fix uninitialized buf read in
mt7996_variant_fem_init()
- wireguard: queueing: preserve tstamp_type when encapsulating packet
- wireguard: noise: reject response consumption after intermediate
initiation
- workqueue: Fix NULL current_pwq deref in chained work check
- xen/netfront: don't leak the skb when xennet_fill_frags() fails
- tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
- strparser: make sure __strp_recv isn't running before tearing down the
parser
- swiotlb: fix default_swiotlb_limit() for non-growable default pool
- tcp: reject net_iov in zerocopy receive mapping hints
- tipc: destroy topsrv workqueues before closing connections
- tipc: hold a reference to nodes found by link name
- Revert "wifi: libertas: reject short monitor TX frames"
- selinux: fix data race on AVC latest_notif
- selinux: preserve NATIVE_LABELS on already-initialized sb in
set_mnt_opts
- sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus()
when !streamoute
- EDAC/amd64: Mask UMC chip select to the four implemented selects
- gpio: mpsse: fix race when arming the IRQ poll worker
- gpio: xilinx: fix runtime PM leak on request error path
- gve: fix napi_disable deadlock when attempting to disable XSK pools
- gve: fix XSK buffer leak when rings are stopped
- gve: fix XSK buffer leak on error descriptor
- ibmveth: h_free logical LAN on open-fail after register
- ibmveth: fix TX LTB and filter unwind on open-fail
- ice: fix use-after-free in dynamic port cleanup
- ice: fix metadata_dst refcount handling on representor teardown
- keys: finalize persistent keyring timeout after link attempt
- KEYS: Fix add_key() race with keyring restriction
- memstick: core: wait for request completion before freeing card
- memstick: rtsx_usb_ms: complete requests after eject instead of dropping
them
- mm: don't schedule deferred kernel page table freeing while booting
- dm-crypt: reject the lmk IV mode with AEAD ciphers
- dm-integrity: fix buffer overflow in inline mode with large tag size
- dm-snap: reject the transient exception store for snapshot-merge
- dm: fix reading free memory in do_resume
- mmc: cavium-octeon: destroy slot platform devices on remove
- mmc: cavium-thunderx: destroy slot platform devices on remove
- mmc: mtk-sd: Cancel request timeout work on remove
- mmc: sdhci-sprd: disable runtime PM on remove
- net/packet: guard the ll header push in packet_rcv_spkt()
- net/smc: protect clcsock lifetime in smc_getname
- net: bridge: avoid recursive multicast port cleanup
- net: dsa: microchip: fix KSZ8765 fiber detection
- net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
- net: sparx5: free the matchall entry on destroy
- net: usb: ax88179_178a: fix rx frame length for non-last packets
- net: team: stop reusing skb after queue override
- net: team: free skb when broadcast has no txable port
- nvme: fix swapped ZRASF zone state values for full and read only
- openvswitch: fix soft lockup in the netlink flow dump
- optee: register TEE devices only once fully initialized
- regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
- regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
- pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
- pmdomain: rockchip: don't ignore clock lookup errors on attach
- pmdomain: rockchip: fix clock leak on domain probe failure
- pmdomain: rockchip: propagate subdomain add errors
- scsi: qedi: Initialize callback state before registration
- riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
- riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
- riscv: fix load_unaligned_zeropad() fixup for RV32
- riscv: futex: untag the user pointer before the atomic access
- riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi
header
- Bluetooth: btintel_pcie: use managed IRQ teardown
- Bluetooth: hci_sock: Serialize dead-device detachment
- Bluetooth: hci_sync: Fix command skb lifetime during scan setup
- Bluetooth: ISO: Reject concurrent BIS listener setup
- Bluetooth: ISO: Serialize concurrent connect calls
- Bluetooth: MGMT: Fix status of pending commands flushed on power off
- Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
- Bluetooth: RFCOMM: free the skb when the DLC has no owner
- Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
- drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
- drm/gud: don't keep a connector without a CRTC as connector_state
- drm/i915/gem: Prevent overstepping exec array boundary
- drm/i915/gt: Unmask interrupts only when ACTIVE is true
- drm/imagination: Size page table preallocation by device address
- drm/vc4: drain the hangcheck timer and works on V3D unbind
- drm/vc4: Fix firmware reference leak in vc4_drm_bind()
- drm/vmwgfx: validate pitch coming from userspace
- drm/xe: Fix shrinker accounting double-subtraction on nested external
pins
- drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
- drm/amdkfd: align SDMA doorbell base for shader doorbell writes
- drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
- drm/amdgpu: serialize vblank counter reads against GPU reset
- drm/amdgpu: make Mac FB workaround generic
- drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
- drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
- drm/amdgpu/userq: return the memdup_user() error for the user MQD
- drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
- mount: keep a copied mount unbindable
- fs: don't silently unmount busy mounts
- namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
- namespace: don't inherit MNT_UMOUNT in clone_mnt()
- namespace: don't copy an unmounted mount tree
- fs: refuse fspick() on internal superblocks
- namespace: check the target before walking it in do_mount_setattr()
- namespace: queue a mount only once for mount notifications
- namespace: check a submount for references right before unmounting it
- namespace: check a recursive bind mount for mount namespace loops
- namespace: look at the topmost mount for a mount namespace file
- namespace: remove the fsnotify marks of a mount namespace in process
context
- namespace: check the mounts before reading their parents in pivot_root()
