-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 30 Dec 2025 23:20:29 +0100 Source: linux-signed-i386 Architecture: source Version: 6.1.159+1 Distribution: bookworm-proposed-updates Urgency: medium Maintainer: Debian Kernel Team <[email protected]> Changed-By: Salvatore Bonaccorso <[email protected]> Changes: linux-signed-i386 (6.1.159+1) bookworm; urgency=medium . * Sign kernel from linux 6.1.159-1 . * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.159 - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083) - perf: Have get_perf_callchain() return NULL if crosstask and user are set - [x86] bugs: Fix reporting of LFENCE retpoline - EDAC/mc_sysfs: Increase legacy channel support to 16 - btrfs: zoned: refine extent allocator hint selection - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - xhci: dbc: Provide sysfs option to configure dbc descriptors - xhci: dbc: poll at different rate depending on data transfer activity - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - NFSD: Fix crash in nfsd4_read_release() (CVE-2025-40324) - net: usb: asix_devices: Check return value of usbnet_get_endpoints - fbcon: Set fb_display[i]->mode to NULL when the mode is released - fbdev: atyfb: Check if pll_ops->init_pll failed - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (CVE-2025-40211) - fbdev: bitblit: bound-check glyph index in bit_putcs* (CVE-2025-40322)* - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (CVE-2025-40321) - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - mptcp: restore window probe - [x86] fpu: Ensure XFD state on signal delivery - wifi: ath10k: Fix memory leak on unsupported WMI command - [arm64] drm/msm/a6xx: Fix GMU firmware parser - ALSA: usb-audio: fix control pipe direction - bpf: Sync pending IRQ work before freeing ring buffer (CVE-2025-40319) - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - bpf: Do not audit capability check in do_jit() - [arm64] ASoC: fsl_sai: fix bit order for DSD format - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - usbnet: Prevents free active kevent - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318) - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - Bluetooth: ISO: Add support for periodic adv reports processing - Bluetooth: ISO: Fix another instance of dst_type handling - [arm64,armhf] drm/etnaviv: fix flush sequence logic - [arm64] net: hns3: return error code when function fails - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - block: make REQ_OP_ZONE_OPEN a write operation - regmap: slimbus: fix bus_context pointer in regmap init calls (CVE-2025-40317) - Reapply "Revert drm/amd/display: Enable Freesync Video Mode by default" (Closes: #1119232) - [s390x] pci: Restore IRQ unconditionally for the zPCI device - net: phy: dp83867: Disable EEE support as not implemented - mptcp: change 'first' as a parameter - mptcp: drop bogus optimization in __mptcp_check_push() - can: gs_usb: increase max interface to U8_MAX - cacheinfo: Return error code in init_of_cache_level() - cacheinfo: Check 'cache-unified' property to count cache leaves - ACPI: PPTT: Remove acpi_find_cache_levels() - ACPI: PPTT: Update acpi_find_last_cache_level() to acpi_get_cache_info() - arch_topology: Build cacheinfo from primary CPU - cacheinfo: Initialize variables in fetch_cache_info() - cacheinfo: Fix LLC is not exported through sysfs - drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug - [arm64] tegra: Update cache properties - filemap: add a kiocb_invalidate_pages helper - filemap: add a kiocb_invalidate_post_direct_write helper - filemap: update ki_pos in generic_perform_write - fs: factor out a direct_write_fallback helper - direct_write_fallback(): on error revert the ->ki_pos update from buffered write - block: open code __generic_file_write_iter for blkdev writes - block: fix race between set_blocksize and read paths (CVE-2025-38073) - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (CVE-2025-40315) - drm/sysfb: Do not dereference NULL pointer in plane reset - drm/sched: Fix race in drm_sched_entity_select_rq() - [s390x] pci: Avoid deadlock between PCI error recovery and mlx5 crdump - [armhf] soc: aspeed: socinfo: Add AST27xx silicon IDs - bpf: Don't use %pK through printk - pinctrl: single: fix bias pull up/down handling in pin_config_set - [arm64] mmc: host: renesas_sdhi: Fix the actual clock - memstick: Add timeout to prevent indefinite waiting - cpufreq/longhaul: handle NULL policy in longhaul_exit - [arm64,armhf] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: sbs-charger: Support multiple devices - [arm64] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - [arm64] tee: allow a driver to allocate a tee_device without a pool - nvmet-fc: avoid scheduling association deletion twice (CVE-2025-40343) - nvme-fc: use lock accessing port_state and rport state (CVE-2025-40342) - [arm64] video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tools/cpupower: fix error return value in cpupower_write_sysfs() - cpuidle: Fail cpuidle device registration if there is one already - futex: Don't leak robust_list pointer on exec race (CVE-2025-40341) - bpf: Clear pfmemalloc flag when freeing all fragments - nvme: Use non zero KATO for persistent discovery connections - uprobe: Do not emulate/sstep original instruction when ip is changed - [x86] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - [x86] hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - [x86] tools/cpupower: Fix incorrect size in cpuidle_state_disable() - [x86] tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - [x86] tools/power x86_energy_perf_policy: Enhance HWP enable - [x86] tools/power x86_energy_perf_policy: Prefer driver HWP limits - [armhf] mfd: stmpe: Remove IRQ domain upon removal - [armhf] mfd: stmpe-i2c: Add missing MODULE_LICENSE - drm/amd/display: add more cyan skillfish devices - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/pm: Use cached metrics data on arcturus - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - media: pci: ivtv: Don't create fake v4l2_fh - [x86] vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - ice: Don't use %pK through printk or tracepoints - thunderbolt: Use is_pciehp instead of is_hotplug_bridge - [powerpc*] eeh: Use result of error_detected() in uevent - [s390x] pci: Use pci_uevent_ers() in PCI recovery - bridge: Redirect to backup port when port is administratively down - net: ipv6: fix field-spanning memcpy warning in AH output - media: imon: make send_packet() more robust - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - char: misc: Does not request module for miscdevice with dynamic minor - net: When removing nexthops, don't call synchronize_net if it is not necessary - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - rds: Fix endianness annotation for RDS_MPATH_HASH - scsi: mpi3mr: Fix controller init failure on fault during queue creation - scsi: pm80xx: Fix race condition caused by static variables - extcon: adc-jack: Fix wakeup source leaks on device unbind - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - drm/amdkfd: fix vram allocation failure for a special case - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - media: fix uninitialized symbol warnings - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - scsi: pm8001: Use int instead of u32 to store error codes - ptp: Limit time setting of PTP clocks - dmaengine: sh: setup_xref error handling - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: dw-edma: Set status for callback_result - [arm64] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - [arm64] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/amdgpu: Allow kfd CRIU with no buffer objects - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - [arm64,armhf] media: verisilicon: Explicitly disable selection api ioctls for decoders - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - net: call cond_resched() less often in __release_sock() - smsc911x: add second read of EEPROM mac when possible corruption seen - [amd64] iommu/amd: Skip enabling command/event buffers for kdump - drm/amd: add more cyan skillfish PCI ids - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amdgpu: add support for cyan skillfish gpu_info - usb: gadget: f_hid: Fix zero length packet transfer - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget (CVE-2025-40314) - [arm64] drm/msm: make sure to not queue up recovery more than once - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - net: phy: marvell: Fix 88e1510 downshift counter errata - wifi: mac80211: Fix HE capabilities element check - [arm64] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - net: sh_eth: Disable WoL if system can not suspend - media: redrat3: use int type to store negative error codes - netfilter: nf_reject: don't reply to icmp error messages - [x86] kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - udp_tunnel: use netdev_warn() instead of netdev_WARN() - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - net/cls_cgroup: Fix task_get_classid() during qdisc run - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - ALSA: serial-generic: remove shared static buffer - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - drm/amd: Avoid evicting resources at S5 - page_pool: always add GFP_NOWARN for ATOMIC allocations - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amdgpu: reject gang submissions under SRIOV - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Define size of debugfs entry for xri rebalancing - allow finish_no_open(file, ERR_PTR(-E...)) - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - [arm64,armhf] usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - ipv6: np->rxpmtu race annotation - jfs: Verify inode mode when loading from disk (CVE-2025-40312) - jfs: fix uninitialized waitqueue in transaction manager - [amd64] iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - wifi: ath10k: Fix connection after GTK rekeying - net: intel: fm10k: Fix parameter idx set but not used - r8169: set EEE speed down ratio to 1 - [arm64] PCI: cadence: Check for the existence of cdns_pcie::ops before using it - vfio: return -ENOTTY for unsupported device feature - PCI/PM: Skip resuming to D0 if device is disconnected - NFSv4: handle ERR_GRACE on delegation recalls - NFSv4.1: fix mount hang after CREATE_SESSION failure - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing - net: bridge: Install FDB for bridge MAC on VLAN 0 - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock - ext4: increase IO priority of fastcommit - net/mlx5e: Don't query FEC statistics when FEC is disabled - net: macb: avoid dealing with endianness in macb_set_hwaddr() - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - Bluetooth: SCO: Fix UAF on sco_conn_free (CVE-2025-40309) - Bluetooth: bcsp: receive data only if registered (CVE-2025-40308) - ALSA: usb-audio: add mono main switch to Presonus S1824c - exfat: limit log print for IO error - 6pack: drop redundant locking and refcounting - page_pool: Clamp pool size to max 16K pages - orangefs: fix xattr related buffer overflow... (CVE-2025-40306) - ftrace: Fix softlockup in ftrace_module_enable - ksmbd: use sock_create_kern interface to create kernel socket - smb: client: transport: avoid reconnects triggered by pending task work - ACPICA: Update dsmethod.c to get rid of unused variable warning - RDMA/irdma: Fix SD index calculation - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Set irdma_cq cq_num field during CQ create - [arm64] RDMA/hns: Fix the modification of max_send_sge - [arm64] RDMA/hns: Fix wrong WQE data when QP wraps around - btrfs: mark dirty extent range for out of bound prealloc extents - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - [arm64] rtc: pcf2127: clear minute/second interrupt - [armhf] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - NTB: epf: Allow arbitrary BAR mapping - 9p: fix /sys/fs/9p/caches overwriting itself - 9p: sysfs_init: don't hardcode error to ENOMEM - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - ACPI: property: Return present device nodes only on fwnode interface - tools bitmap: Add missing asm-generic/bitsperlong.h include - tools: lib: thermal: don't preserve owner in install - tools: lib: thermal: use pkg-config to locate libnl3 - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CVE-2025-40304) - kbuild: uapi: Strip comments before size type check - [arm64,armhf] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - ceph: add checking of wait_for_completion_killable() return value - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Closes: #1120680) - Bluetooth: hci_event: validate skb length for unknown CC opcode (CVE-2025-40301) - [armhf] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - net: vlan: sync VLAN features with lower device - [armhf] net: dsa: b53: fix resetting speed and pause on forced link - [armhf] net: dsa: b53: fix enabling ip multicast - [armhf] net: dsa: b53: stop reading ARL entries if search is done - sctp: Hold RCU read lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write (CVE-2025-40331) - sctp: Hold sock lock while iterating over address list - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - bnxt_en: Fix a possible memory leak in bnxt_ptp_init - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net: bridge: fix use-after-free due to MST port state bypass (CVE-2025-40297) - net: bridge: fix MST static key usage - tracing: Fix memory leaks in create_field_var() - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CVE-2025-40294) - rtc: rx8025: fix incorrect register reference - smb: client: validate change notify buffer before copy - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - PM: suspend: Fix pm_suspend_target_state handling for !CONFIG_PM - extcon: adc-jack: Cleanup wakeup source only if it was enabled - drm/amdgpu: Fix function header names in amdgpu_connectors.c - [x86] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - [x86] drm/i915: Fix conversion between clock ticks and nanoseconds - smb: client: fix refcount leak in smb2_set_path_attr - drm/amd: Fix suspend failure with secure display TA - compiler_types: Move unused static inline functions warning to W=2 - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices (CVE-2025-40288) - NFS4: Fix state renewals missing after boot - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS: check if suid/sgid was cleared after a write as needed - smb/server: fix possible memory leak in smb2_read() (CVE-2025-40286) - smb/server: fix possible refcount leak in smb2_sess_setup() (CVE-2025-40285) - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - wifi: ath11k: Add tx ack signal support for management packets - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - Bluetooth: MGMT: cancel mesh send timer when hdev removed (CVE-2025-40284) - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (CVE-2025-40283) - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (CVE-2025-40282) - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (CVE-2025-40281) - net/smc: fix mismatch between CLC header and proposal - tipc: Fix use-after-free in tipc_mon_reinit_self(). (CVE-2025-40280)). - net: mdio: fix resource leak in mdiobus_register_device() - wifi: mac80211: skip rate verification for not captured PSDUs - af_unix: Initialise scc_index in unix_add_edge(). (CVE-2025-40214)). - net/sched: act_connmark: transition to percpu stats and rcu - net_sched: act_connmark: use RCU in