Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-01-23
Ported from the following upstream stable releases:
v6.6.109, v6.6.110, v6.12.50, v6.12.51
from git://git.kernel.org/
scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
firewire: core: fix overlooked update of subsystem ABI version
ALSA: usb-audio: Fix block comments in mixer_quirks
ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
ALSA: usb-audio: Convert comma to semicolon
ALSA: usb-audio: Fix build with CONFIG_INPUT=n
usb: core: Add 0x prefix to quirks debug output
mmc: sdhci-cadence: add Mobileye eyeQ support
i2c: designware: Add quirk for Intel Xe
ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
ALSA: usb-audio: Add mute TLV for playback volumes on more devices
IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
mm: add folio_expected_ref_count() for reference count calculation
mm/gup: check ref_count instead of lru before migration
mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
mm: folio_may_be_lru_cached() unless folio_test_large()
arm64: dts: imx8mp: Correct thermal sensor index
ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
cpufreq: Initialize cpufreq-based invariance before subsys
smb: server: don't use delayed_work for post_recv_credits_work
wifi: virt_wifi: Fix page fault on connect
can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
bpf: Reject bpf_timer for PREEMPT_RT
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
can: peak_usb: fix shift-out-of-bounds issue
ethernet: rvu-af: Remove slash from the driver name
Bluetooth: hci_sync: Fix hci_resume_advertising_sync
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
vhost: Take a reference on the task in struct vhost_task.
bnxt_en: correct offset handling for IPv6 destination address
net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
nexthop: Forbid FDB status change while nexthop is in a group
selftests: fib_nexthops: Fix creation of non-FDB nexthops
net: dsa: lantiq_gswip: do also enable or disable cpu port
net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to
the CPU port
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
drm/gma500: Fix null dereference in hdmi teardown
futex: Prevent use-after-free during requeue-PI
HID: asus: add support for missing PX series fn keys
i40e: fix idx validation in i40e_validate_queue_map
i40e: fix idx validation in config queues msg
i40e: fix input validation logic for action_meta
i40e: fix validation of VF state in get resources
i40e: add max boundary check for VF filters
i40e: add mask to apply valid bits for itr_idx
i40e: improve VF MAC filters accounting
tracing: dynevent: Add a missing lockdown check on dynevent
ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
afs: Fix potential null pointer dereference in afs_put_server
kmsan: fix out-of-bounds access to shadow memory
mm/hugetlb: fix folio is still mapped when deleted
fbcon: fix integer overflow in fbcon_do_set_font
fbcon: Fix OOB access in font allocation
s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
loop: Avoid updating block size under exclusive owner
gpiolib: Extend software-node support to support secondary software-nodes
drm/ast: Use msleep instead of mdelay for edid read
i40e: add validation for ring_len param
minmax: make generic MIN() and MAX() macros available everywhere
minmax: simplify min()/max()/clamp() implementation
minmax: don't use max() in situations that want a C constant expression
minmax: improve macro expansion and type checking
minmax: fix up min3() and max3() too
minmax.h: add whitespace around operators and after commas
minmax.h: update some comments
minmax.h: reduce the #define expansion of min(), max() and clamp()
minmax.h: move all the clamp() definitions after the min/max() ones
minmax.h: simplify the variants of clamp()
minmax.h: remove some #defines that are only expanded once
drm/i915/backlight: Return immediately when scale() finds invalid parameters
ALSA: usb-audio: Fix code alignment in mixer_quirks
ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info
net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
net: sfp: add quirk for FLYPRO copper SFP+ module
HID: amd_sfh: Add sync across amd sfh work functions
platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
fs/proc/task_mmu: check p->vec_buf for NULL
crypto: sha256 - fix crash at kexec
gcc-plugins: Remove TODO_verify_il for GCC >= 16
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
ASoC: qcom: audioreach: fix potential null pointer dereference
mm: swap: check for stable address space before operating on the VMA
wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
UBUNTU: Upstream stable to v6.6.109, v6.6.110, v6.12.50, v6.12.51
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-01-23
+
+ Ported from the following upstream stable releases:
+ v6.6.109, v6.6.110, v6.12.50, v6.12.51
+
from git://git.kernel.org/
+
+ scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
+ firewire: core: fix overlooked update of subsystem ABI version
+ ALSA: usb-audio: Fix block comments in mixer_quirks
+ ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
+ ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
+ ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
+ ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
+ ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
+ ALSA: usb-audio: Convert comma to semicolon
+ ALSA: usb-audio: Fix build with CONFIG_INPUT=n
+ usb: core: Add 0x prefix to quirks debug output
+ mmc: sdhci-cadence: add Mobileye eyeQ support
+ i2c: designware: Add quirk for Intel Xe
+ ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
+ ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
+ ALSA: usb-audio: Add mute TLV for playback volumes on more devices
+ IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
+ mm: add folio_expected_ref_count() for reference count calculation
+ mm/gup: check ref_count instead of lru before migration
+ mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
+ mm: folio_may_be_lru_cached() unless folio_test_large()
+ arm64: dts: imx8mp: Correct thermal sensor index
+ ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
+ cpufreq: Initialize cpufreq-based invariance before subsys
+ smb: server: don't use delayed_work for post_recv_credits_work
+ wifi: virt_wifi: Fix page fault on connect
+ can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
+ bpf: Reject bpf_timer for PREEMPT_RT
+ xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
+ can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
+ can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
+ can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
+ can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
+ can: peak_usb: fix shift-out-of-bounds issue
+ ethernet: rvu-af: Remove slash from the driver name
+ Bluetooth: hci_sync: Fix hci_resume_advertising_sync
+ Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
+ vhost: Take a reference on the task in struct vhost_task.
