Public bug reported:

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       v5.15.35 upstream stable release
       from git://git.kernel.org/

drm/amd/display: Add pstate verification and recovery for DCN31
drm/amd/display: Fix p-state allow debug index on dcn31
hamradio: defer 6pack kfree after unregister_netdev
hamradio: remove needs_free_netdev to avoid UAF
cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function
ACPI: processor idle: Check for architectural support for LPI
ACPI: processor: idle: fix lockup regression on 32-bit ThinkPad T40
btrfs: remove unused parameter nr_pages in add_ra_bio_pages()
btrfs: remove no longer used counter when reading data page
btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups()
soc: qcom: aoss: Expose send for generic usecase
dt-bindings: net: qcom,ipa: add optional qcom,qmp property
net: ipa: request IPA register values be retained
btrfs: release correct delalloc amount in direct IO write path
ALSA: core: Add snd_card_free_on_error() helper
ALSA: sis7019: Fix the missing error handling
ALSA: ali5451: Fix the missing snd_card_free() call at probe error
ALSA: als300: Fix the missing snd_card_free() call at probe error
ALSA: als4000: Fix the missing snd_card_free() call at probe error
ALSA: atiixp: Fix the missing snd_card_free() call at probe error
ALSA: au88x0: Fix the missing snd_card_free() call at probe error
ALSA: aw2: Fix the missing snd_card_free() call at probe error
ALSA: azt3328: Fix the missing snd_card_free() call at probe error
ALSA: bt87x: Fix the missing snd_card_free() call at probe error
ALSA: ca0106: Fix the missing snd_card_free() call at probe error
ALSA: cmipci: Fix the missing snd_card_free() call at probe error
ALSA: cs4281: Fix the missing snd_card_free() call at probe error
ALSA: cs5535audio: Fix the missing snd_card_free() call at probe error
ALSA: echoaudio: Fix the missing snd_card_free() call at probe error
ALSA: emu10k1x: Fix the missing snd_card_free() call at probe error
ALSA: ens137x: Fix the missing snd_card_free() call at probe error
ALSA: es1938: Fix the missing snd_card_free() call at probe error
ALSA: es1968: Fix the missing snd_card_free() call at probe error
ALSA: fm801: Fix the missing snd_card_free() call at probe error
ALSA: galaxy: Fix the missing snd_card_free() call at probe error
ALSA: hdsp: Fix the missing snd_card_free() call at probe error
ALSA: hdspm: Fix the missing snd_card_free() call at probe error
ALSA: ice1724: Fix the missing snd_card_free() call at probe error
ALSA: intel8x0: Fix the missing snd_card_free() call at probe error
ALSA: intel_hdmi: Fix the missing snd_card_free() call at probe error
ALSA: korg1212: Fix the missing snd_card_free() call at probe error
ALSA: lola: Fix the missing snd_card_free() call at probe error
ALSA: lx6464es: Fix the missing snd_card_free() call at probe error
ALSA: maestro3: Fix the missing snd_card_free() call at probe error
ALSA: oxygen: Fix the missing snd_card_free() call at probe error
ALSA: riptide: Fix the missing snd_card_free() call at probe error
ALSA: rme32: Fix the missing snd_card_free() call at probe error
ALSA: rme9652: Fix the missing snd_card_free() call at probe error
ALSA: rme96: Fix the missing snd_card_free() call at probe error
ALSA: sc6000: Fix the missing snd_card_free() call at probe error
ALSA: sonicvibes: Fix the missing snd_card_free() call at probe error
ALSA: via82xx: Fix the missing snd_card_free() call at probe error
ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb
ALSA: nm256: Don't call card private_free at probe error path
drm/msm: Add missing put_task_struct() in debugfs path
firmware: arm_scmi: Remove clear channel call on the TX channel
memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe
Revert "ath11k: mesh: add support for 256 bitmap in blockack frames in 11ax"
firmware: arm_scmi: Fix sorting of retrieved clock rates
media: rockchip/rga: do proper error checking in probe
SUNRPC: Fix the svc_deferred_event trace class
net/sched: flower: fix parsing of ethertype following VLAN header
veth: Ensure eth header is in skb's linear part
gpiolib: acpi: use correct format characters
cifs: release cached dentries only if mount is complete
net: mdio: don't defer probe forever if PHY IRQ provider is missing
mlxsw: i2c: Fix initialization error flow
net/sched: fix initialization order when updating chain 0 head
net: dsa: felix: suppress -EPROBE_DEFER errors
net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link
net/sched: taprio: Check if socket flags are valid
cfg80211: hold bss_lock while updating nontrans_list
netfilter: nft_socket: make cgroup match work in input too
drm/msm: Fix range size vs end confusion
drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init()
drm/msm/dp: add fail safe mode outside of event_mutex context
net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63
scsi: pm80xx: Enable upper inbound, outbound queues
scsi: iscsi: Move iscsi_ep_disconnect()
scsi: iscsi: Fix offload conn cleanup when iscsid restarts
scsi: iscsi: Fix endpoint reuse regression
scsi: iscsi: Fix conn cleanup and stop race during iscsid restart
scsi: iscsi: Fix unbound endpoint error handling
sctp: Initialize daddr on peeled off socket
netfilter: nf_tables: nft_parse_register can return a negative value
ALSA: ad1889: Fix the missing snd_card_free() call at probe error