tcf_connmark_dump() - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (CVE-2025-40279) - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (CVE-2025-40278) - net/mlx5e: Fix maxrate wraparound in threshold between units - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5: Expose shared buffer registers bits and structs - net/mlx5e: Add API to query/modify SBPR and SBCM registers - net/mlx5e: Update shared buffer along with device buffer changes - net/mlx5e: Consider internal buffers size in port buffer calculations - net/mlx5e: Remove mlx5e_dbg() and msglvl support - net/mlx5e: Fix potentially misleading debug message - net_sched: limit try_bulk_dequeue_skb() batches - hsr: Fix supervision frame sending on HSRv0 - ACPI: CPPC: Check _CPC validity for only the online CPUs - ACPI: CPPC: Perform fast check switch only for online CPUs - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - Bluetooth: L2CAP: export l2cap_chan_hold for modules - acpi,srat: Fix incorrect device handle check for Generic Initiator - regulator: fixed: fix GPIO descriptor leak on register failure - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277) - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (CVE-2025-40275) - bpf: Add bpf_prog_run_data_pointers() - softirq: Add trace points for tasklet entry/exit - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - espintcp: fix skb leaks (CVE-2025-38057) - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch - netfilter: nf_tables: reject duplicate device on updates (CVE-2025-38678) - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - NFSD: free copynotify stateid in nfs4_free_ol_stateid() (CVE-2025-40273) - ksmbd: close accepted socket when per-IP limit rejects connection - strparser: Fix signed/unsigned mismatch bug - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe - wifi: mac80211: reject address change while connecting - fs/proc: fix uaf in proc_readdir_de() (CVE-2025-40271) - [arm64] mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CVE-2025-40269) - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check - spi: Try to get ACPI GPIO IRQ earlier - btrfs: do not update last_log_commit when logging inode due to a new name - virtio-net: fix received length check in big packets (CVE-2025-40292) - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - iommufd: Don't overflow during division for dirty tracking (CVE-2025-40293) - [x86] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - net: netpoll: fix incorrect refcount handling causing incorrect cleanup - eventpoll: Replace rwlock with spinlock - mm, percpu: do not consider sleepable allocations atomic - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() - asm-generic: partially revert "Unify uapi bitsperlong.h for arm64, riscv and loongarch" - net/mlx5: Fix memory leak in error flow of port set buffer - net/sched: act_connmark: handle errno on tcf_idr_check_alloc - net/mlx5e: Do not update SBCM when prio2buffer command is invalid - net/mlx5e: Preserve shared buffer capacity during headroom updates - timers: Fix NULL function pointer race in timer_shutdown_sync() - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Closes: #1114557) - mtdchar: fix integer overflow in read/write ioctls - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - mptcp: Disallow MPTCP subflows from sockmap - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() - be2net: pass wrb_params in case of OS2BMC (CVE-2025-40264) - Input: cros_ec_keyb - fix an invalid memory access (CVE-2025-40263) - Input: imx_sc_key - fix memory corruption on unload (CVE-2025-40262) - Input: pegasus-notetaker - fix potential out-of-bounds access - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (CVE-2025-40261) - scsi: sg: Do not sleep in atomic context (CVE-2025-40259) - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() - mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258) - mptcp: fix ack generation for fallback msk - mptcp: fix premature close in case of fallback - mptcp: avoid unneeded subflow-level drops - mptcp: do not fallback when OoO is present - [arm64,armhf] drm/tegra: dc: Fix reference leak in tegra_dc_couple() - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - xfrm: Determine inner GSO type from packet inner protocol - [arm64,armhf] gpu: host1x: Select context device based on attached IOMMU - [arm64,armhf] drm/tegra: Add call to put_pid() - net: openvswitch: remove never-working support for setting nsh fields (CVE-2025-40254) - nvme-multipath: fix lockdep WARN due to partition scan work - [s390x] ctcm: Fix double-kfree (CVE-2025-40253) - [x86] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - kernel.h: Move ARRAY_SIZE() to a separate header - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() - vsock: Ignore signal/timeout on connect() if already established - bcma: don't register devices disabled in OF - cifs: fix typo in enable_gcm_256 module parameter - scsi: core: Fix a regression triggered by scsi_host_busy() - net: tls: Cancel RX async resync request on rcd_delta overflow - mm/secretmem: fix use-after-free race in fault handler (CVE-2025-40272) - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - ALSA: usb-audio: fix uac2 