Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-16
Ported from the following upstream stable releases:
v6.6.141, v6.12.91
from git://git.kernel.org/
blk-cgroup: wait for blkcg cleanup before initializing new disk
fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
drbd: Balance RCU calls in drbd_adm_dump_devices()
loop: fix partition scan race between udev and loop_reread_partitions()
nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
pstore/ram: fix resource leak when ioremap() fails
ACPI: x86: cmos_rtc: Clean up address space handler driver
ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
devres: fix missing node debug info in devm_krealloc()
thermal/drivers/spear: Fix error condition for reading st,thermal-flags
debugfs: check for NULL pointer in debugfs_create_str()
debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
s390/cio: convert sprintf()/snprintf() to sysfs_emit()
s390/cio: use generic driver_override infrastructure
irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter
hrtimers: Update the return type of enqueue_hrtimer()
hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
hrtimer: Reduce trace noise in hrtimer_start()
locking: Fix rwlock support in <linux/spinlock_up.h>
firmware: dmi: Correct an indexing error in dmi.h
wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
irq_prepare_bcn_tasklet
bpf: Add CHECKSUM_COMPLETE to bpf test progs
bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap
dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
UBUNTU: [Config] Adjust CONFIG_FSL_DPAA2_SWITCH
dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
s390/bpf: Zero-extend bpf prog return values and kfunc arguments
params: Replace __modinit with __init_or_module
module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
mt76_connac2_tx_check_aggr()
wifi: mt76: mt7615: fix use_cts_prot support
wifi: mt76: mt7915: fix use_cts_prot support
wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
arm64: cpufeature: Make PMUVer and PerfMon unsigned
wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
bpf, devmap: Remove unnecessary if check in for loop
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
wifi: rtw89: phy: fix uninitialized variable access in
rtw89_phy_cfo_set_crystal_cap()
r8152: fix incorrect register write to USB_UPHY_XTAL
powerpc/crash: fix backup region offset update to elfcorehdr
selftests/powerpc: Re-order *FLAGS to follow lib.mk
selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15
macvlan: annotate data-races around port->bc_queue_len_used
bpf: fix end-of-list detection in cgroup_storage_get_next_key()
bpf: Fix stale offload->prog pointer after constant blinding
wifi: brcmfmac: Fix error pointer dereference
bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
ACPI: AGDI: fix missing newline in error message
arm64: kexec: Remove duplicate allocation for trans_pgd
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
net: bcmgenet: add bcmgenet_has_* helpers
net: bcmgenet: move DESC_INDEX flow to ring 0
net: bcmgenet: support reclaiming unsent Tx packets
net: bcmgenet: switch to use 64bit statistics
net: bcmgenet: fix racing timeout handler
netfilter: xt_socket: enable defrag after all other checks
netfilter: nft_fwd_netdev: check ttl/hl before forwarding
bpf: Fix RCU stall in bpf_fd_array_map_clear()
6pack: propagage new tty types
net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
net/sched: act_ct: Only release RCU read lock after ct_ft
net/rds: Optimize rds_ib_laddr_check
net/rds: Restrict use of RDS/IB to the initial network namespace
bpf: Fix OOB in pcpu_init_value
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
net/mlx5e: Fix features not applied during netdev registration
net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
net: phy: move at803x PHY driver to dedicated directory
net: phy: qcom: at803x: Use the correct bit to disable extended next page
sctp: fix missing encap_port propagation for GSO fragments
net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
drm/komeda: fix integer overflow in AFBC framebuffer size check
drm/sun4i: backend: fix error pointer dereference
ASoC: sti: Return errors from regmap_field_alloc()
ASoC: sti: use managed regmap_field allocations
dm cache: fix null-deref with concurrent writes in passthrough mode
dm cache: fix write path cache coherency in passthrough mode
dm cache: fix write hang in passthrough mode
dm cache policy smq: fix missing locks in invalidating cache blocks
dm cache: fix concurrent write failure in passthrough mode
dm cache: support shrinking the origin device
dm cache: fix dirty mapping checking in passthrough mode switching
platform/chrome: chromeos_tbmc: Drop wakeup source on remove
dm cache metadata: fix memory leak on metadata abort retry
dm log: fix out-of-bounds write due to region_count overflow
drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in
atomic_enable()
drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs
drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic
check
spi: fsl-qspi: Use reinit_completion() for repeated operations
drm/sun4i: Fix resource leaks
drm/amdgpu: Add default case in DVI mode validation
dm init: ensure device probing has finished in dm-mod.waitfor=
fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
padata: Remove cpu online check from cpu add and removal
padata: Put CPU offline callback in ONLINE section to allow failure
drm/amdgpu/gfx10: look at the right prop for gfx queue priority
spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
drm/msm/dpu: fix mismatch between power and frequency
drm/msm/dsi: add the missing parameter description
drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
drm/panel: simple: Correct G190EAN01 prepare timing
ALSA: core: Validate compress device numbers without dynamic minors
drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
drm/amd/pm/ci: Fill DW8 fields from SMC
drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')
ASoC: SOF: Intel: hda: Place check before dereference
drm/msm/a6xx: Fix HLSQ register dumping
drm/msm/shrinker: Fix can_block() logic
drm/msm/a6xx: Use barriers while updating HFI Q headers
pmdomain: ti: omap_prm: Fix a reference leak on device node
pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
ASoC: fsl_micfil: Add access property for "VAD Detected"
ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
ASoC: fsl_easrc: Change the type for iec958 channel status controls
ASoC: qcom: qdsp6: topology: check widget type before accessing data
crypto: qat - use swab32 macro
ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
PCI: Enable AtomicOps only if Root Port supports them
PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
selftests/mm: skip migration tests if NUMA is unavailable
Documentation: fix a hugetlbfs reservation statement
selftest: memcg: skip memcg_sock test if address family not supported
ALSA: scarlett2: Add missing sentinel initializer field
ASoC: SOF: compress: return the configured codec from get_params
PCI: tegra194: Fix polling delay for L2 state
PCI: tegra194: Increase LTSSM poll time on surprise link down
PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down
PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in
tegra_pcie_downstream_dev_to_D0()
PCI: tegra194: Don't force the device into the D0 state before L2
PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
