Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-10-05
Ported from the following upstream stable releases:
v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153,
v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105,
v6.12.106, v6.12.107, v6.12.108, v6.12.109
from git://git.kernel.org/
smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
ASoC: nau8821: Cancel delayed work on component remove
bpf: Fix use-after-free in offloaded map/prog info fill
riscv: Fix register corruption from uninitialized cregs on error
ASoC: nau8821: Cancel pending work before suspend
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
selinux: switch two allocations to use kzalloc_objs()
powerpc/hv-gpci: fix preempt count leak in sysfs show paths
ksmbd: harden file lifetime during session teardown
ext4: make some fast commit functions reuse extents path
ext4: propagate errors from fast commit range replay
nilfs2: correct return value kernel-doc descriptions for ioctl functions
nilfs2: reject invalid block index in GC ioctl
nfc: nci: add data_len bound checks to activation parameter extractors
HID: magicmouse: re-enable multitouch after reset-resume
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
nvmet-tcp: bound SGL data length before allocating command buffers
HID: nintendo: stop device IO before hid_hw_stop on probe failure
HID: ft260: validate i2c input report length
HID: ft260: fix stack-use-after-return write in I2C read race
HID: uclogic: fix use-after-free of inrange_timer on remove
HID: pidff: clang-format pass
HID: pidff: fix OOB write when hid->inputs is empty
Bluetooth: hci_sync: Use bt_dev_err() to log error message in
hci_update_event_filter_sync()
Bluetooth: hci_sync: Fix accept list UAF during suspend
xfs: remove file_path tracepoint data
fpga: dfl: fme: add error handling
accessibility: speakup: unregister tty ldisc on later init failures
usb: xhci: Handle USB3 port events when there is one roothub
xhci: dbgtty: Fix unregister on tty_register_driver() failure
xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
fuse: fix invalidate lock leak on setattr writeback failure
fuse: fix invalidate lock leak on open O_TRUNC DAX failure
usb: usbtest: disable dynamic ID support
usb: gadget: f_tcm: keep port count until LUN teardown completes
tls: device: fix out-of-bounds write in tls_append_frag()
x86/CPU/AMD: Carve out a Zen5 models range
xfrm: espintcp: fix UAF during close
xfrm: drop ESP-in-TCP packets with no ingress device
xfrm: ah6: validate routing header segments_left
xfrm: fix xfrm_state_construct() auth-trunc leak
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
ipv6: seg6: clear IPv4 control block on IPIP decapsulation
mm/swap: reject swapon() on filesystem-level encrypted files
crypto: atmel-tdes - use scatterlist length before DMA mapping
crypto: qce - fix CCM AAD buffer underallocation
crypto: mxs-dcp - fix source scatterlist length access
crypto: qce - Remove unsafe/deprecated algorithms
KVM: s390: vsie: zero stale crypto bits
usb: core: Add lock to usb_wakeup_notification()
usb: core: Strengthen error handling in hub_hub_status()
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
ALSA: usb-audio: Complete cleanup after system-resume errors
USB: serial: option: fix slab OOB read in interrupt URB callback
USB: serial: spcp8x5: drop broken carrier detect support
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
um: Add os_set_pdeathsig helper function
um: Set parent death signal for winch thread/process
um: Use os_set_pdeathsig helper in winch thread/process
um: Set parent-death signal for ubd io thread/process
um: Set parent-death signal for write_sigio thread/process
um: Set parent death signal for userspace process
kunit: tool: Terminate kernel under test on SIGINT
kunit: tool: skip stty when stdin is not a tty
um: Preserve errno within signal handler
bpf: Reset register bounds before narrowing retval range in check_mem_access()
pinctrl: qcom: Unconditionally mark gpio as wakeup enable
btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
netfilter: nf_tables: make nft_object rhltable per table
hwmon: (ina2xx) Add support for has_alerts configuration flag
hwmon: (ina2xx) Add support for INA260
hwmon: (ina226) Add support for SY24655
hwmon: (ina2xx) Make it easier to add more devices
hwmon: (ina2xx) Add support for INA234
hwmon: (ina2xx) Shift INA234 shunt and current registers
hwmon: (ina2xx) Fix various overflow issues
hwmon: (sht3x) Fix unaligned accesses
net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
net: ethernet: mtk_eth_soc: support named IRQs
net: ethernet: mtk_eth_soc: add consts for irq index
net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
idpf: Fix mailbox IRQ name leak on request failure
Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
Bluetooth: ISO: fix leaking sk after socket release
Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
tracing: Remove TRACE_EVENT_FL_FILTERED logic
tracing/mmiotrace: Remove reference to unused per CPU data pointer
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
ALSA: seq: Fix division by zero in initialize_timer()
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
ata: libata-sata: fix ata_scsi_lpm_supported() iteration
ALSA: usb-audio: fix stack info leak in RME Digiface status
binfmt_misc: don't let an 'F' entry pin its own instance
cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
power: supply: max17040: handle missing status supplier
s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
drm/amd/display: use proper context for logging
Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
media: chips-media: wave5: Support CBP profile
drm/amdgpu: Fix context pstate override handling
drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
drm/xe/sched_job: Promote xe_sched_job_add_deps()
drm/xe: Wait on external BO kernel fences in exec IOCTL
drm/xe: Normalize bo flags macros
drm/xe: Rename ___xe_bo_create_locked()
drm/xe: Hold a dma-buf reference for imported BOs
rxrpc: Generate rtt_min
rxrpc: Adjust the rxrpc_rtt_rx tracepoint
rxrpc: Fix the calculation and use of RTO
rxrpc: Manage RTT per-call rather than per-peer
drm/amd/display: Add AV mute wait frames to dce110_set_avmute
drm/amd/display: Check for tg ops in dce110_set_avmute
net: hns3: fix speed configuration residue after driver reload
enic: fix tx_hang_reset use-after-free on device removal
pds_core: keep the health thread stopped during reset
xsk: require at least 16 bytes of TX metadata
net: usb: ipheth: fix carrier_work UAF on disconnect
blk-mq: pop cached request if it is usable
blk-mq: reinsert cached request to the list
crypto: ccp - Add new SEV/SNP platform shutdown API
KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
selftests/bpf: Ensure UDP sockets are bound
nvmem: layouts: Add fixed-layout driver
ring-buffer: Prevent subbuf order change when resizing is disabled
binfmt_misc: don't warn when the mount is completed from another user namespace
ima: Instantiate file_truncate and path_truncate hooks
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
fsverity: Fix silent truncation in bpf_get_fsverity_digest()
mtd: ubi: skip programming unused bits in ubi headers
ubi: fastmap: fix ubi->fm memory leak
crypto: ccp: Add external API interface for PSP module initialization
KVM: SVM: Ensure PSP module is initialized if KVM module is built-in
drm/amdgpu: reject oversized IBs with per-ring packet limits
pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
drm/xe: Order ring writes before ring tail updates
drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
xfs: clear zapped attr fork state when bmap repair finds no attr fork
ceph: Convert ceph_find_incompatible() to take a folio
ceph: Convert writepage_nounlock() to write_folio_nounlock()
ceph: fix writeback_count leak in write_folio_nounlock()
mm/khugepaged: guard is_zero_pfn() calls with pte_present()
super: remove pointless s_root checks
super: skip dying superblocks early
eventpoll: pin files while checking reverse paths
KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
binfmt_misc: don't leak the user namespace when the mount fails
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
