** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-05
+
+ Ported from the following upstream stable releases:
+ v6.6.131, v6.12.78, v6.12.79, v6.12.80
+
from git://git.kernel.org/
+
+ perf: Extract a few helpers
+ perf: Make sure to use pmu_ctx->pmu for groups
+ cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
+ hwmon: (axi-fan-control) Use device firmware agnostic API
+ hwmon: (axi-fan-control) Make use of dev_err_probe()
+ hwmon: axi-fan: don't use driver_override as IRQ name
+ sh: platform_early: remove pdev->driver_override check
+ bpf: Release module BTF IDR before module unload
+ bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
+ HID: asus: avoid memory leak in asus_report_fixup()
+ platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
+ nvme-pci: cap queue creation to used queues
+ nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
+ platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1
+ platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on
SUPI S10
+ nvme-pci: ensure we're polling a polled queue
+ HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
+ HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
+ net: usb: r8152: add TRENDnet TUC-ET2G
+ HID: mcp2221: cancel last I2C command on read error
+ HID: asus: add xg mobile 2023 external hardware support
+ module: Fix kernel panic when a symbol st_shndx is out of bounds
+ ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
+ ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
+ dma-buf: Include ioctl.h in UAPI header
+ HID: apple: avoid memory leak in apple_report_fixup()
+ btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
+ ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
+ ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
+ objtool: Handle Clang RSP musical chairs
+ usb: core: new quirk to handle devices with zero configurations
+ spi: intel-pci: Add support for Nova Lake mobile SPI flash
+ xfrm: call xdo_dev_state_delete during state update
+ xfrm: Fix the usage of skb->sk
+ esp: fix skb leak with espintcp and async crypto
+ af_key: validate families in pfkey_send_migrate()
+ dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
+ can: statistics: add missing atomic access in hot path
+ Bluetooth: L2CAP: Validate PDU length before reading SDU length in
l2cap_ecred_data_rcv()
+ Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
sock_hold
+ Bluetooth: hci_ll: Fix firmware leak on error path
+ Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
+ pinctrl: mediatek: common: Fix probe failure for devices without EINT
+ ionic: fix persistent MAC address override on PF
+ nfc: nci: fix circular locking dependency in nci_close_device
+ net: openvswitch: Avoid releasing netdev before teardown completes
+ openvswitch: defer tunnel netdev_put to RCU release
+ openvswitch: validate MPLS set/set_masked payload length
+ net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe
buffer
+ rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
+ platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
+ ice: use ice_update_eth_stats() for representor stats
+ ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire.
+ ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
+ tcp: optimize inet_use_bhash2_on_bind()
+ udp: Fix wildcard bind conflict check when using hash2
+ net: enetc: fix the output issue of 'ethtool --show-ring'
+ dma-mapping: add missing `inline` for `dma_free_attrs`
+ Bluetooth: L2CAP: Fix send LE flow credits in ACL link
+ Bluetooth: Remove 3 repeated macro definitions
+ Bluetooth: hci_sync: Remove remaining dependencies of hci_request
+ Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
+ Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
+ Bluetooth: btusb: clamp SCO altsetting table indices
+ tls: Purge async_hold in tls_decrypt_async_wait()
+ netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
+ netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
+ netfilter: nf_conntrack_expect: skip expectations in other netns via proc
+ netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
+ netfilter: ctnetlink: use netlink policy range checks
+ net: macb: use the current queue number for stats
+ regmap: Synchronize cache for the page selector
+ RDMA/rw: Fall back to direct SGE on MR pool exhaustion
+ RDMA/irdma: Initialize free_qp completion before using it
+ RDMA/irdma: Update ibqp state to error if QP is already in error state
+ RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
+ RDMA/irdma: Clean up unnecessary dereference of event->cm_node
+ RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
+ RDMA/irdma: Fix deadlock during netdev reset with active connections
+ RDMA/irdma: Return EINVAL for invalid arp index error
+ scsi: scsi_transport_sas: Fix the maximum channel scanning issue
+ x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
+ drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
+ PM: hibernate: Don't ignore return from set_memory_ro()
+ PM: hibernate: Drain trailing zero pages on userspace restore
+ spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
+ ASoC: Intel: catpt: Fix the device initialization
+ ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
+ drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
+ hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
+ sysctl: fix uninitialized variable in proc_do_large_bitmap
+ ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
+ ASoC: adau1372: Fix clock leak on PLL lock failure
+ spi: spi-fsl-lpspi: fix teardown order issue (UAF)
+ s390/syscalls: Add spectre boundary for syscall dispatch table
+ s390/barrier: Make array_index_mask_nospec() __always_inline
+ ksmbd: replace hardcoded hdr2_len with offsetof() in
smb2_calc_max_out_buf_len()
+ ksmbd: fix potencial OOB in get_file_all_info() for compound requests