PCI: tegra194: Disable direct speed change for Endpoint mode
PCI: tegra194: Allow system suspend when the Endpoint link is not up
PCI: tegra194: Use DWC IP core version
PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
ALSA: sc6000: Use standard print API
ALSA: sc6000: Keep the programmed board state in card-private data
dm cache: fix missing return in invalidate_committed's error path
crypto: jitterentropy - replace long-held spinlock with mutex
gfs2: Call unlock_new_inode before d_instantiate
ktest: Avoid undef warning when WARNINGS_FILE is unset
ktest: Honor empty per-test option overrides
ktest: Run POST_KTEST hooks on failure and cancellation
quota: Fix race of dquot_scan_active() with quota deactivation
gfs2: add some missing log locking
gfs2: prevent NULL pointer dereference during unmount
efi/capsule-loader: fix incorrect sizeof in phys array reallocation
ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
ARM: dts: mediatek: mt7623: fix efuse fallback compatible
memory: tegra124-emc: Fix dll_change check
memory: tegra30-emc: Fix dll_change check
arm64: dts: imx8-apalis: Fix LEDs name collision
arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2
W_DISABLE1)
iommufd: vfio compatibility extension check for noiommu mode
arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
soc: qcom: ocmem: make the core clock optional
soc: qcom: ocmem: use scoped device node handling to simplify error paths
soc: qcom: ocmem: register reasons for probe deferrals
soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
arm64: dts: qcom: sm8450: Fix GIC_ITS range length
arm64: dts: qcom: sm8550: Fix GIC_ITS range length
arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller
arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during
boot
arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
soc/tegra: cbb: Set ERD on resume for err interrupt
unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
ocfs2/dlm: validate qr_numregions in dlm_match_regions()
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
soc: qcom: llcc: fix v1 SB syndrome register offset
soc: qcom: aoss: compare against normalized cooling state
arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
arm64/xor: fix conflicting attributes for xor_block_template
ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
ocfs2: fix listxattr handling when the buffer is full
ocfs2: validate bg_bits during freefrag scan
ocfs2: validate group add input before caching
dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function
soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()
soundwire: cadence: Clear message complete before signaling waiting thread
tracing: Rebuild full_name on each hist_field_name() call
ima: check return value of crypto_shash_final() in boot aggregate
HID: asus: make asus_resume adhere to linux kernel coding standards
HID: asus: do not abort probe when not necessary
mtd: physmap_of_gemini: Fix disabled pinctrl state check
dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
HID: usbhid: fix deadlock in hid_post_reset()
bpf, arm64: Fix off-by-one in check_imm signed range check
bpf, sockmap: Fix af_unix iter deadlock
bpf, sockmap: Fix af_unix null-ptr-deref in proto update
bpf, sockmap: Take state lock for af_unix iter
bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
bpf: Fix NULL deref in map_kptr_match_type for scalar regs
bpf: allow UTF-8 literals in bpf_bprintf_prepare()
bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
pinctrl: pinctrl-pic32: Fix resource leak
pinctrl: cy8c95x0: remove duplicate error message
pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
pinctrl: cy8c95x0: Avoid returning positive values to user space
perf branch: Avoid incrementing NULL
perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
pinctrl: abx500: Fix type of 'argument' variable
perf lock: Fix option value type in parse_max_stack
perf expr: Return -EINVAL for syntax error in expr__find_ids()
ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
ipmi: ssif_bmc: fix message desynchronization after truncated response
ipmi: ssif_bmc: change log level to dbg in irq callback
perf util: Kill die() prototype, dead for a long time
i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
dev_printk: add new dev_err_probe() helpers
backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional()
in sky81452_bl_parse_dt()
platform/surface: surfacepro3_button: Drop wakeup source on remove
leds: lgm-sso: Remove duplicate assignments for priv->mmap
tty: hvc_iucv: fix off-by-one in number of supported devices
platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
fs/ntfs3: terminate the cached volume label after UTF-8 conversion
platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
platform/x86: dell-wmi-sysman: bound enumeration string aggregation
RDMA/core: Prefer NLA_NUL_STRING
clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
scsi: sg: Make sg_sysfs_class constant
scsi: sg: Fix sysctl sg-big-buff register during sg_init()
scsi: sg: Resolve soft lockup issue when opening /dev/sgX
clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src
dividers
scsi: target: core: Fix integer overflow in UNMAP bounds check
dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
clk: qcom: gcc-sc8180x: Add missing GDSCs
clk: qcom: gcc-sc8180x: Use retention for USB power domains
clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
clk: imx8mq: Correct the CSI PHY sels
clk: qoriq: avoid format string warning
clk: xgene: Fix mapping leak in xgene_pllclk_init()
dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
clk: qcom: dispcc-sc7180: Add missing MDSS resets
lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
clk: visconti: pll: initialize clk_init_data to zero
f2fs: Use sysfs_emit_at() to simplify code
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()
drm/i915: Loop over all active pipes in intel_mbus_dbox_update
drm/i915/wm: Verify the correct plane DDB entry
crypto: sa2ul - Fix AEAD fallback algorithm names
crypto: ccp - copy IV using skcipher ivsize
arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
PCMCIA: Fix garbled log messages for KERN_CONT
arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
net/sched: sch_cake: fix NAT destination port not being updated in
cake_update_flowkeys
nexthop: fix IPv6 route referencing IPv4 nexthop
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans
tcp: annotate data-races around tp->bytes_sent
tcp: annotate data-races around tp->bytes_retrans
tcp: annotate data-races around tp->dsack_dups
tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
tcp: annotate data-races around tp->plb_rehash
i40e: don't advertise IFF_SUPP_NOFCS
e1000e: Unroll PTP in probe error handling
ipv6: fix possible UAF in icmpv6_rcv()
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
pppoe: drop PFC frames
openvswitch: cap upcall PID array size and pre-size vport replies
netfilter: nft_osf: restrict it to ipv4
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
netfilter: conntrack: remove sprintf usage
netfilter: xtables: restrict several matches to inet family
ipvs: fix MTU check for GSO packets in tunnel mode
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
slip: reject VJ receive packets on instances with no rstate array
slip: bound decode() reads against the compressed packet length
arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number
ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
ksmbd: Use struct_size() to improve smb_direct_rdma_xmit()
ksmbd: add support for supplementary groups
ksmbd: destroy async_ida in ksmbd_conn_free()
ksmbd: scope conn->binding slowpath to bound sessions only
net/rds: zero per-item info buffer before handing it to visitors
net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
net/sched: sch_pie: annotate data-races in pie_dump_stats()
net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
net/sched: sch_red: annotate data-races in red_dump_stats()
net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
net: dsa: realtek: rtl8365mb: fix mode mask calculation
nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
tipc: fix double-free in tipc_buf_append()
vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
fs/adfs: validate nzones in adfs_validate_bblk()
rtc: abx80x: Disable alarm feature if no interrupt attached
fbdev: offb: fix PCI device reference leak on probe failure
mailbox: mailbox-test: free channels on probe error
cgroup/rdma: fix integer overflow in rdmacg_try_charge()
mailbox: add sanity check for channel array
mailbox: mailbox-test: don't free the reused channel
mailbox: mailbox-test: initialize struct earlier
mailbox: mailbox-test: make data_ready a per-instance variable
btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
tracing: branch: Fix inverted check on stat tracer registration
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
netfilter: arp_tables: fix IEEE1394 ARP payload parsing
nvme-pci: fix missed admin queue sq doorbell write
drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
drm/amdgpu: fix spelling typos
drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
netfilter: xt_policy: fix strict mode inbound policy matching
netfilter: nf_conntrack_sip: don't use simple_strtoul
spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
drm/sysfb: ofdrm: fix PCI device reference leaks
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
netdevsim: zero initialize struct iphdr in dummy sk_buff
net/sched: netem: fix probability gaps in 4-state loss model
net/sched: netem: fix queue limit check to include reordered packets
net/sched: netem: only reseed PRNG when seed is explicitly provided
net/sched: netem: validate slot configuration
net/sched: netem: fix slot delay calculation overflow
net/sched: netem: check for negative latency and jitter
net/sched: sch_choke: annotate data-races in choke_dump_stats()
net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
vrf: Fix a potential NPD when removing a port from a VRF
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
NFC: trf7970a: Ignore antenna noise when checking for RF field
net/sched: taprio: fix NULL pointer dereference in class dump
neighbour: add RCU protection to neigh_tables[]
neigh: let neigh_xmit take skb ownership
ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
net: mctp i2c: check length before marking flow active
net: phy: dp83869: fix setting CLK_O_SEL field.
drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
ASoC: codecs: ab8500: Fix casting of private data
netfilter: skip recording stale or retransmitted INIT
sctp: discard stale INIT after handshake completion
bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
net: netconsole: move newline trimming to function
netconsole: propagate device name truncation in dev_name_store()
ALSA: hda/conexant: fix some typos
ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
ALSA: hda/conexant: Fix missing error check for jack detection
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
drm/amd/display: Allow DCE link encoder without AUX registers
drm/amd/display: Read EDID from VBIOS embedded panel info
bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner
net: bonding: add broadcast_neighbor option for 802.3ad
bonding: add support for per-port LACP actor priority
bonding: print churn state via netlink
bonding: 3ad: implement proper RCU rules for port->aggregator
iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
iavf: stop removing VLAN filters from PF on interface down
iavf: wait for PF confirmation before removing VLAN filters
iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
ice: fix NULL pointer dereference in ice_reset_all_vfs()
net: tls: fix strparser anchor skb leak on offload RX setup failure
sfc: fix error code in efx_devlink_info_running_versions()
net/sched: cls_flower: revert unintended changes
ntfs: ->d_compare() must not block
smb: client: correctly handle ErrorContextData as a flexible array
smb: client: fix OOB reads parsing symlink error response
crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
net: bcmgenet: Initialize u64 stats seq counter
net: bcmgenet: fix leaking free_bds
ksmbd: validate response sizes in ipc_validate_msg()
net/sched: sch_pie: annotate more data-races in pie_dump_stats()
netconsole: avoid out-of-bounds access on empty string in trim_newline()
bonding: fix NULL pointer dereference in actor_port_prio setting
crypto: af_alg - Cap AEAD AD length to 0x80000000
i40e: Cleanup PTP pins on probe failure
workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
netfilter: nf_conntrack_sip: get helper before allocating expectation
audit: fix incorrect inheritable capability in CAPSET records
netfilter: nft_ct: fix missing expect put in obj eval
net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
KVM: x86: Fix Xen hypercall tracepoint argument assignment
netfilter: nf_tables: unconditionally bump set->nelems before insertion
ASoC: SOF: Intel: hda-dai: remove dspless special case
ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio
smb/client: fix possible infinite loop and oob read in symlink_data()
drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
ALSA: usb-audio: Bound MIDI endpoint descriptor scans
ceph: fix a buffer leak in __ceph_setxattr()
io-wq: check that the predecessor is hashed in io_wq_remove_pending()
powerpc/warp: Fix error handling in pika_dtm_thread
netfs: fix error handling in netfs_extract_user_iter()
libceph: Fix potential out-of-bounds access in osdmap_decode()
libceph: Fix potential null-ptr-deref in decode_choose_args()
libceph: Fix potential out-of-bounds access in crush_decode()
libceph: handle rbtree insertion error in decode_choose_args()
iommu/vt-d: Disable DMAR for Intel Q35 IGFX
drm/i915: skip __i915_request_skip() for already signaled requests
drm/panfrost: Fix wait_bo ioctl leaking positive return from
dma_resv_wait_timeout()
drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
drm/gma500/oaktrail_lvds: fix hang on init failure
drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
eventfs: Use list_add_tail_rcu() for SRCU-protected children list
drm/v3d: Reject empty multisync extension to prevent infinite loop
smb: client: Use FullSessionKey for AES-256 encryption key derivation
btrfs: use inode already stored in local variable at btrfs_rmdir()
btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I()
btrfs: fix missing last_unlink_trans update when removing a directory
mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
mptcp: fix rx timestamp corruption on fastopen
mptcp: pm: prio: skip closed subflows
mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
f2fs: fix incorrect file address mapping when inline inode is unwritten
f2fs: fix false alarm of lockdep on cp_global_sem lock
