Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-01-29
Ported from the following upstream stable releases:
v6.6.115, v6.6.116, v6.12.56, v6.12.57
from git://git.kernel.org/
exec: Fix incorrect type for ret
nios2: ensure that memblock.current_limit is set when setting pfn limits
hfs: clear offset and space out of valid records in b-tree node
hfs: make proper initalization of struct hfs_find_data
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
hfs: validate record offset in hfsplus_bmap_alloc
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
dlm: check for defined force value in dlm_lockspace_release
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
hfsplus: return EIO when type of hidden directory mismatch in
hfsplus_fill_super()
lkdtm: fortify: Fix potential NULL dereference on kmalloc failure
m68k: bitops: Fix find_*_bit() signatures
powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure
drivers/perf: hisi: Relax the event ID check in the framework
smb: server: let smb_direct_flush_send_list() invalidate a remote key first
Unbreak 'make tools/*' for user-space targets
net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size()
rtnetlink: Allow deleting FDB entries in user namespace
net: enetc: fix the deadlock of enetc_mdio_lock
net: enetc: correct the value of ENETC_RXB_TRUESIZE
dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of
can_dropped_invalid_skb()
selftests: net: fix server bind failure in sctp_vrf.sh
net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
sctp: avoid NULL dereference when chunk data buffer is missing
net: bonding: fix possible peer notify event loss or dup issue
dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
gpio: pci-idio-16: Define maximum valid register address offset
gpio: 104-idio-16: Define maximum valid register address offset
Revert "cpuidle: menu: Avoid discarding useful information"
ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
can: netlink: can_changelink(): allow disabling of automatic restart
cifs: Fix TCP_Server_Info::credits to be signed
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
ocfs2: clear extent cache after moving/defragmenting extents
vsock: fix lock inversion in vsock_assign_transport()
net: stmmac: dwmac-rk: Fix disabling set_clock_selection
net: usb: rtl8150: Fix frame padding
net: ravb: Enforce descriptor type ordering
net: ravb: Ensure memory write completes before ringing TX doorbell
selftests: mptcp: join: mark 'flush re-add' as skipped if not supported
selftests: mptcp: join: mark implicit tests as skipped if not supported
spi: spi-nxp-fspi: add extra delay after dll locked
firmware: arm_scmi: Account for failed debug initialization
firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
RISC-V: Define pgprot_dmacoherent() for non-coherent devices
RISC-V: Don't print details of CPUs disabled in DT
hwmon: (sht3x) Fix error handling
gpio: ljca: Fix duplicated IRQ mapping
io_uring: correct __must_hold annotation in io_install_fixed_file
sched: Remove never used code in mm_cid_get()
USB: serial: option: add UNISOC UIS7720
USB: serial: option: add Quectel RG255C
USB: serial: option: add Telit FN920C04 ECM compositions
usb/core/quirks: Add Huawei ME906S to wakeup quirk
usb: raw-gadget: do not limit transfer length
xhci: dbc: enable back DbC in resume if it was enabled before suspend
x86/microcode: Fix Entrysign revision check for Zen1/Naples
binder: remove "invalid inc weak" check
comedi: fix divide-by-zero in comedi_buf_munge()
mei: me: add wildcat lake P DID
misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
most: usb: Fix use-after-free in hdm_disconnect
most: usb: hdm_probe: Fix calling put_device() before device initialization
tcpm: switch check for role_sw device with fw_node
dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
serial: 8250_dw: handle reset control deassert error
serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
serial: 8250_mtk: Enable baud clock and manage in runtime PM
devcoredump: Fix circular locking dependency with devcd->mutex.
xfs: always warn about deprecated mount options
fs/notify: call exportfs_encode_fid with s_umount
fuse: allocate ff->release_args only if release is needed
fuse: fix livelock in synchronous file put from fuseblk workers
ksmbd: transport_ipc: validate payload size before reading handle
net/sched: sch_qfq: Fix null-deref in agg_dequeue
audit: record fanotify event regardless of presence of rules
perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm ==
NULL
perf: Have get_perf_callchain() return NULL if crosstask and user are set
perf: Skip user unwind if the task is a kernel thread
x86/bugs: Report correct retbleed mitigation status
x86/bugs: Fix reporting of LFENCE retpoline
EDAC/mc_sysfs: Increase legacy channel support to 16
btrfs: zoned: return error from btrfs_zone_finish_endio()
btrfs: zoned: refine extent allocator hint selection
btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
btrfs: always drop log root tree reference in btrfs_replay_log()
btrfs: use level argument in log tree walk callback replay_one_buffer()
btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
selftests: mptcp: disable add_addr retrans in endpoint_tests
selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported
serial: sc16is7xx: remove useless enable of enhanced features
xhci: dbc: poll at different rate depending on data transfer activity
xhci: dbc: Allow users to modify DbC poll interval via sysfs
xhci: dbc: Improve performance by removing delay in transfer event polling.
xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
bits: add comments and newlines to #if, #else and #endif directives
bits: introduce fixed-type GENMASK_U*()
gpio: regmap: Allow to allocate regmap-irq device
gpio: regmap: add the .fixed_direction_output configuration parameter
gpio: idio-16: Define fixed direction of the GPIO lines
PCI: Test for bit underflow in pcie_set_readrq()
arm64: sysreg: Correct sign definitions for EIESB and DoubleLock
gfs2: Fix unlikely race in gdlm_put_lock
s390/mm: Use __GFP_ACCOUNT for user page table allocations
ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
net/mlx5: Fix IPsec cleanup over MPV device
btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()
riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
arm64: mte: Do not warn if the page is already tagged in copy_highpage()
perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK
cpuset: Use new excpus for nocpu error check when enabling root partition
btrfs: abort transaction on specific error places when walking log tree
btrfs: abort transaction in the process_one_buffer() log tree walk callback
btrfs: abort transaction if we fail to update inode in log replay dir fixup
btrfs: tree-checker: add inode extref checks
docs: kdoc: handle the obsolescensce of docutils.ErrorString()
f2fs: fix to avoid panic once fallocation fails for pinfile
wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
bonding: return detailed error when loading native XDP fails
bonding: check xdp prog when set bond mode
iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE
sfc: fix NULL dereferences in ef100_process_design_param()
btrfs: tree-checker: fix bounds check in check_inode_extref()
UBUNTU: Upstream stable to v6.6.115, v6.6.116, v6.12.56, v6.12.57
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Summary changed:
- Noble update: upstream stable patchset 2026-01-28
+ Noble update: upstream stable patchset 2026-01-29
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
- upstream stable patchset 2026-01-28
+ upstream stable patchset 2026-01-29
+
+ Ported from the following upstream stable releases:
+ v6.6.115, v6.6.116, v6.12.56, v6.12.57
+
from git://git.kernel.org/
+
+ exec: Fix incorrect type for ret
+ nios2: ensure that memblock.current_limit is set when setting pfn limits
+ hfs: clear offset and space out of valid records in b-tree node
+ hfs: make proper initalization of struct hfs_find_data
+ hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
+ hfs: validate record offset in hfsplus_bmap_alloc
+ hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
+ dlm: check for defined force value in dlm_lockspace_release
+ hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
+ hfsplus: return EIO when type of hidden directory mismatch in
hfsplus_fill_super()
+ lkdtm: fortify: Fix potential NULL dereference on kmalloc failure
+ m68k: bitops: Fix find_*_bit() signatures
+ powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure
+ drivers/perf: hisi: Relax the event ID check in the framework
+ smb: server: let smb_direct_flush_send_list() invalidate a remote key first
+ Unbreak 'make tools/*' for user-space targets
+ net/mlx5e: Return 1 instead of 0 in invalid case in
mlx5e_mpwrq_umr_entry_size()
+ rtnetlink: Allow deleting FDB entries in user namespace
+ net: enetc: fix the deadlock of enetc_mdio_lock
+ net: enetc: correct the value of ENETC_RXB_TRUESIZE
+ dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
+ can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of
can_dropped_invalid_skb()
+ selftests: net: fix server bind failure in sctp_vrf.sh
+ net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
+ net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
+ net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
+ arm64, mm: avoid always making PTE dirty in pte_mkwrite()
+ sctp: avoid NULL dereference when chunk data buffer is missing
+ net: bonding: fix possible peer notify event loss or dup issue
+ dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
+ arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
+ gpio: pci-idio-16: Define maximum valid register address offset
+ gpio: 104-idio-16: Define maximum valid register address offset
+ Revert "cpuidle: menu: Avoid discarding useful information"
+ ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
+ can: netlink: can_changelink(): allow disabling of automatic restart
+ cifs: Fix TCP_Server_Info::credits to be signed
+ MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
+ ocfs2: clear extent cache after moving/defragmenting extents
+ vsock: fix lock inversion in vsock_assign_transport()
+ net: stmmac: dwmac-rk: Fix disabling set_clock_selection
+ net: usb: rtl8150: Fix frame padding
+ net: ravb: Enforce descriptor type ordering
+ net: ravb: Ensure memory write completes before ringing TX doorbell
+ selftests: mptcp: join: mark 'flush re-add' as skipped if not supported
+ selftests: mptcp: join: mark implicit tests as skipped if not supported
+ spi: spi-nxp-fspi: add extra delay after dll locked
+ firmware: arm_scmi: Account for failed debug initialization
+ firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
+ RISC-V: Define pgprot_dmacoherent() for non-coherent devices
+ RISC-V: Don't print details of CPUs disabled in DT
+ hwmon: (sht3x) Fix error handling
+ gpio: ljca: Fix duplicated IRQ mapping
+ io_uring: correct __must_hold annotation in io_install_fixed_file
+ sched: Remove never used code in mm_cid_get()
+ USB: serial: option: add UNISOC UIS7720
+ USB: serial: option: add Quectel RG255C
+ USB: serial: option: add Telit FN920C04 ECM compositions
+ usb/core/quirks: Add Huawei ME906S to wakeup quirk
+ usb: raw-gadget: do not limit transfer length
+ xhci: dbc: enable back DbC in resume if it was enabled before suspend
+ x86/microcode: Fix Entrysign revision check for Zen1/Naples
+ binder: remove "invalid inc weak" check
+ comedi: fix divide-by-zero in comedi_buf_munge()
+ mei: me: add wildcat lake P DID
+ misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
+ most: usb: Fix use-after-free in hdm_disconnect
+ most: usb: hdm_probe: Fix calling put_device() before device initialization
+ tcpm: switch check for role_sw device with fw_node
+ dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
+ serial: 8250_dw: handle reset control deassert error
+ serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018
+ serial: 8250_mtk: Enable baud clock and manage in runtime PM
+ devcoredump: Fix circular locking dependency with devcd->mutex.
