Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2025-12-12
Ported from the following upstream stable releases:
v6.6.98, v6.6.99, v6.12.38, v6.12.39
Note: Both v6.6.98 and v6.12.38 consist of only one patch 'x86/CPU/AMD:
Properly check the TSA microcode' that is a follow-up fix for a previous
stable backport and that has been included ahead of time in noble
patchset 2025-12-11 (LP: #2134640), thus leaving them both empty. They
are listed here to make it clear that they have been processed. Arguably
they should have been listed in the previous noble patchset.
from git://git.kernel.org/
eventpoll: don't decrement ep refcount while still holding the ep mutex
drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
perf/core: Fix the WARN_ON_ONCE is out of lock protected region
perf: Revert to requiring CAP_SYS_ADMIN for uprobes
ASoC: cs35l56: probe() should fail if the device ID is not recognized
Bluetooth: hci_sync: Fix not disabling advertising instance
Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
pinctrl: amd: Clear GPIO debounce for suspend
fix proc_sys_compare() handling of in-lookup dentries
netlink: Fix wraparounds of sk->sk_rmem_alloc.
vsock: fix `vsock_proto` declaration
tipc: Fix use-after-free in tipc_conn_close().
tcp: Correct signedness in skb remaining space calculation
vsock: Fix transport_{g2h,h2g} TOCTOU
vsock: Fix transport_* TOCTOU
vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
net: phy: smsc: Force predictable MDI-X state on LAN87xx
net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
atm: clip: Fix potential null-ptr-deref in to_atmarpd().
atm: clip: Fix memory leak of struct clip_vcc.
atm: clip: Fix infinite recursive call of clip_push().
atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
net/sched: Abort __tc_modify_qdisc if parent class does not exist
rxrpc: Fix bug due to prealloc collision
perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
rxrpc: Fix oops due to non-existence of prealloc backlog struct
ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
x86/mce/amd: Add default names for MCA banks and blocks
x86/mce/amd: Fix threshold limit reset
x86/mce: Don't remove sysfs if thresholding sysfs init fails
x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
gre: Fix IPv6 multicast route creation.
md/md-bitmap: fix GPF in bitmap_get_stats()
pinctrl: qcom: msm: mark certain pins as invalid for interrupts
wifi: prevent A-MSDU attacks in mesh networks
drm/gem: Acquire references on GEM handles for framebuffers
drm/sched: Increment job count before swapping tail spsc queue
drm/ttm: fix error handling in ttm_buffer_object_transfer
drm/gem: Fix race in drm_gem_handle_create_tail()
usb: gadget: u_serial: Fix race condition in TTY wakeup
Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
drm/framebuffer: Acquire internal references on GEM handles
kallsyms: fix build without execinfo
maple_tree: fix mt_destroy_walk() on root leaf node
mm: fix the inaccurate memory statistics issue for users
scripts/gdb: fix interrupts display after MCP on x86
scripts/gdb: de-reference per-CPU MCE interrupts
scripts/gdb: fix interrupts.py after maple tree conversion
mm/vmalloc: leave lazy MMU mode on PTE mapping error
pwm: mediatek: Ensure to disable clocks in error path
x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
x86/mm: Disable hugetlb page table sharing on 32-bit
smb: server: make use of rdma_destroy_qp()
ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
erofs: fix to add missing tracepoint in erofs_read_folio()
netlink: Fix rmem check in netlink_broadcast_deliver().
netlink: make sure we allow at least one dump skb
smb: client: avoid unnecessary reconnects when refreshing referrals
smb: client: fix DFS interlink failover
cifs: all initializations for tcon should happen in tcon_info_alloc
wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
drm/tegra: nvdec: Fix dma_alloc_coherent error check
md/raid1: Fix stack memory use after return in raid1_reshape
raid10: cleanup memleak at raid10_make_request
nbd: fix uaf in nbd_genl_connect() error path
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
net: appletalk: Fix device refcount leak in atrtr_create()
ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug
level
net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
bnxt_en: Fix DCB ETS validation
bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
ublk: sanity check add_dev input for underflow
atm: idt77252: Add missing `dma_map_error()`
um: vector: Reduce stack usage in vector_eth_configure()
io_uring: make fallocate be hashed work
ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
net: usb: qmi_wwan: add SIMCom 8230C composition
HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
net: mana: Record doorbell physical address in PF mode
btrfs: fix assertion when building free space tree
vt: add missing notification when switching back to text mode
bpf: Adjust free target to avoid global starvation of LRU map
HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
selftests/bpf: adapt one more case in test_lru_map to the new target_free
