Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-02-19
Ported from the following upstream stable releases:
v6.18.2, v6.12.64, v6.18.3
from git://git.kernel.org/
bpf: Fix sleepable context for async callbacks
bpf: extract generic helper from process_timer_func()
bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq
irqchip: Drop leftover brackets
irqchip: Pass platform device to platform drivers
bpf: Do not let BPF test infra emit invalid GSO types to stack
arm64: dts: exynos: gs101: fix clock module unit reg sizes
ice: move service task start out of ice_init_pf()
ice: move ice_init_interrupt_scheme() prior ice_init_pf()
ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure
ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf()
ice: move ice_init_pf() out of ice_init_dev()
ice: extract ice_init_dev() from ice_init()
ice: move ice_deinit_dev() to the end of deinit paths
ice: remove duplicate call to ice_deinit_hw() on error paths
arm64: dts: qcom: lemans: Add missing quirk for HS only USB controller
tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions
arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration
wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create()
ARM: dts: am33xx: Add missing serial console speed
arm64: tegra: Add pinctrl definitions for pcie-ep nodes
md: init bioset in mddev_init
fs/ntfs3: Initialize allocated memory before use
scsi: qla2xxx: Clear cmds after chip reset
arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors
pwm: Simplify printf to emit chip->npwm in $debugfs/pwm
pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id
soc/tegra: fuse: speedo-tegra210: Update speedo IDs
iio: core: add missing mutex_destroy in iio_dev_release()
iio: core: Clean up device correctly on iio_device_alloc() failure
iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD
of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr()
of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range()
rtla/tests: Extend action tests to 5s
rtla: Fix -a overriding -t argument
btrfs: make sure extent and csum paths are always released in
scrub_raid56_parity_stripe()
iomap: allocate s_dio_done_wq for async reads as well
RDMA/irdma: Remove doorbell elision logic
selftests/landlock: Fix makefile header list
net: vxlan: prevent NULL deref in vxlan_xmit_one
landlock: Fix handling of disconnected directories
exfat: fix refcount leak in exfat_find
io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
ALSA: wavefront: Clear substream pointers on close
btrfs: do not skip logging new dentries when logging a new name
btrfs: fix a potential path leak in print_data_reloc_error()
bpf, arm64: Do not audit capability check in do_jit()
btrfs: fix memory leak of fs_devices in degraded seed device path
shmem: fix recovery on rename failures
iomap: adjust read range correctly for non-block-aligned positions
iomap: account for unaligned end offsets when truncating read range
scripts/faddr2line: Fix "Argument list too long" error
perf/x86/amd: Check event before enable to avoid GPF
sched/deadline: only set free_cpus for online runqueues
sched/fair: Revert max_newidle_lb_cost bump
x86/ptrace: Always inline trivial accessors
ACPICA: Avoid walking the Namespace if start_node is NULL
ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
ACPI: fan: Workaround for 64-bit firmware bug
cpufreq: s5pv210: fix refcount leak
cpuidle: menu: Use residency threshold in polling state override decisions
livepatch: Match old_sympos 0 and 1 in klp_find_func()
fs/ntfs3: Support timestamps prior to epoch
kbuild: Use objtree for module signing key path
ntfs: set dummy blocksize to read boot_block when mounting
hfsplus: fix volume corruption issue for generic/070
hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
hfsplus: Verify inode mode when loading from disk
hfsplus: fix volume corruption issue for generic/073
fs/ntfs3: check for shutdown in fsync
wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
wifi: cfg80211: stop radar detection in cfg80211_leave()
wifi: cfg80211: use cfg80211_leave() in iftype change
wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load
wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
btrfs: scrub: always update btrfs_scrub_progress::last_physical
gfs2: fix remote evict for read-only filesystems
gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
smb/server: fix return value of smb2_ioctl()
ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
ksmbd: vfs: fix race on m_flags in vfs_cache
Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
net: fec: ERR007885 Workaround for XDP TX path
netrom: Fix memory leak in nr_sendmsg()
net/sched: ets: Always remove class from active list before deleting in
ets_qdisc_change
ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
mlxsw: spectrum_router: Fix possible neighbour reference count leak
mlxsw: spectrum_router: Fix neighbour use-after-free
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
bnxt_en: Fix XDP_TX path
net: openvswitch: fix middle attribute validation in push_nsh() action
broadcom: b44: prevent uninitialized value usage
netfilter: nf_conncount: fix leaked ct in error paths
ipvs: fix ipv4 null-ptr-deref in route error path
caif: fix integer underflow in cffrml_receive()
net/sched: ets: Remove drr class from the active list if it changes to strict
nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
netfilter: nf_nat: remove bogus direction check
netfilter: nf_tables: remove redundant chain validation on register store
selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel
iommufd/selftest: Make it clearer to gcc that the access is not out of bounds
iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED
ethtool: Avoid overflowing userspace buffer on stats query
net/mlx5: fw reset, clear reset requested on drain_fw_reset
net/mlx5: Drain firmware reset in shutdown callback
net/mlx5: fw_tracer, Validate format string parameters
net/mlx5: fw_tracer, Handle escaped percent properly
net/mlx5: Serialize firmware reset with devlink
net/handshake: duplicate handshake cancellations leak socket
net: enetc: do not transmit redirected XDP frames when the link is down
net: hns3: using the num_tqps in the vf driver to apply for resources
net: hns3: using the num_tqps to check whether tqp_index is out of range when
vf get ring info from mbx
net: hns3: add VLAN id validation before using
hwmon: (dell-smm) Limit fan multiplier to avoid overflow
hwmon: (ibmpex) fix use-after-free in high/low store
hwmon: (tmp401) fix overflow caused by default conversion rate value
drm/me/gsc: mei interrupt top half should be in irq disabled context
drm/xe: Restore engine registers before restarting schedulers after GT reset
MIPS: Fix a reference leak bug in ip22_check_gio()
drm/panel: sony-td4353-jdi: Enable prepare_prev_first
x86/xen: Fix sparse warning in enlighten_pv.c
arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing
reorder
spi: cadence-quadspi: Fix clock disable on probe failure path
block: rnbd-clt: Fix leaked ID in init_dev()
drm/xe: Limit num_syncs to prevent oversized allocations
drm/xe/oa: Limit num_syncs to prevent oversized allocations
hwmon: (ltc4282): Fix reset_history file permissions
ksmbd: skip lock-range check on equal size to avoid size==0 underflow
ksmbd: Fix refcount leak when invalid session is found on session lookup
ksmbd: fix buffer validation by including null terminator size in EA length
HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
Input: lkkbd - disable pending work before freeing device
Input: alps - fix use-after-free bugs caused by dev3_register_work
Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails
can: gs_usb: gs_can_open(): fix error handling
soc/tegra: fuse: Do not register SoC device on ACPI boot
ACPI: PCC: Fix race condition by removing static qualifier
ACPI: CPPC: Fix missing PCC check for guaranteed_perf
spi: fsl-cpm: Check length parity before switching to 16 bit mode
mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig
mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures
ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
ALSA: usb-mixer: us16x08: validate meter packet indices
ASoC: ak4458: remove the reset operation in probe and remove
nfsd: fix memory leak in nfsd_create_serv error paths
ipmi: Fix the race between __scan_channels() and deliver_response()
ipmi: Fix __scan_channels() failing to rescan channels
scsi: ufs: host: mediatek: Fix shutdown/suspend race condition
firmware: imx: scu-irq: Init workqueue before request mbox channel
ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
scsi: smartpqi: Add support for Hurray Data new controller PCI device
clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
powerpc/addnote: Fix overflow on 32-bit builds
scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
fuse: Always flush the page cache before FOPEN_DIRECT_IO write
fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
via_wdt: fix critical boot hang due to unnamed resource allocation
reset: fix BIT macro reference
exfat: fix remount failure in different process environments
exfat: zero out post-EOF page cache on file extension
usbip: Fix locking bug in RT-enabled kernels
usb: typec: ucsi: Handle incorrect num_connectors capability
iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains
usb: xhci: limit run_graceperiod for only usb 3.0 devices
usb: usb-storage: No additional quirks need to be added to the EL-R12 optical
drive.
serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src
i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured
firmware
nvme-fc: don't hold rport lock when putting ctrl
nvme-fabrics: add ENOKEY to no retry criteria for authentication failures
MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
scsi: scsi_debug: Fix atomic write enable module param description
block: rnbd-clt: Fix signedness bug in init_dev()
vhost/vsock: improve RCU read sections around vhost_vsock_get()
cifs: Fix memory and information leak in smb3_reconfigure()
KEYS: trusted: Fix a memory leak in tpm2_load_cmd
io_uring: fix filename leak in __io_openat_prep()
x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems
mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
s390/dasd: Fix gendisk parent after copy pair swap
wifi: mt76: Fix DTS power-limits on little endian systems
block: rate-limit capacity change info log
floppy: fix for PAGE_SIZE != 4KB
kallsyms: Fix wrong "big" kernel symbol type read from procfs
fs/ntfs3: fix mount failure for sparse runs in run_unpack()
ktest.pl: Fix uninitialized var in config-bisect.pl
tpm: Cap the number of PCR banks
ext4: fix string copying in parse_apply_sb_mount_options()
ext4: xattr: fix null pointer deref in ext4_raw_inode()
ext4: clear i_state_flags when alloc inode
ext4: fix incorrect group number assertion in mb_check_buddy
ext4: align max orphan file size with e2fsprogs limit
jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
jbd2: use a weaker annotation in journal handling
media: v4l2-mem2mem: Fix outdated documentation
selftests: mptcp: pm: ensure unknown flags are ignored
mptcp: schedule rtx timer only after pushing data
mptcp: avoid deadlock on fallback while reinjecting
usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
media: pvrusb2: Fix incorrect variable used in trace message
phy: broadcom: bcm63xx-usbh: fix section mismatches
usb: ohci-nxp: fix device leak on probe failure
usb: typec: altmodes/displayport: Drop the device reference in
dp_altmode_probe()
USB: lpc32xx_udc: Fix error handling in probe
usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
usb: phy: isp1301: fix non-OF device reference imbalance
usb: gadget: lpc32xx_udc: fix clock imbalance in error path
usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
usb: dwc3: keep susphy enabled during exit to avoid controller faults
usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
char: applicom: fix NULL pointer dereference in ac_ioctl
intel_th: Fix error handling in intel_th_output_open
mei: gsc: add dependency on Xe driver
serial: sh-sci: Check that the DMA cookie is valid
cpuidle: governors: teo: Drop misguided target residency check
cpufreq: nforce2: fix reference count leak in nforce2
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
scsi: aic94xx: fix use-after-free in device removal path
NFSD: use correct reservation type in nfsd4_scsi_fence_client
scsi: target: Reset t_task_cdb pointer in error case
scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow
scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
f2fs: ensure node page reads complete before f2fs_put_super() finishes
f2fs: fix to avoid potential deadlock
f2fs: fix to avoid updating zero-sized extent in extent cache
f2fs: invalidate dentry cache on failed whiteout creation
f2fs: fix age extent cache insertion skip on counter overflow
f2fs: fix uninitialized one_time_gc in victim_sel_policy
f2fs: fix return value of f2fs_recover_fsync_data()
tools/testing/nvdimm: Use per-DIMM device handle
KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
media: vidtv: initialize local pointers upon transfer of memory ownership
ocfs2: fix kernel BUG in ocfs2_find_victim_chain
KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI)
platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
scs: fix a wrong parameter in __scs_magic
parisc: Do not reprogram affinitiy on ASP chip
libceph: make decode_pool() more resilient against corrupted osdmaps
powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf()
KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0
KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()
KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit
KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN)
KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits
xfs: fix a memory leak in xfs_buf_item_init()
xfs: fix stupid compiler warning
xfs: fix a UAF problem in xattr repair
tracing: Do not register unsupported perf events
PM: runtime: Do not clear needs_force_resume with enabled runtime PM
r8169: fix RTL8117 Wake-on-Lan in DASH mode
net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write
fsnotify: do not generate ACCESS/MODIFY events on child for special files
net/handshake: restore destructor on submit failure
NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
NFSD: NFSv4 file creation neglects setting ACL
nfsd: Mark variable __maybe_unused to avoid W=1 build break
svcrdma: return 0 on success from svc_rdma_copy_inline_range
svcrdma: use rc_pageoff for memcpy byte offset
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
gss_read_proxy_verf
powerpc/kexec: Enable SMT before waking offline CPUs
btrfs: don't log conflicting inode if it's a dir moved in the current
transaction
s390/ipl: Clear SBP flag when bootprog is set
gpio: regmap: Fix memleak in error path in gpio_regmap_register()
io_uring/poll: correctly handle io_poll_add() return value on update
io_uring: fix min_wait wakeups for SQPOLL
drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
drm/amd/display: Fix scratch registers offsets for DCN35
drm/amd/display: Fix scratch registers offsets for DCN351
drm/displayid: pass iter to drm_find_displayid_extension()
ALSA: wavefront: Use guard() for spin locks
pinctrl: renesas: rzg2l: Fix ISEL restore on resume
arm64: Revamp HCR_EL2.E2H RES1 detection
dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and
resets
dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and
resets
dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and
resets
dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and
resets
dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and
resets
dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and
resets
dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and
resets
crypto: af_alg - zero initialize memory allocated via sock_kmalloc
crypto: caam - Add check for kcalloc() in test_len()
amba: tegra-ahb: Fix device leak on SMMU enable
virtio: vdpa: Fix reference count leak in octep_sriov_enable()
tracing: Fix fixed array of synthetic event
soc: samsung: exynos-pmu: fix device leak on regmap lookup
soc: qcom: pbs: fix device leak on lookup
soc: qcom: ocmem: fix device leak on lookup
soc: apple: mailbox: fix device leak on lookup
soc: amlogic: canvas: fix device leak on lookup
rpmsg: glink: fix rpmsg device leak
platform/x86: intel: chtwc_int33fe: don't dereference swnode args
i2c: amd-mp2: fix reference leak in MP2 PCI device
interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes
hwmon: (max16065) Use local variable to avoid TOCTOU
hwmon: (max6697) fix regmap leak on probe failure
hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
x86/msi: Make irq_retrigger() functional for posted MSI
iommu/mediatek: fix use-after-free on probe deferral
fuse: fix readahead reclaim deadlock
wifi: rtw88: limit indirect IO under powered off for RTL8822CS
wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
wifi: mac80211: do not use old MBSSID elements
i40e: fix scheduling in set_rx_mode
i40e: validate ring_len parameter against hardware-specific values
iavf: fix off-by-one issues in iavf_config_rss_reg()
idpf: reduce mbx_task schedule delay to 300us
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
Bluetooth: btusb: revert use of devm_kzalloc in btusb
net: mdio: aspeed: add dummy read to avoid read-after-write issue
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
ip6_gre: make ip6gre_header() robust
platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names
platform/x86: msi-laptop: add missing sysfs_remove_group()
platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
team: fix check for port enabled in team_queue_override_port_prio_changed()
net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
amd-xgbe: reset retries and mode on RX adapt failures
net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
Revert "UBUNTU: SAUCE: selftests: net: fix "buffer overflow detected" for tap.c"
selftests: net: fix "buffer overflow detected" for tap.c
smc91x: fix broken irq-context in PREEMPT_RT
genalloc.h: fix htmldocs warning
firewire: nosy: Fix dma_free_coherent() size
net: dsa: b53: skip multicast entries for fdb_dump()
kbuild: fix compilation of dtb specified on command-line without make rule
net: usb: asix: validate PHY address before use
net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
net: stmmac: fix the crash issue for zero copy XDP_TX action
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