ALSA: mtpav: Don't call card private_free at probe error path
io_uring: move io_uring_rsrc_update2 validation
io_uring: verify that resv2 is 0 in io_uring_rsrc_update2
io_uring: verify pad field is 0 in io_get_ext_arg
testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set
ALSA: usb-audio: Increase max buffer size
ALSA: usb-audio: Limit max buffer and period sizes per time
perf tools: Fix misleading add event PMU debug message
macvlan: Fix leaking skb in source mode with nodst option
net: ftgmac100: access hardware register after clock ready
nfc: nci: add flush_workqueue to prevent uaf
cifs: potential buffer overflow in handling symlinks
dm mpath: only use ktime_get_ns() in historical selector
vfio/pci: Fix vf_token mechanism when device-specific VF drivers are used
net: bcmgenet: Revert "Use stronger register read/writes to assure ordering"
block: fix offset/size check in bio_trim()
drm/amd: Add USBC connector ID
btrfs: fix fallocate to use file_modified to update permissions consistently
btrfs: do not warn for free space inode in cow_file_range
drm/amdgpu: conduct a proper cleanup of PDB bo
drm/amdgpu/gmc: use PCI BARs for APUs in passthrough
drm/amd/display: fix audio format not updated after edid updated
drm/amd/display: FEC check in timing validation
drm/amd/display: Update VTEM Infopacket definition
drm/amdkfd: Fix Incorrect VMIDs passed to HWS
drm/amdgpu/vcn: improve vcn dpg stop procedure
drm/amdkfd: Check for potential null return of kmalloc_array()
Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated 
guests
PCI: hv: Propagate coherence from VMbus device to PCI device
Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer
scsi: target: tcmu: Fix possible page UAF
scsi: lpfc: Fix queue failures when recovering from PCI parity error
scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
net: micrel: fix KS8851_MLL Kconfig
ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
gpu: ipu-v3: Fix dev_dbg frequency output
regulator: wm8994: Add an off-on delay for WM8994 variant
arm64: alternatives: mark patch_alternative() as `noinstr`
tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry
net: axienet: setup mdio unconditionally
Drivers: hv: balloon: Disable balloon and hot-add accordingly
net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
myri10ge: fix an incorrect free for skb in myri10ge_sw_tso
spi: cadence-quadspi: fix protocol setup for non-1-1-X operations
drm/amd/display: Enable power gating before init_pipes
drm/amd/display: Revert FEC check in validation
drm/amd/display: Fix allocate_mst_payload assert on resume
drbd: set QUEUE_FLAG_STABLE_WRITES
scsi: mpt3sas: Fail reset operation if config request timed out
scsi: mvsas: Add PCI ID of RocketRaid 2640
scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan
drivers: net: slip: fix NPD bug in sl_tx_timeout()
io_uring: zero tag on rsrc removal
io_uring: use nospec annotation for more indexes
perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant
mm/secretmem: fix panic when growing a memfd_secret
mm, page_alloc: fix build_zonerefs_node()
mm: fix unexpected zeroed page mapping with zram swap
mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded
SUNRPC: Fix NFSD's request deferral on RDMA transports
memory: renesas-rpc-if: fix platform-device leak in error path
gcc-plugins: latent_entropy: use /dev/urandom
cifs: verify that tcon is valid before dereference in cifs_kill_sb
ath9k: Properly clear TX status area before reporting to mac80211
ath9k: Fix usage of driver-private space in tx_info
btrfs: fix root ref counts in error handling in btrfs_get_root_ref
btrfs: mark resumed async balance as writing
ALSA: hda/realtek: Add quirk for Clevo PD50PNT
ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers
ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size
ipv6: fix panic when forwarding a pkt with no in6 dev
drm/amd/display: don't ignore alpha property on pre-multiplied mode
drm/amdgpu: Enable gfxoff quirk on MacBook Pro
x86/tsx: Use MSR_TSX_CTRL to clear CPUID bits
x86/tsx: Disable TSX development mode at boot
genirq/affinity: Consider that CPUs on nodes can be unbalanced
tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
ARM: davinci: da850-evm: Avoid NULL pointer dereference
dm integrity: fix memory corruption when tag_size is less than digest size
i2c: dev: check return value when calling dev_set_name()
smp: Fix offline cpu check in flush_smp_call_function_queue()
i2c: pasemi: Wait for write xfers to finish
dt-bindings: net: snps: remove duplicate name
timers: Fix warning condition in __run_timers()
dma-direct: avoid redundant memory sync for swiotlb
drm/i915: Sunset igpu legacy mmap support based on GRAPHICS_VER_FULL
cpu/hotplug: Remove the 'cpu' member of cpuhp_cpu_state
soc: qcom: aoss: Fix missing put_device call in qmp_get
net: ipa: fix a build dependency
cpufreq: intel_pstate: ITMT support for overclocked system
ax25: add refcount in ax25_dev to avoid UAF bugs
ax25: fix reference count leaks of ax25_dev
ax25: fix UAF bugs of net_device caused by rebinding operation
ax25: Fix refcount leaks caused by ax25_cb_del()
ax25: fix UAF bug in ax25_send_control()
ax25: fix NPD bug in ax25_disconnect
ax25: Fix NULL pointer dereferences in ax25 timers
ax25: Fix UAF bugs in ax25 timers
Linux 5.15.35
UBUNTU: upstream stable to v5.15.35