- dcache: don't put a mountpoint on a dentry that's being removed
- namespace: don't let a pseudo dentry become the root of a mount
- namespace: unhash a dentry before detaching the mounts on it
- namei: don't reveal overmounted entries in refwalk
- fcntl: refuse F_SET_RW_HINT on an immutable inode
- namespace: refuse an automount below a mount that is in no namespace
- namespace: never expire a locked mount
- namespace: handle mount locking for automounts correctly
- ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
- accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
- accel/amdxdna: Refactor GEM BO handling and add helper APIs for address
retrieval
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh
forwarding
- s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code
- drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
- NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
- NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
- svcrdma: Add Write chunk WRs to the RPC's Send WR chain
- svcrdma: wake sq waiters when the transport closes
- blk-cgroup: delay freeing policy data after rcu grace period
- ring-buffer: Skip invalid sub-buffers when validating persistent ring
buffer
- ipv6: mcast: annotate data-races around mca_users
- arm64: dts: lx2160a: fix incorrect pinmux
- arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
- arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
- mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount
- fs: don't let a migrating task hide its reference from do_umount()
- Bluetooth: btintel_pcie: fix TX descriptor bounds check
- Bluetooth: btintel_pcie: Add shared HW reset for clean start
- drm/dp: don't mark the AUX backlight enabled when enabling failed
- gpio: exar: initialize the ID before registering its cleanup
- drm/aspeed: Balance the display clock enable on teardown
- drm/vc4: Free the BO cache size list on teardown
- net/sched: em_text: reject unterminated algo before autoload
- amt: send the relay's General Query directly from the receive path
- cxgb4/ch_ktls: disable softirqs around tid_list erases
- tee: optee: fix kernel-doc warnings
- tee: optee: ffa: support shared memory offsets on large-page kernels
- ice: Restore Ordered MMIO Writes for Tx Doorbells
- nvmet: return Invalid Field for invalid NSIDs feature 82h
- nvmet: use the local P2P device on metadata allocation failure
- arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
- zloop: zero out only the unread tail of short reads
- btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
- btrfs: free iov when btrfs_uring_read_extent() fails
- btrfs: unlock inode and extent in caller when io_uring read extent fails
- btrfs: fix xattr replace when multiple xattrs are packed in the same
item
- btrfs: fix lost error return value in btrfs_listxattr()
- drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums
- net: make dev_xdp_sb_prog_count() see programs attached through a link
- riscv: vector: Fix data pointer constraints in context save/restore
- riscv: vector: Fix output operands in context save
- wifi: mt76: don't return TXQ when exceeding max non-AQL packets
- wifi: mac80211: add AQL support for multicast packets
- wifi: mac80211: add ieee80211_txq_aql_pending()
- wifi: mt76: add PS buffering support for HW-managed TIM drivers
- wifi: mt76: account non-AQL frames per peer rather than per link
- wifi: mt76: route nullfunc frames to PSD/ALTX queue
- wifi: mt76: use ALTX queue for packets to disassociated stations
- wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
- wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
- wifi: mt76: mt7915: disable rx napi when removing device
- wifi: mt76: mt7925: don't put the band auto marker in TGID
- wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
- wifi: mt76: mt792x: pick the SAR table layout from the table itself
- Revert "wifi: ath12k: add panic handler"
- ASoC: adau1372: allow sleepy powerdown GPIOs
- ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
- ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
- spi: sg2044-nor: Return transfer errors
- spi: sg2044-nor: Honor SPI clock limits
- cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in
cpuset_handle_hotplug()
- flow_dissector: avoid u16 truncation of skb->len when computing thoff
- net: sparx5: start the TOD counters on non-PTP lan969x variants
- devlink: fix devlink_rel reference leak when notify work is pending
- net/sched: cls_route: reject change with no routing attribute
- Revert "net/mlx5: E-Switch, preserve max tx speed on vport state
modification"
- net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET
- pfcp: make sure the SEID is linear before reading it
- bnxt_en: Add bnxt_clear_bars() helper
- bnxt_en: Fix driver init in kdump kernel
- bnxt_en: Delay for 5 seconds after AER DPC for all chips
- bnxt_en: Drop pci_save_state() after pci_restore_state()
- bnxt_en: Re-write the BARs following any type of PCIe errors
- flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
- drm/imagination: Fix reference and vm_bo handling in remap()
- veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
- net/mlx5e: Order ICOSQ cc update after CQ doorbell
- mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
- ptp: ocp: fix PCIe delay estimation calculation
- net: openvswitch: validate transport header presence in set_ipv6_addr
- vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
- drm/vc4: Fix binner slot allocation failing on an idle GPU
- x86/CPU/AMD: Fix AMD TLBI Erratum #1718
- drm/panthor: validate userspace queue count against initialized firmware
slot count
- s390/zcrypt: Improve CCA CPRB length and overflow checks
- s390/zcrypt: Improve EP11 CPRB length and overflow checks
- s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
- s390/zcrypt: Pad trailing CCA or EP11 message with zeros
- xfs: remove duplicate INO1_WRITTEN check
- xfs: stop exchanging reflink flags when exchanging mappings
- xfs: fix exchange-range-to-eof file size exchange