ipv4: Fix reference count leak when using error routes with nexthop objects
net: rose: fix invalid array index in rose_kill_by_device()
ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
RDMA/irdma: avoid invalid read in irdma_net_event
RDMA/efa: Remove possible negative shift
RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
RDMA/bnxt_re: Fix to use correct page size for PDE table
md: Fix static checker warning in analyze_sbs
md/raid5: fix possible null-pointer dereferences in
raid5_store_group_thread_cnt()
ksmbd: Fix memory leak in get_file_all_info()
RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
RDMA/bnxt_re: fix dma_free_coherent() pointer
blk-mq: skip CPU offline notify on unmapped hctx
selftests/ftrace: traceonoff_triggers: strip off names
ntfs: Do not overwrite uptodate pages
ASoC: codecs: wcd939x: fix regmap leak on probe failure
ASoC: stm32: sai: fix device leak on probe
ASoC: stm32: sai: fix clk prepare imbalance on probe failure
ASoC: stm32: sai: fix OF node leak on probe
ASoC: codecs: lpass-tx-macro: fix SM6115 support
ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr
ASoC: qcom: q6asm-dai: perform correct state check before closing
ASoC: qcom: q6adm: the the copp device only during last instance
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
iommu/amd: Propagate the error code returned by __modify_irte_ga() in
modify_irte_ga()
iommu/apple-dart: fix device leak on of_xlate()
iommu/exynos: fix device leak on of_xlate()
iommu/ipmmu-vmsa: fix device leak on of_xlate()
iommu/mediatek-v1: fix device leak on probe_device()
iommu/mediatek-v1: fix device leaks on probe()
iommu/mediatek: fix device leak on of_xlate()
iommu/omap: fix device leaks on probe_device()
iommu/qcom: fix device leak on of_xlate()
iommu/sun50i: fix device leak on of_xlate()
iommu/tegra: fix device leak on probe_device()
iommu: disable SVA when CONFIG_X86 is set
HID: logitech-dj: Remove duplicate error logging
fgraph: Initialize ftrace_ops->private for function graph ops
fgraph: Check ftrace_pids_enabled on registration for early filtering
PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator
powerpc, mm: Fix mprotect on book3s 32-bit
powerpc/64s/slb: Fix SLB multihit issue during SLB preload
leds: leds-cros_ec: Skip LEDs without color components
leds: leds-lp50xx: Allow LED 0 to be added to module bank
leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
leds: leds-lp50xx: Enable chip before any communication
block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
clk: samsung: exynos-clkout: Assign .num before accessing .hws
mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
mfd: max77620: Fix potential IRQ chip conflict when probing two devices
media: rc: st_rc: Fix reset control resource leak
media: verisilicon: Fix CPU stalls on G2 bus error
mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
powerpc/pseries/cmm: call balloon_devinfo_init() also without
CONFIG_BALLOON_COMPACTION
media: adv7842: Avoid possible out-of-bounds array accesses in
adv7842_cp_log_status()
firmware: stratix10-svc: Add mutex in stratix10 memory management
dm-ebs: Mark full buffer dirty even on partial write
dm-bufio: align write boundary on physical block size
fbdev: gbefb: fix to use physical address instead of dma address
fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
fbdev: tcx.c fix mem_map to correct smem_start offset
media: cec: Fix debugfs leak on bus_register() failure
media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
media: platform: mtk-mdp3: fix device leaks at probe
media: renesas: rcar_drif: fix device node reference leak in
rcar_drif_bond_enabled
media: samsung: exynos4-is: fix potential ABBA deadlock on init
media: TDA1997x: Remove redundant cancel_delayed_work in probe
media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
media: vpif_capture: fix section mismatch
media: vpif_display: fix section mismatch
media: amphion: Cancel message work before releasing the VPU core
media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
LoongArch: Add new PCI ID for pci_fixup_vgadev()
LoongArch: Correct the calculation logic of thread_count
LoongArch: Fix build errors for CONFIG_RANDSTRUCT
LoongArch: Use __pmd()/__pte() for swap entry conversions
LoongArch: Use unsigned long for _end and _text
mm/damon/tests/sysfs-kunit: handle alloc failures on
damon_sysfs_test_add_targets()
mm/damon/tests/vaddr-kunit: handle alloc failures in
damon_test_split_evenly_fail()
mm/damon/tests/vaddr-kunit: handle alloc failures on
damon_test_split_evenly_succ()
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
mm/damon/tests/core-kunit: handle memory alloc failure from
damon_test_aggregate()
mm/damon/tests/core-kunit: handle alloc failures on
dasmon_test_merge_regions_of()
mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()
mm/damon/tests/core-kunit: handle alloc failures in
damon_test_update_monitoring_result()
mm/damon/tests/core-kunit: handle alloc failures in
damon_test_ops_registration()
mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs()
pmdomain: imx: Fix reference count leak in imx_gpc_probe()
compiler_types.h: add "auto" as a macro for "__auto_type"
mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN
kasan: refactor pcpu kasan vmalloc unpoison
kasan: unpoison vms[area] addresses with a common tag
lockd: fix vfs_test_lock() calls
idr: fix idr_alloc() returning an ID out of range
mm/page_owner: fix memory leak in page_owner_stack_fops->release()
x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo
tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
samples/ftrace: Adjust LoongArch register restore order in direct calls
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
RDMA/cm: Fix leaking the multicast GID table reference
e1000: fix OOB in e1000_tbi_should_accept()
fjes: Add missing iounmap in fjes_hw_init()
LoongArch: Refactor register restoration in ftrace_common_return
LoongArch: BPF: Zero-extend bpf_tail_call() index
LoongArch: BPF: Sign extend kfunc call arguments
nfsd: Drop the client reference in client_states_open()
net: usb: sr9700: fix incorrect command used to write single register
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
macb_open()
drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
drm/buddy: Optimize free block management with RB tree
drm/buddy: Separate clear and dirty free block trees
drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
drm/mediatek: Fix probe resource leaks
drm/mediatek: Fix probe memory leak
drm/mediatek: Fix probe device leaks
drm/amdkfd: Trap handler support for expert scheduling mode
drm/i915: Fix format string truncation warning
drm/ttm: Avoid NULL pointer deref for evicted BOs
drm/mgag200: Fix big-endian support
drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
drm/xe/oa: Disallow 0 OA property values
drm/xe: Adjust long-running workload timeslices to reasonable values
drm/xe: Use usleep_range for accurate long-running workload timeslicing
drm/xe: Drop preempt-fences when destroying imported dma-bufs.
drm/msm/dpu: Add missing NULL pointer check for pingpong interface
drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
drm/imagination: Disallow exporting of PM/FW protected objects
lib/crypto: riscv/chacha: Avoid s0/fp register
gfs2: fix freeze error handling
btrfs: don't rewrite ret from inode_permission
sched/eevdf: Fix min_vruntime vs avg_vruntime
erofs: fix unexpected EIO under memory pressure
sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
jbd2: fix the inconsistency between checksum and data in memory for journal sb
xhci: dbgtty: fix device unregister: fixup
f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
f2fs: use global inline_xattr_slab instead of per-sb slab cache
f2fs: fix to avoid updating compression context during writeback
serial: core: Restore sysfs fwnode information
mptcp: pm: ignore unknown endpoint flags
mm/ksm: fix exec/fork inheritance support for prctl
svcrdma: bound check rq_pages index in inline path
ARM: dts: microchip: sama7g5: fix uart fifo size to 32
block: freeze queue when updating zone resources
tpm2-sessions: Fix tpm2_read_public range checks
sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq()
drm/displayid: add quirk to ignore DisplayID checksum errors
serial: xilinx_uartps: fix rs485 delay_rts_after_send
f2fs: add timeout in f2fs_enable_checkpoint()
f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
f2fs: fix to propagate error from f2fs_enable_checkpoint()
gpiolib: acpi: Add quirk for Dell Precision 7780
serial: core: Fix serial device initialization
x86/microcode/AMD: Select which microcode patch to load
media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
gve: defer interrupt enabling until NAPI registration
ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode
block: handle zone management operations completions
ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width
PCI: brcmstb: Fix disabling L0s capability
powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