** Affects: linux (Ubuntu)
     Importance: Medium
     Assignee: Kamal Mostafa (kamalmostafa)
         Status: In Progress

** Affects: linux (Ubuntu Jammy)
     Importance: Medium
     Assignee: Kamal Mostafa (kamalmostafa)
         Status: In Progress


** Tags: kernel-stable-tracking-bug

** Changed in: linux (Ubuntu)
       Status: New => Confirmed

** Tags added: kernel-stable-tracking-bug

** Also affects: linux (Ubuntu Jammy)
   Importance: Undecided
       Status: Confirmed

** Changed in: linux (Ubuntu Jammy)
       Status: Confirmed => In Progress

** Changed in: linux (Ubuntu Jammy)
   Importance: Undecided => Medium

** Changed in: linux (Ubuntu Jammy)
     Assignee: (unassigned) => Kamal Mostafa (kamalmostafa)

** Description changed:

+ SRU Justification
  
-     SRU Justification
+     Impact:
+        The upstream process for stable tree updates is quite similar
+        in scope to the Ubuntu SRU process, e.g., each patch has to
+        demonstrably fix a bug, and each patch is vetted by upstream
+        by originating either directly from a mainline/stable Linux tree or
+        a minimally backported form of that patch. The following upstream
+        stable patches should be included in the Ubuntu kernel:
  