- can: fix unique skb identifier regression under RPS
- SUNRPC: Add Kconfig dependency on CRYPTO_KRB5
- regulator: of: fill in supply names in of_regulator_bulk_get_all()
- drm/amd/display: Don't replace a sink mode that shares the native totals
- sched_ext: Generate qseq from a per-task counter
- HID: steam: Fully unregister controller when hidraw is opened
- HID: steam: Rearrange teardown sequence
- HID: steam: Refactor registration
- HID: steam: Clean up locking
- ipv4: udp: Create exceptions before socket matching
- ipv6: udp: Create exceptions before socket matching
- can: dev: init_can_skb(): restore skb header initialization
- e1000e: add system to disable K1 list
- fsverity: RCU-delay the freeing of struct fsverity_info
- iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test
- iavf: send MAC change request synchronously
- io_uring/register: don't exempt disabled rings from task restrictions
- ip6_tunnel: do not use dst6_mtu() in ip4ip6_err() and
ip6erspan_tunnel_xmit()
- ip6_gre: remove obsolete ERSPAN PMTU update
- mm/vma: introduce vma_test[_any[_mask]](), and make inlining consistent
- mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
- net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
- power: sequencing: pcie-m2: Fix leaking array from
of_regulator_bulk_get_all()
- scsi: ch: Do not keep references to data transfer element devices
- scsi: ufs: core: Avoid unsafe MMIO reads in
ufshcd_mcq_compl_all_cqes_lock()
- scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
- riscv: patch: fix handling of bpf-jit execmem addresses
- riscv: ptrace: reject CFI regset access when extensions are absent
- Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
- drm/xe/i2c: cancel the client work on remove
- drm/amd/display: disable self-refresh on tearing flips
- statmount: read the parent of an unmounted mount under mount_lock
- namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
- namespace: don't reconfigure internal superblocks via remount and umount
- unshare: don't drop active namespace references that were never taken
- nullfs: don't update the access time
- clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks
- clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable
- iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys
- scsi: ufs: core: Hold a clock reference across the probe
- drm/bridge: Fix unlocked list_del in drm_bridge_add()
- drm/bridge: Fix unlocked list access in drm_bridge_attach()
- cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
- drm/vc4: Use kvmalloc_objs() for the BO cache size list
- lib/dim: fix 32-bit overflow in dim_calc_stats() rates
- net: stmmac: propagate PTP addend and system time programming errors
- bonding: fix the program leak when XDP is replaced
- btrfs: don't stash io_uring encoded data across -EAGAIN
- drm/xe: Do not emit Wa_16010904313 twice
- net/mlx5: Lag, split aggregate speed into oper and max helpers
- net: stmmac: Do not advertise S-VLAN stripping when it is disabled
- net: stmmac: Disable S-Tag processing on dwmac4
- net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()
- Revert "net: stmmac: propagate PTP addend and system time programming
errors"
- scsi: ufs: mediatek: Handle mPHY power-on failures
- net: always dissect GSO packets in __virtio_net_hdr_to_skb()
- ASoC: sdw_utils: Add codec info for CS35L62
- ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI
- riscv: ptrace: Zero-initialize regset buffers before copyin
- bareudp: set the inner protocol to the protocol of the packet
- net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
- drm/vc4: Use devm_request_irq() for automatic cleanup
- drm/vc4: Disable the V3D interrupt across runtime suspend
- io_uring/memmap: account the pages a compound region really uses
- io_uring/zcrx: use better name for RQ region
- io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring()
- io_uring/zcrx: use correct mmap off constants
- io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
- io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
- mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
- Upstream stable to v6.18.57, v7.2.11
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-98038
- bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-93175
- drm/amd/display: Fix dangling pointer in CRTC reset function
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-90317
- bpf: Invalidate RCU pointers after final spin unlock
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-90315
- PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-90167
- ksmbd: serialize oplock close with pending break ownership
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-90162
- ksmbd: defer publishing granted locks to prevent UAF/double-free race
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-90155
- ksmbd: detach blocked lock requests before freeing
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-90144
- dpll: fix NULL deref in dpll_device_ops() during teardown race
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-89907
- LoongArch: KVM: Validate MSI data before routing it to EIOINTC
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-89709
- lockd, nfsd: RCU-protect nlmsvc_ops dispatch
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-89568
- kho: fix size calculation in kho_preserved_memory_reserve()
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-74568
- KVM: arm64: vgic: Fix race between LPI release and re-registration
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-74527
- octeontx2-af: Block VFs from clobbering special CGX PKIND state
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-74466
- s390/zcrypt: Close speculative mem read possibility
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-72497
- RDMA/bnxt_re: Add a max slot check for SQ
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-72404
- tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2026-68305
- drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
* Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //
CVE-2024-50169.
