Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-10
Ported from the following upstream stable releases:
v6.12.68, v6.18.8
from git://git.kernel.org/
arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
arm64: dts: rockchip: Fix wrong register range of rk3576 gpu
perf parse-events: Fix evsel allocation failure
Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
wifi: ath12k: don't force radio frequency check in freq_to_idx()
ata: ahci: Do not read the per port area for unimplemented ports
ata: libata: Call ata_dev_config_lpm() for ATAPI devices
ata: libata-sata: Improve link_power_management_supported sysfs attribute
ata: libata: Add cpr_log to ata_dev_print_features() early return
ata: libata: Add DIPM and HIPM to ata_dev_print_features() early return
ata: libata: Print features also for ATAPI devices
wifi: ath12k: cancel scan only on active scan vdev
wifi: ath12k: Fix scan state stuck in ABORTING after cancel_remain_on_channel
wifi: ath12k: fix dead lock while flushing management frames
wifi: ath12k: Fix wrong P2P device link id issue
ice: initialize ring_stats->syncp
ice: Avoid detrimental cleanup for bond during interface stop
ice: Fix incorrect timeout ice_release_res()
igc: Restore default Qbv schedule when changing channels
igc: fix race condition in TX timestamp read for register 0
igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue
vsock/virtio: Coalesce only linear skb
net: usb: dm9601: remove broken SR9700 support
bonding: limit BOND_MODE_8023AD to Ethernet devices
l2tp: Fix memleak in l2tp_udp_encap_recv().
selftests: net: fib-onlink-tests: Convert to use namespaces by default
net: freescale: ucc_geth: Return early when TBI PHY can't be found
can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb()
error
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
amd-xgbe: avoid misleading per-packet error log
gue: Fix skb memleak with inner IP protocol 0.
tools: ynl: Specify --no-line-number in ynl-regen.sh.
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
veth: fix data race in veth_get_ethtool_stats
pwm: Ensure ioctl() returns a negative errno on error
l2tp: avoid one data-race in l2tp_tunnel_del_work()
ipvlan: Make the addrs_lock be per port
octeontx2: cn10k: fix RX flowid TCAM mask handling
net/sched: qfq: Use cl_is_active to determine whether class is active in
qfq_rm_from_ag
wifi: mac80211: don't perform DA check on S1G beacon
serial: 8250_pci: Fix broken RS485 for F81504/508/512
serial: Fix not set tty->port race condition
comedi: dmm32at: serialize use of paged registers
w1: therm: Fix off-by-one buffer overflow in alarms_store
w1: fix redundant counter decrement in w1_attach_slave_device()
Revert "nfc/nci: Add the inconsistency check between the input data length and
count"
Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
scsi: storvsc: Process unsupported MODE_SENSE_10
scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
i2c: spacemit: drop IRQF_ONESHOT flag from IRQ request
ARM: dts: microchip: sama7d65: fix the ranges property for flx9
ARM: dts: microchip: sama7d65: fix size-cells property for i2c3
arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
arm64: dts: rockchip: remove dangerous max-link-speed from helios64
arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro
arm64: dts: rockchip: Fix headphones widget name on NanoPi M5
arm64: dts: rockchip: Configure MCLK for analog sound on NanoPi M5
rxrpc: Fix recvmsg() unconditional requeue
x86/kfence: avoid writing L1TF-vulnerable PTEs
comedi: Fix getting range information for subdevices 16 to 255
fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
mm/hugetlb: fix hugetlb_pmd_shared()
mm/rmap: fix two comments related to huge_pmd_unshare()
mm: restore per-memcg proactive reclaim with !CONFIG_NUMA
timekeeping: Adjust the leap state for the correct auxiliary timekeeper
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
iio: adc: ad7280a: handle spi_setup() errors in probe()
iio: adc: ad7606: Fix incorrect type for error return variable
interconnect: debugfs: initialize src_node and dst_node to empty strings
spi: spi-sprd-adi: Fix double free in probe error path
regmap: Fix race condition in hwspinlock irqsave routine
kconfig: fix static linking of nconf
riscv: clocksource: Fix stimecmp update hazard on RV32
riscv: suspend: Fix stimecmp update hazard on RV32
platform/mellanox: Fix SN5640/SN5610 LED platform data
platform/x86/amd: Fix memory leak in wbrf_record()
scsi: core: Wake up the error handler when final completions race against each
