This bug was fixed in the package linux - 6.8.0-64.67
---------------
linux (6.8.0-64.67) noble; urgency=medium
* noble/linux: 6.8.0-64.67 -proposed tracker (LP: #2114668)
* Unexpected system reboot at loading GUI session on some AMD platforms
(LP: #2112462)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush
* [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
(LP: #2114174)
- s390/pci: rename lock member in struct zpci_dev
- s390/pci: introduce lock to synchronize state of zpci_dev's
- s390/pci: remove hotplug slot when releasing the device
- s390/pci: Remove redundant bus removal and disable from
zpci_release_device()
- s390/pci: Prevent self deletion in disable_slot()
- s390/pci: Allow re-add of a reserved but not yet removed device
- s390/pci: Serialize device addition and removal
* [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
(LP: #2114174) // CVE-2025-37946
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has
child VFs
* [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
(LP: #2114174) // CVE-2025-37974
- s390/pci: Fix missing check for zpci_create_device() error return
* [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
(LP: #2114174) // CVE-2024-56699
- s390/pci: Fix potential double remove of hotplug slot
* System will restart while resuming with SATA HDD or nvme installed with
password set (LP: #2110090)
- PCI: Explicitly put devices into D0 when initializing
* Noble update: upstream stable patchset 2025-06-12 (LP: #2114239)
- btrfs: fix assertion failure when splitting ordered extent after
transaction abort
- btrfs: fix use-after-free when attempting to join an aborted transaction
- arm64/mm: Ensure adequate HUGE_MAX_HSTATE
- exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
- s390/stackleak: Use exrl instead of ex in __stackleak_poison()
- btrfs: fix data race when accessing the inode's disk_i_size at
btrfs_drop_extents()
- btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error
handling
- sched: Don't try to catch up excess steal time.
- locking/ww_mutex/test: Use swap() macro
- lockdep: Fix upper limit for LOCKDEP_*_BITS configs
- x86/amd_nb: Restrict init function to AMD-based systems
- drm/virtio: New fence for every plane update
- drm: Add panel backlight quirks
- drm: panel-backlight-quirks: Add Framework 13 matte panel
- drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
- nvkm/gsp: correctly advance the read pointer of GSP message queue
- nvkm: correctly calculate the available space of the GSP cmdq buffer
- drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
- drm/amd/display: Overwriting dualDPP UBF values before usage
- printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
- drm/connector: add mutex to protect ELD from concurrent access
- drm/bridge: anx7625: use eld_mutex to protect access to connector->eld
- drm/bridge: ite-it66121: use eld_mutex to protect access to
connector->eld
- drm/amd/display: use eld_mutex to protect access to connector->eld
- drm/exynos: hdmi: use eld_mutex to protect access to connector->eld
- drm/radeon: use eld_mutex to protect access to connector->eld
- drm/sti: hdmi: use eld_mutex to protect access to connector->eld
- drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
- drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
- drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
- drm/amdkfd: Queue interrupt work to different CPU
- drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
- drm/bridge: it6505: fix HDCP Bstatus check
- drm/bridge: it6505: fix HDCP encryption when R0 ready
- drm/bridge: it6505: fix HDCP CTS compare V matching
- drm/bridge: it6505: fix HDCP V match check is not performed correctly
- drm/bridge: it6505: fix HDCP CTS KSV list wait timer
- safesetid: check size of policy writes
- drm/amd/display: Increase sanitizer frame larger than limit when compile
testing with clang
- drm/amd/display: Limit Scaling Ratio on DCN3.01
- wifi: rtw89: add crystal_cap check to avoid setting as overflow value
- tun: fix group permission check
- mmc: core: Respect quirk_max_rate for non-UHS SDIO card
- mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
- tomoyo: don't emit warning in tomoyo_write_control()
- mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
- wifi: rtw88: add __packed attribute to efuse layout struct
- clk: qcom: Make GCC_8150 depend on QCOM_GDSC
- HID: multitouch: Add quirk for Hantick 5288 touchpad
- HID: Wacom: Add PCI Wacom device support
- net/mlx5: use do_aux_work for PHC overflow checks
- wifi: brcmfmac: Check the return value of
of_property_read_string_index()
- wifi: iwlwifi: pcie: Add support for new device ids
- wifi: iwlwifi: avoid memory leak
- i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
- APEI: GHES: Have GHES honor the panic= setting
- Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
- Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
- Bluetooth: MGMT: Fix slab-use-after-free Read in
mgmt_remove_adv_monitor_sync
- net: wwan: iosm: Fix hibernation by re-binding the driver around it
- mmc: sdhci-msm: Correctly set the load for the regulator
- octeon_ep: update tx/rx stats locally for persistence
- tipc: re-order conditions in tipc_crypto_key_rcv()
- selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
- x86/kexec: Allocate PGD for x86_64 transition page tables separately
- iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
- iommu/arm-smmu-v3: Clean up more on probe failure
- platform/x86: int3472: Check for adev == NULL
- platform/x86: acer-wmi: Add support for Acer PH14-51
- ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
- platform/x86: acer-wmi: Add support for Acer Predator PH16-72
- ASoC: amd: Add ACPI dependency to fix build error
- Input: allocate keycode for phone linking
- platform/x86: acer-wmi: add support for Acer Nitro AN515-58
- platform/x86: acer-wmi: Ignore AC events
- xfs: report realtime block quota limits on realtime directories
- xfs: don't over-report free space or inodes in statvfs
- tty: xilinx_uartps: split sysrq handling
- tty: vt: pass proper pointers from tioclinux()
- tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
- platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
- nvme: handle connectivity loss in nvme_set_queue_count
- firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
- gpu: drm_dp_cec: fix broken CEC adapter properties check
- ice: put Rx buffers after being done with current frame
- ice: gather page_count()'s of each frag right before XDP prog call
- ice: stop storing XDP verdict within ice_rx_buf
- nvme-fc: use ctrl state getter
- net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
- vmxnet3: Fix tx queue race condition with XDP
- tg3: Disable tg3 PCIe AER on system reboot
- udp: gso: do not drop small packets when PMTU reduces
- rxrpc: Fix the rxrpc_connection attend queue handling
- gpio: pca953x: Improve interrupt support
- net: atlantic: fix warning during hot unplug
- net: rose: lock the socket in rose_bind()
- ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
- tun: revert fix group permission check
- net: sched: Fix truncation of offloaded action statistics
- rxrpc: Fix call state set to not include the SERVER_SECURING state
- cpufreq: s3c64xx: Fix compilation warning
- leds: lp8860: Write full EEPROM, not only half of it
- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
- drm/modeset: Handle tiled displays in pan_display_atomic.