- vsock/virtio: account only unread bytes in read_skb()
* Resolute update: upstream stable patchset 2026-10-20 (LP: #2171596)
- selftests/mm: hugetlb-mremap: add setup of HugeTLB pages
- mm/execmem: make the populate and alloc atomic
- ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture
- Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
- smb/client: pass cifs_open_info_data to SMB2_open()
- ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
- audit: fix exe mark UAF in kill_rules()
- crypto: x86/aes-gcm - fix always true check for last AAD segment
- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
- HID: multitouch: stop the release timer from being rearmed on remove
- io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full
- io_uring/zcrx: requeue multishot receives stopped by a local resource
- kasan: unpoison task stack below watermark only in generic mode
- kprobes: Skip disarmed probes when checking optkprobe overlap
- octeontx2-pf: Fix RSS indirection table size
- of/irq: Fix remaining refcount leaks in of_irq_init()
- of/overlay: put property on deadprops only after changeset add succeeds
- of/overlay: only treat a positive changeset id as registered
- net: fix checksum offsets in skb_splice_from_iter()
- net: phy: aquantia: fix system interface type not updated in forced mode
- netfilter: nft_flow_offload: drop flowtable reference on init error path
- net/packet: prevent TX_RING byte count overflow
- r8169: disable EEE on RTL8168h/8111h
- rtc: ac100: Assign .num before accessing .hws
- rtc: spear: initialize IRQ state before requesting alarm IRQ
- sctp: check RCV_SHUTDOWN after the sendmsg connect wait
- tpm: Disable TPM on null key name mismatch
- netfs: zero gaps in read-gaps folio to avoid writing back stale data
- module: fix lost error code from codetag_load_module()
- virt: vmgenid: remap memory as decrypted
- virt: vmgenid: set driver_data before registering notification handlers
- mm: shmem: ignore sysfs configs for shmem forced collapse
- rds_tcp: close NULL deref window in rds_tcp_set_callbacks
- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
- vt: selection: Fix unsigned underflow and slab-out-of-bounds read in
paste_selection()
- vt: skip screen update for DEC alignment test on backgroup consoles
- wifi: wlcore: Fix runtime PM leak in wlcore_remove()
- ALSA: caiaq: unregister the input device when probe fails
- ALSA: line6: reject oversized playback packets
- random: vDSO: avoid call to memset() when zeroing reserved parameter
- [Config] Add CC_OPT_INLINE_MEMSET compiler option
- mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
- iio: dac: rohm-bd79703: Do not allow writing SCALE
- iio: light: rohm-bu27034: Fix error return
- iio: accel: kionix-kx022a: Fix array boundary check
- mtd: core: call _get_device() with the master MTD
- nvmet: preserve device path on allocation failure
- random: fix vgetrandom_opaque_params kernel-doc
- of/overlay: don't leak fragment references when changeset init fails
- of/overlay: don't create "//" paths for fragments targeting the root
- ASoC: wm8903: Move the DRC QR threshold to the register that holds it
- wifi: wfx: validate MIB read length before copying to caller
- ASoC: tegra: Fix ASRC Stream6 input threshold control
- wifi: mac80211: drop oversized fragments to avoid extra_len overflow
- wifi: ath11k: reset ar->num_stations on hardware start
- wifi: ath9k: reject short WMI command responses
- wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
- rtc: ac100: Fix clock provider use-after-free on probe failure
- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
- wifi: cfg80211: preserve hidden-group beacon IE ownership
- wifi: mac80211: Add multicast to unicast support for 802.3 path
- wifi: mac80211: Add 802.3 multicast encapsulation offload support
- wifi: mac80211: prevent AP VLAN tx from other interfaces
- ASoC: codecs: rt286: Revert delay value for jack setup
- ASoC: codecs: rt274: Fix format setting for 44100 rate
- block: reject polled dio with user integrity metadata
- blk-mq: set RQF_USE_SCHED when the operation is known
- Bluetooth: hci_core: free the HCI ID if naming fails
- Bluetooth: btintel: validate DDC record lengths
- arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz
- ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer
- net/mctp: publish the mctp_dev only after it is initialised
- net/sched: cls_api: reclaim an empty proto on the error path
- net: bcmgenet: allocate RX buffers as page fragments
- ipv6: fix prefix route expiry in modify_prefix_route()
- netfilter: ipset: do not update comments from kernel-side adds
- Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
- net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
- net: systemport: Fix RUNT MIB counter register offset calculation
- net/mlx5: Fix slab-out-of-bounds when handling team device events
- octeontx2-af: mcs: Fix SC resource cleanup loop
- tipc: prevent GCM nonce reuse on peer key changes
- net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
- net: stmmac: fix rx Scatter-Gather support
- net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
- gve: DQO: accept TSO packets with non-protocol gso_type bits
- net/sched: fq_codel: match the no-drop threshold to the packet size