spi: sifive: Simplify clock handling with devm_clk_get_enabled()
spi: sifive: fix controller deregistration
mptcp: pm: ADD_ADDR rtx: fix potential data-race
mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
netfs: Fix potential uninitialised var in netfs_extract_user_iter()
io_uring/kbuf: use mem_is_zero()
md/raid1: fix the comparing region of interval tree
md: wake raid456 reshape waiters before suspend
btrfs: pass struct btrfs_inode to clone_copy_inline_extent()
btrfs: fix deadlock between reflink and transaction commit when using
flushoncommit
bus: fsl-mc: use generic driver_override infrastructure
sparc/vdso: Always reject undefined references during linking
sparc64: vdso: Link with -z noexecstack
wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
wifi: mt76: mt7921: fix 6GHz regulatory update on connection
bpf: Fix variable length stack write over spilled pointers
wifi: ath10k: fix station lookup failure during disconnect
bpf: fix mm lifecycle in open-coded task_vma iterator
bpf: switch task_vma iterator from mmap_lock to per-VMA locks
bpf: return VMA snapshot from task_vma iterator
Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
sco_pi(sk)->codec
ipv4: udp: fix typos in comments
ipv6: udp: fix typos in comments
udp: Force compute_score to always inline
PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs
encoding
PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix()
PCI: dwc: Invoke post_init in dw_pcie_resume_noirq()
PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
spi: spi-nxp-fspi: remove the goto in probe
spi: spi-nxp-fspi: enable runtime pm for fspi
spi: nxp-fspi: Use reinit_completion() for repeated operations
drm/v3d: Handle error from drm_sched_entity_init()
PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation
drm/imagination: Switch reset_reason fields from enum to u32
drm/msm/dsi: fix bits_per_pclk
drm/msm/dsi: fix hdisplay calculation for CMD mode panel
PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support
drm/msm/a6xx: Fix dumping A650+ debugbus blocks
crypto: qat - introduce fuse array
crypto: qat - disable 4xxx AE cluster when lead engine is fused off
crypto: qat - disable 420xx AE cluster when lead engine is fused off
crypto: qat - fix type mismatch in RAS sysfs show functions
PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode
PCI: tegra194: Free up Endpoint resources during remove()
arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
arm64: dts: qcom: sm8650: Fix GIC_ITS range length
arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller
arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
hte: tegra194: remove Kconfig dependency on Tegra194 SoC
UBUNTU: [Config] Adjust CONFIG_HTE_TEGRA194
cxl/pci: Check memdev driver binding status in cxl_reset_done()
ext4: fix possible null-ptr-deref in mbt_kunit_exit()
pinctrl: realtek: Fix function signature for config argument
perf maps: Fix copy_from that can break sorted by name order
platform/x86: asus-wmi: adjust screenpad power/brightness handling
platform/x86: asus-wmi: fix screenpad brightness range
tty: serial: ip22zilog: Fix section mispatch warning
clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
erofs: unify lcn as u64 for 32-bit platforms
net/sched: act_mirred: fix wrong device for mac_header_xmit check in
tcf_blockcast_redir
tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
ice: fix ICE_AQ_LINK_SPEED_M for 200G
net/mlx5: Fix HCA caps leak on notifier init failure
pwm: atmel-tcb: Cache clock rates and mark chip as atomic
mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
fsnotify: fix inode reference leak in fsnotify_recalc_mask()
drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
tcp: make probe0 timer handle expired user timeout
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
drm/xe/debugfs: Correct printing of register whitelist ranges
drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
PCI: Initialize temporary device in new_id_store()
ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
drm/loongson: Use managed KMS polling
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
drm/xe/dma-buf: handle empty bo and UAF races
btrfs: do not mark inode incompressible after inline attempt fails
RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
tracing: Avoid NULL return from hist_field_name() on truncation
UBUNTU: Upstream stable to v6.6.141, v6.12.91
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-16
+
+ Ported from the following upstream stable releases:
+ v6.6.141, v6.12.91
+
from git://git.kernel.org/
+
+ blk-cgroup: wait for blkcg cleanup before initializing new disk
+ fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
+ drbd: Balance RCU calls in drbd_adm_dump_devices()
+ loop: fix partition scan race between udev and loop_reread_partitions()
+ nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
+ blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
+ pstore/ram: fix resource leak when ioremap() fails
+ ACPI: x86: cmos_rtc: Clean up address space handler driver
+ ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
+ devres: fix missing node debug info in devm_krealloc()
+ thermal/drivers/spear: Fix error condition for reading st,thermal-flags
+ debugfs: check for NULL pointer in debugfs_create_str()
+ debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
+ s390/cio: convert sprintf()/snprintf() to sysfs_emit()
+ s390/cio: use generic driver_override infrastructure
+ irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter
+ hrtimers: Update the return type of enqueue_hrtimer()
+ hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
+ hrtimer: Reduce trace noise in hrtimer_start()
+ locking: Fix rwlock support in <linux/spinlock_up.h>
+ firmware: dmi: Correct an indexing error in dmi.h
+ wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
+ wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
irq_prepare_bcn_tasklet
+ bpf: Add CHECKSUM_COMPLETE to bpf test progs
+ bpf: test_run: Fix the null pointer dereference issue in
bpf_lwt_xmit_push_encap
+ dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
+ UBUNTU: [Config] Adjust CONFIG_FSL_DPAA2_SWITCH
+ dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
+ s390/bpf: Zero-extend bpf prog return values and kfunc arguments
+ params: Replace __modinit with __init_or_module
+ module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
+ wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
mt76_connac2_tx_check_aggr()
+ wifi: mt76: mt7615: fix use_cts_prot support
+ wifi: mt76: mt7915: fix use_cts_prot support
+ wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
+ arm64: cpufeature: Make PMUVer and PerfMon unsigned
+ wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
+ wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
+ bpf, devmap: Remove unnecessary if check in for loop
+ bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
+ wifi: rtw89: phy: fix uninitialized variable access in
rtw89_phy_cfo_set_crystal_cap()
+ r8152: fix incorrect register write to USB_UPHY_XTAL
+ powerpc/crash: fix backup region offset update to elfcorehdr
+ selftests/powerpc: Re-order *FLAGS to follow lib.mk
+ selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15
+ macvlan: annotate data-races around port->bc_queue_len_used
+ bpf: fix end-of-list detection in cgroup_storage_get_next_key()
+ bpf: Fix stale offload->prog pointer after constant blinding