- drm/client: Handle tiled displays better
- smb: client: fix order of arguments of tracepoints
- smb: client: change lease epoch type from unsigned int to __u16
- s390/futex: Fix FUTEX_OP_ANDN implementation
- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented
- m68k: vga: Fix I/O defines
- fs/proc: do_task_stat: Fix ESP not readable during coredump
- binfmt_flat: Fix integer overflow bug on 32 bit systems
- accel/ivpu: Fix Qemu crash when running in passthrough
- arm64/kvm: Configure HYP TCR.PS/DS based on host stage1
- arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
- KVM: arm64: timer: Always evaluate the need for a soft timer
- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
- remoteproc: omap: Handle ARM dma_iommu_mapping
- KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
- KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
- ksmbd: fix integer overflows on 32 bit systems
- drm/amd/display: Optimize cursor position updates
- drm/amd/pm: Mark MM activity as unsupported
- drm/amdkfd: only flush the validate MES contex
- drm/i915/guc: Debug print LRC state entries only if the context is
pinned
- drm/i915: Fix page cleanup on DMA remap failure
- drm/komeda: Add check for komeda_get_layer_fourcc_list()
- drm/i915/dp: Iterate DSC BPP from high to low on all platforms
- drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
- drm/amd/display: Fix seamless boot sequence
- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
- clk: sunxi-ng: a100: enable MMC clock reparenting
- clk: mmp2: call pm_genpd_init() only after genpd.name is set
- media: i2c: ds90ub960: Fix UB9702 refclk register access
- clk: qcom: clk-alpha-pll: fix alpha mode configuration
- clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
- clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during gdsc_disable()
- clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
- clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
- clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
- clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
- clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
- clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe
- clk: mediatek: mt2701-bdp: add missing dummy clk
- clk: mediatek: mt2701-img: add missing dummy clk
- clk: mediatek: mt2701-mm: add missing dummy clk
- blk-cgroup: Fix class @block_class's subsystem refcount leakage
- efi: libstub: Use '-std=gnu11' to fix build with GCC 15
- perf bench: Fix undefined behavior in cmpworker()
- scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
- of: Correct child specifier used as input of the 2nd nexus node
- of: Fix of_find_node_opts_by_path() handling of alias+path+options
- Input: bbnsm_pwrkey - add remove hook
- HID: hid-sensor-hub: don't use stale platform-data on remove
- ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
- atomic64: Use arch_spin_locks instead of raw_spin_locks
- wifi: rtlwifi: rtl8821ae: Fix media status report
- wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
- wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
- wifi: rtw88: sdio: Fix disconnection after beacon loss
- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
- usb: gadget: f_tcm: Translate error to sense
- usb: gadget: f_tcm: Decrement command ref count on cleanup
- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
- usb: gadget: f_tcm: Don't prepare BOT write request twice
- usbnet: ipheth: fix possible overflow in DPE length check
- usbnet: ipheth: use static NDP16 location in URB
- usbnet: ipheth: check that DPE points past NCM header
- usbnet: ipheth: refactor NCM datagram loop
- usbnet: ipheth: break up NCM header size computation
- usbnet: ipheth: fix DPE OoB read
- usbnet: ipheth: document scope of NCM implementation
- ASoC: acp: Support microphone from Lenovo Go S
- soc: qcom: socinfo: Avoid out of bounds read of serial number
- serial: sh-sci: Drop __initdata macro for port_cfg
- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[]
is in use
- MIPS: Loongson64: remove ROM Size unit in boardinfo
- LoongArch: Extend the maximum number of watchpoints
- powerpc/pseries/eeh: Fix get PE state translation
- dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
- dm-crypt: track tag_offset in convert_context
- mips/math-emu: fix emulation of the prefx instruction
- MIPS: pci-legacy: Override pci_address_to_pio
- block: don't revert iter for -EIOCBQUEUED
- firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available()
- ALSA: hda/realtek: Enable headset mic on Positivo C6400
- ALSA: hda: Fix headset detection failure due to unstable sort
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
- arm64: tegra: Fix Tegra234 PCIe interrupt-map
- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
- PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
- PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
- scsi: st: Don't set pos_unknown just after device recognition
- scsi: qla2xxx: Move FCE Trace buffer allocation to user control
- scsi: ufs: qcom: Fix crypto key eviction
- scsi: ufs: core: Fix use-after free in init error and remove paths
- scsi: storvsc: Set correct data length for sending SCSI command without
payload
- scsi: core: Do not retry I/Os during depopulation
- kbuild: Move -Wenum-enum-conversion to W=2
- rust: init: use explicit ABI to clean warning in future compilers
- x86/boot: Use '-std=gnu11' to fix build with GCC 15
- ubi: Add a check for ubi_num
- ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
- ARM: dts: ti/omap: gta04: fix pm issues caused by spi module
- arm64: dts: qcom: sm6115: Fix MPSS memory length
- arm64: dts: qcom: sm6115: Fix CDSP memory length
- arm64: dts: qcom: sm6115: Fix ADSP memory base and length
- arm64: dts: qcom: sm6350: Fix ADSP memory length
- arm64: dts: qcom: sm6350: Fix MPSS memory length
- arm64: dts: qcom: sm6350: Fix uart1 interconnect path
- arm64: dts: qcom: sm6375: Fix ADSP memory length
- arm64: dts: qcom: sm6375: Fix CDSP memory base and length
- arm64: dts: qcom: sm6375: Fix MPSS memory base and length
- arm64: dts: qcom: sm8350: Fix ADSP memory base and length
- arm64: dts: qcom: sm8350: Fix CDSP memory base and length
- arm64: dts: qcom: sm8350: Fix MPSS memory length