media: mediatek: vcodec: Use spinlock for context list protection lock
media: amphion: Make some vpu_v4l2 functions static
media: amphion: Remove vpu_vb_is_codecconfig
vfio/pci: Disable qword access to the PCI ROM bar
mm/damon/tests/core-kunit: handle alloc failures on
damon_test_split_regions_of()
mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter()
mm/damon/tests/vaddr-kunit: handle alloc failures on
damon_do_test_apply_three_regions()
block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
bpf: Fix truncated dmabuf iterator reads
bpf: Fix verifier assumptions of bpf_d_path's output buffer
btrfs: fix changeset leak on mmap write after failure to reserve metadata
scripts: kdoc_parser.py: warn about Python version only once
crypto: ccp - Add support for PCI device 0x115A
hfsplus: fix volume corruption issue for generic/101
Bluetooth: btusb: add new custom firmwares
net/mlx5: make enable_mpesw idempotent
net: phy: realtek: eliminate priv->phycr2 variable
net: phy: realtek: eliminate has_phycr2 variable
net: phy: realtek: allow CLKOUT to be disabled on RTL8211F(D)(I)-VD-CG
net: phy: realtek: eliminate priv->phycr1 variable
net: phy: realtek: create rtl8211f_config_phy_eee() helper
net: phy: RTL8211FVD: Restore disabling of PHY-mode EEE
net: ti: icssg-prueth: add PTP_1588_CLOCK_OPTIONAL dependency
selftests: net: Fix build warnings
selftests: net: tfo: Fix build warning
inet: frags: avoid theoretical race in ip_frag_reinit()
inet: frags: add inet_frag_queue_flush()
inet: frags: flush pending skbs in fqdir_pre_exit()
selftests: netfilter: prefer xfail in case race wasn't triggered
can: j1939: make j1939_sk_bind() fail if device is no longer registered
net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
net/mlx5e: Trigger neighbor resolution for unresolved destinations
drm/tests: hdmi: Handle drm_kunit_helper_enable_crtc_connector() returning
EDEADLK
drm/tests: Handle EDEADLK in drm_test_check_valid_clones()
drm/tests: Handle EDEADLK in set_up_atomic_state()
selftests: ublk: fix overflow in ublk_queue_auto_zc_fallback()
block: unify elevator tags and type xarrays into struct elv_change_ctx
block: move elevator tags into struct elevator_resources
block: introduce alloc_sched_data and free_sched_data elevator methods
block: use {alloc|free}_sched data methods
block: fix race between wbt_enable_default and IO submission
spi: microchip: rename driver file and internal identifiers
UBUNTU: [Config] Remove CONFIG_SPI_MICROCHIP_CORE
spi: mpfs: Fix an error handling path in mpfs_spi_probe()
drm/xe: Fix freq kobject leak on sysfs_create_files failure
drm/xe: Apply Wa_14020316580 in xe_gt_idle_enable_pg()
drm/xe: Increase TDF timeout
drm/amdgpu: fix a job->pasid access race in gpu recovery
io_uring: fix nr_segs calculation in io_import_kbuf
ublk: add parameter `struct io_uring_cmd *` to ublk_prep_auto_buf_reg()
ublk: add `union ublk_io_buf` with improved naming
ublk: refactor auto buffer register in ublk_dispatch_req()
ublk: fix deadlock when reading partition table
drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME
amd/iommu: Preserve domain ids inside the kdump kernel
arm64: dts: mediatek: Apply mt8395-radxa DT overlay at build time
Input: apple_z2 - fix reading incorrect reports after exiting sleep
Input: xpad - add support for CRKD Guitars
platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in <trace/events/tlb.h>
ASoC: fsl_sai: Constrain sample rates from audio PLLs only in master mode
ASoC: SDCA: support Q7.8 volume format
ASoC: ops: fix snd_soc_get_volsw for sx controls
um: init cpu_tasks[] earlier
scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI
usb: xhci: Don't unchain link TRBs on quirky HCs
platform/x86: wmi-gamezone: Add Legion Go 2 Quirks
hwmon: (emc2305) fix device node refcount leak in error path
hwmon: (emc2305) fix double put in emc2305_probe_childs_from_dt
drm/msm/a6xx: move preempt_prepare_postamble after error check
ublk: add helpers to check ublk_device flags
ublk: clean up user copy references on ublk server exit
rust/drm/gem: Fix missing header in `Object` rustdoc
rust: dma: add helpers for architectures without CONFIG_HAS_DMA
samples: rust: fix endianness issue in rust_driver_pci
rust: io: define ResourceSize as resource_size_t
rust: io: move ResourceSize to top-level io module
rust: io: add typedef for phys_addr_t
clk: keystone: syscon-clk: fix regmap leak on probe failure
printk: Avoid scheduling irq_work on suspend
sched_ext: Fix the memleak for sch->helper objects
sched_ext: Fix bypass depth leak on scx_enable() failure
dt-bindings: clock: mmcc-sdm660: Add missing MDSS reset
phy: exynos5-usbdrd: fix clock prepare imbalance
efi: Add missing static initializer for efi_mm::cpus_allowed_lock
crypto: scatterwalk - Fix memcpy_sglist() to always succeed
printk: Allow printk_trigger_flush() to flush all types
printk: Avoid irq_work for printk_deferred() on suspend
block: Remove queue freezing from several sysfs store callbacks
mm/huge_memory: add pmd folio to ds_queue in do_huge_zero_wp_pmd()
tpm2-sessions: Fix out of range indexing in name_size
crash: let architecture decide crash memory export to iomem_resource
usb: typec: ucsi: huawei-gaokin: add DRM dependency
f2fs: clean up w/ get_left_section_blocks()
f2fs: fix to not account invalid blocks in get_left_section_blocks()
media: iris: Add sanity check for stop streaming
KVM: selftests: Forcefully override ARCH from x86_64 to x86
KVM: Fix last_boosted_vcpu index assignment bug
KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the
TDX-Module
KVM: x86: Apply runtime updates to current CPUID during KVM_SET_CPUID{,2}
KVM: selftests: Add missing "break" in rseq_test's param parsing
xfs: fix the zoned RT growfs check for zone alignment
xfs: validate that zoned RT devices are zone aligned
arm64/gcs: Flush the GCS locking state on exec
ALSA: hda/realtek: Add Asus quirk for TAS amplifiers
NFSD: Clear TIME_DELEG in the suppattr_exclcreat bitmap
cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated
gpio: loongson: Switch 2K2000/3000 GPIO to BYTE_CTRL_MODE
crypto: arm64/ghash - Fix incorrect output from ghash-neon
zloop: fail zone append operations that are targeting full zones
zloop: make the write pointer of full zones invalid
vfio: Fix ksize arg while copying user struct in vfio_df_ioctl_bind_iommufd()
rtla/timerlat_bpf: Stop tracing on user latency
pwm: rzg2l-gpt: Allow checking period_tick cache value only if sibling channel
is enabled
lib/crypto: riscv: Depend on RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS
UBUNTU: [Config] Disable accelerated crypto for riscv64 by default
io_uring/rsrc: fix lost entries after cloned range
ARM: dts: microchip: sama7d65: fix uart fifo size to 32
fuse: fix io-uring list corruption for terminated non-committed requests
fuse: missing copy_finish in fuse-over-io-uring argument copies
ice: add missing ice_deinit_hw() in devlink reinit path
arp: do not assume dev_hard_header() does not change skb->head
firmware: imx: scu-irq: Set mu_resource_id before get handle
keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
intel_th: fix device leak on output open()
UBUNTU: Upstream stable to v6.18.2, v6.12.64, v6.18.3
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Questing)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Questing)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Questing)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Questing)
Status: New => In Progress
** Changed in: linux (Ubuntu Questing)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-02-19
+
+ Ported from the following upstream stable releases:
+ v6.18.2, v6.12.64, v6.18.3
+
from git://git.kernel.org/
+
+ bpf: Fix sleepable context for async callbacks
+ bpf: extract generic helper from process_timer_func()
+ bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq
+ irqchip: Drop leftover brackets
+ irqchip: Pass platform device to platform drivers
+ bpf: Do not let BPF test infra emit invalid GSO types to stack
+ arm64: dts: exynos: gs101: fix clock module unit reg sizes
+ ice: move service task start out of ice_init_pf()
+ ice: move ice_init_interrupt_scheme() prior ice_init_pf()
+ ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure
+ ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf()
+ ice: move ice_init_pf() out of ice_init_dev()
+ ice: extract ice_init_dev() from ice_init()
+ ice: move ice_deinit_dev() to the end of deinit paths
+ ice: remove duplicate call to ice_deinit_hw() on error paths
+ arm64: dts: qcom: lemans: Add missing quirk for HS only USB controller
+ tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions
+ arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration
+ wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create()
+ ARM: dts: am33xx: Add missing serial console speed
+ arm64: tegra: Add pinctrl definitions for pcie-ep nodes
+ md: init bioset in mddev_init
+ fs/ntfs3: Initialize allocated memory before use
+ scsi: qla2xxx: Clear cmds after chip reset
+ arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors
+ pwm: Simplify printf to emit chip->npwm in $debugfs/pwm
+ pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id
+ soc/tegra: fuse: speedo-tegra210: Update speedo IDs
+ iio: core: add missing mutex_destroy in iio_dev_release()
+ iio: core: Clean up device correctly on iio_device_alloc() failure
+ iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD
+ of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr()
+ of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range()
+ rtla/tests: Extend action tests to 5s
+ rtla: Fix -a overriding -t argument
+ btrfs: make sure extent and csum paths are always released in
scrub_raid56_parity_stripe()
+ iomap: allocate s_dio_done_wq for async reads as well
+ RDMA/irdma: Remove doorbell elision logic
+ selftests/landlock: Fix makefile header list
+ net: vxlan: prevent NULL deref in vxlan_xmit_one
+ landlock: Fix handling of disconnected directories
+ exfat: fix refcount leak in exfat_find
+ io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
+ ALSA: wavefront: Clear substream pointers on close
+ btrfs: do not skip logging new dentries when logging a new name
+ btrfs: fix a potential path leak in print_data_reloc_error()
+ bpf, arm64: Do not audit capability check in do_jit()
+ btrfs: fix memory leak of fs_devices in degraded seed device path
+ shmem: fix recovery on rename failures
+ iomap: adjust read range correctly for non-block-aligned positions
+ iomap: account for unaligned end offsets when truncating read range
+ scripts/faddr2line: Fix "Argument list too long" error
+ perf/x86/amd: Check event before enable to avoid GPF
+ sched/deadline: only set free_cpus for online runqueues
+ sched/fair: Revert max_newidle_lb_cost bump
+ x86/ptrace: Always inline trivial accessors
+ ACPICA: Avoid walking the Namespace if start_node is NULL
+ ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only
+ cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
+ ACPI: fan: Workaround for 64-bit firmware bug
+ cpufreq: s5pv210: fix refcount leak
+ cpuidle: menu: Use residency threshold in polling state override decisions
+ livepatch: Match old_sympos 0 and 1 in klp_find_func()
+ fs/ntfs3: Support timestamps prior to epoch
+ kbuild: Use objtree for module signing key path
+ ntfs: set dummy blocksize to read boot_block when mounting
+ hfsplus: fix volume corruption issue for generic/070
+ hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
+ hfsplus: Verify inode mode when loading from disk
+ hfsplus: fix volume corruption issue for generic/073
+ fs/ntfs3: check for shutdown in fsync
+ wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
+ wifi: cfg80211: stop radar detection in cfg80211_leave()
+ wifi: cfg80211: use cfg80211_leave() in iftype change
+ wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load
+ wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
+ btrfs: scrub: always update btrfs_scrub_progress::last_physical
+ gfs2: fix remote evict for read-only filesystems
+ gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
+ smb/server: fix return value of smb2_ioctl()
+ ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
+ ksmbd: vfs: fix race on m_flags in vfs_cache
+ Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
+ Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
+ Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
+ Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
+ Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
+ net: fec: ERR007885 Workaround for XDP TX path
+ netrom: Fix memory leak in nr_sendmsg()
+ net/sched: ets: Always remove class from active list before deleting in
ets_qdisc_change
+ ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
+ mlxsw: spectrum_router: Fix possible neighbour reference count leak
+ mlxsw: spectrum_router: Fix neighbour use-after-free
+ mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
+ bnxt_en: Fix XDP_TX path
+ net: openvswitch: fix middle attribute validation in push_nsh() action
+ broadcom: b44: prevent uninitialized value usage
+ netfilter: nf_conncount: fix leaked ct in error paths
+ ipvs: fix ipv4 null-ptr-deref in route error path
+ caif: fix integer underflow in cffrml_receive()
+ net/sched: ets: Remove drr class from the active list if it changes to strict
+ nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
+ netfilter: nf_nat: remove bogus direction check
+ netfilter: nf_tables: remove redundant chain validation on register store
+ selftests: netfilter: packetdrill: avoid failure on HZ=100 kernel
+ iommufd/selftest: Make it clearer to gcc that the access is not out of bounds
+ iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED
+ ethtool: Avoid overflowing userspace buffer on stats query
+ net/mlx5: fw reset, clear reset requested on drain_fw_reset
+ net/mlx5: Drain firmware reset in shutdown callback
+ net/mlx5: fw_tracer, Validate format string parameters
+ net/mlx5: fw_tracer, Handle escaped percent properly
+ net/mlx5: Serialize firmware reset with devlink
+ net/handshake: duplicate handshake cancellations leak socket
+ net: enetc: do not transmit redirected XDP frames when the link is down
+ net: hns3: using the num_tqps in the vf driver to apply for resources
+ net: hns3: using the num_tqps to check whether tqp_index is out of range when
vf get ring info from mbx
+ net: hns3: add VLAN id validation before using
+ hwmon: (dell-smm) Limit fan multiplier to avoid overflow
+ hwmon: (ibmpex) fix use-after-free in high/low store
+ hwmon: (tmp401) fix overflow caused by default conversion rate value
+ drm/me/gsc: mei interrupt top half should be in irq disabled context
+ drm/xe: Restore engine registers before restarting schedulers after GT reset
+ MIPS: Fix a reference leak bug in ip22_check_gio()
+ drm/panel: sony-td4353-jdi: Enable prepare_prev_first
+ x86/xen: Fix sparse warning in enlighten_pv.c
+ arm64: kdump: Fix elfcorehdr overlap caused by reserved memory processing
reorder
+ spi: cadence-quadspi: Fix clock disable on probe failure path
+ block: rnbd-clt: Fix leaked ID in init_dev()
+ drm/xe: Limit num_syncs to prevent oversized allocations
+ drm/xe/oa: Limit num_syncs to prevent oversized allocations
+ hwmon: (ltc4282): Fix reset_history file permissions
+ ksmbd: skip lock-range check on equal size to avoid size==0 underflow
+ ksmbd: Fix refcount leak when invalid session is found on session lookup
+ ksmbd: fix buffer validation by including null terminator size in EA length
+ HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
+ Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
+ Input: lkkbd - disable pending work before freeing device
+ Input: alps - fix use-after-free bugs caused by dev3_register_work
+ Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
+ xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails
+ can: gs_usb: gs_can_open(): fix error handling
+ soc/tegra: fuse: Do not register SoC device on ACPI boot
+ ACPI: PCC: Fix race condition by removing static qualifier
+ ACPI: CPPC: Fix missing PCC check for guaranteed_perf
+ spi: fsl-cpm: Check length parity before switching to 16 bit mode
+ mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig
+ mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
+ dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
+ net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
+ x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures
+ ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
+ ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
+ ALSA: usb-mixer: us16x08: validate meter packet indices
+ ASoC: ak4458: remove the reset operation in probe and remove
+ nfsd: fix memory leak in nfsd_create_serv error paths
+ ipmi: Fix the race between __scan_channels() and deliver_response()
+ ipmi: Fix __scan_channels() failing to rescan channels
+ scsi: ufs: host: mediatek: Fix shutdown/suspend race condition
+ firmware: imx: scu-irq: Init workqueue before request mbox channel
+ ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
+ scsi: smartpqi: Add support for Hurray Data new controller PCI device
+ clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
+ powerpc/addnote: Fix overflow on 32-bit builds
+ scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
+ scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
+ scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
+ fuse: Always flush the page cache before FOPEN_DIRECT_IO write
+ fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
+ via_wdt: fix critical boot hang due to unnamed resource allocation
+ reset: fix BIT macro reference
+ exfat: fix remount failure in different process environments
+ exfat: zero out post-EOF page cache on file extension
+ usbip: Fix locking bug in RT-enabled kernels
+ usb: typec: ucsi: Handle incorrect num_connectors capability
+ iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains
+ usb: xhci: limit run_graceperiod for only usb 3.0 devices
+ usb: usb-storage: No additional quirks need to be added to the EL-R12 optical
drive.
+ serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
+ libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
+ clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src
+ i2c: designware: Disable SMBus interrupts to prevent storms from
mis-configured firmware
+ nvme-fc: don't hold rport lock when putting ctrl
+ nvme-fabrics: add ENOKEY to no retry criteria for authentication failures
+ MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
+ scsi: scsi_debug: Fix atomic write enable module param description
+ block: rnbd-clt: Fix signedness bug in init_dev()
+ vhost/vsock: improve RCU read sections around vhost_vsock_get()
+ cifs: Fix memory and information leak in smb3_reconfigure()
+ KEYS: trusted: Fix a memory leak in tpm2_load_cmd
+ io_uring: fix filename leak in __io_openat_prep()
+ x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems
+ mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
+ perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
+ lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
+ s390/dasd: Fix gendisk parent after copy pair swap
+ wifi: mt76: Fix DTS power-limits on little endian systems
+ block: rate-limit capacity change info log
+ floppy: fix for PAGE_SIZE != 4KB
+ kallsyms: Fix wrong "big" kernel symbol type read from procfs
+ fs/ntfs3: fix mount failure for sparse runs in run_unpack()
+ ktest.pl: Fix uninitialized var in config-bisect.pl
+ tpm: Cap the number of PCR banks
+ ext4: fix string copying in parse_apply_sb_mount_options()
+ ext4: xattr: fix null pointer deref in ext4_raw_inode()
+ ext4: clear i_state_flags when alloc inode
+ ext4: fix incorrect group number assertion in mb_check_buddy
+ ext4: align max orphan file size with e2fsprogs limit
+ jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
+ jbd2: use a weaker annotation in journal handling
+ media: v4l2-mem2mem: Fix outdated documentation
+ selftests: mptcp: pm: ensure unknown flags are ignored
+ mptcp: schedule rtx timer only after pushing data
+ mptcp: avoid deadlock on fallback while reinjecting
+ usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
+ media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
+ media: pvrusb2: Fix incorrect variable used in trace message
+ phy: broadcom: bcm63xx-usbh: fix section mismatches
+ usb: ohci-nxp: fix device leak on probe failure
+ usb: typec: altmodes/displayport: Drop the device reference in
dp_altmode_probe()
+ USB: lpc32xx_udc: Fix error handling in probe
+ usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
+ usb: phy: isp1301: fix non-OF device reference imbalance
+ usb: gadget: lpc32xx_udc: fix clock imbalance in error path
+ usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
+ usb: dwc3: keep susphy enabled during exit to avoid controller faults
+ usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
+ char: applicom: fix NULL pointer dereference in ac_ioctl
+ intel_th: Fix error handling in intel_th_output_open
+ mei: gsc: add dependency on Xe driver
+ serial: sh-sci: Check that the DMA cookie is valid
+ cpuidle: governors: teo: Drop misguided target residency check
+ cpufreq: nforce2: fix reference count leak in nforce2
+ scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort
path"
+ scsi: aic94xx: fix use-after-free in device removal path
+ NFSD: use correct reservation type in nfsd4_scsi_fence_client
+ scsi: target: Reset t_task_cdb pointer in error case
+ scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow
+ scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
+ f2fs: ensure node page reads complete before f2fs_put_super() finishes
+ f2fs: fix to avoid potential deadlock
+ f2fs: fix to avoid updating zero-sized extent in extent cache
+ f2fs: invalidate dentry cache on failed whiteout creation
+ f2fs: fix age extent cache insertion skip on counter overflow
+ f2fs: fix uninitialized one_time_gc in victim_sel_policy
+ f2fs: fix return value of f2fs_recover_fsync_data()
+ tools/testing/nvdimm: Use per-DIMM device handle
+ KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
+ media: vidtv: initialize local pointers upon transfer of memory ownership
+ ocfs2: fix kernel BUG in ocfs2_find_victim_chain
+ KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI)
+ platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
+ scs: fix a wrong parameter in __scs_magic
+ parisc: Do not reprogram affinitiy on ASP chip
+ libceph: make decode_pool() more resilient against corrupted osdmaps
+ powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf()
+ KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0
+ KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()
+ KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
+ KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
+ KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
+ KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
+ KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
+ KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit
+ KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed
VMRUN)
+ KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits
+ xfs: fix a memory leak in xfs_buf_item_init()
+ xfs: fix stupid compiler warning
+ xfs: fix a UAF problem in xattr repair
+ tracing: Do not register unsupported perf events
+ PM: runtime: Do not clear needs_force_resume with enabled runtime PM
+ r8169: fix RTL8117 Wake-on-Lan in DASH mode
+ net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write
+ fsnotify: do not generate ACCESS/MODIFY events on child for special files
+ net/handshake: restore destructor on submit failure
+ NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
+ NFSD: NFSv4 file creation neglects setting ACL
+ nfsd: Mark variable __maybe_unused to avoid W=1 build break
+ svcrdma: return 0 on success from svc_rdma_copy_inline_range
+ svcrdma: use rc_pageoff for memcpy byte offset
+ SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
gss_read_proxy_verf
+ powerpc/kexec: Enable SMT before waking offline CPUs
+ btrfs: don't log conflicting inode if it's a dir moved in the current
transaction
+ s390/ipl: Clear SBP flag when bootprog is set
+ gpio: regmap: Fix memleak in error path in gpio_regmap_register()
+ io_uring/poll: correctly handle io_poll_add() return value on update
+ io_uring: fix min_wait wakeups for SQPOLL
+ drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
+ drm/amd/display: Fix scratch registers offsets for DCN35
+ drm/amd/display: Fix scratch registers offsets for DCN351
+ drm/displayid: pass iter to drm_find_displayid_extension()
+ ALSA: wavefront: Use guard() for spin locks
+ pinctrl: renesas: rzg2l: Fix ISEL restore on resume
+ arm64: Revamp HCR_EL2.E2H RES1 detection
+ dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and
resets
+ dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and
resets
+ dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and
resets
+ dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and
resets
+ dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and
resets
+ dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and
resets
+ dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and
resets
+ crypto: af_alg - zero initialize memory allocated via sock_kmalloc
+ crypto: caam - Add check for kcalloc() in test_len()
+ amba: tegra-ahb: Fix device leak on SMMU enable
+ virtio: vdpa: Fix reference count leak in octep_sriov_enable()
+ tracing: Fix fixed array of synthetic event
+ soc: samsung: exynos-pmu: fix device leak on regmap lookup
+ soc: qcom: pbs: fix device leak on lookup
+ soc: qcom: ocmem: fix device leak on lookup
+ soc: apple: mailbox: fix device leak on lookup
+ soc: amlogic: canvas: fix device leak on lookup
+ rpmsg: glink: fix rpmsg device leak
+ platform/x86: intel: chtwc_int33fe: don't dereference swnode args
+ i2c: amd-mp2: fix reference leak in MP2 PCI device
+ interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes
+ hwmon: (max16065) Use local variable to avoid TOCTOU
+ hwmon: (max6697) fix regmap leak on probe failure
+ hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
+ hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
+ ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
+ x86/msi: Make irq_retrigger() functional for posted MSI
+ iommu/mediatek: fix use-after-free on probe deferral
+ fuse: fix readahead reclaim deadlock
+ wifi: rtw88: limit indirect IO under powered off for RTL8822CS
+ wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
+ wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
+ wifi: mac80211: do not use old MBSSID elements
+ i40e: fix scheduling in set_rx_mode
+ i40e: validate ring_len parameter against hardware-specific values
+ iavf: fix off-by-one issues in iavf_config_rss_reg()
+ idpf: reduce mbx_task schedule delay to 300us
+ crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
+ Bluetooth: btusb: revert use of devm_kzalloc in btusb
+ net: mdio: aspeed: add dummy read to avoid read-after-write issue
+ net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
+ ip6_gre: make ip6gre_header() robust
+ platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names
+ platform/x86: msi-laptop: add missing sysfs_remove_group()
+ platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
+ team: fix check for port enabled in team_queue_override_port_prio_changed()
+ net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
+ amd-xgbe: reset retries and mode on RX adapt failures
+ net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
+ Revert "UBUNTU: SAUCE: selftests: net: fix "buffer overflow detected" for
tap.c"