+ wifi: brcmfmac: Fix error pointer dereference
+ bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
+ bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
+ ACPI: AGDI: fix missing newline in error message
+ arm64: kexec: Remove duplicate allocation for trans_pgd
+ net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
+ net: bcmgenet: add bcmgenet_has_* helpers
+ net: bcmgenet: move DESC_INDEX flow to ring 0
+ net: bcmgenet: support reclaiming unsent Tx packets
+ net: bcmgenet: switch to use 64bit statistics
+ net: bcmgenet: fix racing timeout handler
+ netfilter: xt_socket: enable defrag after all other checks
+ netfilter: nft_fwd_netdev: check ttl/hl before forwarding
+ bpf: Fix RCU stall in bpf_fd_array_map_clear()
+ 6pack: propagage new tty types
+ net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
+ net/sched: act_ct: Only release RCU read lock after ct_ft
+ net/rds: Optimize rds_ib_laddr_check
+ net/rds: Restrict use of RDS/IB to the initial network namespace
+ bpf: Fix OOB in pcpu_init_value
+ ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
+ net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
+ net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
+ dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
+ net/mlx5e: Fix features not applied during netdev registration
+ net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
+ bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
+ Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
+ Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
+ Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
+ Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
+ net: phy: move at803x PHY driver to dedicated directory
+ net: phy: qcom: at803x: Use the correct bit to disable extended next page
+ sctp: fix missing encap_port propagation for GSO fragments
+ net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
+ drm/komeda: fix integer overflow in AFBC framebuffer size check
+ drm/sun4i: backend: fix error pointer dereference
+ ASoC: sti: Return errors from regmap_field_alloc()
+ ASoC: sti: use managed regmap_field allocations
+ dm cache: fix null-deref with concurrent writes in passthrough mode
+ dm cache: fix write path cache coherency in passthrough mode
+ dm cache: fix write hang in passthrough mode
+ dm cache policy smq: fix missing locks in invalidating cache blocks
+ dm cache: fix concurrent write failure in passthrough mode
+ dm cache: support shrinking the origin device
+ dm cache: fix dirty mapping checking in passthrough mode switching
+ platform/chrome: chromeos_tbmc: Drop wakeup source on remove
+ dm cache metadata: fix memory leak on metadata abort retry
+ dm log: fix out-of-bounds write due to region_count overflow
+ drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in
atomic_enable()
+ drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
drm_bridge_funcs
+ drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic
check
+ spi: fsl-qspi: Use reinit_completion() for repeated operations
+ drm/sun4i: Fix resource leaks
+ drm/amdgpu: Add default case in DVI mode validation
+ dm init: ensure device probing has finished in dm-mod.waitfor=
+ fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
+ crypto: atmel - Use unregister_{aeads,ahashes,skciphers}
+ crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
+ padata: Remove cpu online check from cpu add and removal
+ padata: Put CPU offline callback in ONLINE section to allow failure
+ drm/amdgpu/gfx10: look at the right prop for gfx queue priority
+ spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
+ drm/msm/dpu: fix mismatch between power and frequency
+ drm/msm/dsi: add the missing parameter description
+ drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
+ drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
+ drm/panel: simple: Correct G190EAN01 prepare timing
+ ALSA: core: Validate compress device numbers without dynamic minors
+ drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
+ drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
+ drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
+ drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
+ drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
+ drm/amd/pm/ci: Fill DW8 fields from SMC
+ drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
+ ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')
+ ASoC: SOF: Intel: hda: Place check before dereference
+ drm/msm/a6xx: Fix HLSQ register dumping
+ drm/msm/shrinker: Fix can_block() logic
+ drm/msm/a6xx: Use barriers while updating HFI Q headers
+ pmdomain: ti: omap_prm: Fix a reference leak on device node
+ pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
+ ASoC: fsl_micfil: Add access property for "VAD Detected"
+ ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
+ ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
+ ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
+ ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
+ ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
+ ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
+ ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
+ ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
+ ASoC: fsl_easrc: Change the type for iec958 channel status controls
+ ASoC: qcom: qdsp6: topology: check widget type before accessing data
+ crypto: qat - use swab32 macro
+ ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
+ PCI: Enable AtomicOps only if Root Port supports them
+ PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
+ selftests/mm: skip migration tests if NUMA is unavailable
+ Documentation: fix a hugetlbfs reservation statement
+ selftest: memcg: skip memcg_sock test if address family not supported
+ ALSA: scarlett2: Add missing sentinel initializer field
+ ASoC: SOF: compress: return the configured codec from get_params
+ PCI: tegra194: Fix polling delay for L2 state
+ PCI: tegra194: Increase LTSSM poll time on surprise link down
+ PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down
+ PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in
tegra_pcie_downstream_dev_to_D0()
+ PCI: tegra194: Don't force the device into the D0 state before L2
+ PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
+ PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select"
+ PCI: tegra194: Disable direct speed change for Endpoint mode
+ PCI: tegra194: Allow system suspend when the Endpoint link is not up
+ PCI: tegra194: Use DWC IP core version
+ PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
+ spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback
+ ALSA: sc6000: Use standard print API
+ ALSA: sc6000: Keep the programmed board state in card-private data
+ dm cache: fix missing return in invalidate_committed's error path
+ crypto: jitterentropy - replace long-held spinlock with mutex
+ gfs2: Call unlock_new_inode before d_instantiate
+ ktest: Avoid undef warning when WARNINGS_FILE is unset
+ ktest: Honor empty per-test option overrides
+ ktest: Run POST_KTEST hooks on failure and cancellation
+ quota: Fix race of dquot_scan_active() with quota deactivation
+ gfs2: add some missing log locking
+ gfs2: prevent NULL pointer dereference during unmount
+ efi/capsule-loader: fix incorrect sizeof in phys array reallocation
+ ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
+ ARM: dts: mediatek: mt7623: fix efuse fallback compatible