- arm64: dts: qcom: sm8450: Fix CDSP memory length
- arm64: dts: qcom: sm8450: Fix MPSS memory length
- arm64: dts: qcom: sm8550: Fix CDSP memory length
- arm64: dts: qcom: sm8550: Fix MPSS memory length
- arm64: dts: qcom: sm8450: add missing qcom,non-secure-domain property
- arm64: dts: qcom: sm8450: Fix ADSP memory base and length
- arm64: dts: qcom: sm8550: add missing qcom,non-secure-domain property
- arm64: dts: qcom: sm8550: Add dma-coherent property
- arm64: dts: qcom: sm8550: Fix ADSP memory base and length
- arm64: dts: qcom: sm8650: Fix CDSP memory length
- arm64: dts: qcom: sm8650: Fix MPSS memory length
- arm64: dts: qcom: sm8550: correct MDSS interconnects
- arm64: dts: qcom: sm8650: correct MDSS interconnects
- crypto: qce - fix priority to be less than ARMv8 CE
- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
- arm64: tegra: Disable Tegra234 sce-fabric node
- parisc: Temporarily disable jump label support
- pwm: microchip-core: fix incorrect comparison with max period
- xfs: Propagate errors from xfs_reflink_cancel_cow_range in
xfs_dax_write_iomap_end
- xfs: Add error handling for xfs_reflink_cancel_cow_range
- ACPI: PRM: Remove unnecessary strict handler address checks
- tpm: Change to kvalloc() in eventlog/acpi.c
- rv: Reset per-task monitors also for idle tasks
- hrtimers: Force migrate away hrtimers queued after
CPUHP_AP_HRTIMERS_DYING
- kfence: skip __GFP_THISNODE allocations on NUMA systems
- media: ccs: Clean up parsed CCS static data on parse failure
- mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
- iio: light: as73211: fix channel handling in only-color triggered buffer
- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
- soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
- soc: qcom: smem_state: fix missing of_node_put in error path
- media: mmp: Bring back registration of the device
- media: mc: fix endpoint iteration
- media: nuvoton: Fix an error check in npcm_video_ece_init()
- media: imx296: Add standby delay during probe
- media: ov5640: fix get_light_freq on auto
- media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
- media: ccs: Fix CCS static data parsing for large block sizes
- media: ccs: Fix cleanup order in ccs_probe()
- media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
- media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
- media: i2c: ds90ub960: Fix UB9702 VC map
- media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
- media: uvcvideo: Fix crash during unbind if gpio unit is in use
- media: uvcvideo: Fix event flags in uvc_ctrl_send_events
- media: uvcvideo: Support partial control reads
- media: uvcvideo: Remove redundant NULL assignment
- media: uvcvideo: Refactor iterators
- media: uvcvideo: Only save async fh if success
- media: uvcvideo: Remove dangling pointers
- mm: kmemleak: fix upper boundary check for physical address objects
- mm/compaction: fix UBSAN shift-out-of-bounds warning
- ata: libata-sff: Ensure that we cannot write outside the allocated
buffer
- crypto: qce - fix goto jump in error path
- crypto: qce - unregister previously registered algos in error path
- nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
- nvmem: core: improve range check for nvmem_cell_write()
- nvmem: imx-ocotp-ele: simplify read beyond device check
- nvmem: imx-ocotp-ele: fix MAC address byte order
- nvmem: imx-ocotp-ele: fix reading from non zero offset
- nvmem: imx-ocotp-ele: set word length to 1
- io_uring: fix multishots with selected buffers
- io_uring/net: don't retry connect operation on EPOLLERR
- selftests: mptcp: connect: -f: no reconnect
- pnfs/flexfiles: retry getting layout segment for reads
- ocfs2: fix incorrect CPU endianness conversion causing mount failure
- ocfs2: handle a symlink read error correctly
- nilfs2: fix possible int overflows in nilfs_fiemap()
- nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
- NFSD: Encode COMPOUND operation status on page boundaries
- mailbox: tegra-hsp: Clear mailbox before using message
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
- irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
- mtd: onenand: Fix uninitialized retlen in do_otp_read()
- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
- char: misc: deallocate static minor in error path
- misc: fastrpc: Deregister device nodes properly in error scenarios
- misc: fastrpc: Fix registered buffer page address
- misc: fastrpc: Fix copy buffer page size
- net/ncsi: wait for the last response to Deselect Package before
configuring channel
- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
- maple_tree: simplify split calculation
- scripts/gdb: fix aarch64 userspace detection in get_current_task
- tracing/osnoise: Fix resetting of tracepoints
- rtla/osnoise: Distinguish missing workload option
- rtla: Add trace_instance_stop
- rtla/timerlat_hist: Stop timerlat tracer on signal
- rtla/timerlat_top: Stop timerlat tracer on signal
- pinctrl: samsung: fix fwnode refcount cleanup if
platform_get_irq_optional() fails
- ptp: Ensure info->enable callback is always set
- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
- rtc: zynqmp: Fix optional clock name property
- MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
- xfs: avoid nested calls to __xfs_trans_commit
- xfs: don't lose solo superblock counter update transactions
- spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC
families
- spi: atmel-qspi: Memory barriers after memory-mapped I/O
- btrfs: avoid monopolizing a core when activating a swap file
- mptcp: prevent excessive coalescing on receive
- Revert "drm/amd/display: Fix green screen issue after suspend"
- statmount: let unset strings be empty
- arm64: dts: rockchip: add reset-names for combphy on rk3568
- ocfs2: check dir i_size in ocfs2_find_entry
- Upstream stable to v6.6.77, v6.12.14
* kvmppc_set_passthru_irq_hv: Could not assign IRQ map traces are seen when
pci device is attached to kvm guest when "xive=off" is set (LP: #2109951)
- KVM: PPC: Book3S HV: Fix IRQ map warnings with XICS on pSeries KVM Guest
* Latitude 5450 is experiencing packet loss on Ethernet in Ubuntu 22.04
(LP: #2106558)
- e1000e: change k1 configuration on MTP and later platforms