+ selftests: net: fix "buffer overflow detected" for tap.c
+ smc91x: fix broken irq-context in PREEMPT_RT
+ genalloc.h: fix htmldocs warning
+ firewire: nosy: Fix dma_free_coherent() size
+ net: dsa: b53: skip multicast entries for fdb_dump()
+ kbuild: fix compilation of dtb specified on command-line without make rule
+ net: usb: asix: validate PHY address before use
+ net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
+ vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
+ platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package
parsing
+ octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
+ net: stmmac: fix the crash issue for zero copy XDP_TX action
+ ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
+ ipv4: Fix reference count leak when using error routes with nexthop objects
+ net: rose: fix invalid array index in rose_kill_by_device()
+ ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
+ RDMA/irdma: avoid invalid read in irdma_net_event
+ RDMA/efa: Remove possible negative shift
+ RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
+ RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
+ RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
+ RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
+ RDMA/bnxt_re: Fix to use correct page size for PDE table
+ md: Fix static checker warning in analyze_sbs
+ md/raid5: fix possible null-pointer dereferences in
raid5_store_group_thread_cnt()
+ ksmbd: Fix memory leak in get_file_all_info()
+ RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
+ RDMA/bnxt_re: fix dma_free_coherent() pointer
+ blk-mq: skip CPU offline notify on unmapped hctx
+ selftests/ftrace: traceonoff_triggers: strip off names
+ ntfs: Do not overwrite uptodate pages
+ ASoC: codecs: wcd939x: fix regmap leak on probe failure
+ ASoC: stm32: sai: fix device leak on probe
+ ASoC: stm32: sai: fix clk prepare imbalance on probe failure
+ ASoC: stm32: sai: fix OF node leak on probe
+ ASoC: codecs: lpass-tx-macro: fix SM6115 support
+ ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr
+ ASoC: qcom: q6asm-dai: perform correct state check before closing
+ ASoC: qcom: q6adm: the the copp device only during last instance
+ ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
+ iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
+ iommu/amd: Propagate the error code returned by __modify_irte_ga() in
modify_irte_ga()
+ iommu/apple-dart: fix device leak on of_xlate()
+ iommu/exynos: fix device leak on of_xlate()
+ iommu/ipmmu-vmsa: fix device leak on of_xlate()
+ iommu/mediatek-v1: fix device leak on probe_device()
+ iommu/mediatek-v1: fix device leaks on probe()
+ iommu/mediatek: fix device leak on of_xlate()
+ iommu/omap: fix device leaks on probe_device()
+ iommu/qcom: fix device leak on of_xlate()
+ iommu/sun50i: fix device leak on of_xlate()
+ iommu/tegra: fix device leak on probe_device()
+ iommu: disable SVA when CONFIG_X86 is set
+ HID: logitech-dj: Remove duplicate error logging
+ fgraph: Initialize ftrace_ops->private for function graph ops
+ fgraph: Check ftrace_pids_enabled on registration for early filtering
+ PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
+ arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator
+ powerpc, mm: Fix mprotect on book3s 32-bit
+ powerpc/64s/slb: Fix SLB multihit issue during SLB preload
+ leds: leds-cros_ec: Skip LEDs without color components
+ leds: leds-lp50xx: Allow LED 0 to be added to module bank
+ leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
+ leds: leds-lp50xx: Enable chip before any communication
+ block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
+ clk: samsung: exynos-clkout: Assign .num before accessing .hws
+ mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
+ mfd: max77620: Fix potential IRQ chip conflict when probing two devices
+ media: rc: st_rc: Fix reset control resource leak
+ media: verisilicon: Fix CPU stalls on G2 bus error
+ mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
+ mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
+ mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
+ mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
+ mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
+ mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
+ mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
+ parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
+ parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
+ perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on
error
+ powerpc/pseries/cmm: call balloon_devinfo_init() also without
CONFIG_BALLOON_COMPACTION
+ media: adv7842: Avoid possible out-of-bounds array accesses in
adv7842_cp_log_status()
+ firmware: stratix10-svc: Add mutex in stratix10 memory management
+ dm-ebs: Mark full buffer dirty even on partial write
+ dm-bufio: align write boundary on physical block size
+ fbdev: gbefb: fix to use physical address instead of dma address
+ fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
+ fbdev: tcx.c fix mem_map to correct smem_start offset
+ media: cec: Fix debugfs leak on bus_register() failure
+ media: msp3400: Avoid possible out-of-bounds array accesses in
msp3400c_thread()
+ media: platform: mtk-mdp3: fix device leaks at probe
+ media: renesas: rcar_drif: fix device node reference leak in
rcar_drif_bond_enabled
+ media: samsung: exynos4-is: fix potential ABBA deadlock on init
+ media: TDA1997x: Remove redundant cancel_delayed_work in probe
+ media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
+ media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
+ media: vpif_capture: fix section mismatch
+ media: vpif_display: fix section mismatch
+ media: amphion: Cancel message work before releasing the VPU core
+ media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
+ media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
+ media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
+ LoongArch: Add new PCI ID for pci_fixup_vgadev()
+ LoongArch: Correct the calculation logic of thread_count
+ LoongArch: Fix build errors for CONFIG_RANDSTRUCT
+ LoongArch: Use __pmd()/__pte() for swap entry conversions
+ LoongArch: Use unsigned long for _end and _text
+ mm/damon/tests/sysfs-kunit: handle alloc failures on
damon_sysfs_test_add_targets()
+ mm/damon/tests/vaddr-kunit: handle alloc failures in
damon_test_split_evenly_fail()
+ mm/damon/tests/vaddr-kunit: handle alloc failures on
damon_test_split_evenly_succ()
+ mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
+ mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
+ mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
+ mm/damon/tests/core-kunit: handle memory alloc failure from
damon_test_aggregate()
+ mm/damon/tests/core-kunit: handle alloc failures on
dasmon_test_merge_regions_of()
+ mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
+ mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()
+ mm/damon/tests/core-kunit: handle alloc failures in
damon_test_update_monitoring_result()
+ mm/damon/tests/core-kunit: handle alloc failures in
damon_test_ops_registration()
+ mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs()
+ pmdomain: imx: Fix reference count leak in imx_gpc_probe()
+ compiler_types.h: add "auto" as a macro for "__auto_type"
+ mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN
+ kasan: refactor pcpu kasan vmalloc unpoison
+ kasan: unpoison vms[area] addresses with a common tag
+ lockd: fix vfs_test_lock() calls
+ idr: fix idr_alloc() returning an ID out of range
+ mm/page_owner: fix memory leak in page_owner_stack_fops->release()
+ x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo
+ tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
+ samples/ftrace: Adjust LoongArch register restore order in direct calls
+ RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
+ RDMA/cm: Fix leaking the multicast GID table reference
+ e1000: fix OOB in e1000_tbi_should_accept()
+ fjes: Add missing iounmap in fjes_hw_init()
+ LoongArch: Refactor register restoration in ftrace_common_return
+ LoongArch: BPF: Zero-extend bpf_tail_call() index
+ LoongArch: BPF: Sign extend kfunc call arguments
+ nfsd: Drop the client reference in client_states_open()
+ net: usb: sr9700: fix incorrect command used to write single register
+ net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
+ net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
macb_open()
+ drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
+ drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
+ drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
+ drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
+ drm/buddy: Optimize free block management with RB tree
+ drm/buddy: Separate clear and dirty free block trees
+ drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
+ drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
+ drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
+ drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
+ drm/mediatek: Fix probe resource leaks
+ drm/mediatek: Fix probe memory leak
+ drm/mediatek: Fix probe device leaks
+ drm/amdkfd: Trap handler support for expert scheduling mode
+ drm/i915: Fix format string truncation warning
+ drm/ttm: Avoid NULL pointer deref for evicted BOs
+ drm/mgag200: Fix big-endian support
+ drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
+ drm/xe/oa: Disallow 0 OA property values
+ drm/xe: Adjust long-running workload timeslices to reasonable values
+ drm/xe: Use usleep_range for accurate long-running workload timeslicing
+ drm/xe: Drop preempt-fences when destroying imported dma-bufs.