super: use a common iterator (Part 1)
ata: libata-scsi: terminate deferred commands on time out
super: use common iterator (Part 2)
drm/amd/pm: Use same metric table for APU
drm/amd/pm: Use macro to initialize metrics table
drm/amdgpu: remove unused function parameter
drm/amd/pm: adjust the visibility of pp_table sysfs node
ring-buffer: Simplify functions with __free(kfree) to free allocations
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
x86/mce: Remove __mcheck_cpu_init_early()
x86/mce: Set CR4.MCE last during init
x86/mce: Set up the polling timer before CMCI discovery
tcp: fix icsk_ack.ato bitfield overflow
fs: unlock the superblock during iterate_supers_type
ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
net: ethernet: mtk_eth_soc: improve support for named interrupts
ALSA: scarlett2: Use a private URB for the notification endpoint
hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
xfs: namespace the maximum length/refcount symbols
xfs: check AGI unlinked inode buckets
xfs: hoist per-bucket unlinked list check to helper
xfs: don't livelock in scrub on a circular unlinked list
net: dst: add four helpers to annotate data-races around dst->dev
ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
ipv4: start using dst_dev_rcu()
HID: nintendo: register input device after capabilities are set
Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
selinux: fix style issues in security/selinux/ss/avtab.h
selinux: fix style issues in security/selinux/ss/policydb.c
selinux: use known type instead of void pointer
selinux: avoid unnecessary indirection in struct level_datum
selinux: make more use of str_read() when loading the policy
selinux: fix style issues in security/selinux/ss/policydb.h
selinux: use u16 for security classes
selinux: fix style issues in security/selinux/ss/constraint.h
selinux: more strict policy parsing
selinux: reject a permission value exceeding the class permission count
selinux: require a class's permission values to cover its permission count
HID: pidff: Rework pidff_set_time() to fix warnings
HID: pidff: Use ARRAY_SIZE macro instead of sizeof
HID: asus: simplify RGB init sequence
HID: asus: fix missing hid_is_usb() check
gtp: serialize PDP context updates
net/tcp: fix TCP-AO key deletion in VRFs
tcp: fix AO info use-after-free in tcp_ao_connect_init()
net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
batman-adv: reject unrepresentable multicast TVLV offsets
vxlan: keep the last remote linked during FDB flush
netfilter: nf_tables: don't queue packet path object notifications
crypto: qcom-rng - rename *_of_data to *_match_data
crypto: qcom-rng - Enable clock in hwrng case
crypto: qcom-rng - Allow zero as a random number
crypto: qcom-rng - Remove crypto_rng interface
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
bnxt_en: Mask the bd_cnt field in the TX BD properly
md: make rdev_addable usable for rcu mode
f2fs: convert f2fs_compress_ctx_add_page() to use folio
f2fs: convert f2fs_handle_page_eio() to use folio
f2fs: fix potential deadloop in prepare_compress_overwrite()
block: mark GFP_NOIO around sysfs ->store()
drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
perf/x86/intel/uncore: Fix die ID init and look up bugs
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
wifi: ath11k: fix memory leaks in beacon template setup
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
alpha: don't leak hardware-fabricated FP exception bits to user space
clocksource/drivers/timer-sun4i: Advertise a real minimum delta
powerpc/pseries/iommu: switch to Default DMA window during kdump
timers/itimer: Zero-init old itimerval before copy to userspace
apparmor: fix cred UAF caused by begin_current_label_crit_section()
apparmor: fix out-of-bounds write when null terminating a label vec
include/linux/list.h: mark list_add and __list_add as __always_inline
mm/kmemleak: avoid soft lockup when scanning task stacks
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
mm/zswap: fix global shrinker when memory cgroup is disabled
mm: memcg: stop reclaim when a limit update is superseded
mm: mempolicy: fix automatic numa balancing for shmem
tools/compiler: match glibc 2.42 definition of __attribute_const__
x86/tdx: Fix off-by-one in port I/O handling
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
x86/tdx: Fix zero-extension for 32-bit port I/O
hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
tracing/user_events: Clear copied tracing state before fork duplication
tracing: Fix crash passing ERR_PTR to kthread_stop()
tracing: Fix logged instance name on creation failure
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
tracing: Fix use-after-free with same-name named triggers
cdx: Fix double free when sysfs file creation fails
device property: fix infinite loop in fwnode_for_each_child_node()
misc: nsm: bound the device-reported response length
powerpc/powermac: fix OF node refcount
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
serial: imx: serialize imx_uart_ports[] lifetime
staging: greybus: hid: fix SET_REPORT return value
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
USB: phy: fsl-usb: fix missing static keywords
usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
usb: gadget: midi2: remove default configfs groups on teardown
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and
uvc_function_unbind()
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
media: cec: stm32: prevent out-of-bounds write on RX overflow
media: vicodec: fix out-of-bounds write in FWHT encoder
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
of: fix out-of-bounds read in of_alias_scan() stem parser
ubifs: fix out-of-bounds read in signature length check
zsmalloc: rename class stat mutators
zsmalloc: account for handle size in class lookup
NFSD: check truncate permission under inode lock
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
NFSD: Fix off-by-one in DRC bucket pruning limit
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
nfsd: release path refs on follow_down() error
nfsd: Reset write verifier when async COPY writeback fails
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
nfsd: sample writeback error cursor before async COPY loop
nfsd: size fh_verify server sockaddr slot by xpt_locallen
nfsd: validate symlink target length in NFSv4 CREATE
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
nfsd: add filehandle match check to nfsd4_delegreturn()
nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
nfsd: check client ownership when cancelling a copy-notify stateid
nfsd: clear opcnt on compound arg release to prevent OOB read
nfsd: defer vfree of compound ops to fix rpc_status UAF
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
nfsd: fix cpntf publish race in nfs4_init_cp_state
nfsd: fix nfsd_file leak on inter-server COPY setup failure
nfsd: fix version mismatch loops in nfsd_acl_init_request()
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
nfsd: gate nfs2 setacl by argp->mask
nfsd: gate nfs3 setacl by argp->mask
nfsd: initialize copy-notify stateid before publishing it
nfsd: initialize DRC hash table before registering shrinker
nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
nfsd: revoke copy-notify stateids before dropping their reference
NFSD: Prevent lock owner use-after-free during client teardown
libceph: validate OSD extent maps before cursor advance
libceph: reject buckets with mismatched CRUSH ids
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
ceph: bound copied dentry name length in NFS export get_name
ceph: bound num_export_targets array for mds info v2/v3
ceph: bound xattr value length in __build_xattrs()
ceph: do not repeat ceph_trim_dentries() if no progress possible
btrfs: rename err to ret in btrfs_recover_relocation()
btrfs: drop recovered reloc root refs on recovery failure
audit: avoid dropping live tree ref on fsnotify rule autoremove
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
smb: client: clear ce->tgthint in free_tgts()
smb: client: fix ALIGN() overflow in symlink_data() error context loop
smb: client: harden DFS cache against invalid target hints
HID: picolcd: clamp eeprom debugfs read to bytes actually received