* cpufreq amd-pstate: cpuinfo_max_freq reports incorrect value
(LP: #2109609)
- SAUCE: Revert "Revert "cpufreq: amd-pstate: Fix the inconsistency in max
frequency units""
* Backport pci=config_acs parameter with fix commit (LP: #2100340)
- PCI: Extend ACS configurability
- PCI: Fix pci_enable_acs() support for the ACS quirks
- PCI/ACS: Fix 'pci=config_acs=' parameter
* [UBUNTU 24.04] s390/pci: Fix zpci_bus_is_isolated_vf() for non-VF
(LP: #2111599)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs
* nvme/tcp hangs IO on arm (LP: #2106381)
- nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
* CVE-2025-37750
- smb: client: fix UAF in decryption with multichannel
* CVE-2025-40364
- io_uring: fix io_req_prep_async with provided buffers
* CVE-2024-49887
- f2fs: fix to handle segment allocation failure correctly
- f2fs: fix to don't panic system for no free segment fault injection
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953)
- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active
- dlm: fix srcu_read_lock() return type to int
- afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
- afs: Fix directory format encoding struct
- afs: Fix cleanup of immediately failed async calls
- fs: fix proc_handler for sysctl_nr_open
- block: retry call probe after request_module in blk_request_module
- pstore/blk: trivial typo fixes
- nvme: Add error check for xa_store in nvme_get_effects_log
- selftests/powerpc: Fix argument order to timer_sub()
- nvme: Add error path for xa_store in nvme_init_effects
- partitions: ldm: remove the initial kernel-doc notation
- select: Fix unbalanced user_access_end()
- nvme: fix bogus kzalloc() return check in nvme_init_effects_log()
- afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
- perf/core: Save raw sample data conditionally based on sample type
- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
- x86/cpu: Enable SD_ASYM_PACKING for PKG domain on AMD
- x86/topology: Use x86_sched_itmt_flags for PKG domain unconditionally
- drm/msm/dp: set safe_to_exit_level before printing it
- drm/etnaviv: Fix page property being used for non writecombine buffers
- drm/amd/pm: Fix an error handling path in
vega10_enable_se_edc_force_stall_config()
- drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset
- drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
- drm/rockchip: vop2: Fix the windows switch between different layers
- drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8
- drm/rockchip: vop2: include rockchip_drm_drv.h
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8150
- drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8250
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8350
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8550
- drm/msm: Check return value of of_dma_configure()
- drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
- drm/amdgpu: tear down ttm range manager for doorbell in
amdgpu_ttm_fini()
- genirq: Make handle_enforce_irqctx() unconditionally available
- wifi: ath11k: Fix unexpected return buffer manager error for
WCN6750/WCN6855
- wifi: rtlwifi: do not complete firmware loading needlessly
- wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last
step
- wifi: rtlwifi: wait for firmware loading before releasing memory
- wifi: rtlwifi: fix init_sw_vars leak when probe fails
- wifi: rtlwifi: usb: fix workqueue leak when probe fails
- net_sched: sch_sfq: annotate data-races around q->perturb_period
- net_sched: sch_sfq: handle bigger packets
- spi: zynq-qspi: Add check for clk_enable()
- dt-bindings: mmc: controller: clarify the address-cells description
- of: remove internal arguments from of_property_for_each_u32()
- clk: fix an OF node reference leak in of_clk_get_parent_name()
- dt-bindings: leds: class-multicolor: Fix path to color definitions
- wifi: rtlwifi: destroy workqueue at rtl_deinit_core
- wifi: rtlwifi: pci: wait for firmware loading before releasing memory
- HID: multitouch: fix support for Goodix PID 0x01e9
- regulator: dt-bindings: mt6315: Drop regulator-compatible property
- wifi: brcmfmac: add missing header include for brcmf_dbg
- ACPI: fan: cleanup resources in the error path of .probe()
- cpupower: fix TSC MHz calculation
- dt-bindings: mfd: bd71815: Fix rsense and typos
- leds: netxbig: Fix an OF node reference leak in
netxbig_leds_get_of_pdata()
- inetpeer: remove create argument of inet_getpeer_v[46]()
- inetpeer: remove create argument of inet_getpeer()
- inetpeer: update inetpeer timestamp in inet_getpeer()
- inetpeer: do not get a refcount in inet_getpeer()
- pwm: stm32-lp: Add check for clk_enable()
- cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
- gpio: pca953x: log an error when failing to get the reset GPIO
- cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if LMh IRQ
is not available
- cpufreq: qcom: Implement clk_ops::determine_rate() for qcom_cpufreq*
clocks
- clk: imx8mp: Fix clkout1/2 support
- dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI
- clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI
- clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent
- regulator: of: Implement the unwind path of of_regulator_match()
- OPP: OF: Fix an OF node leak in _opp_add_static_v2()
- ipmi: ssif_bmc: Fix new request loss when bmc ready for a response
- wifi: ath12k: fix tx power, max reg power update to firmware
- clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
- HID: fix generic desktop D-Pad controls
- leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak
- mfd: syscon: Remove extern from function prototypes
- mfd: syscon: Add of_syscon_register_regmap() API
- mfd: syscon: Use scoped variables with memory allocators to simplify
error paths
- mfd: syscon: Fix race in device_node_get_regmap()
- samples/landlock: Fix possible NULL dereference in parse_path()
- wifi: wlcore: fix unbalanced pm_runtime calls
- wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC
- wifi: mac80211: fix tid removal during mesh forwarding
- wifi: mac80211: Fix common size calculation for ML element
- net/smc: fix data error when recvmsg with MSG_PEEK flag
- wifi: mt76: mt76u_vendor_request: Do not print error messages when
-EPROTO
- wifi: mt76: mt7921: fix using incorrect group cipher after
disconnection.