other
scsi: qla2xxx: Sanitize payload size to prevent member overflow
ALSA: usb: Increase volume range that triggers a warning
iommu/amd: Fix error path in amd_iommu_probe_device()
drm/xe: Disable timestamp WA on VFs
drm/mediatek: dpi: Find next bridge during probe
drm/imagination: Wait for FW trace update command completion
vsock/test: Do not filter kallsyms by symbol type
netdevsim: fix a race issue related to the operation on bpf_bound_progs list
ice: Fix persistent failure in ice_get_rxfh
ice: fix devlink reload call trace
idpf: read lower clock bits inside the time sandwich
net: phy: intel-xway: fix OF node refcount leakage
net: hns3: fix data race in hns3_fetch_stats
idpf: Fix data race in idpf_net_dim
be2net: fix data race in be_get_new_eqd
net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
mISDN: annotate data-race around dev->work
ipv6: annotate data-race in ndisc_router_discovery()
usbnet: limit max_mtu based on device's hard_mtu
Octeontx2-pf: Update xdp features
clocksource: Reduce watchdog readout delay limit to prevent false positives
drm/xe/pm: Add scope-based cleanup helper for runtime PM
drm/xe: Update wedged.mode only after successful reset policy change
ublk: fix ublksrv pid handling for pid namespaces
selftests/ublk: fix IO thread idle check
selftests/ublk: fix error handling for starting device
selftests/ublk: fix garbage output in foreground mode
sched/fair: Fix pelt clock sync when entering idle
drm/amd/pm: Fix si_dpm mmCG_THERMAL_INT setting
drm/amd/pm: Don't clear SI SMC table when setting power limit
drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
drm/amdgpu: fix type for wptr in ring backup
drm/nouveau: add missing DCB connector types
drm/nouveau: implement missing DCB connector types; gracefully handle unknown
connectors
be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
selftests: net: amt: wait longer for connection before sending packets
bonding: provide a net pointer to __skb_flow_dissect()
net: bcmasp: Fix network filter wake for asp-3.0
net: dsa: fix off-by-one in maximum bridge ID determination
net: pcs: pcs-mtk-lynxi: report in-band capability for 2500Base-X
octeontx2-af: Fix error handling
net: openvswitch: fix data race in ovs_vport_get_upcall_stats
vsock/virtio: fix potential underflow in virtio_transport_get_credit()
vsock/test: fix seqpacket message bounds test
vsock/virtio: cap TX credit to local buffer size
net/sched: act_ife: avoid possible NULL deref
dpll: Prevent duplicate registrations
Octeontx2-af: Add proper checks for fwdata
x86: make page fault handling disable interrupts properly
leds: led-class: Only Add LED to leds_list when it is fully ready
panic: add note that 'panic_print' parameter is deprecated
panic: clean up message about deprecated 'panic_print' parameter
panic: only warn about deprecated panic_print on write access
of: fix reference count leak in of_alias_scan()
of: platform: Use default match table for /firmware
migrate: correct lock ordering for hugetlb file folios
iio: accel: adxl380: fix handling of unavailable "INT1" interrupt
iio: accel: iis328dq: fix gain values
iio: adc: ad9467: fix ad9434 vref mask
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
iio: adc: exynos_adc: fix OF populate on driver rebind
iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
iio: chemical: scd4x: fix reported channel endianness
iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source
iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
ALSA: hda/realtek: Add quirk for Samsung 730QED to fix headphone
ALSA: scarlett2: Fix buffer overflow in config retrieval
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
iommu/io-pgtable-arm: fix size_t signedness bug in unmap path
wifi: ath10k: fix dma_free_coherent() pointer
wifi: ath12k: fix dma_free_coherent() pointer
wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
wifi: rsi: Fix memory corruption due to not set vif driver data size
arm64/fpsimd: ptrace: Fix SVE writes on !SME systems
arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
arm64/fpsimd: signal: Fix restoration of SVE context
arm64: Set __nocfi on swsusp_arch_resume()
ksmbd: smbd: fix dma_unmap_sg() nents
octeontx2: Fix otx2_dma_map_page() error return code
slimbus: core: fix runtime PM imbalance on report present
slimbus: core: fix device reference leak on report present
tracing: Fix crash on synthetic stacktrace field usage
mei: trace: treat reg parameter as string
s390/ap: Fix wrong APQN fill calculation