- net/sched: sch_codel: match the no-drop threshold to the packet size
- virtio_blk: set the zone write granularity
- net: pcs: rzn1-miic: Clear MIIC protection state before unprotect
sequence
- net: bcmgenet: fix NULL dereference in set_coalesce before first open
- net: cap skb->queue_mapping when the tx queue is picked
- net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
- net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values
- net: sparx5: move netdev and notifier block registration to probe
- net: sparx5: move VCAP initialization to probe
- net: sparx5: move MAC table initialization and add deinit function
- net: sparx5: move stats initialization and add deinit function
- net: sparx5: move PTP IRQ handling out of sparx5_start()
- net: sparx5: skip ptp deinit if init was skipped
- tcp: refresh TS.Recent for accepted old ACKs
- ipvs: fix missing counter decrement in lblc
- ipvs: do not create invisible templates
- ipvs: filter some flags received in the backup server
- netfilter: bpf: reject invalid NAT manipulation types
- netfilter: flowtable: generalize pending status bit
- net: microchip: vcap: stop scanning after deleting key field
- of: Put coreboot node after compatibility check
- net: sparx5: make ports inherit the switch base mac address type
- net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
- ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
- net: mvneta: clear XDP pfmemalloc flag between frames
- i2c: at91: release DMA channels when probe defers
- perf: Fix race between perf_event_exit_task() and perf_pending_task()
- ALSA: core: Define auto-cleanup for snd_card_free()
- ALSA: ice1712: Fix the error handling via auto-cleanup at probe
- spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260
- PCI: Accept AtomicOps already enabled by the hypervisor
- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
- drm/amd/pm/si: Fix updating clock limits on AC/DC
- drm/amdgpu/gfx6: fix firmware leak on teardown
- drm/radeon: Read the VRAM VBIOS signature with readb()
- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
- drm/mediatek: Fix ovl adaptor platform device leak
- drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
- drm/amdgpu: fix IP instance memory leak on kobject add failure
- drm/amdgpu: fix ACP MFD device leak on init failure
- drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU
- binder: fix is_failure flag for superseded transaction cleanup
- binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
- kgdboc: Fix tty driver reference leak in configure_kgdboc()
- Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
- Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
- Input: s6sy761 - fix resume ordering and restore sensing
- Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
- Input: synaptics - limit T440p InterTouch quirk to LEN0036
- nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
- rust_binder: cancel deferred work items in thread exit
- soc: qcom: geni-se: Correct QUP Core ICC vote constants
- USB: cdc-acm: fix racy TIOCMIWAIT implementation
- USB: cdc-acm: skip URB restart in port_shutdown if disconnected
- USB: serial: fix port tear down use-after-free
- usb: storage: sierra_ms: reject short SWoC info transfers
- usb: hub: use shorter 120ms post resume hold for SS root hubs
- usb: octeon-hcd: fix the FIFO-flush timeout computation
- usb: ohci-da8xx: disable controller wakeup on cleanup
- usb: ohci-s3c2410: disable controller wakeup on removal
- usb: ohci-spear: disable controller wakeup on removal
- usb: ohci-st: disable controller wakeup on removal
- usb: gadget: midi2: Fix the jack descriptor array sizes
- usb: gadget: f_uac1_legacy: validate bRequest index in
generic_{set,get}_cmd
- usb: typec: anx7411 - stop the IRQ before destroying the workqueue
- usb: typec: port-mapper: Only match USB4 port if host interface is
available
- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
- usb: gadget: aspeed-vhub: cancel wake work on device removal
- USB: gadget: dummy-hcd: Fix wait for outstanding request completions
- usb: gadget: f_fs: Fix NULL pointer dereference in
FUNCTIONFS_ENDPOINT_DESC
- usb: chipidea: tegra: disable runtime PM on resume failure
- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
- USB: dwc2: shut down wakeup timer before freeing HCD state
- usb: typec: tcpm: recover after failure to start the frs ams
- usb: typec: tipd: don't send GAID when probe fails in APP mode
- usb: typec: tipd: fix uninitialized typec_partner_desc in
tps6598x_connect()
- usb: typec: tipd: fix uninitialized typec_partner_desc in
cd321x_update_work()
- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
- usb: typec: ucsi: Get the connector fwnode based on reg value
- usb: typec: ucsi: displayport: Current CAM OOB index fixup
- usb: cdns3: fix use-after-free in cdns3_gadget_exit()
- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
- tty: vt: fix memory leak in vc_allocate()
- tty: amiserial: fix broken TIOCMIWAIT
- tty: vcc: zero-initialize control packet in vcc_send_ctl()
- tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
- tty: tty_port: restore TTY_IO_ERROR on activation failure
- tty: port: fix tty_port_tty_vhangup() race
- tty: serial: qcom_geni_serial: Keep console RX functional after deep
idle