- wifi: mt76: mt7915: fix overflows seen when writing limit attributes
- wifi: mt76: mt7996: fix rx filter setting for bfee functionality
- wifi: mt76: mt7915: firmware restart on devices with a second pcie link
- wifi: mt76: connac: move mt7615_mcu_del_wtbl_all to connac
- wifi: mt76: mt7915: improve hardware restart reliability
- wifi: mt76: mt7915: fix omac index assignment after hardware reset
- wifi: mt76: mt7915: fix register mapping
- wifi: mt76: mt7996: fix register mapping
- wifi: mt76: mt7996: add max mpdu len capability
- wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU
- wifi: mt76: mt7996: fix HE Phy capability
- wifi: mt76: mt7996: fix incorrect indexing of MIB FW event
- wifi: mt76: mt7996: fix ldpc setting
- cpufreq: ACPI: Fix max-frequency computation
- selftests: timers: clocksource-switch: Adapt progress to kselftest
framework
- selftests: harness: fix printing of mismatch values in __EXPECT()
- wifi: cfg80211: adjust allocation of colocated AP data
- inet: ipmr: fix data-races
- clk: analogbits: Fix incorrect calculation of vco rate delta
- pwm: stm32: Add check for clk_enable()
- selftests/landlock: Fix error message
- net/mlxfw: Drop hard coded max FW flash image size
- octeon_ep: remove firmware stats fetch in ndo_get_stats64
- netfilter: nf_tables: fix set size with rbtree backend
- netfilter: nft_flow_offload: update tcp state flags under lock
- tcp_cubic: fix incorrect HyStart round start detection
- libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is
missing
- tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
- libbpf: Fix segfault due to libelf functions not setting errno
- ASoC: sun4i-spdif: Add clock multiplier settings
- selftests/bpf: Fix fill_link_info selftest on powerpc
- crypto: caam - use JobR's space to access page 0 regs
- perf header: Fix one memory leakage in process_bpf_btf()
- perf header: Fix one memory leakage in process_bpf_prog_info()
- perf bpf: Fix two memory leakages when calling
perf_env__insert_bpf_prog_info()
- ASoC: renesas: rz-ssi: Use only the proper amount of dividers
- perf expr: Initialize is_test value in expr__ctx_new()
- ktest.pl: Remove unused declarations in run_bisect_test function
- crypto: hisilicon/sec2 - fix for aead icv error
- crypto: hisilicon/sec2 - fix for aead invalid authsize
- crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
- ALSA: seq: remove redundant 'tristate' for SND_SEQ_UMP_CLIENT
- ALSA: seq: Make dependency on UMP clearer
- padata: fix sysfs store callback check
- perf top: Don't complain about lack of vmlinux when not resolving some
kernel samples
- perf machine: Don't ignore _etext when not a text symbol
- perf namespaces: Introduce nsinfo__set_in_pidns()
- perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool
- ASoC: Intel: avs: Prefix SKL/APL-specific members
- ASoC: Intel: avs: Abstract IPC handling
- ASoC: Intel: avs: Do not readq() u32 registers
- ASoC: Intel: avs: Fix theoretical infinite loop
- perf report: Fix misleading help message about --demangle
- pinctrl: stm32: Add check for clk_enable()
- pinctrl: amd: Take suspend type into consideration which pins are non-
wake
- bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
- ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire
A115-31 laptop
- perf lock: Fix parse_lock_type which only retrieve one lock flag
- padata: add pd get/put refcnt helper
- cifs: Use cifs_autodisable_serverino() for disabling
CIFS_MOUNT_SERVER_INUM in readdir.c
- soc: atmel: fix device_node release in atmel_soc_device_init()
- ARM: at91: pm: change BU Power Switch to automatic mode
- arm64: dts: mediatek: mt8186: Move wakeup to MTU3 to get working suspend
- arm64: dts: mt8183: set DMIC one-wire mode on Damu
- arm64: dts: mediatek: mt8516: fix GICv2 range
- arm64: dts: mediatek: mt8516: fix wdt irq type
- arm64: dts: mediatek: mt8516: add i2c clock-div property
- arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A
- ARM: dts: stm32: Fix IPCC EXTI declaration on stm32mp151
- RDMA/mlx4: Avoid false error about access to uninitialized gids array
- arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
- arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property
- arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible property
- arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible property
- arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property
- arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
- arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
- ARM: dts: aspeed: yosemite4: correct the compatible string of adm1272
- ARM: dts: aspeed: yosemite4: Add required properties for IOE on fan
boards
- ARM: dts: aspeed: yosemite4: correct the compatible string for max31790