HID: roccat: free buffered reports when destroying device
HID: sensor: custom: Fix field sysfs group cleanup on failure
HID: mcp2221: stop device IO before hid_hw_stop
HID: mcp2221: validate report size in mcp2221_raw_event()
eventfs: Initialize ei->children and ei->list in init_ei()
fs/ntfs3: validate dirty page table on log replay
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
fs/ntfs3: bound page_lcns[] index by the log record
eCryptfs: bound the packet-length peek to the user buffer
ecryptfs: fix tag 11 packet exact-fit size check
ecryptfs: hold msg ctx list lock when cleaning daemon queue
ecryptfs: pass packet set buffer size to parser
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
ecryptfs: reject too-small tag 70 packets
ecryptfs: release message context on send failure
ecryptfs: show filename encryption options
efivarfs: Rate limit statfs() handler
fat: restore original value when fat_ent_write failed
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
fbdev: uvesafb: unregister connector callback on init failure
forcedeth: fix off-by-one when saving/restoring non-PCI config space
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
ACPI: APEI: Fix ERST timeout unit conversion
ACPI: APEI: GHES: fix ARM section length accounting after header
ACPI: pfr_update: fix stack buffer overflow in query_capability()
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
alpha: marvel: Fix lock ordering in init_io7_irqs()
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
auxdisplay: charlcd: cancel backlight work on registration failure
block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
Bluetooth: eir: Fix OOB read in eir_get_service_data()
bnx2x: fix double free in bnx2x_init_firmware() error path
bpf: Disable preemption in __bpf_get_stack
bpf: Harden bloom filter sizing and indexing on 32-bit kernels
dm-era: fix shadowed superblock leak on take-snap failure
dm raid1: reserve space for NUL-terminator in build_constructor_string()
dm: Constify struct dm_block_validator
dm array: validate array block headers on read
dm array: reject an array block whose value size is not the caller's
coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
cpufreq: schedutil: Fix rate limit overflow
cxl/pmem: Format the nvdimm serial number as unsigned decimal
Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
Bluetooth: RFCOMM: serialize security confirmation handling
Bluetooth: hci_conn: re-enable advertising only for peripheral role
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
kasan: fix cache shrink race with CPU hotplug
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
ip6_gre: fix hardware header length for NBMA tunnels
ipv6: use RCU iterator to dump route exceptions
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
mailbox: qcom-ipcc: fix duplicate channel allocation across holes
md: do overflow check for sb->bblog_shift in super_1_load()
mpls: reload header after pskb_may_pull()
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
params: fix charp corruption on allocation failure
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
SUNRPC: svcauth_gss: enforce krb5 token minimum length
SUNRPC: always drain cache_cleaner before destroying a cache_detail
SUNRPC: Check svc pool percpu counter allocation
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
SUNRPC: harden gss_unwrap_resp_priv length checks
sunrpc: init gssp_lock before publishing proc entry
SUNRPC: reject duplicate CREDS_VALUE options
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
SUNRPC: wait for in-flight client TLS handshake callback
svcrdma: Fix offset arithmetic in read_chunk_range
svcrdma: Fix pcl_for_each_segment for empty chunks
jbd2: bound shrinker scans by examined checkpoint buffers
jbd2: add prefix 'jbd2' for 'shrink_type'
jbd2: check need_resched() when skipping busy checkpoint buffers
ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
sunrpc: route to a populated pool in svc_pool_for_cpu()
svcrdma: Fix unmatched rn_unregister on failed accept
svcrdma: Reject connection when transport allocation fails
svcrdma: Reject inline replies that overflow the pull-up buffer
svcrdma: Validate Read chunk positions before reconstruction
udf: reject VAT indexes equal to the entry count
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
staging: media: tegra-video: fix of_node_put() on VIP parse errors
staging: media: tegra-video: vi: fix probe failure on skipped last port
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
rpmsg: glink: smem: order FIFO read after availability check
arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
riscv: acpi: Handle LPI architectural context loss flags
remoteproc: scp: Fix device reference leak on failed lookup
qede: Fix NULL pointer dereference in TPA fragment processing
RDMA/cxgb4: Cancel reg_work before freeing device on remove
RDMA/ucma: Lock the handler in ucma_set_ib_path()
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving
dangling of_node pointer
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership
transferred to rdata
regulator: qcom-refgen: correct the regulator type to CURRENT
ring-buffer: Free cpu_buffer::free_page with subbuf_order
ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
orangefs: fix double-free of trailer_buf on readdir copy failure
orangefs: skip leading spaces before parsing client debug masks
ocfs2: always run deallocs on copy-on-write completion
ocfs2: bound namelen in dlm_migrate_request_handler
ocfs2: validate lengths in dlm_mig_lockres_handler
ocfs2: validate rl_used against rl_count in refcount block validator
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
ocfs2: fix readdir position truncation on 32-bit kernels
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
openvswitch: only skb_tx_error() a packet we are about to drop
ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
arm64: compat: Fix decrementing LDM/STM alignment emulation
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
hwmon: (max6621) fix negative temperature offset and crit readings
hwmon: (max6621) fix temperature clamp range
lockd: pin next file across nlm_inspect_file lock-drop
lockd: fix NULL dereference on lockowner allocation failure
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
nvme: zero the discard fallback page
nvme-pci: disable controller on admin queue IRQ setup failure
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
nvme-tcp: fix host memory disclosure on R2T for a read command
nvme-tcp: reject a read that transferred too few bytes
sctp: stop processing a packet once its association is deleted
sctp: drop a chunk if its transport was removed
sctp: fix NULL deref on untransmitted RECONF completion
sctp: distinguish sequence zero from wildcard in reconf lookup
sctp: fix stream->outcnt underflow on duplicate RECONF responses
power: supply: bq24257: fix use-after-free on remove
power: supply: bq256xx: drain usb_work before freeing the charger
power: supply: bq25890: Fix power_supply reference leak
power: supply: charger-manager: register regulators before exposing sysfs
power: supply: cros_usbpd-charger: bound the EC-reported port count
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
power: supply: lp8788-charger: fix use-after-free on remove
power: supply: qcom_battmgr: terminate the strings from firmware
power: supply: rt9455: quiesce delayed work before teardown
power: supply: twl4030_charger: cancel workers via devm
power: supply: ucs1002: fix use-after-free on remove
power: supply: max17040: propagate register read errors
power: supply: max17040: drop incorrect I2C functionality check
power: supply: max17040: synchronize work cancellation on suspend
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
s390/dasd: Do not complete a failed ESE read as successful
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
s390/dasd: Propagate partial completion length across ERP recovery
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
PCI: meson: Fix GPIO state while requesting PERST#
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
PCI/MSI: Enable memory decoding before restoring MSI-X messages