- tty: abort break signalling on hangup
- tty: serial: max3100: shut down timer before freeing port
- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
- serial: 8250_omap: fix wake irq cleared during suspend
- serial: revert guards in uart_wait_modem_status()
- serial: fix TIOCMIWAIT race
- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
- serial: tegra: don't clear the Tx FIFO on an Rx-only reset
- serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-
around
- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
- arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only
systems
- ASoC: codecs: max98363: fix uninitialized stream_config->type
- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194
- ALSA: seq: Serialize compat port-info ioctls
- ALSA: ua101: reject mismatched capture/playback packet sizes
- ALSA: hda/realtek: Fix square wave output on ASUS Strix G615LR
- ALSA: hda/realtek: Fix silent speaker on Higole F9B
- EDAC/versalnet: Drop remote processor handle refcount on driver removal
- EDAC/altera: Do not allow driver unbinding
- EDAC/altera: Drop __init from ECC setup paths for re-probe safety
- EDAC/altera: Fix memory leak on dci allocation failure
- EDAC/altera: Fix use-after-free in error paths
- EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup
- i2c: xiic: preserve PEC byte length in SMBus block read setup
- i2c: xiic: don't clobber msg->len to signal block-read completion
- Bluetooth: RFCOMM: Fix initial port reference race
- Bluetooth: hci_sync: Fix inquiry cache use-after-free
- Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
- Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
- Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
- Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
- Bluetooth: hci_core: Serialize fragmented ISO packet queueing
- Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
- Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
- x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
- x86/mm: Drop unnecessary PMD page copy when freeing
- mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
- fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
- io_uring: fix task_work add use-after-free with SQPOLL
- ipvs: bound LBLCR and LBLC cache growth
- net: extend IPv6 exthdr detection of tunneled packets
- tpm: fix off-by-four bounds check in tpm2_get_random()
- nvme-multipath: fix underflow in ANA log bounds checks
- nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
- nvmet: pci-epf: reject too-short SGL segments
- mtd: block2mtd: Fix divide error when erase_size is zero
- mtd: mtd_intel_dg: reset poll counter for each erase
- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of
OOB
- mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive()
- mtd: spinand: Enable QE on all dies
- mtd: spinand: fix zero oobavail when no ECC engine is used
- mtd: spinand: Do not update the QE bit on devices without one
- KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are
modified
- KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
- KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV
state
- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
- KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs
- KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor
- wifi: cfg80211: fix RTS threshold setting for single-radio PHY
- wifi: cw1200: fix TX padding OOB read leaking heap data to device
- wifi: iwlegacy: 3945: free EEPROM data on remove
- wifi: mac80211: keep paired old chanctx alive
- wifi: mac80211: shut down RX BA session timer on teardown
- wifi: mac80211: drain PS delivery work during station teardown
- wifi: mac80211: account proxy paths against the mesh path limit
- wifi: mac80211: keep fallback association elements alive
- wifi: mac80211: minstrel_ht: validate fixed rate index
- wifi: mac80211: reject invalid 320 MHz CSA bandwidth
- wifi: mac80211: release mesh path quota on failed additions
- wifi: mac80211: fix mesh fast xmit path deletion UAF
- wifi: mac80211: handle empty FILS association request payload
- USB: serial: cp210x: add Corsair AX1500i Power Supply
- USB: serial: quatech2: fix baud rate overflow
- USB: serial: ssu100: fix baud rate overflow
- USB: serial: fix dynamic id driver deregistration race
- USB: serial: fix driver deregistration order
- USB: serial: fix ioctl hangup race
- USB: serial: option: add support for SIMCom SIM8260C
- USB: serial: option: add Quectel EG060W
- USB: serial: option: add Compal EXM-G1x support
- USB: serial: option: add Quectel RG660QB
- USB: serial: option: add Compal EXC-T1 support
- thunderbolt: Fix KASAN reported use-after-free when request is canceled
- thunderbolt: Hold a router reference for each allocated HopID
- thunderbolt: Mark discovered tunnels as active
- thunderbolt: Tear down inactive DP tunnels when the domain is stopped
- thunderbolt: Fix domain reference leak when DPRX read is canceled
- thunderbolt: Disable CL states for the Anker Prime TB5 dock
- thunderbolt: Reject oversized XDomain properties responses
- smb: client: discard post-EOF pagecache when extending a file via zero
range
- smb: client: discard post-EOF pagecache when extending a file via copy
range
- smb: client: flush and commit data before querying allocated ranges
- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
- iio: accel: kionix-kx022a: Prevent memory leak and fix state
- iio: accel: kxcjk-1013: reject duplicate event disable
- iio: accel: sca3000: fix frequency divider condition check
- iio: adc: ad7173: Fix digital filter configuration
- iio: adc: ad_sigma_delta: fix use-after-free on unbind
- iio: adc: ade9000: fix NULL pointer dereference in clkout registration
- iio: adc: ade9000: fix overlapping scan_index for current and voltage
channels
- iio: adc: ade9000: handle Phase C dip events in IRQ1 handler
- iio: adc: ade9000: request interrupts after powering the device
- iio: adc: axp288: Add TS bias override for Haier HV103H
- iio: adc: max1363: sign-extend bipolar differential channel reads
- iio: adc: pac1934: check ACPI label duplication
- iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop
- iio: adc: rohm-bd79124: Fix channel initialization
- iio: adc: rohm-bd79124: Fix GPIO mask check
- iio: adc: rohm-bd79124: Fix rising alarm
- iio: adc: stm32-adc: fix check on internal channel availability
- iio: adc: stm32-adc: fix possible division by zero in processed channel
- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on
unbind
- iio: admv1013: initialize callback mutex before registering notifier
- iio: buffer: serialize buffer teardown with mode claims
- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
- iio: cdc: ad7150: fix OF matching and publish module aliases
- iio: frequency: admv1013: fix wrong channel field used in
admv1013_read_raw()
- iio: gyro: adis16136: fix unprotected debugfs reads
- iio: health: max30102: fix NULL dereference in interrupt handler
- iio: imu: adis16400: fix unprotected debugfs reads
- iio: imu: adis16480: fix unprotected debugfs reads
- iio: light: gp2ap020a00f: drain irq_work after free_irq
- iio: light: rohm-bu27034: Fix infinite delay on error
- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency
lookup
- iio: pressure: rohm-bm1390: Return error when read fails
- iio: proximity: aw96103: validate firmware data length
- iio: proximity: isl29501: Fix return type of isl29501_register_write
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup
failure
- iio: proximity: sx9324: Correct proximity channel resolution
- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
- iio: proximity: vl53l0x-i2c: claim direct mode for raw reads
- iio: trigger: cancel reenable_work before freeing trigger
- mptcp: fix msk->timer_ival reset
- mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
- pfcp: fix socket lifetime on netdevice registration failure
- netfs: clear post-EOF pagecache when extending a file via write
- mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc
- rust: devres: ensure revocation is complete before device finishes
unbinding
- rust: irq: pass RegistrationInner as cookie to request_irq
- Bluetooth: Serialize SMP remote OOB data access
- nvmet-tcp: Don't error if TLS is enabed on a reset
- nvmet: copy the hostid into the ctrl before creating PR pc_refs
- nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
- mtd: spinand: fix NULL pointer dereference with no ECC engine
- wifi: mac80211: count only matching reservations in reserved switch
- wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
- wifi: mac80211: set info->band for 802.3 encap offload frames
- thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
- smb: client: flush dirty data before zeroing a range
- smb: client: distinguish real EOF from a stale remote_i_size on read
- iio: adc: aspeed: propagate reset deassert errors
- smb: client: only require read lease for size-extending preallocate
- iio: adc: ad4030: fix invalid oversampling_ratio validation
- drm/amd/display: Mark DCE 6.4 as not APU
- drm/amd/display: Preserve eDP mode on initial ASSR failure
- drm/amdgpu: reset VI ASIC on MacBookPro15,1
- drm/amdgpu: reset VI ASIC on MacBookPro14,3
- drm/amd/display: Fix fast updates on DCE 8.1
- usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
- tty: n_gsm: fix missing modem controls after DLCI open in convergence
layer type 2
- usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
- tty: fix saved termios reset race
- perf: Replace perf_event_header__init_id with full header init
- perf/core: Check kernel access when kernel callchains are requested
- perf: Require kernel access for text poke events
- arm64: mm: Fix the break-before-make flush range for erratum 2645198
- arm64: errata: Factor out broken AMU const counter cap
- [Config] Enable ARM64_WORKAROUND_BROKEN_AMU_CONSTCNT
- arm64: errata: Add Cortex-A725 erratum 3821522 workaround
- [Config] Enable ARM64_ERRATUM_3821522
- KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h
- KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
- KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
- KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is
intercepted
- KVM: move TSS constants from kvm_host.h to tss.h
- KVM: x86: Add static calls for nested virtualization ops
- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
- net: usb: qmi_wwan: add Quectel EG120K-EA
- xen/netfront: drop RX packets with a short Ethernet header
- net: mana: remove double CQ cleanup in mana_create_rxq error path
- iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