smb: client: fix potential race in cifs_put_tcon()
kasan: remove kasan_find_vm_area() to prevent possible deadlock
ksmbd: fix potential use-after-free in oplock/lease break ack
crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
rseq: Fix segfault on registration when rseq_cs is non-zero
drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
drm/amdgpu/ip_discovery: add missing ip_discovery fw
drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid
Priority Inversion in SRIOV
x86/mce: Ensure user polling settings are honored when restarting timer
KVM: Allow CPU to reschedule while setting per-page memory attributes
ASoC: fsl_sai: Force a software reset when starting in consumer mode
wifi: mt76: mt7921: prevent decap offload config before STA initialization
wifi: mt76: mt7925: fix the wrong config for tx interrupt
wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan
drm/imagination: Fix kernel crash when hard resetting the GPU
drm/amdkfd: Don't call mmput from MMU notifier callback
drm/xe: Allocate PF queue size on pow2 boundary
clk: scmi: Handle case where child clocks are initialized before their parents
erofs: address D-cache aliasing
wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements
wifi: cfg80211: fix S1G beacon head validation in nl80211
wifi: mac80211: correctly identify S1G short beacon
wifi: mac80211: fix non-transmitted BSSID profile search
drm/nouveau/gsp: fix potential leak of memory used during acpi init
drm/xe/pf: Clear all LMTT pages on alloc
erofs: free pclusters if no cached folio is attached
erofs: get rid of `z_erofs_next_pcluster_t`
erofs: tidy up zdata.c
erofs: refine readahead tracepoint
erofs: fix to add missing tracepoint in erofs_readahead()
net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
selftests: net: lib: Move logging from forwarding/lib.sh here
selftests: net: lib: fix shift count out of range
net/mlx5e: Add new prio for promiscuous mode
ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
ALSA: hda/realtek: Add quirks for some Clevo laptops
riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment
HID: nintendo: avoid bluetooth suspend/resume stalls
erofs: fix rare pcluster memory leak after unmounting
net: libwx: fix alloc msix vectors failed
net: wangxun: revert the adjustment of the IRQ vector sequence
arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
KVM: SVM: Set synthesized TSA CPUID flags
UBUNTU: Upstream stable to v6.6.98, v6.6.99, v6.12.38, v6.12.39
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2025-12-12
+
+ Ported from the following upstream stable releases:
+ v6.6.98, v6.6.99, v6.12.38, v6.12.39
+
+ Note: Both v6.6.98 and v6.12.38 consist of only one patch 'x86/CPU/AMD:
+ Properly check the TSA microcode' that is a follow-up fix for a previous
+ stable backport and that has been included ahead of time in noble
+ patchset 2025-12-11 (LP: #2134640), thus leaving them both empty. They
+ are listed here to make it clear that they have been processed. Arguably
+ they should have been listed in the previous noble patchset.
+
from git://git.kernel.org/
+
+ eventpoll: don't decrement ep refcount while still holding the ep mutex
+ drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
+ ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
+ perf/core: Fix the WARN_ON_ONCE is out of lock protected region
+ perf: Revert to requiring CAP_SYS_ADMIN for uprobes
+ ASoC: cs35l56: probe() should fail if the device ID is not recognized
+ Bluetooth: hci_sync: Fix not disabling advertising instance
+ Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
+ pinctrl: amd: Clear GPIO debounce for suspend
+ fix proc_sys_compare() handling of in-lookup dentries
+ netlink: Fix wraparounds of sk->sk_rmem_alloc.
+ vsock: fix `vsock_proto` declaration
+ tipc: Fix use-after-free in tipc_conn_close().
+ tcp: Correct signedness in skb remaining space calculation
+ vsock: Fix transport_{g2h,h2g} TOCTOU
+ vsock: Fix transport_* TOCTOU
+ vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
+ net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
+ net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
+ net: phy: smsc: Force predictable MDI-X state on LAN87xx
+ net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
+ atm: clip: Fix potential null-ptr-deref in to_atmarpd().
+ atm: clip: Fix memory leak of struct clip_vcc.
+ atm: clip: Fix infinite recursive call of clip_push().
+ atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
+ net/sched: Abort __tc_modify_qdisc if parent class does not exist
+ rxrpc: Fix bug due to prealloc collision
+ perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
+ rxrpc: Fix oops due to non-existence of prealloc backlog struct
+ ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
+ x86/mce/amd: Add default names for MCA banks and blocks
+ x86/mce/amd: Fix threshold limit reset
+ x86/mce: Don't remove sysfs if thresholding sysfs init fails
+ x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
+ KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
+ KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
+ gre: Fix IPv6 multicast route creation.