-     Impact:
-        The upstream process for stable tree updates is quite similar
-        in scope to the Ubuntu SRU process, e.g., each patch has to
-        demonstrably fix a bug, and each patch is vetted by upstream
-        by originating either directly from a mainline/stable Linux tree or
-        a minimally backported form of that patch. The following upstream
-        stable patches should be included in the Ubuntu kernel:
+        v5.15.35 upstream stable release
+        from git://git.kernel.org/
  
-        v5.15.35 upstream stable release
-        from git://git.kernel.org/
+ drm/amd/display: Add pstate verification and recovery for DCN31
+ drm/amd/display: Fix p-state allow debug index on dcn31
+ hamradio: defer 6pack kfree after unregister_netdev
+ hamradio: remove needs_free_netdev to avoid UAF
+ cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function
+ ACPI: processor idle: Check for architectural support for LPI
+ ACPI: processor: idle: fix lockup regression on 32-bit ThinkPad T40
+ btrfs: remove unused parameter nr_pages in add_ra_bio_pages()
+ btrfs: remove no longer used counter when reading data page
+ btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups()
+ soc: qcom: aoss: Expose send for generic usecase
+ dt-bindings: net: qcom,ipa: add optional qcom,qmp property
+ net: ipa: request IPA register values be retained
+ btrfs: release correct delalloc amount in direct IO write path
+ ALSA: core: Add snd_card_free_on_error() helper
+ ALSA: sis7019: Fix the missing error handling
+ ALSA: ali5451: Fix the missing snd_card_free() call at probe error
+ ALSA: als300: Fix the missing snd_card_free() call at probe error
+ ALSA: als4000: Fix the missing snd_card_free() call at probe error
+ ALSA: atiixp: Fix the missing snd_card_free() call at probe error
+ ALSA: au88x0: Fix the missing snd_card_free() call at probe error
+ ALSA: aw2: Fix the missing snd_card_free() call at probe error
+ ALSA: azt3328: Fix the missing snd_card_free() call at probe error
+ ALSA: bt87x: Fix the missing snd_card_free() call at probe error
+ ALSA: ca0106: Fix the missing snd_card_free() call at probe error
+ ALSA: cmipci: Fix the missing snd_card_free() call at probe error
+ ALSA: cs4281: Fix the missing snd_card_free() call at probe error
+ ALSA: cs5535audio: Fix the missing snd_card_free() call at probe error
+ ALSA: echoaudio: Fix the missing snd_card_free() call at probe error
+ ALSA: emu10k1x: Fix the missing snd_card_free() call at probe error
+ ALSA: ens137x: Fix the missing snd_card_free() call at probe error
+ ALSA: es1938: Fix the missing snd_card_free() call at probe error
+ ALSA: es1968: Fix the missing snd_card_free() call at probe error
+ ALSA: fm801: Fix the missing snd_card_free() call at probe error
+ ALSA: galaxy: Fix the missing snd_card_free() call at probe error
+ ALSA: hdsp: Fix the missing snd_card_free() call at probe error
+ ALSA: hdspm: Fix the missing snd_card_free() call at probe error
+ ALSA: ice1724: Fix the missing snd_card_free() call at probe error
+ ALSA: intel8x0: Fix the missing snd_card_free() call at probe error
+ ALSA: intel_hdmi: Fix the missing snd_card_free() call at probe error
+ ALSA: korg1212: Fix the missing snd_card_free() call at probe error
+ ALSA: lola: Fix the missing snd_card_free() call at probe error
+ ALSA: lx6464es: Fix the missing snd_card_free() call at probe error
+ ALSA: maestro3: Fix the missing snd_card_free() call at probe error
+ ALSA: oxygen: Fix the missing snd_card_free() call at probe error
+ ALSA: riptide: Fix the missing snd_card_free() call at probe error
+ ALSA: rme32: Fix the missing snd_card_free() call at probe error
+ ALSA: rme9652: Fix the missing snd_card_free() call at probe error
+ ALSA: rme96: Fix the missing snd_card_free() call at probe error
+ ALSA: sc6000: Fix the missing snd_card_free() call at probe error
+ ALSA: sonicvibes: Fix the missing snd_card_free() call at probe error
