Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-01-22
Ported from the following upstream stable releases:
v6.6.108, v6.12.49
from git://git.kernel.org/
wifi: wilc1000: avoid buffer overflow in WID string configuration
ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
supported
wifi: mac80211: increase scan_ies_len for S1G
wifi: mac80211: fix incorrect type for ret
pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
cgroup: split cgroup_destroy_wq into 3 workqueues
um: virtio_uml: Fix use-after-free after put_device in probe
qed: Don't collect too many protection override GRC elements
bonding: set random address only when slaves already exist
net/mlx5e: Harden uplink netdev access against device unbind
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
tls: make sure to abort the stream if headers are bogus
cnic: Fix use-after-free bugs in cnic_delete_task
octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
ksmbd: smbdirect: validate data_offset and data_length field of
smb_direct_data_transfer
ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
power: supply: bq27xxx: restrict no-battery detection to bq27000
LoongArch: Update help info of ARCH_STRICT_ALIGN
LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
LoongArch: Check the return value when creating kobj
iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
btrfs: tree-checker: fix the incorrect inode ref size check
ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph
failed
ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
rds: ib: Increment i_fastreg_wrs before bailing out
selftests: mptcp: connect: catch IO errors on listen side
selftests: mptcp: avoid spurious errors on TCP disconnect
ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
io_uring: backport io_should_terminate_tw()
io_uring: include dying ring in task_work "should cancel" state
ASoC: wm8940: Correct PLL rate rounding
ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
crypto: af_alg - Set merge to zero early in af_alg_sendmsg
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
vmxnet3: unregister xdp rxq info in the reset path
selftests: mptcp: userspace pm: validate deny-join-id0 flag
xhci: dbc: decouple endpoint allocation from initialization
xhci: dbc: Fix full DbC transfer ring after several reconnects
iommu/amd/pgtbl: Fix possible race while increase page table level
rtc: pcf2127: fix SPI command byte for PCF2131 backport
mptcp: propagate shutdown to subflows when possible
minmax: avoid overly complicated constant expressions in VM code
minmax: simplify and clarify min_t()/max_t() implementation
minmax: add a few more MIN_T/MAX_T users
nvme: fix PI insert on write
btrfs: fix invalid extref key setup when replaying dentry
dpaa2-switch: fix buffer pool seeding for control traffic
net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
mptcp: set remote_deny_join_id0 on SYN recv
mptcp: tfo: record 'deny join id0' info
selftests: mptcp: sockopt: fix error messages
net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
ice: store max_frame and rx_buf_len only in ice_rx_ring
ice: fix Rx page leak on multi-buffer frames
i40e: remove redundant memory barrier when cleaning Tx descs
bonding: don't set oif to bond dev when getting NS target destination
octeon_ep: fix VF MAC address lifecycle handling
net: liquidio: fix overflow in octeon_init_instr_queue()
nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
dm-raid: don't set io_min and io_opt for raid1
dm-stripe: fix a possible integer overflow
mm: revert "mm: vmscan.c: fix OOM on swap stress test"
mmc: mvsdio: Fix dma_unmap_sg() nents value
KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
ASoC: wm8940: Correct typo in control name
ASoC: wm8974: Correct PLL rate rounding
ASoC: Intel: catpt: Expose correct bit depth to userspace
drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
smb: client: fix filename matching of deferred files
smb: client: let smbd_destroy() call
disable_work_sync(&info->post_send_credits_work)
platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13
platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
x86/bugs: Add SRSO_USER_KERNEL_NO support
x86/bugs: KVM: Add support for SRSO_MSR_FIX
KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count transitions
mptcp: pm: nl: announce deny-join-id0 flag
UBUNTU: Upstream stable to v6.6.108, v6.12.49
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-01-22
+
+ Ported from the following upstream stable releases:
+ v6.6.108, v6.12.49
+
from git://git.kernel.org/
+
+ wifi: wilc1000: avoid buffer overflow in WID string configuration
+ ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
supported
+ wifi: mac80211: increase scan_ies_len for S1G