+ ksmbd: do not expire session on binding failure
+ ALSA: firewire-lib: fix uninitialized local variable
+ ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload
+ can: gw: fix OOB heap access in cgw_csum_crc8_rel()
+ can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
+ cpufreq: conservative: Reset requested_freq on limits change
+ platform/x86: ISST: Correct locked bit width
+ KVM: arm64: Discard PC update state on vcpu reset
+ hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes
+ hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute
temperature
+ hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
+ media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
+ virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
napi_tx is false
+ s390/entry: Scrub r12 register on kernel entry
+ erofs: add GFP_NOIO in the bio completion if needed
+ alarmtimer: Fix argument order in alarm_timer_forward()
+ scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
+ scsi: ses: Handle positive SCSI error from ses_recv_diag()
+ net: macb: Use dev_consume_skb_any() to free TX SKBs
+ KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
+ jbd2: gracefully abort on checkpointing state corruptions
+ irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
+ dmaengine: sh: rz-dmac: Protect the driver specific lists
+ dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
+ LoongArch: Workaround LS2K/LS7A GPU DMA hang bug
+ xfs: stop reclaim before pushing AIL during unmount
+ xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
+ ext4: fix journal credit check when setting fscrypt context
+ ext4: convert inline data to extents when truncate exceeds inline size
+ ext4: fix fsync(2) for nojournal mode
+ ext4: make recently_deleted() properly work with lazy itable initialization
+ ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
+ ext4: avoid infinite loops caused by residual data
+ ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
+ ext4: reject mount if bigalloc with s_first_data_block != 0
+ ext4: fix use-after-free in update_super_work when racing with umount
+ ext4: fix the might_sleep() warnings in kvfree()
+ ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
+ ext4: always drain queued discard work in ext4_mb_release()
+ arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off
+ powerpc64/bpf: do not increment tailcall count when prog is NULL
+ ksmbd: fix memory leaks and NULL deref in smb2_lock()
+ tracing: Switch trace_osnoise.c code over to use guard() and __free()
+ tracing: Fix potential deadlock in cpu hotplug with osnoise
+ mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
+ mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
+ libbpf: Fix -Wdiscarded-qualifiers under C23
+ mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
+ xfs: avoid dereferencing log items after push callbacks
+ xfs: save ailp before dropping the AIL lock in push callbacks
+ dmaengine: idxd: Fix not releasing workqueue on .release()
+ dmaengine: idxd: Fix memory leak when a wq is reset
+ phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()
+ dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and
CYCLE_BIT bits for HDMA.
+ dmaengine: xilinx: xdma: Fix regmap init error handling
+ dmaengine: xilinx: xilinx_dma: Fix dma_device directions
+ dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
+ dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
+ dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
+ btrfs: fix super block offset in error message in btrfs_validate_super()
+ btrfs: fix leak of kobject name for sub-group space_info
+ btrfs: fix lost error when running device stats on multiple devices fs
+ dmaengine: idxd: Fix freeing the allocated ida too late
+ futex: Clear stale exiting pointer in futex_lock_pi() retry path
+ ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
+ kexec: Consolidate machine_kexec_mask_interrupts() implementation
+ UBUNTU: [Config] Enable GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD by default.
+ kexec: Include kernel-end even without crashkernel
+ powerpc/kexec/core: use big-endian types for crash variables
+ drm/msm/dsi: fix hdisplay calculation when programming dsi registers
+ perf disasm: Fix off-by-one bug in outside check
+ net/mlx5: Fix crash when moving to switchdev mode
+ bonding: add ESP offload features when slaves support
+ bonding: Correctly support GSO ESP offload
+ net: add a common function to compute features for upper devices
+ bonding: use common function to compute the features
+ bonding: fix type confusion in bond_setup_by_slave()
+ xdp: allow attaching already registered memory model to xdp_rxq_info
+ net: add generic percpu page_pool allocator
+ net: do not consume a cacheline for system_page_pool
+ xdp: register system page pool as an XDP memory model
+ net: add xmit recursion limit to tunnel xmit functions
+ netfilter: nf_tables: always walk all pending catchall elements
+ net: prevent NULL deref in ip[6]tunnel_xmit()
+ ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
+ usb: typec: altmode/displayport: set displayport signaling rate in configure
message
+ rust: kbuild: allow `unused_features`
+ ceph: add a bunch of missing ceph_path_info initializers
+ net/tcp-ao: Fix MAC comparison to be constant-time
+ drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
+ tracing: Fix enabling multiple events on the kernel command line and
bootconfig
+ qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
+ xfs: fix returned valued from xfs_defer_can_append
+ iio: imu: inv_icm42600: add support of ICM-42686-P
+ iio: imu: inv_icm42600: fix odr switch when turning buffer off
+ perf/x86/intel/uncore: Support more units on Granite Rapids
+ perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
+ cleanup: Provide retain_and_null_ptr()