- iio: adc: adi-axi-adc: Initialize state mutex
- ipv4: free inet_opt and ireq_opt after an RCU grace period
- drm/xe/i2c: Keep the i2c controller always enabled
- selftests/cgroup: account for zswap shrinker writeback
- KVM: x86: Move nested_run_pending to kvm_vcpu_arch
- KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages()
error paths
- net: gso: limit recursive IP-in-IP segmentation
- sysctl: Negate before converting in the int read path
- time/jiffies: Saturate in mult_hz() instead of wrapping
- netfs: zero the tail of a short DIO/unbuffered read
- ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270)
- ext4: don't enable large folios on encrypted inodes
- mtd: core: avoid double-free of OTP NVMEM device
- wifi: ath9k: Clean up device initialisation guards
- wifi: mac80211: validate TX status rate metadata
- mm/slab: handle the !allow_spin case in kfree_rcu_sheaf()
- mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()
- ASoC: SDCA: Set suspended flag after resuming within system suspend
- ASoC: SDCA: Add better pm_runtime error handling in func probe
- bpf: Fix overflow of jump offset in constant blinding
- nvme: fix command effects log lifetime for multipath heads
- bpf: Hold map BTF for the memory allocator destructor record
- wifi: mac80211: fix slab-out-of-bounds read in
ieee80211_monitor_select_queue()
- drm/xe/pf: Refactor VF LMEM BAR resize helper function
- drm/xe/pf: Keep VF LMEM BAR size low if no VFs enabled
- drm/mediatek: mtk_hdmi_v2: fix VID_DOWNSAMPLE_CONFIG register offset
- octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled
- seg6: ensure packet data is writable before modifying SRH and IPv6 DA
- net: ethtool: let tsconfig reach a PHY-only timestamp provider
- bpf: Wait for an RCU tasks grace period before freeing trampoline progs
- bpf: Skip detached progs in trampoline images that are still in use
- bpf: Factor out __do_call_rcu_ttrace()
- bpf: Fix objects stuck in free_by_rcu_ttrace
- drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe()
- futex: Fix private hash use-after-free on resize
- drm/amd/display: guard dc_sink dereferences in MST mode validation
- drm/amd/display: Fix fast updates on DCE 6.x
- drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub()
- drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()
- drm/i915/vrr: Disable DC balance by default
- drm/amdgpu: drop userq callback assignment for sdma 7.1
- binderfs: fix UAF write in binder_add_device
- clk: spacemit: k3: add CPU PLL rate tables
- serial: core: fix NULL pointer dereference in
serial_core_unregister_port()
- ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after
enabling clocks
- ALSA: hda/realtek: Add quirk for Acer Nitro ANV15-41
- ALSA: hda/realtek: Update Acer Nitro ANV15-41 quirk to enable mute LED
- ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72
- Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
- KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
- KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN
succeeded
- KVM: arm64: vgic: Allow last_lr_irq to be NULL when LRs are not
overflowing
- KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
- thunderbolt: Make the DP tunnel activation callback mandatory
- smb: client: discard post-EOF pagecache when extending a file via clone
range
- smb: client: only require read lease for size-extending zero range
- smb: client: drain and invalidate before server-side copy/clone
- smb: client: require stable pages for signed connections
- iio: frequency: adf4377: Fully initialize clk_init_data and
clk_parent_data
- Upstream stable to v6.18.56, v7.2.10
* Resolute update: upstream stable patchset 2026-10-20 (LP: #2171596) //
CVE-2026-89764
- rust: devres: fix race between concurrent revokers
-- [email protected] (Alice C. Munduruca) Wed, 28 Oct 2026
10:17:00 -0400
** Changed in: linux-oem-7.0 (Ubuntu Resolute)
Status: Confirmed => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2024-50169
** CVE added: https://cve.org/CVERecord?id=CVE-2026-68305
** CVE added: https://cve.org/CVERecord?id=CVE-2026-72404
** CVE added: https://cve.org/CVERecord?id=CVE-2026-72497
** CVE added: https://cve.org/CVERecord?id=CVE-2026-74466
** CVE added: https://cve.org/CVERecord?id=CVE-2026-74527
** CVE added: https://cve.org/CVERecord?id=CVE-2026-74568
** CVE added: https://cve.org/CVERecord?id=CVE-2026-89568
** CVE added: https://cve.org/CVERecord?id=CVE-2026-89709
** CVE added: https://cve.org/CVERecord?id=CVE-2026-89764
** CVE added: https://cve.org/CVERecord?id=CVE-2026-89907
** CVE added: https://cve.org/CVERecord?id=CVE-2026-90144
** CVE added: https://cve.org/CVERecord?id=CVE-2026-90155
** CVE added: https://cve.org/CVERecord?id=CVE-2026-90162
** CVE added: https://cve.org/CVERecord?id=CVE-2026-90167
** CVE added: https://cve.org/CVERecord?id=CVE-2026-90315
** CVE added: https://cve.org/CVERecord?id=CVE-2026-90317
** CVE added: https://cve.org/CVERecord?id=CVE-2026-93175
** CVE added: https://cve.org/CVERecord?id=CVE-2026-98038
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169023
Title:
Fix TI TAS2783 amplifier firmware load issue
To manage notifications about this bug go to:
https://bugs.launchpad.net/hwe-next/+bug/2169023/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