+ memory: tegra124-emc: Fix dll_change check
+ memory: tegra30-emc: Fix dll_change check
+ arm64: dts: imx8-apalis: Fix LEDs name collision
+ arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2
W_DISABLE1)
+ iommufd: vfio compatibility extension check for noiommu mode
+ arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
+ arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
+ arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
+ arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
+ soc: qcom: ocmem: make the core clock optional
+ soc: qcom: ocmem: use scoped device node handling to simplify error paths
+ soc: qcom: ocmem: register reasons for probe deferrals
+ soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
+ arm64: dts: qcom: sm8450: Fix GIC_ITS range length
+ arm64: dts: qcom: sm8550: Fix GIC_ITS range length
+ arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller
+ arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
+ arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
+ arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
+ arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
during boot
+ arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
+ soc/tegra: cbb: Set ERD on resume for err interrupt
+ unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure
+ ocfs2/dlm: validate qr_numregions in dlm_match_regions()
+ ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
+ soc: qcom: llcc: fix v1 SB syndrome register offset
+ soc: qcom: aoss: compare against normalized cooling state
+ arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
+ ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
+ arm64/xor: fix conflicting attributes for xor_block_template
+ ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
+ ocfs2: fix listxattr handling when the buffer is full
+ ocfs2: validate bg_bits during freefrag scan
+ ocfs2: validate group add input before caching
+ dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function
+ soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
+ dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register()
+ soundwire: cadence: Clear message complete before signaling waiting thread
+ tracing: Rebuild full_name on each hist_field_name() call
+ ima: check return value of crypto_shash_final() in boot aggregate
+ HID: asus: make asus_resume adhere to linux kernel coding standards
+ HID: asus: do not abort probe when not necessary
+ mtd: physmap_of_gemini: Fix disabled pinctrl state check
+ dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
+ mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
+ mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook
+ mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook
+ mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
+ mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
+ mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
+ mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
+ mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
+ HID: usbhid: fix deadlock in hid_post_reset()
+ bpf, arm64: Fix off-by-one in check_imm signed range check
+ bpf, sockmap: Fix af_unix iter deadlock
+ bpf, sockmap: Fix af_unix null-ptr-deref in proto update
+ bpf, sockmap: Take state lock for af_unix iter
+ bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
+ bpf: Fix NULL deref in map_kptr_match_type for scalar regs
+ bpf: allow UTF-8 literals in bpf_bprintf_prepare()
+ bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
+ pinctrl: pinctrl-pic32: Fix resource leak
+ pinctrl: cy8c95x0: remove duplicate error message
+ pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
+ pinctrl: cy8c95x0: Avoid returning positive values to user space
+ perf branch: Avoid incrementing NULL
+ perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace
+ pinctrl: abx500: Fix type of 'argument' variable
+ perf lock: Fix option value type in parse_max_stack
+ perf expr: Return -EINVAL for syntax error in expr__find_ids()
+ ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
+ ipmi: ssif_bmc: fix message desynchronization after truncated response
+ ipmi: ssif_bmc: change log level to dbg in irq callback
+ perf util: Kill die() prototype, dead for a long time
+ i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
+ dev_printk: add new dev_err_probe() helpers
+ backlight: sky81452-backlight: Check return value of
devm_gpiod_get_optional() in sky81452_bl_parse_dt()
+ platform/surface: surfacepro3_button: Drop wakeup source on remove
+ leds: lgm-sso: Remove duplicate assignments for priv->mmap
+ tty: hvc_iucv: fix off-by-one in number of supported devices
+ platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup
+ mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
+ nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
+ fs/ntfs3: terminate the cached volume label after UTF-8 conversion
+ platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
+ platform/x86: dell-wmi-sysman: bound enumeration string aggregation
+ RDMA/core: Prefer NLA_NUL_STRING
+ clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
+ scsi: sg: Make sg_sysfs_class constant
+ scsi: sg: Fix sysctl sg-big-buff register during sg_init()
+ scsi: sg: Resolve soft lockup issue when opening /dev/sgX
+ clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src
dividers
+ scsi: target: core: Fix integer overflow in UNMAP bounds check
+ dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
+ clk: qcom: gcc-sc8180x: Add missing GDSCs
+ clk: qcom: gcc-sc8180x: Use retention for USB power domains
+ clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
+ clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
+ clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
+ clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
+ clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
+ clk: imx8mq: Correct the CSI PHY sels
+ clk: qoriq: avoid format string warning
+ clk: xgene: Fix mapping leak in xgene_pllclk_init()
+ dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
+ clk: qcom: dispcc-sc7180: Add missing MDSS resets
+ lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
+ clk: visconti: pll: initialize clk_init_data to zero
+ f2fs: Use sysfs_emit_at() to simplify code
+ f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
+ drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()
+ drm/i915: Loop over all active pipes in intel_mbus_dbox_update
+ drm/i915/wm: Verify the correct plane DDB entry
+ crypto: sa2ul - Fix AEAD fallback algorithm names
+ crypto: ccp - copy IV using skcipher ivsize
+ arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
+ arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
+ arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
+ arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
+ arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT
+ PCMCIA: Fix garbled log messages for KERN_CONT
+ arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
+ arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
+ arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
+ macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
+ net/sched: sch_cake: fix NAT destination port not being updated in
cake_update_flowkeys
+ nexthop: fix IPv6 route referencing IPv4 nexthop
+ net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
+ tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans
+ tcp: annotate data-races around tp->bytes_sent
+ tcp: annotate data-races around tp->bytes_retrans
+ tcp: annotate data-races around tp->dsack_dups
+ tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
+ tcp: annotate data-races around tp->plb_rehash
+ i40e: don't advertise IFF_SUPP_NOFCS
+ e1000e: Unroll PTP in probe error handling
+ ipv6: fix possible UAF in icmpv6_rcv()
+ sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
+ pppoe: drop PFC frames
+ openvswitch: cap upcall PID array size and pre-size vport replies
+ netfilter: nft_osf: restrict it to ipv4
+ netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
+ netfilter: conntrack: remove sprintf usage
+ netfilter: xtables: restrict several matches to inet family
+ ipvs: fix MTU check for GSO packets in tunnel mode
+ netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
+ netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
+ slip: reject VJ receive packets on instances with no rstate array
+ slip: bound decode() reads against the compressed packet length
+ arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number
+ ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
+ ksmbd: Use struct_size() to improve smb_direct_rdma_xmit()
+ ksmbd: add support for supplementary groups
+ ksmbd: destroy async_ida in ksmbd_conn_free()
+ ksmbd: scope conn->binding slowpath to bound sessions only
+ net/rds: zero per-item info buffer before handing it to visitors
+ net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
+ net/sched: sch_pie: annotate data-races in pie_dump_stats()
+ net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
+ net/sched: sch_red: annotate data-races in red_dump_stats()
+ net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
+ net: dsa: realtek: rtl8365mb: fix mode mask calculation
+ nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
+ tipc: fix double-free in tipc_buf_append()
+ vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
+ fs/adfs: validate nzones in adfs_validate_bblk()
+ rtc: abx80x: Disable alarm feature if no interrupt attached
+ fbdev: offb: fix PCI device reference leak on probe failure
+ mailbox: mailbox-test: free channels on probe error
+ cgroup/rdma: fix integer overflow in rdmacg_try_charge()
+ mailbox: add sanity check for channel array
+ mailbox: mailbox-test: don't free the reused channel
+ mailbox: mailbox-test: initialize struct earlier
+ mailbox: mailbox-test: make data_ready a per-instance variable
+ btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
+ tracing: branch: Fix inverted check on stat tracer registration
+ nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
+ netfilter: arp_tables: fix IEEE1394 ARP payload parsing
+ nvme-pci: fix missed admin queue sq doorbell write
+ drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
+ drm/amdgpu: fix spelling typos
+ drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
+ drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
+ netfilter: xt_policy: fix strict mode inbound policy matching
+ netfilter: nf_conntrack_sip: don't use simple_strtoul
+ spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
+ drm/sysfb: ofdrm: fix PCI device reference leaks
+ cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
+ netdevsim: zero initialize struct iphdr in dummy sk_buff
+ net/sched: netem: fix probability gaps in 4-state loss model
+ net/sched: netem: fix queue limit check to include reordered packets
+ net/sched: netem: only reseed PRNG when seed is explicitly provided
+ net/sched: netem: validate slot configuration
+ net/sched: netem: fix slot delay calculation overflow
+ net/sched: netem: check for negative latency and jitter
+ net/sched: sch_choke: annotate data-races in choke_dump_stats()
+ net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
+ vrf: Fix a potential NPD when removing a port from a VRF
+ net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
+ net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
+ NFC: trf7970a: Ignore antenna noise when checking for RF field
+ net/sched: taprio: fix NULL pointer dereference in class dump
+ neighbour: add RCU protection to neigh_tables[]
+ neigh: let neigh_xmit take skb ownership
+ ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
+ net: mctp i2c: check length before marking flow active
+ net: phy: dp83869: fix setting CLK_O_SEL field.
+ drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
+ drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
+ drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
+ drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
+ drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
+ drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
+ drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
+ drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
+ drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
+ ASoC: codecs: ab8500: Fix casting of private data
+ netfilter: skip recording stale or retransmitted INIT
+ sctp: discard stale INIT after handshake completion
+ bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
+ net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
+ net: netconsole: move newline trimming to function
+ netconsole: propagate device name truncation in dev_name_store()
+ ALSA: hda/conexant: fix some typos
+ ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
+ ALSA: hda/conexant: Fix missing error check for jack detection
+ futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
+ drm/amd/display: Allow DCE link encoder without AUX registers
+ drm/amd/display: Read EDID from VBIOS embedded panel info
+ bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner
+ net: bonding: add broadcast_neighbor option for 802.3ad
+ bonding: add support for per-port LACP actor priority
+ bonding: print churn state via netlink
+ bonding: 3ad: implement proper RCU rules for port->aggregator
+ iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
+ iavf: stop removing VLAN filters from PF on interface down
+ iavf: wait for PF confirmation before removing VLAN filters
+ iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
+ ice: fix NULL pointer dereference in ice_reset_all_vfs()
+ net: tls: fix strparser anchor skb leak on offload RX setup failure
+ sfc: fix error code in efx_devlink_info_running_versions()
+ net/sched: cls_flower: revert unintended changes
+ ntfs: ->d_compare() must not block
+ smb: client: correctly handle ErrorContextData as a flexible array
+ smb: client: fix OOB reads parsing symlink error response
+ crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
+ net: bcmgenet: Initialize u64 stats seq counter
+ net: bcmgenet: fix leaking free_bds
+ ksmbd: validate response sizes in ipc_validate_msg()
+ net/sched: sch_pie: annotate more data-races in pie_dump_stats()
+ netconsole: avoid out-of-bounds access on empty string in trim_newline()
+ bonding: fix NULL pointer dereference in actor_port_prio setting
+ crypto: af_alg - Cap AEAD AD length to 0x80000000
+ i40e: Cleanup PTP pins on probe failure
+ workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
+ netfilter: nf_conntrack_sip: get helper before allocating expectation
+ audit: fix incorrect inheritable capability in CAPSET records
+ netfilter: nft_ct: fix missing expect put in obj eval
+ net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
+ audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
+ KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
+ KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer
arithmetic
+ KVM: x86: Fix Xen hypercall tracepoint argument assignment
+ netfilter: nf_tables: unconditionally bump set->nelems before insertion
+ ASoC: SOF: Intel: hda-dai: remove dspless special case
+ ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio
+ smb/client: fix possible infinite loop and oob read in symlink_data()
+ drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
+ ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
+ ALSA: usb-audio: Bound MIDI endpoint descriptor scans
+ ceph: fix a buffer leak in __ceph_setxattr()
+ io-wq: check that the predecessor is hashed in io_wq_remove_pending()
+ powerpc/warp: Fix error handling in pika_dtm_thread
+ netfs: fix error handling in netfs_extract_user_iter()
+ libceph: Fix potential out-of-bounds access in osdmap_decode()
+ libceph: Fix potential null-ptr-deref in decode_choose_args()
+ libceph: Fix potential out-of-bounds access in crush_decode()
+ libceph: handle rbtree insertion error in decode_choose_args()
+ iommu/vt-d: Disable DMAR for Intel Q35 IGFX
+ drm/i915: skip __i915_request_skip() for already signaled requests
+ drm/panfrost: Fix wait_bo ioctl leaking positive return from
dma_resv_wait_timeout()
+ drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
+ drm/gma500/oaktrail_lvds: fix hang on init failure
+ drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
+ eventfs: Use list_add_tail_rcu() for SRCU-protected children list
+ drm/v3d: Reject empty multisync extension to prevent infinite loop
+ smb: client: Use FullSessionKey for AES-256 encryption key derivation
+ btrfs: use inode already stored in local variable at btrfs_rmdir()
+ btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I()
+ btrfs: fix missing last_unlink_trans update when removing a directory
+ mptcp: drop __mptcp_fastopen_gen_msk_ackseq()
+ mptcp: fix rx timestamp corruption on fastopen
+ mptcp: pm: prio: skip closed subflows
+ mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
+ f2fs: fix incorrect file address mapping when inline inode is unwritten
+ f2fs: fix false alarm of lockdep on cp_global_sem lock
+ spi: sifive: Simplify clock handling with devm_clk_get_enabled()
+ spi: sifive: fix controller deregistration
+ mptcp: pm: ADD_ADDR rtx: fix potential data-race
+ mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
+ netfs: Fix potential uninitialised var in netfs_extract_user_iter()
+ io_uring/kbuf: use mem_is_zero()
+ md/raid1: fix the comparing region of interval tree
+ md: wake raid456 reshape waiters before suspend
+ btrfs: pass struct btrfs_inode to clone_copy_inline_extent()
+ btrfs: fix deadlock between reflink and transaction commit when using
flushoncommit
+ bus: fsl-mc: use generic driver_override infrastructure
+ sparc/vdso: Always reject undefined references during linking
+ sparc64: vdso: Link with -z noexecstack
+ wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
+ wifi: mt76: mt7921: fix 6GHz regulatory update on connection
+ bpf: Fix variable length stack write over spilled pointers
+ wifi: ath10k: fix station lookup failure during disconnect
+ bpf: fix mm lifecycle in open-coded task_vma iterator
+ bpf: switch task_vma iterator from mmap_lock to per-VMA locks
+ bpf: return VMA snapshot from task_vma iterator
+ Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
sco_pi(sk)->codec
+ ipv4: udp: fix typos in comments
+ ipv6: udp: fix typos in comments
+ udp: Force compute_score to always inline
+ PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs
encoding
+ PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix()
+ PCI: dwc: Invoke post_init in dw_pcie_resume_noirq()
+ PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
+ spi: spi-nxp-fspi: remove the goto in probe
+ spi: spi-nxp-fspi: enable runtime pm for fspi
+ spi: nxp-fspi: Use reinit_completion() for repeated operations
+ drm/v3d: Handle error from drm_sched_entity_init()
+ PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation
+ drm/imagination: Switch reset_reason fields from enum to u32
+ drm/msm/dsi: fix bits_per_pclk
+ drm/msm/dsi: fix hdisplay calculation for CMD mode panel
+ PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
support
+ drm/msm/a6xx: Fix dumping A650+ debugbus blocks
+ crypto: qat - introduce fuse array
+ crypto: qat - disable 4xxx AE cluster when lead engine is fused off
+ crypto: qat - disable 420xx AE cluster when lead engine is fused off
+ crypto: qat - fix type mismatch in RAS sysfs show functions
+ PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode
+ PCI: tegra194: Free up Endpoint resources during remove()
+ arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
+ arm64: dts: qcom: sm8650: Fix GIC_ITS range length
+ arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller
+ arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
+ arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
+ arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
+ arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
+ hte: tegra194: remove Kconfig dependency on Tegra194 SoC
+ UBUNTU: [Config] Adjust CONFIG_HTE_TEGRA194
+ cxl/pci: Check memdev driver binding status in cxl_reset_done()
+ ext4: fix possible null-ptr-deref in mbt_kunit_exit()
+ pinctrl: realtek: Fix function signature for config argument
+ perf maps: Fix copy_from that can break sorted by name order
+ platform/x86: asus-wmi: adjust screenpad power/brightness handling
+ platform/x86: asus-wmi: fix screenpad brightness range
+ tty: serial: ip22zilog: Fix section mispatch warning
+ clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
+ erofs: unify lcn as u64 for 32-bit platforms
+ net/sched: act_mirred: fix wrong device for mac_header_xmit check in
tcf_blockcast_redir
+ tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
+ ice: fix ICE_AQ_LINK_SPEED_M for 200G
+ net/mlx5: Fix HCA caps leak on notifier init failure
+ pwm: atmel-tcb: Cache clock rates and mark chip as atomic
+ mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
+ fsnotify: fix inode reference leak in fsnotify_recalc_mask()
+ drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
+ ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
+ tcp: make probe0 timer handle expired user timeout
+ drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
+ drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
+ ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
+ drm/xe/debugfs: Correct printing of register whitelist ranges
+ drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
+ PCI: Initialize temporary device in new_id_store()
+ ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
+ drm/loongson: Use managed KMS polling
+ ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
+ drm/xe/dma-buf: handle empty bo and UAF races
+ btrfs: do not mark inode incompressible after inline attempt fails
+ RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
+ tracing: Avoid NULL return from hist_field_name() on truncation
+ UBUNTU: Upstream stable to v6.6.141, v6.12.91
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2156956
Title:
Noble update: upstream stable patchset 2026-06-16
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2156956/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