+ usb: gadget: f_ncm: Fix net_device lifecycle with device_move
+ KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create()
+ KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration
+ KVM: x86: do not allow re-enabling quirks
+ KVM: x86: Allow vendor code to disable quirks
+ KVM: x86: Introduce supported_quirks to block disabling quirks
+ KVM: x86: Remove VMX support for virtualizing guest MTRR memtypes
+ KVM: VMX: Drop support for forcing UC memory when guest CR0.CD=1
+ KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT
+ KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
+ KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
+ drm/xe/sync: Cleanup partially initialized sync on parse failure
+ ice: fix devlink reload call trace
+ io_uring/uring_cmd: fix too strict requirement on ioctl
+ erofs: fix inline data read failure for ztailpacking pclusters
+ mm: merge folio_is_secretmem() and folio_fast_pin_allowed() into
gup_fast_folio_allowed()
+ mm: thp: deny THP for files on anonymous inodes
+ sched/fair: Fix zero_vruntime tracking
+ mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
+ drm/i915/dsc: Add Selective Update register definitions
+ drm/imagination: Fix deadlock in soft reset sequence
+ ata: libata-scsi: Return residual for emulated SCSI commands
+ ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()
+ soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()
+ firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap()
+ Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
+ nf_tables: nft_dynset: fix possible stateful expression memleak in error path
+ bonding: prevent potential infinite loop in bond_header_parse()
+ drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
+ perf/x86/intel: Add missing branch counters constraint apply
+ Revert "LoongArch: Add machine_kexec_mask_interrupts() implementation"
+ cxl/port: Fix use after free of parent_port in cxl_detach_ep()
+ driver core: generalize driver_override in struct device
+ driver core: platform: use generic driver_override infrastructure
+ bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
+ HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
+ kbuild: install-extmod-build: Package resolve_btfids if necessary
+ nvmet: move async event work off nvmet-wq
+ ALSA: hda/realtek: add quirk for ASUS UM6702RC
+ i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
+ xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
+ xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
+ xfrm: prevent policy_hthresh.work from racing with netns teardown
+ Bluetooth: MGMT: Fix dangling pointer on
mgmt_add_adv_patterns_monitor_complete
+ net: bcmasp: remove eee_enabled/eee_active in bcmasp_get_eee()
+ net: bcm: asp2: fix LPI timer handling
+ net: bcm: asp2: remove tx_lpi_enabled
+ net: bcmasp: Add support for ASP 2.2
+ net: bcm: asp2: convert to phylib managed EEE
+ net: bcmasp: Remove support for asp-v2.0
+ net: bcmasp: streamline early exit in probe
+ net: bcmasp: fix double free of WoL irq
+ net: bcmasp: Add support for asp-v3.0
+ net: bcmasp: fix double disable of clk
+ platform/x86: intel-hid: disable wakeup_mode during hibernation
+ iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
+ team: fix header_ops type confusion with non-Ethernet ports
+ ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
+ spi: meson-spicc: Fix double-put in remove path
+ drm/amd/display: Do not skip unrelated mode changes in DSC validation
+ spi: Group CS related fields in struct spi_device
+ spi: use generic driver_override infrastructure
+ hwmon: (pmbus/core) Fix various coding style issues
+ hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
+ hwmon: (pmbus) Introduce the concept of "write-only" attributes
+ x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
+ ovl: fix wrong detection of 32bit inode numbers
+ net: macb: Move devm_{free,request}_irq() out of spin lock area
+ dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate()
+ dmaengine: fsl-edma: fix channel parameter config for fixed channel requests
+ LoongArch: Fix missing NULL checks for kstrdup()
+ xfs: scrub: unlock dquot before early return in quota scrub
+ ext4: validate p_idx bounds in ext4_ext_correct_indexes
+ LoongArch: vDSO: Emit GNU_EH_FRAME correctly
+ spi: tegra210-quad: Protect curr_xfer check in IRQ handler
+ media: nxp: imx8-isi: Fix streaming cleanup on release
+ rust: pin-init: internal: init: document load-bearing fact of field accessors
+ ovl: Use str_on_off() helper in ovl_show_options()
+ ovl: make fsync after metadata copy-up opt-in mount option
+ virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
+ net: add proper RCU protection to /proc/net/ptype
+ landlock: Optimize file path walks and prepare for audit support
+ landlock: Fix handling of disconnected directories
+ idpf: check error for register_netdev() on init
+ idpf: detach and close netdevs while handling a reset
+ idpf: Fix RSS LUT NULL pointer crash on early ethtool operations
+ idpf: Fix RSS LUT NULL ptr issue after soft reset
+ ASoC: ak4458: Convert to RUNTIME_PM_OPS() & co
+ netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
+ dmaengine: idxd: fix possible wrong descriptor completion in
llist_abort_desc()
+ xen/privcmd: unregister xenstore notifier on module exit
+ futex: Require sys_futex_requeue() to have identical flags
+ dmaengine: idxd: Fix leaking event log memory
+ net: bcmasp: Restore programming of TX map vector register
+ net: bcmasp: Fix network filter wake for asp-3.0
+ idpf: nullify pointers after they are freed
+ UBUNTU: Upstream stable to v6.6.131, v6.12.78, v6.12.79, v6.12.80
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2155660
Title:
Noble update: upstream stable patchset 2026-06-05
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2155660/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