+ bnxt_en: correct offset handling for IPv6 destination address
+ net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
+ nexthop: Forbid FDB status change while nexthop is in a group
+ selftests: fib_nexthops: Fix creation of non-FDB nexthops
+ net: dsa: lantiq_gswip: do also enable or disable cpu port
+ net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
+ net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added
to the CPU port
+ octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
+ drm/gma500: Fix null dereference in hdmi teardown
+ futex: Prevent use-after-free during requeue-PI
+ HID: asus: add support for missing PX series fn keys
+ i40e: fix idx validation in i40e_validate_queue_map
+ i40e: fix idx validation in config queues msg
+ i40e: fix input validation logic for action_meta
+ i40e: fix validation of VF state in get resources
+ i40e: add max boundary check for VF filters
+ i40e: add mask to apply valid bits for itr_idx
+ i40e: improve VF MAC filters accounting
+ tracing: dynevent: Add a missing lockdown check on dynevent
+ ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
+ afs: Fix potential null pointer dereference in afs_put_server
+ kmsan: fix out-of-bounds access to shadow memory
+ mm/hugetlb: fix folio is still mapped when deleted
+ fbcon: fix integer overflow in fbcon_do_set_font
+ fbcon: Fix OOB access in font allocation
+ s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
+ ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
+ loop: Avoid updating block size under exclusive owner
+ gpiolib: Extend software-node support to support secondary software-nodes
+ drm/ast: Use msleep instead of mdelay for edid read
+ i40e: add validation for ring_len param
+ minmax: make generic MIN() and MAX() macros available everywhere
+ minmax: simplify min()/max()/clamp() implementation
+ minmax: don't use max() in situations that want a C constant expression
+ minmax: improve macro expansion and type checking
+ minmax: fix up min3() and max3() too
+ minmax.h: add whitespace around operators and after commas
+ minmax.h: update some comments
+ minmax.h: reduce the #define expansion of min(), max() and clamp()
+ minmax.h: move all the clamp() definitions after the min/max() ones
+ minmax.h: simplify the variants of clamp()
+ minmax.h: remove some #defines that are only expanded once
+ drm/i915/backlight: Return immediately when scale() finds invalid parameters
+ ALSA: usb-audio: Fix code alignment in mixer_quirks
+ ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
+ net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info
+ net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
+ net: sfp: add quirk for FLYPRO copper SFP+ module
+ HID: amd_sfh: Add sync across amd sfh work functions
+ platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
+ fs/proc/task_mmu: check p->vec_buf for NULL
+ crypto: sha256 - fix crash at kexec
+ gcc-plugins: Remove TODO_verify_il for GCC >= 16
+ scsi: target: target_core_configfs: Add length check to avoid buffer overflow
+ media: b2c2: Fix use-after-free causing by irq_check_work in
flexcop_pci_remove
+ media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
+ ASoC: qcom: audioreach: fix potential null pointer dereference
+ mm: swap: check for stable address space before operating on the VMA
+ wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
+ UBUNTU: Upstream stable to v6.6.109, v6.6.110, v6.12.50, v6.12.51
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2138938
Title:
Noble update: upstream stable patchset 2026-01-23
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2138938/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