+ ALSA: via82xx: Fix the missing snd_card_free() call at probe error
+ ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb
+ ALSA: nm256: Don't call card private_free at probe error path
+ drm/msm: Add missing put_task_struct() in debugfs path
+ firmware: arm_scmi: Remove clear channel call on the TX channel
+ memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe
+ Revert "ath11k: mesh: add support for 256 bitmap in blockack frames in 11ax"
+ firmware: arm_scmi: Fix sorting of retrieved clock rates
+ media: rockchip/rga: do proper error checking in probe
+ SUNRPC: Fix the svc_deferred_event trace class
+ net/sched: flower: fix parsing of ethertype following VLAN header
+ veth: Ensure eth header is in skb's linear part
+ gpiolib: acpi: use correct format characters
+ cifs: release cached dentries only if mount is complete
+ net: mdio: don't defer probe forever if PHY IRQ provider is missing
+ mlxsw: i2c: Fix initialization error flow
+ net/sched: fix initialization order when updating chain 0 head
+ net: dsa: felix: suppress -EPROBE_DEFER errors
+ net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link
+ net/sched: taprio: Check if socket flags are valid
+ cfg80211: hold bss_lock while updating nontrans_list
+ netfilter: nft_socket: make cgroup match work in input too
+ drm/msm: Fix range size vs end confusion
+ drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init()
+ drm/msm/dp: add fail safe mode outside of event_mutex context
+ net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
+ scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63
+ scsi: pm80xx: Enable upper inbound, outbound queues
+ scsi: iscsi: Move iscsi_ep_disconnect()
+ scsi: iscsi: Fix offload conn cleanup when iscsid restarts
+ scsi: iscsi: Fix endpoint reuse regression
+ scsi: iscsi: Fix conn cleanup and stop race during iscsid restart
+ scsi: iscsi: Fix unbound endpoint error handling
+ sctp: Initialize daddr on peeled off socket
+ netfilter: nf_tables: nft_parse_register can return a negative value
+ ALSA: ad1889: Fix the missing snd_card_free() call at probe error
+ ALSA: mtpav: Don't call card private_free at probe error path
+ io_uring: move io_uring_rsrc_update2 validation
+ io_uring: verify that resv2 is 0 in io_uring_rsrc_update2
+ io_uring: verify pad field is 0 in io_get_ext_arg
+ testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set
+ ALSA: usb-audio: Increase max buffer size
+ ALSA: usb-audio: Limit max buffer and period sizes per time
+ perf tools: Fix misleading add event PMU debug message
+ macvlan: Fix leaking skb in source mode with nodst option
+ net: ftgmac100: access hardware register after clock ready
+ nfc: nci: add flush_workqueue to prevent uaf
+ cifs: potential buffer overflow in handling symlinks
+ dm mpath: only use ktime_get_ns() in historical selector
+ vfio/pci: Fix vf_token mechanism when device-specific VF drivers are used
+ net: bcmgenet: Revert "Use stronger register read/writes to assure ordering"
+ block: fix offset/size check in bio_trim()
+ drm/amd: Add USBC connector ID
+ btrfs: fix fallocate to use file_modified to update permissions consistently
+ btrfs: do not warn for free space inode in cow_file_range
+ drm/amdgpu: conduct a proper cleanup of PDB bo
+ drm/amdgpu/gmc: use PCI BARs for APUs in passthrough
+ drm/amd/display: fix audio format not updated after edid updated
+ drm/amd/display: FEC check in timing validation
+ drm/amd/display: Update VTEM Infopacket definition
+ drm/amdkfd: Fix Incorrect VMIDs passed to HWS
+ drm/amdgpu/vcn: improve vcn dpg stop procedure
+ drm/amdkfd: Check for potential null return of kmalloc_array()
+ Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated 
guests
+ PCI: hv: Propagate coherence from VMbus device to PCI device
+ Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer
+ scsi: target: tcmu: Fix possible page UAF
+ scsi: lpfc: Fix queue failures when recovering from PCI parity error
+ scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