- arm: dts: socfpga: use reset-name "stmmaceth-ocp" instead of "ahb"
- RDMA/rxe: Improve newline in printing messages
- RDMA/rxe: Fix mismatched max_msg_sz
- arm64: dts: mediatek: mt8183: kenzo: Support second source touchscreen
- arm64: dts: mediatek: mt8183: willow: Support second source touchscreen
- RDMA/srp: Fix error handling in srp_add_port
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1
- ARM: dts: stm32: Deduplicate serial aliases and chosen node for
STM32MP15xx DHCOM SoM
- ARM: dts: stm32: Swap USART3 and UART8 alias on STM32MP15xx DHCOM SoM
- arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage
settings
- arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
- arm64: dts: qcom: move common parts for sa8775p-ride variants into a
.dtsi
- arm64: dts: qcom: sa8775p: Update sleep_clk frequency
- arm64: dts: qcom: msm8996: Fix up USB3 interrupts
- arm64: dts: qcom: msm8994: Describe USB interrupts
- arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
- arm64: dts: qcom: msm8916: correct sleep clock frequency
- arm64: dts: qcom: msm8939: correct sleep clock frequency
- arm64: dts: qcom: msm8994: correct sleep clock frequency
- arm64: dts: qcom: qcs404: correct sleep clock frequency
- arm64: dts: qcom: q[dr]u1000: correct sleep clock frequency
- arm64: dts: qcom: qrb4210-rb2: correct sleep clock frequency
- arm64: dts: qcom: sc7280: correct sleep clock frequency
- arm64: dts: qcom: sdx75: correct sleep clock frequency
- arm64: dts: qcom: sm4450: correct sleep clock frequency
- arm64: dts: qcom: sm6125: correct sleep clock frequency
- arm64: dts: qcom: sm6375: correct sleep clock frequency
- arm64: dts: qcom: sm8250: correct sleep clock frequency
- arm64: dts: qcom: sm8350: correct sleep clock frequency
- arm64: dts: qcom: sm8450: correct sleep clock frequency
- ARM: dts: microchip: sama5d27_wlsom1_ek: Add no-1-8-v property to sdmmc0
node
- arm64: dts: ti: k3-am62: Remove duplicate GICR reg
- arm64: dts: ti: k3-am62a: Remove duplicate GICR reg
- arm64: dts: allwinner: a64: explicitly assign clock parent for TCON0
- RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error
- ARM: omap1: Fix up the Retu IRQ on Nokia 770
- arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine
riser to dtso
- arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled
ov7251 camera
- arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply
- arm64: dts: qcom: sc7180-*: Remove thermal zone polling delays
- arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
- arm64: dts: qcom: sc7180: change labels to lower-case
- arm64: dts: qcom: sc7180: fix psci power domain node names
- arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280
properties
- arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes
- dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
- arm64: dts: mediatek: add per-SoC compatibles for keypad nodes
- arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts
- arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts
- ARM: dts: mediatek: mt7623: fix IR nodename
- fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
- arm64: tegra: Fix DMA ID for SPI2
- i3c: dw: Add hot-join support.
- RDMA/mlx5: Fix indirect mkey ODP page count
- of: reserved-memory: Do not make kmemleak ignore freed address
- efi: sysfb_efi: fix W=1 warnings when EFI is not set
- spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors
- media: rc: iguanair: handle timeouts
- media: lmedm04: Handle errors for lme2510_int_read
- PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
- media: marvell: Add check for clk_enable()
- media: i2c: imx290: Register 0x3011 varies between imx327 and imx290
- media: i2c: imx412: Add missing newline to prints
- media: i2c: ov9282: Correct the exposure offset
- media: mipi-csis: Add check for clk_enable()
- media: camif-core: Add check for clk_enable()
- media: uvcvideo: Propagate buf->error to userspace
- mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc
- mtd: hyperbus: hbmc-am654: fix an OF node reference leak
- media: nxp: imx8-isi: fix v4l2-compliance test errors
- watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe()
- staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
- media: dvb-usb-v2: af9035: fix ISO C90 compilation error on
af9035_i2c_master_xfer
- PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
- PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
- scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
- scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
- ocfs2: mark dquot as inactive if failed to start trans while releasing
dquot
- module: Extend the preempt disabled section in
dereference_symbol_descriptor().