s390/boot/vmlinux.lds.S: Ensure bzImage ends with SecureBoot trailer
uacce: fix cdev handling in the cleanup path
uacce: fix isolate sysfs check condition
uacce: implement mremap in uacce_vm_ops to return -EPERM
uacce: ensure safe queue release with state management
netrom: fix double-free in nr_route_frame()
platform/x86: hp-bioscfg: Fix automatic module loading
pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
pmdomain:rockchip: Fix init genpd as GENPD_STATE_ON before regulator ready
rust: io: always inline functions using build_assert with arguments
rxrpc: Fix data-race warning and potential load/store tearing
perf/x86/intel: Do not enable BTS for guests
irqchip/gic-v3-its: Avoid truncating memory addresses
net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
net: txgbe: remove the redundant data return in SW-FW mailbox
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
drm/amdgpu: remove frame cntl for gfx v12
drm/xe: Adjust page count tracepoints in shrinker
drm/xe: fix WQ_MEM_RECLAIM passed as max_active to alloc_workqueue()
gpio: cdev: Correct return code on memory allocation failure
gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()
gpio: cdev: Fix resource leaks on errors in gpiolib_cdev_register()
mm: fix some typos in mm module
mm/hugetlb: fix two comments related to huge_pmd_unshare()
iio: core: Replace lockdep_set_class() + mutex_init() by combined call
iio: core: add separate lockdep class for info_exist_lock
arm64: dts: qcom: talos: Correct UFS clocks ordering
irqchip/renesas-rzv2h: Prevent TINT spurious interrupt during resume
mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge
mm/vma: enforce VMA fork limit on unfaulted,faulted mremap merge too
Revert "ALSA: usb: Increase volume range that triggers a warning"
UBUNTU: Upstream stable to v6.12.68, v6.18.8
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Questing)
Importance: Medium
Assignee: Bethany Jamison (bjamison)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Questing)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Questing)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Questing)
Status: New => In Progress
** Changed in: linux (Ubuntu Questing)
Assignee: (unassigned) => Bethany Jamison (bjamison)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-10
+
+ Ported from the following upstream stable releases:
+ v6.12.68, v6.18.8
+
from git://git.kernel.org/
+
+ arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
+ arm64: dts: rockchip: Fix wrong register range of rk3576 gpu
+ perf parse-events: Fix evsel allocation failure
+ Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
+ btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
+ dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
+ pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
+ wifi: ath12k: don't force radio frequency check in freq_to_idx()
+ ata: ahci: Do not read the per port area for unimplemented ports
+ ata: libata: Call ata_dev_config_lpm() for ATAPI devices
+ ata: libata-sata: Improve link_power_management_supported sysfs attribute
+ ata: libata: Add cpr_log to ata_dev_print_features() early return
+ ata: libata: Add DIPM and HIPM to ata_dev_print_features() early return
+ ata: libata: Print features also for ATAPI devices
+ wifi: ath12k: cancel scan only on active scan vdev
+ wifi: ath12k: Fix scan state stuck in ABORTING after cancel_remain_on_channel
+ wifi: ath12k: fix dead lock while flushing management frames
+ wifi: ath12k: Fix wrong P2P device link id issue
+ ice: initialize ring_stats->syncp
+ ice: Avoid detrimental cleanup for bond during interface stop
+ ice: Fix incorrect timeout ice_release_res()
+ igc: Restore default Qbv schedule when changing channels
+ igc: fix race condition in TX timestamp read for register 0
+ igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue
+ vsock/virtio: Coalesce only linear skb
+ net: usb: dm9601: remove broken SR9700 support
+ bonding: limit BOND_MODE_8023AD to Ethernet devices
+ l2tp: Fix memleak in l2tp_udp_encap_recv().
+ selftests: net: fib-onlink-tests: Convert to use namespaces by default
+ net: freescale: ucc_geth: Return early when TBI PHY can't be found
+ can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb()
error
+ sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
+ amd-xgbe: avoid misleading per-packet error log
+ gue: Fix skb memleak with inner IP protocol 0.
+ tools: ynl: Specify --no-line-number in ynl-regen.sh.
+ fou: Don't allow 0 for FOU_ATTR_IPPROTO.
