Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2025-12-09
Ported from the following upstream stable releases:
v6.6.96, v6.12.36
from git://git.kernel.org/
cifs: Correctly set SMB1 SessionKey field in Session Setup Request
cifs: Fix cifs_query_path_info() for Windows NT servers
cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode
NFSv4: Always set NLINK even if the server doesn't support it
NFSv4.2: fix listxattr to return selinux security label
mailbox: Not protect module_put with spin_lock_irqsave
mfd: max14577: Fix wakeup source leaks on device unbind
sunrpc: don't immediately retransmit on seqno miss
leds: multicolor: Fix intensity setting while SW blinking
fuse: fix race between concurrent setattrs from multiple nodes
cxl/region: Add a dev_err() on missing target list entries
NFSv4: xattr handlers should check for absent nfs filehandles
hwmon: (pmbus/max34440) Fix support for max34451
ksmbd: allow a filename to contain special characters on SMB3.1.1 posix
extension
ksmbd: provide zero as a unique ID to the Mac client
rust: module: place cleanup_module() in .exit.text section
dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver
before using
dmaengine: xilinx_dma: Set dma_device directions
PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to
one lane
PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
md/md-bitmap: fix dm-raid max_write_behind setting
amd/amdkfd: fix a kfd_process ref leak
bcache: fix NULL pointer in cache_set_flush()
drm/scheduler: signal scheduled fence when kill job
iio: pressure: zpa2326: Use aligned_s64 for the timestamp
um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
um: use proper care when taking mmap lock during segfault
coresight: Only check bottom two claim bits
usb: dwc2: also exit clock_gating when stopping udc while suspended
iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
usb: potential integer overflow in usbg_make_tpg()
tty: serial: uartlite: register uart driver in init
usb: common: usb-conn-gpio: use a unique name for usb connector device
usb: Add checks for snprintf() calls in usb_alloc_dev()
usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
ALSA: hda: Ignore unsol events for cards being shut down
ALSA: hda: Add new pci id for AMD GPU display HD audio controller
ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
ceph: fix possible integer overflow in ceph_zero_objects()
scsi: ufs: core: Don't perform UFS clkscaling during host async scan
ovl: Check for NULL d_inode() in ovl_dentry_upper()
btrfs: handle csum tree error with rescue=ibadroots correctly
fs/jfs: consolidate sanity checking in dbMount
jfs: validate AG parameters in dbMount() to prevent crashes
ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with
dev_err_probe()
ASoC: codec: wcd9335: Convert to GPIO descriptors
ASoC: codecs: wcd9335: Fix missing free of regulator supplies
f2fs: don't over-report free space or inodes in statvfs
PCI: apple: Use helper function for_each_child_of_node_scoped()
PCI: apple: Set only available ports up
platform/x86: ideapad-laptop: move ACPI helpers from header to source file
platform/x86: ideapad-laptop: use usleep_range() for EC polling
i2c: tiny-usb: disable zero-length read messages
i2c: robotfuzz-osif: disable zero-length read messages
mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
s390/pkey: Prevent overflow in size calculation for memdup_user()
lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
atm: clip: prevent NULL deref in clip_push()
ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
attach_recursive_mnt(): do not lock the covering tree when sliding something
under it
libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
wifi: mac80211: fix beacon interval calculation overflow
af_unix: Don't set -ECONNRESET for consumed OOB skb.
vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
um: ubd: Add missing error check in start_io_thread()
libbpf: Fix possible use-after-free for externs
net: enetc: Correct endianness handling in _enetc_rd_reg64
atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
net: selftests: fix TCP packet checksum
drm/i915: fix build error some more
drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
smb: client: fix potential deadlock when reconnecting channels
EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
serial: imx: Restore original RXTL for console to fix data loss
Bluetooth: L2CAP: Fix L2CAP MTU negotiation
dm-raid: fix variable in journal device check
btrfs: fix a race between renames and directory logging
btrfs: update superblock's device bytes_used when dropping chunk
net: libwx: fix the creation of page_pool
HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
HID: wacom: fix memory leak on kobject creation failure
HID: wacom: fix memory leak on sysfs attribute creation failure
HID: wacom: fix kobject reference count leak
scsi: megaraid_sas: Fix invalid node index
drm/ast: Fix comment on modeset lock
drm/cirrus-qemu: Fix pitch programming
drm/etnaviv: Protect the scheduler's pending list with its lock
drm/tegra: Assign plane type before registration
drm/tegra: Fix a possible null pointer dereference
drm/udl: Unregister device before cleaning up on disconnect
drm/msm/gpu: Fix crash when throttling GPU immediately during boot
drm/amdkfd: Fix race in GWS queue scheduling
drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
drm/bridge: cdns-dsi: Fix phy de-init and flag it so
drm/bridge: cdns-dsi: Fix connecting to next bridge
drm/bridge: cdns-dsi: Check return value when getting default PHY config
drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
drm/amd/display: Add null pointer check for get_first_active_display()
drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
drm/amdgpu: Add kicker device detection
drm/amdgpu: switch job hw_fence to amdgpu_fence
ksmbd: Use unsafe_memcpy() for ntlm_negotiate
ksmbd: remove unsafe_memcpy use in session setup
media: uvcvideo: Rollback non processed entities on error
firmware: arm_scmi: Add a common helper to check if a message is supported
firmware: arm_scmi: Ensure that the message-id supports fastchannel
ARM: 9354/1: ptrace: Use bitfield helpers
nvme-tcp: fix I/O stalls on congested sockets
nvme-tcp: sanitize request list handling
drm/amdgpu: seq64 memory unmap uses uninterruptible lock
8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and
later devices
usb: gadget: f_hid: wake up readers on disable/unbind
drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
btrfs: fix qgroup reservation leak on failure to allocate ordered extent
smb: client: remove \t from TP_printk statements
fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
drm/xe/display: Add check for alloc_ordered_workqueue()
HID: wacom: fix crash in wacom_aes_battery_handler()
Bluetooth: hci_core: Fix use-after-free in vhci_flush()
ethernet: ionic: Fix DMA mapping tests
wifi: mac80211: Add link iteration macro for link data
wifi: mac80211: Create separate links for VLAN interfaces
wifi: mac80211: finish link init before RCU publish
bnxt: properly flush XDP redirect lists
netlink: specs: tc: replace underscores with dashes in names
drm/amdgpu/discovery: optionally use fw based ip discovery
drm/amd: Adjust output for discovery error handling
x86/traps: Initialize DR6 by writing its architectural reset value
serial: core: restore of_node information in sysfs
spi: spi-cadence-quadspi: Fix pm runtime unbalance
maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
drm/amd/display: Correct non-OLED pre_T11_delay.
drm/xe/vm: move rebind_work init earlier
drm/xe/sched: stop re-submitting signalled jobs
drm/amd/display: Check dce_hwseq before dereferencing it
drm/xe: Fix memset on iomem
drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
drm/amd/display: Fix mpv playback corruption on weston
x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
net: libwx: fix Tx L4 checksum
io_uring: fix potential page leak in io_sqe_buffer_register()
iio: dac: ad3552r: changes to use FIELD_PREP
drm/xe: Carve out wopcm portion from the stolen memory
usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY
drm/msm/dp: account for widebus and yuv420 during mode validation
arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi
ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA
net: stmmac: Fix accessing freed irq affinity_hint
spi: fsl-qspi: use devm function instead of driver remove
spi: fsl-qspi: Fix double cleanup in probe error path
UBUNTU: Upstream stable to v6.6.96, v6.12.36
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2025-12-09
+
+ Ported from the following upstream stable releases:
+ v6.6.96, v6.12.36
+
from git://git.kernel.org/
+
+ cifs: Correctly set SMB1 SessionKey field in Session Setup Request
+ cifs: Fix cifs_query_path_info() for Windows NT servers
+ cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode
+ NFSv4: Always set NLINK even if the server doesn't support it
+ NFSv4.2: fix listxattr to return selinux security label
+ mailbox: Not protect module_put with spin_lock_irqsave
+ mfd: max14577: Fix wakeup source leaks on device unbind
+ sunrpc: don't immediately retransmit on seqno miss
+ leds: multicolor: Fix intensity setting while SW blinking
+ fuse: fix race between concurrent setattrs from multiple nodes
+ cxl/region: Add a dev_err() on missing target list entries
+ NFSv4: xattr handlers should check for absent nfs filehandles
+ hwmon: (pmbus/max34440) Fix support for max34451
+ ksmbd: allow a filename to contain special characters on SMB3.1.1 posix
extension
+ ksmbd: provide zero as a unique ID to the Mac client
+ rust: module: place cleanup_module() in .exit.text section
+ dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver
before using
+ dmaengine: xilinx_dma: Set dma_device directions
+ PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to
one lane
+ PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
+ md/md-bitmap: fix dm-raid max_write_behind setting
+ amd/amdkfd: fix a kfd_process ref leak
+ bcache: fix NULL pointer in cache_set_flush()
+ drm/scheduler: signal scheduled fence when kill job
+ iio: pressure: zpa2326: Use aligned_s64 for the timestamp
+ um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
+ um: use proper care when taking mmap lock during segfault
+ coresight: Only check bottom two claim bits
+ usb: dwc2: also exit clock_gating when stopping udc while suspended
+ iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
+ misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
+ usb: potential integer overflow in usbg_make_tpg()
+ tty: serial: uartlite: register uart driver in init
+ usb: common: usb-conn-gpio: use a unique name for usb connector device
+ usb: Add checks for snprintf() calls in usb_alloc_dev()
+ usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
+ usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
+ usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
+ ALSA: hda: Ignore unsol events for cards being shut down
+ ALSA: hda: Add new pci id for AMD GPU display HD audio controller
+ ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
+ ceph: fix possible integer overflow in ceph_zero_objects()
+ scsi: ufs: core: Don't perform UFS clkscaling during host async scan
+ ovl: Check for NULL d_inode() in ovl_dentry_upper()
+ btrfs: handle csum tree error with rescue=ibadroots correctly
+ fs/jfs: consolidate sanity checking in dbMount
+ jfs: validate AG parameters in dbMount() to prevent crashes
+ ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with
dev_err_probe()
+ ASoC: codec: wcd9335: Convert to GPIO descriptors
+ ASoC: codecs: wcd9335: Fix missing free of regulator supplies
+ f2fs: don't over-report free space or inodes in statvfs
+ PCI: apple: Use helper function for_each_child_of_node_scoped()
+ PCI: apple: Set only available ports up
+ platform/x86: ideapad-laptop: move ACPI helpers from header to source file
+ platform/x86: ideapad-laptop: use usleep_range() for EC polling
+ i2c: tiny-usb: disable zero-length read messages
+ i2c: robotfuzz-osif: disable zero-length read messages
+ mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on
write
+ ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
+ s390/pkey: Prevent overflow in size calculation for memdup_user()
+ lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
+ atm: clip: prevent NULL deref in clip_push()
+ ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
+ attach_recursive_mnt(): do not lock the covering tree when sliding something
under it
+ libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
+ wifi: mac80211: fix beacon interval calculation overflow
+ af_unix: Don't set -ECONNRESET for consumed OOB skb.
+ vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
+ um: ubd: Add missing error check in start_io_thread()
+ libbpf: Fix possible use-after-free for externs
+ net: enetc: Correct endianness handling in _enetc_rd_reg64
+ atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
+ ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
+ net: selftests: fix TCP packet checksum
+ drm/i915: fix build error some more
+ drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
+ drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
+ smb: client: fix potential deadlock when reconnecting channels
+ EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
+ staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
+ dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
+ serial: imx: Restore original RXTL for console to fix data loss
+ Bluetooth: L2CAP: Fix L2CAP MTU negotiation
+ dm-raid: fix variable in journal device check
+ btrfs: fix a race between renames and directory logging
+ btrfs: update superblock's device bytes_used when dropping chunk
+ net: libwx: fix the creation of page_pool
+ HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
+ HID: wacom: fix memory leak on kobject creation failure
+ HID: wacom: fix memory leak on sysfs attribute creation failure
+ HID: wacom: fix kobject reference count leak
+ scsi: megaraid_sas: Fix invalid node index
+ drm/ast: Fix comment on modeset lock
+ drm/cirrus-qemu: Fix pitch programming
+ drm/etnaviv: Protect the scheduler's pending list with its lock
+ drm/tegra: Assign plane type before registration
+ drm/tegra: Fix a possible null pointer dereference
+ drm/udl: Unregister device before cleaning up on disconnect
+ drm/msm/gpu: Fix crash when throttling GPU immediately during boot
+ drm/amdkfd: Fix race in GWS queue scheduling
+ drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
+ drm/bridge: cdns-dsi: Fix phy de-init and flag it so
+ drm/bridge: cdns-dsi: Fix connecting to next bridge
+ drm/bridge: cdns-dsi: Check return value when getting default PHY config
+ drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
+ drm/amd/display: Add null pointer check for get_first_active_display()
+ drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
+ drm/amdgpu: Add kicker device detection
+ drm/amdgpu: switch job hw_fence to amdgpu_fence
+ ksmbd: Use unsafe_memcpy() for ntlm_negotiate
+ ksmbd: remove unsafe_memcpy use in session setup
+ media: uvcvideo: Rollback non processed entities on error
+ firmware: arm_scmi: Add a common helper to check if a message is supported
+ firmware: arm_scmi: Ensure that the message-id supports fastchannel
+ ARM: 9354/1: ptrace: Use bitfield helpers
+ nvme-tcp: fix I/O stalls on congested sockets
+ nvme-tcp: sanitize request list handling
+ drm/amdgpu: seq64 memory unmap uses uninterruptible lock
+ 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0 and
later devices
+ usb: gadget: f_hid: wake up readers on disable/unbind
+ drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
+ Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
+ btrfs: fix qgroup reservation leak on failure to allocate ordered extent
+ smb: client: remove \t from TP_printk statements
+ fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
+ drm/xe/display: Add check for alloc_ordered_workqueue()
+ HID: wacom: fix crash in wacom_aes_battery_handler()
+ Bluetooth: hci_core: Fix use-after-free in vhci_flush()
+ ethernet: ionic: Fix DMA mapping tests
+ wifi: mac80211: Add link iteration macro for link data
+ wifi: mac80211: Create separate links for VLAN interfaces
+ wifi: mac80211: finish link init before RCU publish
+ bnxt: properly flush XDP redirect lists
+ netlink: specs: tc: replace underscores with dashes in names
+ drm/amdgpu/discovery: optionally use fw based ip discovery
+ drm/amd: Adjust output for discovery error handling
+ x86/traps: Initialize DR6 by writing its architectural reset value
+ serial: core: restore of_node information in sysfs
+ spi: spi-cadence-quadspi: Fix pm runtime unbalance
+ maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
+ mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
+ scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
+ drm/amd/display: Correct non-OLED pre_T11_delay.
+ drm/xe/vm: move rebind_work init earlier
+ drm/xe/sched: stop re-submitting signalled jobs
+ drm/amd/display: Check dce_hwseq before dereferencing it
+ drm/xe: Fix memset on iomem
+ drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
+ drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
+ drm/amd/display: Fix mpv playback corruption on weston
+ x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
+ net: libwx: fix Tx L4 checksum
+ io_uring: fix potential page leak in io_sqe_buffer_register()
+ iio: dac: ad3552r: changes to use FIELD_PREP
+ drm/xe: Carve out wopcm portion from the stolen memory
+ usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters ERROR_RECOVERY
+ drm/msm/dp: account for widebus and yuv420 during mode validation
+ arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi
+ ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA
+ net: stmmac: Fix accessing freed irq affinity_hint
+ spi: fsl-qspi: use devm function instead of driver remove
+ spi: fsl-qspi: Fix double cleanup in probe error path
+ UBUNTU: Upstream stable to v6.6.96, v6.12.36
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2134499
Title:
Noble update: upstream stable patchset 2025-12-09
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2134499/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