clock source at terminal parser - tracing/tools: Fix incorrcet short option in usage text for --threads - uio_hv_generic: Set event for all channels on the device (Closes: #1120602) - mm/truncate: unmap large folio on split failure - maple_tree: fix tracepoint string pointers - mptcp: decouple mptcp fastclose from tcp close - mptcp: fix a race in mptcp_pm_del_add_timer() (CVE-2025-40257) - mm/mempool: replace kmap_atomic() with kmap_local_page() - mm/mempool: fix poisoning order>0 pages with HIGHMEM - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - ata: libata-scsi: Fix system suspend for a security locked drive - HID: amd_sfh: Stop sensor before starting - [armhf] pmdomain: samsung: plug potential memleak during probe - [arm64] pmdomain: arm: scmi: Fix genpd leak on provider registration failure - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_remove - filemap: cap PTE range to be created to allowed zero fill in folio_map_range() - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - [x86] platform/x86: intel: punit_ipc: fix memory corruption - net: aquantia: Add missing descriptor cache invalidation on ATL2 - net/mlx5e: Fix validation logic in rate limiting - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - net: atlantic: fix fragment overflow handling in RX path - mailbox: Allow direct registration to a channel - [amd64,arm64] mailbox: pcc: Use mbox_bind_client - [amd64,arm64] mailbox: pcc: Add support for platform notification handling - [amd64,arm64] mailbox: pcc: Support shared interrupt for multiple subspaces - ACPI: PCC: Add PCC shared memory region command and status bitfields - [amd64,arm64] mailbox: pcc: Check before sending MCTP PCC response ACK - [amd64,arm64] mailbox: pcc: Refactor error handling in irq handler into separate function - [amd64,arm64] mailbox: pcc: don't zero error register - [x86] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: accel: bmc150: Fix irq assumption regression (Closes: #1106411) - iio: accel: fix ADXL355 startup race condition - iio: adc: ad7280a: fix ad7280_store_balance_timer() - [mips*] mm: Prevent a TLB shutdown on initial uniquification - [mips*] mm: kmalloc tlb_vpn array to avoid stack overflow - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - atm/fore200e: Fix possible data race in fore200e_open() - can: sja1000: fix max irq loop handling - [armhf] can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - dm-verity: fix unreliable memory allocation - [arm64,armhf] drivers/usb/dwc3: fix PCI parent check - smb: client: fix memory leak in cifs_construct_tcon() - [x86] thunderbolt: Add support for Intel Wildcat Lake - firmware: stratix10-svc: fix bug in saving controller data - [arm64,armhf] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - usb: cdns3: Fix double resource release in cdns3_pci_probe - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: storage: Fix memory leak in USB bulk transport - USB: storage: Remove subclass and protocol overrides from Novatek quirk - usb: storage: sddr55: Reject out-of-bound new_pba - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer - [arm64,armhf] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - USB: serial: option: add support for Rolling RW101R-GL - drm/amd/display: Check NULL before accessing - libceph: fix potential use-after-free in have_mon_and_osd_map() - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: replace BUG_ON with bounds check for map->max_osd - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: macb: fix unregister_netdev call order in macb_remove() (CVE-2025-39805) - mptcp: fix duplicate reset on fastclose - mptcp: Fix proto fallback detection with BPF - staging: rtl8712: Remove driver using deprecated API wext - ksmbd: fix use-after-free in session logoff (CVE-2025-37899) - usb: typec: ucsi: psy: Set max current to zero when disconnected - usb: udc: Add trace event for usb_gadget_set_state - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - scsi: pm80xx: Set phy->enable_completion only when we - [arm64] i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros - HID: core: Harden s32ton() against conversion to 0 bits . [ Ben Hutchings ] * tools/hv: Make the sample hv_get_dhcp_info script more useful * hyperv-daemons: Install the sample network info scripts (Closes: #919350) Checksums-Sha1: d55245755d3f5d09cc4ec60d3490af02ad683a39 13434 linux-signed-i386_6.1.159+1.dsc eaef08a05b1a46bab866b9fbd3853af55b81b0eb 789380 linux-signed-i386_6.1.159+1.tar.xz Checksums-Sha256: 938f1970a342882ecada5e4c4996aa80d4e4986fff8149984cfe07c2fe2368d5 13434 linux-signed-i386_6.1.159+1.dsc fa986d3991159012cbd041a3e97363ecfaab032372cea990a793cd7c4a44c466 789380 linux-signed-i386_6.1.159+1.tar.xz Files: 80a66b65ea66211d5af5d299b4c013fd 13434 kernel optional linux-signed-i386_6.1.159+1.dsc 37f1e8867a770fb92067fdeadb170425 789380 kernel optional linux-signed-i386_6.1.159+1.tar.xz
-----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQSInBJdRTWyTRy0ztFCTVFtUgONCgUCaVfcGAAKCRBCTVFtUgON CjFXAQC5WcUfk0bW/22aNbXXqWStfbKUlroIsjJQbFl5aE1hKgD/Z/NQTwimHaWY S2EgG4+ZgFMhT3htN7PlxNkbSwMUnAQ= =NIng -----END PGP SIGNATURE-----
pgpQmMNkrMuQK.pgp
Description: PGP signature