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
PCI/proc: Use file_ns_capable() when checking config space read access
PCI/proc: Warn on writes to kernel-exclusive config space regions
iommu/sva: Set handle->dev before the SVA handle is visible
iommu/arm-smmu-v3: Manage teardown with devm
iommu/vt-d: Fix no_iommu to disable platform opt-in
iommu/vt-d: Force requesting ACS when tboot is enabled
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
platform/x86: ISST: Validate level in perf mask ioctls
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
mmc: via-sdmmc: stop card-detect handling on probe failure
platform/x86: ISST: Just allow 2 bits for SST feature enable
platform/x86: ISST: Validate logical CPU id and clos id
platform/x86: ISST: Validate parameter for core power state
platform/x86: ISST: Validate parameter for frequency and priority
platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
platform/chrome: sensorhub: Bound the EC-reported sensor number
platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
platform/x86: hp-bioscfg: advance elem past consumed array elements
platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
platform/x86: hp-bioscfg: fix heap OOB read on empty password write
platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
platform/x86: hp-bioscfg: pass validated element count to package parsers
platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
ipmi: ipmb: validate write message length
ipmi: si: Fix NULL pointer dereference after failed registration
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
xdp: fix zero-copy frame layout
slip: fix use-after-free in sl_sync()
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
net: tun: bound receive headroom
platform/x86: ISST: Add a NULL check for sst_inst[]
platform/x86: ISST: Use PP level enable mask
platform/x86: ISST: Return error during profile addition
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
net: ipa: fix stalled modem TX queue after runtime resume
l2tp: improve tunnel/session refcount helpers
l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
net: l2tp: do not propagate multicast notification errors
net: openvswitch: fix flow mask use-after-free on flow deletion
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
net: ravb: avoid dereferencing an invalid PTP clock
net: ravb: serialize PTP clock teardown
net: thunderbolt: Release the Rx HopID that was handed out on mismatch
net: thunderbolt: Mark the connection down when bringing it up fails
NTB: ntb_transport: Recycle TX entries before client callbacks
NTB: ntb_transport: Fail TX enqueue when the QP link is down
NTB: ntb_transport: Reject oversized TX buffers
net: ntb_netdev: Avoid double-accounting netif_rx() drops
net: ntb_netdev: Count packets dropped on RX refill failure
net/smc: do not dereference an unset send buffer on the SMC-D teardown path
net/smc: fix socket refcount leak in smc_switch_conns()
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
net/smc: unregister the connection before draining the rx tasklet
net: cap advertised IP tunnel headroom
net: fix spurious TX timeout after dev_activate()
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
seg6: reset IP6CB after IPv6 decapsulation
mfd: sm501: Fix potential memory leaks during remove
ALSA: 6fire: bound the MIDI event length from the device
ALSA: aloop: Check card index validity at probe
ALSA: bcd2000: clear the URB pointers on disconnect
ALSA: mpu401: Check card index validity at probe
ALSA: mts64: Check card index validity at probe
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
ALSA: portman2x4: Check card index validity at probe
ALSA: serial-u16550: Check card index validity at probe
ALSA: virmidi: Check card index validity at probe
ring-buffer: Fix subbuf resize race with ring buffer readers
iommu/amd: remove return value of amd_iommu_detect
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
dm-stats: fix a crash if allocation of per-cpu data fails
dm-switch: use WRITE_ONCE() in switch_region_table_write()
i3c: master: Fix info leak and UAF in device unregister path
i3c: master: svc: bound IBI payload to the requested max_payload_len
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
wifi: rtl8xxxu: remove rtl8xxxu_ prefix from filenames
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
crypto: sun8i-ss - Remove crypto_rng interface
UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_SS_PRNG
crypto: sun8i-ce - Remove crypto_rng interface
UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_CE_PRNG
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
vsock/virtio: flush works in dependency order
w1: ds28e17: reject an oversize length on an I2C block read
xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
sticon/parisc: Detect default STI graphics card for console output
signal: avoid shared siginfo namespace rewrites
smack: fix cred UAF in smack_file_send_sigiotask()
taskstats: fix cpumask parsing cutting off the last character
timer: Keep debugobjects state consistent in migrate_timer_list()
udf: Fix i_lenExtents truncation on 32-bit kernels
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
mm: avoid unnecessary use of is_swap_pmd()
mm: provide mm_struct and address to huge_ptep_get()
mm/rmap: use huge_ptep_get() in try_to_unmap_one()
UBUNTU: Upstream stable to v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153,
v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105,
v6.12.106, v6.12.107, v6.12.108, v6.12.109
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Summary changed:
- Noble update: upstream stable patchset 2026-10-07
+ Noble update: upstream stable patchset 2026-10-05
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
- upstream stable patchset 2026-10-07
+ upstream stable patchset 2026-10-05
+
+ Ported from the following upstream stable releases:
+ v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153,
v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105,
v6.12.106, v6.12.107, v6.12.108, v6.12.109
+
from git://git.kernel.org/
+
+ smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
+ smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
+ ASoC: nau8821: Cancel delayed work on component remove
+ bpf: Fix use-after-free in offloaded map/prog info fill
+ riscv: Fix register corruption from uninitialized cregs on error
+ ASoC: nau8821: Cancel pending work before suspend
+ smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
+ selinux: switch two allocations to use kzalloc_objs()
+ powerpc/hv-gpci: fix preempt count leak in sysfs show paths
+ ksmbd: harden file lifetime during session teardown
+ ext4: make some fast commit functions reuse extents path
+ ext4: propagate errors from fast commit range replay
+ nilfs2: correct return value kernel-doc descriptions for ioctl functions
+ nilfs2: reject invalid block index in GC ioctl
+ nfc: nci: add data_len bound checks to activation parameter extractors
+ HID: magicmouse: re-enable multitouch after reset-resume
+ HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
+ nvmet-tcp: bound SGL data length before allocating command buffers
+ HID: nintendo: stop device IO before hid_hw_stop on probe failure
+ HID: ft260: validate i2c input report length
+ HID: ft260: fix stack-use-after-return write in I2C read race
+ HID: uclogic: fix use-after-free of inrange_timer on remove
+ HID: pidff: clang-format pass
+ HID: pidff: fix OOB write when hid->inputs is empty
+ Bluetooth: hci_sync: Use bt_dev_err() to log error message in
hci_update_event_filter_sync()
+ Bluetooth: hci_sync: Fix accept list UAF during suspend
+ xfs: remove file_path tracepoint data
+ fpga: dfl: fme: add error handling
+ accessibility: speakup: unregister tty ldisc on later init failures
+ usb: xhci: Handle USB3 port events when there is one roothub
+ xhci: dbgtty: Fix unregister on tty_register_driver() failure
+ xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
+ fuse: fix invalidate lock leak on setattr writeback failure
+ fuse: fix invalidate lock leak on open O_TRUNC DAX failure
+ usb: usbtest: disable dynamic ID support
+ usb: gadget: f_tcm: keep port count until LUN teardown completes
+ tls: device: fix out-of-bounds write in tls_append_frag()