- serial: 8250: Adjust the timeout for FIFO mode
- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
- tools/bootconfig: Fix the wrong format specifier
- xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
- dmaengine: ti: edma: fix OF node reference leaks in edma_driver
- rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr()
- regulator: core: Add missing newline character
- gpio: mxc: remove dead code after switch to DT-only
- net: fec: implement TSO descriptor cleanup
- PM: hibernate: Add error handling for syscore_suspend()
- iavf: allow changing VLAN state without calling PF
- net: netdevsim: try to close UDP port harness races
- ptp: Properly handle compat ioctls
- net: stmmac: Limit the number of MTL queues to hardware capability
- net: stmmac: Limit FIFO size by hardware capability
- perf trace: Fix runtime error of index out of bounds
- Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming
- vsock: Allow retrying on connect() failure
- bgmac: reduce max frame size to support just MTU 1500
- net: sh_eth: Fix missing rtnl lock in suspend/resume path
- genksyms: fix memory leak when the same symbol is added from source
- genksyms: fix memory leak when the same symbol is read from *.symref
file
- RISC-V: Mark riscv_v_init() as __init
- ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback
- io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()
- cifs: Fix getting and setting SACLs over SMB1
- kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
- kconfig: fix memory leak in sym_warn_unmet_dep()
- hexagon: fix using plain integer as NULL pointer warning in cmpxchg
- hexagon: Fix unbalanced spinlock in die()
- f2fs: Introduce linear search for dentries
- Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC
messages"
- kbuild: switch from lz4c to lz4 for compression
- selftests/rseq: Fix handling of glibc without rseq support
- ktest.pl: Check kernelrelease return in get_version
- ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
- usb: gadget: f_tcm: Fix Get/SetInterface return value
- usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
- usb: dwc3: core: Defer the probe until USB power supply ready
- usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to
PD_T_SENDER_RESPONSE
- usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
PPS
- btrfs: output the reason for open_ctree() failure
- s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
- LoongArch: Change 8 to 14 for LOONGARCH_MAX_{BRP,WRP}
- block: copy back bounce buffer to user-space correctly in case of split
- nvme-tcp: Fix I/O queue cpu spreading for multiple controllers
- sched/fair: Untangle NEXT_BUDDY and pick_next_task()
- sched: Fix race between yield_to() and try_to_wake_up()
- drm/v3d: Fix performance counter source settings on V3D 7.x
- drm/rockchip: vop2: fix rk3588 dp+dsi maxclk verification
- drm/rockchip: vop2: Set AXI id for rk3588
- drm/rockchip: vop2: Setup delay cycle for Esmart2/3
- drm/rockchip: vop2: Add check for 32 bpp format for rk3588
- drm/msm/dpu: provide DSPP and correct LM config for SDM670
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8650
- drm/msm: don't clean up priv->kms prematurely
- drm/msm/mdp4: correct LCDC regulator name
- wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop
- selftests/bpf: Actuate tx_metadata_len in xdp_hw_metadata
- selftests: ktap_helpers: Fix uninitialized variable
- inet: constify inet_sk_bound_dev_eq() net parameter
- inet: constify 'struct net' parameter of various lookup helpers
- udp: constify 'struct net' parameter of socket lookups
- inet6: constify 'struct net' parameter of various lookup helpers
- ipv6: udp: constify 'struct net' parameter of socket lookups
- dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition
- dt-bindings: clock: Add i.MX91 clock support
- dt-bindings: clock: imx93: Add SPDIF IPG clk
- clk: imx93: Move IMX93_CLK_END macro to clk driver
- clk: imx: add i.MX91 clk
- clk: imx93: Add IMX93_CLK_SPDIF_IPG clock
- arm64: dts: imx93: Use IMX93_CLK_SPDIF_IPG as SPDIF IPG clock
- clk: imx: Apply some clks only for i.MX93
- wifi: rtw89: mcc: consider time limits not divisible by 1024
- wifi: iwlwifi: cleanup uefi variables loading
- wifi: iwlwifi: fw: read STEP table from correct UEFI var
- wifi: mt76: mt7996: fix overflows seen when writing limit attributes
- wifi: mt76: mt7996: fix definition of tx descriptor
- Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
- platform/mellanox: mlxbf-pmc: incorrect type in assignment
- platform/x86: x86-android-tablets: make platform data be static
- crypto: api - Fix boot-up self-test race
- pinctrl: nomadik: Add check for clk_enable()
- rhashtable: Fix potential deadlock by moving schedule_work outside lock
- crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to
'async'
- perf maps: Fix display of kernel symbols
- perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the perf
tarball
- ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers
- tools: Sync if_xdp.h uapi tooling header
- rhashtable: Fix rhashtable_try_insert test
- ARM: dts: imx7-tqma7: add missing vs-supply for LM75A (rev. 01xxx)
- arm64: dts: renesas: rzg3s-smarc: Fix the debug serial alias
- arm64: dts: mediatek: mt8395-genio-1200-evk: Drop regulator-compatible
property
- arm64: dts: qcom: sm8550: correct sleep clock frequency
- arm64: dts: qcom: sm8650: correct sleep clock frequency
- arm64: dts: qcom: x1e80100: correct sleep clock frequency
- ARM: dts: microchip: sama5d29_curiosity: Add no-1-8-v property to sdmmc0
node
- RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
- [Config] updateconfigs for INFINIBAND_HNS
- RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event
- iommu: iommufd: fix WARNING in iommufd_device_unbind
- remoteproc: mtk_scp: Only populate devices for SCP cores
- PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset()
- PCI: dwc: Always stop link in the dw_pcie_suspend_noirq
- PCI: microchip: Add support for using either Root Port 1 or 2
- PCI: microchip: Set inbound address translation for coherent or non-
coherent mode
- erofs: get rid of erofs_{find,insert}_workgroup
- erofs: move erofs_workgroup operations into zdata.c
- erofs: sunset `struct erofs_workgroup`
- erofs: fix potential return value overflow of z_erofs_shrink_scan()
- tty: mips_ejtag_fdc: fix one more u8 warning
- xfrm: Add support for per cpu xfrm state handling.
- xfrm: Cache used outbound xfrm states at the policy.
- xfrm: Add an inbound percpu state cache.
- xfrm: Don't disable preemption while looking up cache state.
- idpf: add read memory barrier when checking descriptor done bit
- net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
- tools: ynl: c: correct reverse decode of empty attrs
- selftests: mptcp: extend CFLAGS to keep options from environment
- selftests: net/{lib,openvswitch}: extend CFLAGS to keep options from
environment
- net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts
in
- ethtool: Fix set RXNFC command with symmetric RSS hash
- tools/power turbostat: Fix forked child affinity regression
- md: add a new callback pers->bitmap_sector()
- md/raid5: implement pers->bitmap_sector()
- xfs: check for dead buffers in xfs_buf_find_insert
- xfs: don't shut down the filesystem for media failures beyond end of log
- usb: dwc3: Skip resume if pm_runtime_set_active() fails
- clk: qcom: gcc-x1e80100: Do not turn off usb_2 controller GDSC
- xfrm: Add error handling when nla_put_u32() returns an error
- xfrm: Fix acquire state insertion.