+ veth: fix data race in veth_get_ethtool_stats
+ pwm: Ensure ioctl() returns a negative errno on error
+ l2tp: avoid one data-race in l2tp_tunnel_del_work()
+ ipvlan: Make the addrs_lock be per port
+ octeontx2: cn10k: fix RX flowid TCAM mask handling
+ net/sched: qfq: Use cl_is_active to determine whether class is active in
qfq_rm_from_ag
+ wifi: mac80211: don't perform DA check on S1G beacon
+ serial: 8250_pci: Fix broken RS485 for F81504/508/512
+ serial: Fix not set tty->port race condition
+ comedi: dmm32at: serialize use of paged registers
+ w1: therm: Fix off-by-one buffer overflow in alarms_store
+ w1: fix redundant counter decrement in w1_attach_slave_device()
+ Revert "nfc/nci: Add the inconsistency check between the input data length
and count"
+ Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
+ Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
+ scsi: storvsc: Process unsupported MODE_SENSE_10
+ scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
+ i2c: spacemit: drop IRQF_ONESHOT flag from IRQ request
+ ARM: dts: microchip: sama7d65: fix the ranges property for flx9
+ ARM: dts: microchip: sama7d65: fix size-cells property for i2c3
+ arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
+ arm64: dts: rockchip: remove dangerous max-link-speed from helios64
+ arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro
+ arm64: dts: rockchip: Fix headphones widget name on NanoPi M5
+ arm64: dts: rockchip: Configure MCLK for analog sound on NanoPi M5
+ rxrpc: Fix recvmsg() unconditional requeue
+ x86/kfence: avoid writing L1TF-vulnerable PTEs
+ comedi: Fix getting range information for subdevices 16 to 255
+ fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
+ platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
+ platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
+ mm/hugetlb: fix hugetlb_pmd_shared()
+ mm/rmap: fix two comments related to huge_pmd_unshare()
+ mm: restore per-memcg proactive reclaim with !CONFIG_NUMA
+ timekeeping: Adjust the leap state for the correct auxiliary timekeeper
+ io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
+ iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
+ iio: adc: ad7280a: handle spi_setup() errors in probe()
+ iio: adc: ad7606: Fix incorrect type for error return variable
+ interconnect: debugfs: initialize src_node and dst_node to empty strings
+ spi: spi-sprd-adi: Fix double free in probe error path
+ regmap: Fix race condition in hwspinlock irqsave routine
+ kconfig: fix static linking of nconf
+ riscv: clocksource: Fix stimecmp update hazard on RV32
+ riscv: suspend: Fix stimecmp update hazard on RV32
+ platform/mellanox: Fix SN5640/SN5610 LED platform data
+ platform/x86/amd: Fix memory leak in wbrf_record()
+ scsi: core: Wake up the error handler when final completions race against
each other
+ scsi: qla2xxx: Sanitize payload size to prevent member overflow
+ ALSA: usb: Increase volume range that triggers a warning
+ iommu/amd: Fix error path in amd_iommu_probe_device()
+ drm/xe: Disable timestamp WA on VFs
+ drm/mediatek: dpi: Find next bridge during probe
+ drm/imagination: Wait for FW trace update command completion
+ vsock/test: Do not filter kallsyms by symbol type
+ netdevsim: fix a race issue related to the operation on bpf_bound_progs list
+ ice: Fix persistent failure in ice_get_rxfh
+ ice: fix devlink reload call trace
+ idpf: read lower clock bits inside the time sandwich
+ net: phy: intel-xway: fix OF node refcount leakage
+ net: hns3: fix data race in hns3_fetch_stats
+ idpf: Fix data race in idpf_net_dim
+ be2net: fix data race in be_get_new_eqd
+ net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
+ net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
+ mISDN: annotate data-race around dev->work
+ ipv6: annotate data-race in ndisc_router_discovery()
+ usbnet: limit max_mtu based on device's hard_mtu
+ Octeontx2-pf: Update xdp features
+ clocksource: Reduce watchdog readout delay limit to prevent false positives
+ drm/xe/pm: Add scope-based cleanup helper for runtime PM
+ drm/xe: Update wedged.mode only after successful reset policy change
+ ublk: fix ublksrv pid handling for pid namespaces
+ selftests/ublk: fix IO thread idle check
+ selftests/ublk: fix error handling for starting device
+ selftests/ublk: fix garbage output in foreground mode
+ sched/fair: Fix pelt clock sync when entering idle
+ drm/amd/pm: Fix si_dpm mmCG_THERMAL_INT setting
+ drm/amd/pm: Don't clear SI SMC table when setting power limit
+ drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
+ drm/amdgpu: fix type for wptr in ring backup
+ drm/nouveau: add missing DCB connector types
+ drm/nouveau: implement missing DCB connector types; gracefully handle unknown
connectors
+ be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
+ selftests: net: amt: wait longer for connection before sending packets
+ bonding: provide a net pointer to __skb_flow_dissect()
+ net: bcmasp: Fix network filter wake for asp-3.0
+ net: dsa: fix off-by-one in maximum bridge ID determination