+ x86/CPU/AMD: Carve out a Zen5 models range
+ xfrm: espintcp: fix UAF during close
+ xfrm: drop ESP-in-TCP packets with no ingress device
+ xfrm: ah6: validate routing header segments_left
+ xfrm: fix xfrm_state_construct() auth-trunc leak
+ net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
+ ipv6: seg6: clear IPv4 control block on IPIP decapsulation
+ mm/swap: reject swapon() on filesystem-level encrypted files
+ crypto: atmel-tdes - use scatterlist length before DMA mapping
+ crypto: qce - fix CCM AAD buffer underallocation
+ crypto: mxs-dcp - fix source scatterlist length access
+ crypto: qce - Remove unsafe/deprecated algorithms
+ KVM: s390: vsie: zero stale crypto bits
+ usb: core: Add lock to usb_wakeup_notification()
+ usb: core: Strengthen error handling in hub_hub_status()
+ ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
+ ALSA: usb-audio: Complete cleanup after system-resume errors
+ USB: serial: option: fix slab OOB read in interrupt URB callback
+ USB: serial: spcp8x5: drop broken carrier detect support
+ USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
+ usb: usbfs: fix use-after-free of usb_device in usbdev_release()
+ um: Add os_set_pdeathsig helper function
+ um: Set parent death signal for winch thread/process
+ um: Use os_set_pdeathsig helper in winch thread/process
+ um: Set parent-death signal for ubd io thread/process
+ um: Set parent-death signal for write_sigio thread/process
+ um: Set parent death signal for userspace process
+ kunit: tool: Terminate kernel under test on SIGINT
+ kunit: tool: skip stty when stdin is not a tty
+ um: Preserve errno within signal handler
+ bpf: Reset register bounds before narrowing retval range in check_mem_access()
+ pinctrl: qcom: Unconditionally mark gpio as wakeup enable
+ btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
+ Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
+ netfilter: nf_tables: make nft_object rhltable per table
+ hwmon: (ina2xx) Add support for has_alerts configuration flag
+ hwmon: (ina2xx) Add support for INA260
+ hwmon: (ina226) Add support for SY24655
+ hwmon: (ina2xx) Make it easier to add more devices
+ hwmon: (ina2xx) Add support for INA234
+ hwmon: (ina2xx) Shift INA234 shunt and current registers
+ hwmon: (ina2xx) Fix various overflow issues
+ hwmon: (sht3x) Fix unaligned accesses
+ net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
+ net: ethernet: mtk_eth_soc: support named IRQs
+ net: ethernet: mtk_eth_soc: add consts for irq index
+ net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
+ idpf: Fix mailbox IRQ name leak on request failure
+ Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
+ Bluetooth: ISO: fix leaking sk after socket release
+ Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
+ tracing: Remove TRACE_EVENT_FL_FILTERED logic
+ tracing/mmiotrace: Remove reference to unused per CPU data pointer
+ tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
+ net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
+ fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
+ Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
+ ALSA: seq: Fix division by zero in initialize_timer()
+ ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
+ ata: libata-sata: fix ata_scsi_lpm_supported() iteration
+ ALSA: usb-audio: fix stack info leak in RME Digiface status
+ binfmt_misc: don't let an 'F' entry pin its own instance
+ cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
+ power: supply: max17040: handle missing status supplier
+ s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
+ drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
+ drm/amd/display: use proper context for logging
+ Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
+ fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
+ media: chips-media: wave5: Support CBP profile
+ drm/amdgpu: Fix context pstate override handling
+ drm/exec: Remove the index parameter from
drm_exec_for_each_locked_obj[_reverse]
+ drm/xe/sched_job: Promote xe_sched_job_add_deps()
+ drm/xe: Wait on external BO kernel fences in exec IOCTL
+ drm/xe: Normalize bo flags macros
+ drm/xe: Rename ___xe_bo_create_locked()
+ drm/xe: Hold a dma-buf reference for imported BOs
+ rxrpc: Generate rtt_min
+ rxrpc: Adjust the rxrpc_rtt_rx tracepoint
+ rxrpc: Fix the calculation and use of RTO
+ rxrpc: Manage RTT per-call rather than per-peer
+ drm/amd/display: Add AV mute wait frames to dce110_set_avmute
+ drm/amd/display: Check for tg ops in dce110_set_avmute
+ net: hns3: fix speed configuration residue after driver reload
+ enic: fix tx_hang_reset use-after-free on device removal
+ pds_core: keep the health thread stopped during reset
+ xsk: require at least 16 bytes of TX metadata
+ net: usb: ipheth: fix carrier_work UAF on disconnect
+ blk-mq: pop cached request if it is usable
+ blk-mq: reinsert cached request to the list
+ crypto: ccp - Add new SEV/SNP platform shutdown API
+ KVM: SVM: Add support to initialize SEV/SNP functionality in KVM
+ selftests/bpf: Ensure UDP sockets are bound
+ nvmem: layouts: Add fixed-layout driver
+ ring-buffer: Prevent subbuf order change when resizing is disabled
+ binfmt_misc: don't warn when the mount is completed from another user
namespace
+ ima: Instantiate file_truncate and path_truncate hooks
+ fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
+ fsverity: Fix silent truncation in bpf_get_fsverity_digest()
+ mtd: ubi: skip programming unused bits in ubi headers
+ ubi: fastmap: fix ubi->fm memory leak
+ crypto: ccp: Add external API interface for PSP module initialization
+ KVM: SVM: Ensure PSP module is initialized if KVM module is built-in
+ drm/amdgpu: reject oversized IBs with per-ring packet limits
+ pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0
+ mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
+ drm/xe: Order ring writes before ring tail updates
+ drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
+ xfs: clear zapped attr fork state when bmap repair finds no attr fork
+ ceph: Convert ceph_find_incompatible() to take a folio
+ ceph: Convert writepage_nounlock() to write_folio_nounlock()
+ ceph: fix writeback_count leak in write_folio_nounlock()
+ mm/khugepaged: guard is_zero_pfn() calls with pte_present()
+ super: remove pointless s_root checks
+ super: skip dying superblocks early
+ eventpoll: pin files while checking reverse paths
+ KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
+ binfmt_misc: don't leak the user namespace when the mount fails
+ net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
+ drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
+ super: use a common iterator (Part 1)
+ ata: libata-scsi: terminate deferred commands on time out
+ super: use common iterator (Part 2)
+ drm/amd/pm: Use same metric table for APU
+ drm/amd/pm: Use macro to initialize metrics table
+ drm/amdgpu: remove unused function parameter
+ drm/amd/pm: adjust the visibility of pp_table sysfs node
+ ring-buffer: Simplify functions with __free(kfree) to free allocations
+ ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
+ x86/mce: Remove __mcheck_cpu_init_early()
+ x86/mce: Set CR4.MCE last during init
+ x86/mce: Set up the polling timer before CMCI discovery
+ tcp: fix icsk_ack.ato bitfield overflow
+ fs: unlock the superblock during iterate_supers_type
+ ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
+ net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name
+ net: ethernet: mtk_eth_soc: improve support for named interrupts
+ ALSA: scarlett2: Use a private URB for the notification endpoint
+ hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS()
+ serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
+ xfs: namespace the maximum length/refcount symbols
+ xfs: check AGI unlinked inode buckets
+ xfs: hoist per-bucket unlinked list check to helper
+ xfs: don't livelock in scrub on a circular unlinked list
+ net: dst: add four helpers to annotate data-races around dst->dev
+ ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
+ ipv4: start using dst_dev_rcu()
+ HID: nintendo: register input device after capabilities are set
+ Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
+ RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
+ selinux: fix style issues in security/selinux/ss/avtab.h
+ selinux: fix style issues in security/selinux/ss/policydb.c
+ selinux: use known type instead of void pointer
+ selinux: avoid unnecessary indirection in struct level_datum
+ selinux: make more use of str_read() when loading the policy
+ selinux: fix style issues in security/selinux/ss/policydb.h
+ selinux: use u16 for security classes
+ selinux: fix style issues in security/selinux/ss/constraint.h
+ selinux: more strict policy parsing
+ selinux: reject a permission value exceeding the class permission count
+ selinux: require a class's permission values to cover its permission count
+ HID: pidff: Rework pidff_set_time() to fix warnings
+ HID: pidff: Use ARRAY_SIZE macro instead of sizeof
+ HID: asus: simplify RGB init sequence
+ HID: asus: fix missing hid_is_usb() check
+ gtp: serialize PDP context updates
+ net/tcp: fix TCP-AO key deletion in VRFs
+ tcp: fix AO info use-after-free in tcp_ao_connect_init()
+ net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
+ batman-adv: reject unrepresentable multicast TVLV offsets
+ vxlan: keep the last remote linked during FDB flush
+ netfilter: nf_tables: don't queue packet path object notifications
+ crypto: qcom-rng - rename *_of_data to *_match_data
+ crypto: qcom-rng - Enable clock in hwrng case
+ crypto: qcom-rng - Allow zero as a random number
+ crypto: qcom-rng - Remove crypto_rng interface
+ wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
+ bnxt_en: Mask the bd_cnt field in the TX BD properly
+ md: make rdev_addable usable for rcu mode
+ f2fs: convert f2fs_compress_ctx_add_page() to use folio
+ f2fs: convert f2fs_handle_page_eio() to use folio
+ f2fs: fix potential deadloop in prepare_compress_overwrite()
+ block: mark GFP_NOIO around sysfs ->store()
+ drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
+ perf/x86/intel/uncore: Fix die ID init and look up bugs
+ wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
+ wifi: ath11k: fix memory leaks in beacon template setup
+ drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
+ alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
+ alpha: don't leak hardware-fabricated FP exception bits to user space
+ clocksource/drivers/timer-sun4i: Advertise a real minimum delta
+ powerpc/pseries/iommu: switch to Default DMA window during kdump
+ timers/itimer: Zero-init old itimerval before copy to userspace
+ apparmor: fix cred UAF caused by begin_current_label_crit_section()
+ apparmor: fix out-of-bounds write when null terminating a label vec
+ include/linux/list.h: mark list_add and __list_add as __always_inline
+ mm/kmemleak: avoid soft lockup when scanning task stacks
+ mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
+ mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
+ mm/zswap: fix global shrinker when memory cgroup is disabled
+ mm: memcg: stop reclaim when a limit update is superseded
+ mm: mempolicy: fix automatic numa balancing for shmem
+ tools/compiler: match glibc 2.42 definition of __attribute_const__
+ x86/tdx: Fix off-by-one in port I/O handling
+ x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
+ x86/tdx: Fix zero-extension for 32-bit port I/O
+ hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
+ tracing/user_events: Clear copied tracing state before fork duplication
+ tracing: Fix crash passing ERR_PTR to kthread_stop()
+ tracing: Fix logged instance name on creation failure
+ tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
+ tracing: Fix use-after-free with same-name named triggers
+ cdx: Fix double free when sysfs file creation fails
+ device property: fix infinite loop in fwnode_for_each_child_node()
+ misc: nsm: bound the device-reported response length
+ powerpc/powermac: fix OF node refcount
+ rapidio: mport_cdev: fix use-after-free in dma_req_free()
+ Revert "media: v4l2-dev: fix error handling in __video_register_device()"
+ serial: imx: serialize imx_uart_ports[] lifetime
+ staging: greybus: hid: fix SET_REPORT return value
+ usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
+ usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
+ USB: phy: fsl-usb: fix missing static keywords
+ usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
+ usb: gadget: u_audio: Fix use-after-free on sound card disconnect
+ usb: gadget: snps_udc_plat: clean up PHY on probe deferral
+ usb: gadget: midi2: remove default configfs groups on teardown
+ usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
+ usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and
uvc_function_unbind()
+ usb: gadget: f_fs: Prevent deadlock during ep0 read loop
+ fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
+ HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
+ lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
+ media: cec: stm32: prevent out-of-bounds write on RX overflow
+ media: vicodec: fix out-of-bounds write in FWHT encoder
+ nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
+ of: fix out-of-bounds read in of_alias_scan() stem parser
+ ubifs: fix out-of-bounds read in signature length check
+ zsmalloc: rename class stat mutators
+ zsmalloc: account for handle size in class lookup
+ NFSD: check truncate permission under inode lock
+ NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
+ NFSD: Fix off-by-one in DRC bucket pruning limit
+ NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
+ NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
+ NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
+ nfsd: release path refs on follow_down() error
+ nfsd: Reset write verifier when async COPY writeback fails
+ nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
+ nfsd: sample writeback error cursor before async COPY loop
+ nfsd: size fh_verify server sockaddr slot by xpt_locallen
+ nfsd: validate symlink target length in NFSv4 CREATE
+ nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
+ nfsd: add filehandle match check to nfsd4_delegreturn()
+ nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
+ nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
+ nfsd: check client ownership when cancelling a copy-notify stateid
+ nfsd: clear opcnt on compound arg release to prevent OOB read
+ nfsd: defer vfree of compound ops to fix rpc_status UAF
+ nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
+ nfsd: fix cpntf publish race in nfs4_init_cp_state
+ nfsd: fix nfsd_file leak on inter-server COPY setup failure
+ nfsd: fix version mismatch loops in nfsd_acl_init_request()
+ nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
+ nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
+ nfsd: gate nfs2 setacl by argp->mask
+ nfsd: gate nfs3 setacl by argp->mask
+ nfsd: initialize copy-notify stateid before publishing it
+ nfsd: initialize DRC hash table before registering shrinker
+ nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
+ nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
+ nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
+ nfsd: revoke copy-notify stateids before dropping their reference
+ NFSD: Prevent lock owner use-after-free during client teardown
+ libceph: validate OSD extent maps before cursor advance
+ libceph: reject buckets with mismatched CRUSH ids
+ ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
+ ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
+ ceph: bound copied dentry name length in NFS export get_name
+ ceph: bound num_export_targets array for mds info v2/v3
+ ceph: bound xattr value length in __build_xattrs()
+ ceph: do not repeat ceph_trim_dentries() if no progress possible
+ btrfs: rename err to ret in btrfs_recover_relocation()
+ btrfs: drop recovered reloc root refs on recovery failure
+ audit: avoid dropping live tree ref on fsnotify rule autoremove
+ cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
+ smb: client: clear ce->tgthint in free_tgts()
+ smb: client: fix ALIGN() overflow in symlink_data() error context loop
+ smb: client: harden DFS cache against invalid target hints
+ HID: picolcd: clamp eeprom debugfs read to bytes actually received