+ wifi: mac80211: fix incorrect type for ret
+ pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
+ cgroup: split cgroup_destroy_wq into 3 workqueues
+ um: virtio_uml: Fix use-after-free after put_device in probe
+ qed: Don't collect too many protection override GRC elements
+ bonding: set random address only when slaves already exist
+ net/mlx5e: Harden uplink netdev access against device unbind
+ tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
+ tls: make sure to abort the stream if headers are bogus
+ cnic: Fix use-after-free bugs in cnic_delete_task
+ octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
+ ksmbd: smbdirect: validate data_offset and data_length field of
smb_direct_data_transfer
+ ksmbd: smbdirect: verify remaining_data_length respects
max_fragmented_recv_size
+ power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
+ power: supply: bq27xxx: restrict no-battery detection to bq27000
+ LoongArch: Update help info of ARCH_STRICT_ALIGN
+ LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
+ LoongArch: Check the return value when creating kobj
+ iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
+ btrfs: tree-checker: fix the incorrect inode ref size check
+ ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
+ ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph
failed
+ ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
+ net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
+ rds: ib: Increment i_fastreg_wrs before bailing out
+ selftests: mptcp: connect: catch IO errors on listen side
+ selftests: mptcp: avoid spurious errors on TCP disconnect
+ ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
+ io_uring: backport io_should_terminate_tw()
+ io_uring: include dying ring in task_work "should cancel" state
+ ASoC: wm8940: Correct PLL rate rounding
+ ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
+ drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
+ drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
+ crypto: af_alg - Set merge to zero early in af_alg_sendmsg
+ smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
+ vmxnet3: unregister xdp rxq info in the reset path
+ selftests: mptcp: userspace pm: validate deny-join-id0 flag
+ xhci: dbc: decouple endpoint allocation from initialization
+ xhci: dbc: Fix full DbC transfer ring after several reconnects
+ iommu/amd/pgtbl: Fix possible race while increase page table level
+ rtc: pcf2127: fix SPI command byte for PCF2131 backport
+ mptcp: propagate shutdown to subflows when possible
+ minmax: avoid overly complicated constant expressions in VM code
+ minmax: simplify and clarify min_t()/max_t() implementation
+ minmax: add a few more MIN_T/MAX_T users
+ nvme: fix PI insert on write
+ btrfs: fix invalid extref key setup when replaying dentry
+ dpaa2-switch: fix buffer pool seeding for control traffic
+ net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
+ mptcp: set remote_deny_join_id0 on SYN recv
+ mptcp: tfo: record 'deny join id0' info
+ selftests: mptcp: sockopt: fix error messages
+ net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
+ ice: store max_frame and rx_buf_len only in ice_rx_ring
+ ice: fix Rx page leak on multi-buffer frames
+ i40e: remove redundant memory barrier when cleaning Tx descs
+ bonding: don't set oif to bond dev when getting NS target destination
+ octeon_ep: fix VF MAC address lifecycle handling
+ net: liquidio: fix overflow in octeon_init_instr_queue()
+ nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
+ dm-raid: don't set io_min and io_opt for raid1
+ dm-stripe: fix a possible integer overflow
+ mm: revert "mm: vmscan.c: fix OOM on swap stress test"
+ mmc: mvsdio: Fix dma_unmap_sg() nents value
+ KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
+ ASoC: wm8940: Correct typo in control name
+ ASoC: wm8974: Correct PLL rate rounding
+ ASoC: Intel: catpt: Expose correct bit depth to userspace
+ drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
+ smb: client: fix filename matching of deferred files
+ smb: client: let smbd_destroy() call
disable_work_sync(&info->post_send_credits_work)
+ platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13
+ platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
+ x86/bugs: Add SRSO_USER_KERNEL_NO support
+ x86/bugs: KVM: Add support for SRSO_MSR_FIX
+ KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count transitions
+ mptcp: pm: nl: announce deny-join-id0 flag
+ UBUNTU: Upstream stable to v6.6.108, v6.12.49
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2138867
Title:
Noble update: upstream stable patchset 2026-01-22
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2138867/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