+ net: pcs: pcs-mtk-lynxi: report in-band capability for 2500Base-X
+ octeontx2-af: Fix error handling
+ net: openvswitch: fix data race in ovs_vport_get_upcall_stats
+ vsock/virtio: fix potential underflow in virtio_transport_get_credit()
+ vsock/test: fix seqpacket message bounds test
+ vsock/virtio: cap TX credit to local buffer size
+ net/sched: act_ife: avoid possible NULL deref
+ dpll: Prevent duplicate registrations
+ Octeontx2-af: Add proper checks for fwdata
+ x86: make page fault handling disable interrupts properly
+ leds: led-class: Only Add LED to leds_list when it is fully ready
+ panic: add note that 'panic_print' parameter is deprecated
+ panic: clean up message about deprecated 'panic_print' parameter
+ panic: only warn about deprecated panic_print on write access
+ of: fix reference count leak in of_alias_scan()
+ of: platform: Use default match table for /firmware
+ migrate: correct lock ordering for hugetlb file folios
+ iio: accel: adxl380: fix handling of unavailable "INT1" interrupt
+ iio: accel: iis328dq: fix gain values
+ iio: adc: ad9467: fix ad9434 vref mask
+ iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
+ iio: adc: exynos_adc: fix OF populate on driver rebind
+ iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot
+ iio: chemical: scd4x: fix reported channel endianness
+ iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source
+ iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
+ ALSA: ctxfi: Fix potential OOB access in audio mixer handling
+ ALSA: hda/realtek: Add quirk for Samsung 730QED to fix headphone
+ ALSA: scarlett2: Fix buffer overflow in config retrieval
+ ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
+ mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
+ mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
+ iommu/io-pgtable-arm: fix size_t signedness bug in unmap path
+ wifi: ath10k: fix dma_free_coherent() pointer
+ wifi: ath12k: fix dma_free_coherent() pointer
+ wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
+ wifi: rsi: Fix memory corruption due to not set vif driver data size
+ arm64/fpsimd: ptrace: Fix SVE writes on !SME systems
+ arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
+ arm64/fpsimd: signal: Fix restoration of SVE context
+ arm64: Set __nocfi on swsusp_arch_resume()
+ ksmbd: smbd: fix dma_unmap_sg() nents
+ octeontx2: Fix otx2_dma_map_page() error return code
+ slimbus: core: fix runtime PM imbalance on report present
+ slimbus: core: fix device reference leak on report present
+ tracing: Fix crash on synthetic stacktrace field usage
+ mei: trace: treat reg parameter as string
+ s390/ap: Fix wrong APQN fill calculation
+ s390/boot/vmlinux.lds.S: Ensure bzImage ends with SecureBoot trailer
+ uacce: fix cdev handling in the cleanup path
+ uacce: fix isolate sysfs check condition
+ uacce: implement mremap in uacce_vm_ops to return -EPERM
+ uacce: ensure safe queue release with state management
+ netrom: fix double-free in nr_route_frame()
+ platform/x86: hp-bioscfg: Fix automatic module loading
+ pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
+ pmdomain:rockchip: Fix init genpd as GENPD_STATE_ON before regulator ready
+ rust: io: always inline functions using build_assert with arguments
+ rxrpc: Fix data-race warning and potential load/store tearing
+ perf/x86/intel: Do not enable BTS for guests
+ irqchip/gic-v3-its: Avoid truncating memory addresses
+ net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
+ net: txgbe: remove the redundant data return in SW-FW mailbox
+ can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
+ can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
+ can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
+ can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
+ can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
+ drm/amdgpu: remove frame cntl for gfx v12
+ drm/xe: Adjust page count tracepoints in shrinker
+ drm/xe: fix WQ_MEM_RECLAIM passed as max_active to alloc_workqueue()
+ gpio: cdev: Correct return code on memory allocation failure
+ gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()
+ gpio: cdev: Fix resource leaks on errors in gpiolib_cdev_register()
+ mm: fix some typos in mm module
+ mm/hugetlb: fix two comments related to huge_pmd_unshare()
+ iio: core: Replace lockdep_set_class() + mutex_init() by combined call
+ iio: core: add separate lockdep class for info_exist_lock
+ arm64: dts: qcom: talos: Correct UFS clocks ordering
+ irqchip/renesas-rzv2h: Prevent TINT spurious interrupt during resume
+ mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge
+ mm/vma: enforce VMA fork limit on unfaulted,faulted mremap merge too
+ Revert "ALSA: usb: Increase volume range that triggers a warning"
+ UBUNTU: Upstream stable to v6.12.68, v6.18.8
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2156362
Title:
Questing update: upstream stable patchset 2026-06-10
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2156362/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