- ethtool: Fix access to uninitialized fields in set RXNFC command
- ASoC: da7213: Initialize the mutex
- drm/amd/display: Add hubp cache reset when powergating
- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
- ethtool: ntuple: fix rss + ring_cookie check
- Upstream stable to v6.6.76, v6.12.13
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57975
- btrfs: do proper folio cleanup when run_delalloc_nocow() failed
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21714
- RDMA/mlx5: Fix implicit ODP use after free
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21801
- net: ravb: Fix missing rtnl lock in suspend/resume path
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21809
- rxrpc, afs: Fix peer hash locking vs RCU callback
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58057
- idpf: convert workqueues to unbound
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57953
- rtc: tps6594: Fix integer overflow on 32bit systems
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57982
- xfrm: state: fix out-of-bounds read during lookup
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21721
- nilfs2: handle errors that nilfs_prepare_chunk() may return
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21722
- nilfs2: do not force clear folio if buffer is referenced
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21798
- firewire: test: Fix potential null dereference in firewire kunit test
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21723
- scsi: mpi3mr: Fix possible crash when setting up bsg fails
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21724
- iommufd/iova_bitmap: Fix shift-out-of-bounds in
iova_bitmap_offset_to_index()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21825
- bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57990
- wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57974
- udp: Deal with race between UDP socket address change and rehash
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57994
- ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57999
- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58054
- staging: media: max96712: fix kernel oops when removing module
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58055
- usb: gadget: f_tcm: Don't free command immediately
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57979
- pps: Fix a use-after-free
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57980
- media: uvcvideo: Fix double free in error path
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58056
- remoteproc: core: Fix ida_free call while not allocated
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21705
- mptcp: handle fastopen disconnect correctly
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21707
- mptcp: consolidate suboption status
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57981
- usb: xhci: Fix NULL pointer dereference on certain command aborts
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21708
- net: usb: rtl8150: enable basic endpoint checking
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21826
- netfilter: nf_tables: reject mismatching sum of field_len with set key
length
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21808
- net: xdp: Disallow attaching device-bound programs in generic mode
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21710
- tcp: correct handling of extreme memory squeeze
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21715
- net: davicom: fix UAF in dm9000_drv_remove
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21716
- vxlan: Fix uninit-value in vxlan_vnifilter_dump()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21718
- net: rose: fix timer races against user threads
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21719
- ipmr: do not call mr_mfc_uses_dev() for unres entries
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21802
- net: hns3: fix oops when unload drivers paralleling
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58058
- ubifs: skip dumping tnc tree when zroot is null
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58069
- rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21720
- xfrm: delete intermediate secpath entry in packet offload mode
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21803
- LoongArch: Fix warnings during S3 suspend
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21810
- driver core: class: Fix wild pointer dereferences in API
class_dev_iter_next()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21811
- nilfs2: protect access to buffers with no active references
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21804
- PCI: rcar-ep: Fix incorrect variable used when calling
devm_request_mem_region()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21829
- RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57984
- i3c: dw: Fix use-after-free in dw_i3c_master driver due to race
condition
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58034
- memory: tegra20-emc: fix an OF node reference bug in
tegra_emc_find_node_by_ram_code()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57973
- rdma/cxgb4: Prevent potential integer overflow on 32bit
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21725
- smb: client: fix oops due to unset link speed
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21726
- padata: avoid UAF for reorder_work
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21727
- padata: fix UAF in padata_reorder
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21728
- bpf: Send signals asynchronously if !preemptible
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58070
- bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21711
- net/rose: prevent integer overflows in rose_setsockopt()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21799
- net: ethernet: ti: am65-cpsw: fix freeing IRQ in
am65_cpsw_nuss_remove_tx_chns()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21806
- net: let net.core.dev_weight always be non-zero
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21830
- landlock: Handle weird files
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21828
- wifi: mac80211: don't flush non-uploaded STAs
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58061
- wifi: mac80211: prohibit deactivating all links
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57993
- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding
endpoint check
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58071
- team: prevent adding a device which is already a team device lower
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58063
- wifi: rtlwifi: fix memory leaks and invalid access at probe error path
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58072
- wifi: rtlwifi: remove unused check_buddy_priv
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58053
- rxrpc: Fix handling of received connection abort
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57996
- net_sched: sch_sfq: don't allow 1 packet limit
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57997
- wifi: wcn36xx: fix channel survey memory allocation size
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58051
- ipmi: ipmb: Add check devm_kasprintf() returned value
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58068
- OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57998
- OPP: add index check to assert to avoid buffer overflow in _read_freq()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58052
- drm/amdgpu: Fix potential NULL pointer dereference in
atomctrl_get_smc_sclk_range_table
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57986
- HID: core: Fix assumption that Resolution Multipliers must be in Logical
Collections
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21731
- nbd: don't allow reconnect after disconnect
* CVE-2025-37798
- sch_htb: make htb_qlen_notify() idempotent
- sch_htb: make htb_deactivate() idempotent
- sch_drr: make drr_qlen_notify() idempotent
- sch_hfsc: make hfsc_qlen_notify() idempotent
- sch_qfq: make qfq_qlen_notify() idempotent
- sch_ets: make est_qlen_notify() idempotent
- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
* CVE-2025-37997
- netfilter: ipset: fix region locking in hash types
* CVE-2025-22088
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
* CVE-2025-37890
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child
qdisc
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
* raid1: Fix NULL pointer dereference in process_checks() (LP: #2112519)
- md/raid1: Add check for missing source disk in process_checks()
* Packaging resync (LP: #1786013)
- [Packaging] update variants
- [Packaging] update annotations scripts
-- Mehmet Basaran <mehmet.basa...@canonical.com> Sun, 15 Jun 2025
10:53:51 +0300
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2112462
Title:
Unexpected system reboot at loading GUI session on some AMD platforms
To manage notifications about this bug go to:
https://bugs.launchpad.net/hwe-next/+bug/2112462/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