+ HID: roccat: free buffered reports when destroying device
+ HID: sensor: custom: Fix field sysfs group cleanup on failure
+ HID: mcp2221: stop device IO before hid_hw_stop
+ HID: mcp2221: validate report size in mcp2221_raw_event()
+ eventfs: Initialize ei->children and ei->list in init_ei()
+ fs/ntfs3: validate dirty page table on log replay
+ fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
+ fs/ntfs3: bound page_lcns[] index by the log record
+ eCryptfs: bound the packet-length peek to the user buffer
+ ecryptfs: fix tag 11 packet exact-fit size check
+ ecryptfs: hold msg ctx list lock when cleaning daemon queue
+ ecryptfs: pass packet set buffer size to parser
+ ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
+ ecryptfs: reject too-small tag 70 packets
+ ecryptfs: release message context on send failure
+ ecryptfs: show filename encryption options
+ efivarfs: Rate limit statfs() handler
+ fat: restore original value when fat_ent_write failed
+ fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
+ fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
+ fbdev: ssd1307fb: defer I2C transfers from damage callbacks
+ fbdev: uvesafb: unregister connector callback on init failure
+ forcedeth: fix off-by-one when saving/restoring non-PCI config space
+ fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
+ hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
+ ACPI: APEI: Fix ERST timeout unit conversion
+ ACPI: APEI: GHES: fix ARM section length accounting after header
+ ACPI: pfr_update: fix stack buffer overflow in query_capability()
+ alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
+ alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
+ alpha: marvel: Fix lock ordering in init_io7_irqs()
+ ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
+ ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
+ auxdisplay: charlcd: cancel backlight work on registration failure
+ block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
+ Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
+ Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
+ Bluetooth: eir: Fix OOB read in eir_get_service_data()
+ bnx2x: fix double free in bnx2x_init_firmware() error path
+ bpf: Disable preemption in __bpf_get_stack
+ bpf: Harden bloom filter sizing and indexing on 32-bit kernels
+ dm-era: fix shadowed superblock leak on take-snap failure
+ dm raid1: reserve space for NUL-terminator in build_constructor_string()
+ dm: Constify struct dm_block_validator
+ dm array: validate array block headers on read
+ dm array: reject an array block whose value size is not the caller's
+ coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
+ cpufreq: schedutil: Fix rate limit overflow
+ cxl/pmem: Format the nvdimm serial number as unsigned decimal
+ Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378
+ Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
+ Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
+ Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
+ Bluetooth: RFCOMM: serialize security confirmation handling
+ Bluetooth: hci_conn: re-enable advertising only for peripheral role
+ Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
+ Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
+ Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
+ Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
+ Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
+ kasan: fix cache shrink race with CPU hotplug
+ ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
+ ip6_gre: fix hardware header length for NBMA tunnels
+ ipv6: use RCU iterator to dump route exceptions
+ libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
+ mailbox: qcom-ipcc: fix duplicate channel allocation across holes
+ md: do overflow check for sb->bblog_shift in super_1_load()
+ mpls: reload header after pskb_may_pull()
+ mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
+ nouveau/gem: reserve the bo in the info ioctl around the vma lookup
+ params: fix charp corruption on allocation failure
+ SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
+ SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
+ SUNRPC: svcauth_gss: enforce krb5 token minimum length
+ SUNRPC: always drain cache_cleaner before destroying a cache_detail
+ SUNRPC: Check svc pool percpu counter allocation
+ SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
+ SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
+ SUNRPC: harden gss_unwrap_resp_priv length checks
+ sunrpc: init gssp_lock before publishing proc entry
+ SUNRPC: reject duplicate CREDS_VALUE options
+ SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
+ SUNRPC: wait for in-flight client TLS handshake callback
+ svcrdma: Fix offset arithmetic in read_chunk_range
+ svcrdma: Fix pcl_for_each_segment for empty chunks
+ jbd2: bound shrinker scans by examined checkpoint buffers
+ jbd2: add prefix 'jbd2' for 'shrink_type'
+ jbd2: check need_resched() when skipping busy checkpoint buffers
+ ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
+ sunrpc: route to a populated pool in svc_pool_for_cpu()
+ svcrdma: Fix unmatched rn_unregister on failed accept
+ svcrdma: Reject connection when transport allocation fails
+ svcrdma: Reject inline replies that overflow the pull-up buffer
+ svcrdma: Validate Read chunk positions before reconstruction
+ udf: reject VAT indexes equal to the entry count
+ wifi: ath6kl: clamp assoc request/response lengths before subtracting IE
offsets
+ staging: media: tegra-video: fix of_node_put() on VIP parse errors
+ staging: media: tegra-video: vi: fix probe failure on skipped last port
+ scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
+ rpmsg: glink: smem: order FIFO read after availability check
+ arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
+ arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
+ riscv: acpi: Handle LPI architectural context loss flags
+ remoteproc: scp: Fix device reference leak on failed lookup
+ qede: Fix NULL pointer dereference in TPA fragment processing
+ RDMA/cxgb4: Cancel reg_work before freeing device on remove
+ RDMA/ucma: Lock the handler in ucma_set_ib_path()
+ regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving
dangling of_node pointer
+ regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership
transferred to rdata
+ regulator: qcom-refgen: correct the regulator type to CURRENT
+ ring-buffer: Free cpu_buffer::free_page with subbuf_order
+ ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
+ orangefs: fix double-free of trailer_buf on readdir copy failure
+ orangefs: skip leading spaces before parsing client debug masks
+ ocfs2: always run deallocs on copy-on-write completion
+ ocfs2: bound namelen in dlm_migrate_request_handler
+ ocfs2: validate lengths in dlm_mig_lockres_handler
+ ocfs2: validate rl_used against rl_count in refcount block validator
+ ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
+ ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
+ ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
+ ocfs2: fix readdir position truncation on 32-bit kernels
+ openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
+ openvswitch: only skb_tx_error() a packet we are about to drop
+ ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
+ arm64: compat: Fix decrementing LDM/STM alignment emulation
+ ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
+ hwmon: (max6621) fix negative temperature offset and crit readings
+ hwmon: (max6621) fix temperature clamp range
+ lockd: pin next file across nlm_inspect_file lock-drop
+ lockd: fix NULL dereference on lockowner allocation failure
+ nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
+ nvme: zero the discard fallback page
+ nvme-pci: disable controller on admin queue IRQ setup failure
+ nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
+ nvme-tcp: fix host memory disclosure on R2T for a read command
+ nvme-tcp: reject a read that transferred too few bytes
+ sctp: stop processing a packet once its association is deleted
+ sctp: drop a chunk if its transport was removed
+ sctp: fix NULL deref on untransmitted RECONF completion
+ sctp: distinguish sequence zero from wildcard in reconf lookup