+ net: micrel: fix KS8851_MLL Kconfig
+ ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
+ gpu: ipu-v3: Fix dev_dbg frequency output
+ regulator: wm8994: Add an off-on delay for WM8994 variant
+ arm64: alternatives: mark patch_alternative() as `noinstr`
+ tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry
+ net: axienet: setup mdio unconditionally
+ Drivers: hv: balloon: Disable balloon and hot-add accordingly
+ net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
+ myri10ge: fix an incorrect free for skb in myri10ge_sw_tso
+ spi: cadence-quadspi: fix protocol setup for non-1-1-X operations
+ drm/amd/display: Enable power gating before init_pipes
+ drm/amd/display: Revert FEC check in validation
+ drm/amd/display: Fix allocate_mst_payload assert on resume
+ drbd: set QUEUE_FLAG_STABLE_WRITES
+ scsi: mpt3sas: Fail reset operation if config request timed out
+ scsi: mvsas: Add PCI ID of RocketRaid 2640
+ scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan
+ drivers: net: slip: fix NPD bug in sl_tx_timeout()
+ io_uring: zero tag on rsrc removal
+ io_uring: use nospec annotation for more indexes
+ perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant
+ mm/secretmem: fix panic when growing a memfd_secret
+ mm, page_alloc: fix build_zonerefs_node()
+ mm: fix unexpected zeroed page mapping with zram swap
+ mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
+ KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded
+ SUNRPC: Fix NFSD's request deferral on RDMA transports
+ memory: renesas-rpc-if: fix platform-device leak in error path
+ gcc-plugins: latent_entropy: use /dev/urandom
+ cifs: verify that tcon is valid before dereference in cifs_kill_sb
+ ath9k: Properly clear TX status area before reporting to mac80211
+ ath9k: Fix usage of driver-private space in tx_info
+ btrfs: fix root ref counts in error handling in btrfs_get_root_ref
+ btrfs: mark resumed async balance as writing
+ ALSA: hda/realtek: Add quirk for Clevo PD50PNT
+ ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers
+ ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
+ nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size
+ ipv6: fix panic when forwarding a pkt with no in6 dev
+ drm/amd/display: don't ignore alpha property on pre-multiplied mode
+ drm/amdgpu: Enable gfxoff quirk on MacBook Pro
+ x86/tsx: Use MSR_TSX_CTRL to clear CPUID bits
+ x86/tsx: Disable TSX development mode at boot
+ genirq/affinity: Consider that CPUs on nodes can be unbalanced
+ tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
+ ARM: davinci: da850-evm: Avoid NULL pointer dereference
+ dm integrity: fix memory corruption when tag_size is less than digest size
+ i2c: dev: check return value when calling dev_set_name()
+ smp: Fix offline cpu check in flush_smp_call_function_queue()
+ i2c: pasemi: Wait for write xfers to finish
+ dt-bindings: net: snps: remove duplicate name
+ timers: Fix warning condition in __run_timers()
+ dma-direct: avoid redundant memory sync for swiotlb
+ drm/i915: Sunset igpu legacy mmap support based on GRAPHICS_VER_FULL
+ cpu/hotplug: Remove the 'cpu' member of cpuhp_cpu_state
+ soc: qcom: aoss: Fix missing put_device call in qmp_get
+ net: ipa: fix a build dependency
+ cpufreq: intel_pstate: ITMT support for overclocked system
+ ax25: add refcount in ax25_dev to avoid UAF bugs
+ ax25: fix reference count leaks of ax25_dev
+ ax25: fix UAF bugs of net_device caused by rebinding operation
+ ax25: Fix refcount leaks caused by ax25_cb_del()
+ ax25: fix UAF bug in ax25_send_control()
+ ax25: fix NPD bug in ax25_disconnect
+ ax25: Fix NULL pointer dereferences in ax25 timers
+ ax25: Fix UAF bugs in ax25 timers
+ Linux 5.15.35
+ UBUNTU: upstream stable to v5.15.35

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1969857

Title:
  Jammy update: v5.15.35 upstream stable release

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1969857/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to