+ xfs: always warn about deprecated mount options
+ fs/notify: call exportfs_encode_fid with s_umount
+ fuse: allocate ff->release_args only if release is needed
+ fuse: fix livelock in synchronous file put from fuseblk workers
+ ksmbd: transport_ipc: validate payload size before reading handle
+ net/sched: sch_qfq: Fix null-deref in agg_dequeue
+ audit: record fanotify event regardless of presence of rules
+ perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm
== NULL
+ perf: Have get_perf_callchain() return NULL if crosstask and user are set
+ perf: Skip user unwind if the task is a kernel thread
+ x86/bugs: Report correct retbleed mitigation status
+ x86/bugs: Fix reporting of LFENCE retpoline
+ EDAC/mc_sysfs: Increase legacy channel support to 16
+ btrfs: zoned: return error from btrfs_zone_finish_endio()
+ btrfs: zoned: refine extent allocator hint selection
+ btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io()
+ btrfs: always drop log root tree reference in btrfs_replay_log()
+ btrfs: use level argument in log tree walk callback replay_one_buffer()
+ btrfs: use smp_mb__after_atomic() when forcing COW in
create_pending_snapshot()
+ arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
+ mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
+ selftests: mptcp: disable add_addr retrans in endpoint_tests
+ selftests: mptcp: join: mark 'delete re-add signal' as skipped if not
supported
+ serial: sc16is7xx: remove useless enable of enhanced features
+ xhci: dbc: poll at different rate depending on data transfer activity
+ xhci: dbc: Allow users to modify DbC poll interval via sysfs
+ xhci: dbc: Improve performance by removing delay in transfer event polling.
+ xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive.
+ xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event
+ bits: add comments and newlines to #if, #else and #endif directives
+ bits: introduce fixed-type GENMASK_U*()
+ gpio: regmap: Allow to allocate regmap-irq device
+ gpio: regmap: add the .fixed_direction_output configuration parameter
+ gpio: idio-16: Define fixed direction of the GPIO lines
+ PCI: Test for bit underflow in pcie_set_readrq()
+ arm64: sysreg: Correct sign definitions for EIESB and DoubleLock
+ gfs2: Fix unlikely race in gdlm_put_lock
+ s390/mm: Use __GFP_ACCOUNT for user page table allocations
+ ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
+ net/mlx5: Fix IPsec cleanup over MPV device
+ btrfs: directly free partially initialized fs_info in
btrfs_check_leaked_roots()
+ riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
+ platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
+ arm64: mte: Do not warn if the page is already tagged in copy_highpage()
+ perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK
+ cpuset: Use new excpus for nocpu error check when enabling root partition
+ btrfs: abort transaction on specific error places when walking log tree
+ btrfs: abort transaction in the process_one_buffer() log tree walk callback
+ btrfs: abort transaction if we fail to update inode in log replay dir fixup
+ btrfs: tree-checker: add inode extref checks
+ docs: kdoc: handle the obsolescensce of docutils.ErrorString()
+ f2fs: fix to avoid panic once fallocation fails for pinfile
+ wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
+ bonding: return detailed error when loading native XDP fails
+ bonding: check xdp prog when set bond mode
+ iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE
+ sfc: fix NULL dereferences in ef100_process_design_param()
+ btrfs: tree-checker: fix bounds check in check_inode_extref()
+ UBUNTU: Upstream stable to v6.6.115, v6.6.116, v6.12.56, v6.12.57
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2139282
Title:
Noble update: upstream stable patchset 2026-01-29
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2139282/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