+ sctp: fix stream->outcnt underflow on duplicate RECONF responses
+ power: supply: bq24257: fix use-after-free on remove
+ power: supply: bq256xx: drain usb_work before freeing the charger
+ power: supply: bq25890: Fix power_supply reference leak
+ power: supply: charger-manager: register regulators before exposing sysfs
+ power: supply: cros_usbpd-charger: bound the EC-reported port count
+ power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
+ power: supply: lp8727: fix use-after-free in lp8727_release_irq()
+ power: supply: lp8788-charger: fix use-after-free on remove
+ power: supply: qcom_battmgr: terminate the strings from firmware
+ power: supply: rt9455: quiesce delayed work before teardown
+ power: supply: twl4030_charger: cancel workers via devm
+ power: supply: ucs1002: fix use-after-free on remove
+ power: supply: max17040: propagate register read errors
+ power: supply: max17040: drop incorrect I2C functionality check
+ power: supply: max17040: synchronize work cancellation on suspend
+ s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
+ s390/dasd: Do not complete a failed ESE read as successful
+ s390/dasd: Guard sysfs discipline callbacks against unallocated private data
+ s390/dasd: Propagate partial completion length across ERP recovery
+ PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
+ PCI: meson: Fix GPIO state while requesting PERST#
+ PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
+ PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
+ PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
+ PCI/MSI: Enable memory decoding before restoring MSI-X messages
+ PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
+ PCI/proc: Use file_ns_capable() when checking config space read access
+ PCI/proc: Warn on writes to kernel-exclusive config space regions
+ iommu/sva: Set handle->dev before the SVA handle is visible
+ iommu/arm-smmu-v3: Manage teardown with devm
+ iommu/vt-d: Fix no_iommu to disable platform opt-in
+ iommu/vt-d: Force requesting ACS when tboot is enabled
+ platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
+ platform/x86: ISST: Validate level in perf mask ioctls
+ platform/x86: ISST: Validate socket ID in clos_assoc ioctl
+ mmc: via-sdmmc: stop card-detect handling on probe failure
+ platform/x86: ISST: Just allow 2 bits for SST feature enable
+ platform/x86: ISST: Validate logical CPU id and clos id
+ platform/x86: ISST: Validate parameter for core power state
+ platform/x86: ISST: Validate parameter for frequency and priority
+ platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
+ platform/chrome: sensorhub: Bound the EC-reported sensor number
+ platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
+ platform/x86: hp-bioscfg: advance elem past consumed array elements
+ platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
+ platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
+ platform/x86: hp-bioscfg: fix heap OOB read on empty password write
+ platform/x86: hp-bioscfg: fix new_password_store() overwriting
current_password
+ platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
+ platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
+ platform/x86: hp-bioscfg: pass validated element count to package parsers
+ platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
+ interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
+ ipmi: ipmb: validate write message length
+ ipmi: si: Fix NULL pointer dereference after failed registration
+ net/iucv: filter frames in afiucv_hs_rcv() by ingress device
+ xdp: fix zero-copy frame layout
+ slip: fix use-after-free in sl_sync()
+ net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
+ net: tun: bound receive headroom
+ platform/x86: ISST: Add a NULL check for sst_inst[]
+ platform/x86: ISST: Use PP level enable mask
+ platform/x86: ISST: Return error during profile addition
+ net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
+ net: ipa: fix stalled modem TX queue after runtime resume
+ l2tp: improve tunnel/session refcount helpers
+ l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
+ net: l2tp: do not propagate multicast notification errors
+ net: openvswitch: fix flow mask use-after-free on flow deletion
+ net: openvswitch: fix nf_connlabels leak in ovs_ct_init
+ net: ravb: avoid dereferencing an invalid PTP clock
+ net: ravb: serialize PTP clock teardown
+ net: thunderbolt: Release the Rx HopID that was handed out on mismatch
+ net: thunderbolt: Mark the connection down when bringing it up fails
+ NTB: ntb_transport: Recycle TX entries before client callbacks
+ NTB: ntb_transport: Fail TX enqueue when the QP link is down
+ NTB: ntb_transport: Reject oversized TX buffers
+ net: ntb_netdev: Avoid double-accounting netif_rx() drops
+ net: ntb_netdev: Count packets dropped on RX refill failure
+ net/smc: do not dereference an unset send buffer on the SMC-D teardown path
+ net/smc: fix socket refcount leak in smc_switch_conns()
+ net/smc: fix use-after-free in smc_rx_pipe_buf_release()
+ net/smc: unregister the connection before draining the rx tasklet
+ net: cap advertised IP tunnel headroom
+ net: fix spurious TX timeout after dev_activate()
+ net: skbuff: don't touch shared zerocopy state in skb_tx_error()
+ seg6: reset IP6CB after IPv6 decapsulation
+ mfd: sm501: Fix potential memory leaks during remove
+ ALSA: 6fire: bound the MIDI event length from the device
+ ALSA: aloop: Check card index validity at probe
+ ALSA: bcd2000: clear the URB pointers on disconnect
+ ALSA: mpu401: Check card index validity at probe
+ ALSA: mts64: Check card index validity at probe
+ ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
+ ALSA: portman2x4: Check card index validity at probe
+ ALSA: serial-u16550: Check card index validity at probe
+ ALSA: virmidi: Check card index validity at probe
+ ring-buffer: Fix subbuf resize race with ring buffer readers
+ iommu/amd: remove return value of amd_iommu_detect
+ PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
+ arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
+ dm-stats: fix a crash if allocation of per-cpu data fails
+ dm-switch: use WRITE_ONCE() in switch_region_table_write()
+ i3c: master: Fix info leak and UAF in device unregister path
+ i3c: master: svc: bound IBI payload to the requested max_payload_len
+ wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
+ wifi: rtl8xxxu: remove rtl8xxxu_ prefix from filenames
+ wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
+ crypto: sun8i-ss - Remove crypto_rng interface
+ UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_SS_PRNG
+ crypto: sun8i-ce - Remove crypto_rng interface
+ UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_CE_PRNG
+ wifi: mwifiex: Detach sync cmd buffer on interrupted wait
+ wifi: rtl818x: initialize eeprom_93cx6 struct to zero
+ wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
+ wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
+ vsock/virtio: flush works in dependency order
+ w1: ds28e17: reject an oversize length on an I2C block read
+ xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
+ tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
+ sticon/parisc: Detect default STI graphics card for console output
+ signal: avoid shared siginfo namespace rewrites
+ smack: fix cred UAF in smack_file_send_sigiotask()
+ taskstats: fix cpumask parsing cutting off the last character
+ timer: Keep debugobjects state consistent in migrate_timer_list()
+ udf: Fix i_lenExtents truncation on 32-bit kernels
+ platform/chrome: sensorhub: Fix dropped timestamp events and log spam
+ mm: avoid unnecessary use of is_swap_pmd()
+ mm: provide mm_struct and address to huge_ptep_get()
+ mm/rmap: use huge_ptep_get() in try_to_unmap_one()
+ UBUNTU: Upstream stable to v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153,
v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105,
v6.12.106, v6.12.107, v6.12.108, v6.12.109
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169770
Title:
Noble update: upstream stable patchset 2026-10-05
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169770/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