+ md/md-bitmap: fix GPF in bitmap_get_stats()
+ pinctrl: qcom: msm: mark certain pins as invalid for interrupts
+ wifi: prevent A-MSDU attacks in mesh networks
+ drm/gem: Acquire references on GEM handles for framebuffers
+ drm/sched: Increment job count before swapping tail spsc queue
+ drm/ttm: fix error handling in ttm_buffer_object_transfer
+ drm/gem: Fix race in drm_gem_handle_create_tail()
+ usb: gadget: u_serial: Fix race condition in TTY wakeup
+ Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
+ drm/framebuffer: Acquire internal references on GEM handles
+ kallsyms: fix build without execinfo
+ maple_tree: fix mt_destroy_walk() on root leaf node
+ mm: fix the inaccurate memory statistics issue for users
+ scripts/gdb: fix interrupts display after MCP on x86
+ scripts/gdb: de-reference per-CPU MCE interrupts
+ scripts/gdb: fix interrupts.py after maple tree conversion
+ mm/vmalloc: leave lazy MMU mode on PTE mapping error
+ pwm: mediatek: Ensure to disable clocks in error path
+ x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
+ x86/mm: Disable hugetlb page table sharing on 32-bit
+ smb: server: make use of rdma_destroy_qp()
+ ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
+ erofs: fix to add missing tracepoint in erofs_read_folio()
+ netlink: Fix rmem check in netlink_broadcast_deliver().
+ netlink: make sure we allow at least one dump skb
+ smb: client: avoid unnecessary reconnects when refreshing referrals
+ smb: client: fix DFS interlink failover
+ cifs: all initializations for tcon should happen in tcon_info_alloc
+ wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
+ drm/tegra: nvdec: Fix dma_alloc_coherent error check
+ md/raid1: Fix stack memory use after return in raid1_reshape
+ raid10: cleanup memleak at raid10_make_request
+ nbd: fix uaf in nbd_genl_connect() error path
+ netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
+ net: appletalk: Fix device refcount leak in atrtr_create()
+ ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
+ net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
+ can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to
debug level
+ net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
+ bnxt_en: Fix DCB ETS validation
+ bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
+ ublk: sanity check add_dev input for underflow
+ atm: idt77252: Add missing `dma_map_error()`
+ um: vector: Reduce stack usage in vector_eth_configure()
+ io_uring: make fallocate be hashed work
+ ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
+ ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
+ net: usb: qmi_wwan: add SIMCom 8230C composition
+ HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
+ net: mana: Record doorbell physical address in PF mode
+ btrfs: fix assertion when building free space tree
+ vt: add missing notification when switching back to text mode
+ bpf: Adjust free target to avoid global starvation of LRU map
+ HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
+ HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
+ selftests/bpf: adapt one more case in test_lru_map to the new target_free
+ smb: client: fix potential race in cifs_put_tcon()
+ kasan: remove kasan_find_vm_area() to prevent possible deadlock
+ ksmbd: fix potential use-after-free in oplock/lease break ack
+ crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
+ rseq: Fix segfault on registration when rseq_cs is non-zero
+ drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
+ drm/amdgpu/ip_discovery: add missing ip_discovery fw
+ drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid
Priority Inversion in SRIOV
+ x86/mce: Ensure user polling settings are honored when restarting timer
+ KVM: Allow CPU to reschedule while setting per-page memory attributes
+ ASoC: fsl_sai: Force a software reset when starting in consumer mode
+ wifi: mt76: mt7921: prevent decap offload config before STA initialization
+ wifi: mt76: mt7925: fix the wrong config for tx interrupt
+ wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan
+ drm/imagination: Fix kernel crash when hard resetting the GPU
+ drm/amdkfd: Don't call mmput from MMU notifier callback
+ drm/xe: Allocate PF queue size on pow2 boundary
+ clk: scmi: Handle case where child clocks are initialized before their parents
+ erofs: address D-cache aliasing
+ wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements
+ wifi: cfg80211: fix S1G beacon head validation in nl80211
+ wifi: mac80211: correctly identify S1G short beacon
+ wifi: mac80211: fix non-transmitted BSSID profile search
+ drm/nouveau/gsp: fix potential leak of memory used during acpi init
+ drm/xe/pf: Clear all LMTT pages on alloc
+ erofs: free pclusters if no cached folio is attached
+ erofs: get rid of `z_erofs_next_pcluster_t`
+ erofs: tidy up zdata.c
+ erofs: refine readahead tracepoint
+ erofs: fix to add missing tracepoint in erofs_readahead()
+ net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
+ selftests: net: lib: Move logging from forwarding/lib.sh here
+ selftests: net: lib: fix shift count out of range
+ net/mlx5e: Add new prio for promiscuous mode
+ ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
+ ALSA: hda/realtek: Add quirks for some Clevo laptops
+ riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment
+ HID: nintendo: avoid bluetooth suspend/resume stalls
+ erofs: fix rare pcluster memory leak after unmounting
+ net: libwx: fix alloc msix vectors failed
+ net: wangxun: revert the adjustment of the IRQ vector sequence
+ arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
+ KVM: SVM: Set synthesized TSA CPUID flags
+ UBUNTU: Upstream stable to v6.6.98, v6.6.99, v6.12.38, v6.12.39
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2135261
Title:
Noble update: upstream stable patchset 2025-12-12
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2135261/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