+ drm/msm/dpu: Add missing NULL pointer check for pingpong interface
+ drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
+ drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
+ drm/imagination: Disallow exporting of PM/FW protected objects
+ lib/crypto: riscv/chacha: Avoid s0/fp register
+ gfs2: fix freeze error handling
+ btrfs: don't rewrite ret from inode_permission
+ sched/eevdf: Fix min_vruntime vs avg_vruntime
+ erofs: fix unexpected EIO under memory pressure
+ sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
+ jbd2: fix the inconsistency between checksum and data in memory for journal sb
+ xhci: dbgtty: fix device unregister: fixup
+ f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()
+ f2fs: use global inline_xattr_slab instead of per-sb slab cache
+ f2fs: fix to avoid updating compression context during writeback
+ serial: core: Restore sysfs fwnode information
+ mptcp: pm: ignore unknown endpoint flags
+ mm/ksm: fix exec/fork inheritance support for prctl
+ svcrdma: bound check rq_pages index in inline path
+ ARM: dts: microchip: sama7g5: fix uart fifo size to 32
+ block: freeze queue when updating zone resources
+ tpm2-sessions: Fix tpm2_read_public range checks
+ sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue()
+ sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq()
+ drm/displayid: add quirk to ignore DisplayID checksum errors
+ serial: xilinx_uartps: fix rs485 delay_rts_after_send
+ f2fs: add timeout in f2fs_enable_checkpoint()
+ f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
+ f2fs: fix to propagate error from f2fs_enable_checkpoint()
+ gpiolib: acpi: Add quirk for Dell Precision 7780
+ serial: core: Fix serial device initialization
+ x86/microcode/AMD: Select which microcode patch to load
+ media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
+ gve: defer interrupt enabling until NAPI registration
+ ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode
+ block: handle zone management operations completions
+ ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
+ ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width
+ PCI: brcmstb: Fix disabling L0s capability
+ powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
+ media: mediatek: vcodec: Use spinlock for context list protection lock
+ media: amphion: Make some vpu_v4l2 functions static
+ media: amphion: Remove vpu_vb_is_codecconfig
+ vfio/pci: Disable qword access to the PCI ROM bar
+ mm/damon/tests/core-kunit: handle alloc failures on
damon_test_split_regions_of()
+ mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter()
+ mm/damon/tests/vaddr-kunit: handle alloc failures on
damon_do_test_apply_three_regions()
+ block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
+ bpf: Fix truncated dmabuf iterator reads
+ bpf: Fix verifier assumptions of bpf_d_path's output buffer
+ btrfs: fix changeset leak on mmap write after failure to reserve metadata
+ scripts: kdoc_parser.py: warn about Python version only once
+ crypto: ccp - Add support for PCI device 0x115A
+ hfsplus: fix volume corruption issue for generic/101
+ Bluetooth: btusb: add new custom firmwares
+ net/mlx5: make enable_mpesw idempotent
+ net: phy: realtek: eliminate priv->phycr2 variable
+ net: phy: realtek: eliminate has_phycr2 variable
+ net: phy: realtek: allow CLKOUT to be disabled on RTL8211F(D)(I)-VD-CG
+ net: phy: realtek: eliminate priv->phycr1 variable
+ net: phy: realtek: create rtl8211f_config_phy_eee() helper
+ net: phy: RTL8211FVD: Restore disabling of PHY-mode EEE
+ net: ti: icssg-prueth: add PTP_1588_CLOCK_OPTIONAL dependency
+ selftests: net: Fix build warnings
+ selftests: net: tfo: Fix build warning
+ inet: frags: avoid theoretical race in ip_frag_reinit()
+ inet: frags: add inet_frag_queue_flush()
+ inet: frags: flush pending skbs in fqdir_pre_exit()
+ selftests: netfilter: prefer xfail in case race wasn't triggered
+ can: j1939: make j1939_sk_bind() fail if device is no longer registered
+ net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
+ net/mlx5e: Trigger neighbor resolution for unresolved destinations
+ drm/tests: hdmi: Handle drm_kunit_helper_enable_crtc_connector() returning
EDEADLK
+ drm/tests: Handle EDEADLK in drm_test_check_valid_clones()
+ drm/tests: Handle EDEADLK in set_up_atomic_state()
+ selftests: ublk: fix overflow in ublk_queue_auto_zc_fallback()
+ block: unify elevator tags and type xarrays into struct elv_change_ctx
+ block: move elevator tags into struct elevator_resources
+ block: introduce alloc_sched_data and free_sched_data elevator methods
+ block: use {alloc|free}_sched data methods
+ block: fix race between wbt_enable_default and IO submission
+ spi: microchip: rename driver file and internal identifiers
+ UBUNTU: [Config] Remove CONFIG_SPI_MICROCHIP_CORE
+ spi: mpfs: Fix an error handling path in mpfs_spi_probe()
+ drm/xe: Fix freq kobject leak on sysfs_create_files failure
+ drm/xe: Apply Wa_14020316580 in xe_gt_idle_enable_pg()
+ drm/xe: Increase TDF timeout
+ drm/amdgpu: fix a job->pasid access race in gpu recovery
+ io_uring: fix nr_segs calculation in io_import_kbuf
+ ublk: add parameter `struct io_uring_cmd *` to ublk_prep_auto_buf_reg()
+ ublk: add `union ublk_io_buf` with improved naming
+ ublk: refactor auto buffer register in ublk_dispatch_req()
+ ublk: fix deadlock when reading partition table
+ drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME
+ amd/iommu: Preserve domain ids inside the kdump kernel
+ arm64: dts: mediatek: Apply mt8395-radxa DT overlay at build time
+ Input: apple_z2 - fix reading incorrect reports after exiting sleep
+ Input: xpad - add support for CRKD Guitars
+ platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
+ x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in <trace/events/tlb.h>
+ ASoC: fsl_sai: Constrain sample rates from audio PLLs only in master mode
+ ASoC: SDCA: support Q7.8 volume format
+ ASoC: ops: fix snd_soc_get_volsw for sx controls
+ um: init cpu_tasks[] earlier
+ scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI
+ usb: xhci: Don't unchain link TRBs on quirky HCs
+ platform/x86: wmi-gamezone: Add Legion Go 2 Quirks
+ hwmon: (emc2305) fix device node refcount leak in error path
+ hwmon: (emc2305) fix double put in emc2305_probe_childs_from_dt
+ drm/msm/a6xx: move preempt_prepare_postamble after error check
+ ublk: add helpers to check ublk_device flags
+ ublk: clean up user copy references on ublk server exit
+ rust/drm/gem: Fix missing header in `Object` rustdoc
+ rust: dma: add helpers for architectures without CONFIG_HAS_DMA
+ samples: rust: fix endianness issue in rust_driver_pci
+ rust: io: define ResourceSize as resource_size_t
+ rust: io: move ResourceSize to top-level io module
+ rust: io: add typedef for phys_addr_t
+ clk: keystone: syscon-clk: fix regmap leak on probe failure
+ printk: Avoid scheduling irq_work on suspend
+ sched_ext: Fix the memleak for sch->helper objects
+ sched_ext: Fix bypass depth leak on scx_enable() failure
+ dt-bindings: clock: mmcc-sdm660: Add missing MDSS reset
+ phy: exynos5-usbdrd: fix clock prepare imbalance
+ efi: Add missing static initializer for efi_mm::cpus_allowed_lock
+ crypto: scatterwalk - Fix memcpy_sglist() to always succeed
+ printk: Allow printk_trigger_flush() to flush all types
+ printk: Avoid irq_work for printk_deferred() on suspend
+ block: Remove queue freezing from several sysfs store callbacks
+ mm/huge_memory: add pmd folio to ds_queue in do_huge_zero_wp_pmd()
+ tpm2-sessions: Fix out of range indexing in name_size
+ crash: let architecture decide crash memory export to iomem_resource
+ usb: typec: ucsi: huawei-gaokin: add DRM dependency
+ f2fs: clean up w/ get_left_section_blocks()
+ f2fs: fix to not account invalid blocks in get_left_section_blocks()
+ media: iris: Add sanity check for stop streaming
+ KVM: selftests: Forcefully override ARCH from x86_64 to x86
+ KVM: Fix last_boosted_vcpu index assignment bug
+ KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the
TDX-Module
+ KVM: x86: Apply runtime updates to current CPUID during KVM_SET_CPUID{,2}
+ KVM: selftests: Add missing "break" in rseq_test's param parsing
+ xfs: fix the zoned RT growfs check for zone alignment
+ xfs: validate that zoned RT devices are zone aligned
+ arm64/gcs: Flush the GCS locking state on exec
+ ALSA: hda/realtek: Add Asus quirk for TAS amplifiers
+ NFSD: Clear TIME_DELEG in the suppattr_exclcreat bitmap
+ cgroup: rstat: use LOCK CMPXCHG in css_rstat_updated
+ gpio: loongson: Switch 2K2000/3000 GPIO to BYTE_CTRL_MODE
+ crypto: arm64/ghash - Fix incorrect output from ghash-neon
+ zloop: fail zone append operations that are targeting full zones
+ zloop: make the write pointer of full zones invalid
+ vfio: Fix ksize arg while copying user struct in vfio_df_ioctl_bind_iommufd()
+ rtla/timerlat_bpf: Stop tracing on user latency
+ pwm: rzg2l-gpt: Allow checking period_tick cache value only if sibling
channel is enabled
+ lib/crypto: riscv: Depend on RISCV_EFFICIENT_VECTOR_UNALIGNED_ACCESS
+ UBUNTU: [Config] Disable accelerated crypto for riscv64 by default
+ io_uring/rsrc: fix lost entries after cloned range
+ ARM: dts: microchip: sama7d65: fix uart fifo size to 32
+ fuse: fix io-uring list corruption for terminated non-committed requests
+ fuse: missing copy_finish in fuse-over-io-uring argument copies
+ ice: add missing ice_deinit_hw() in devlink reinit path
+ arp: do not assume dev_hard_header() does not change skb->head
+ firmware: imx: scu-irq: Set mu_resource_id before get handle
+ keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
+ intel_th: fix device leak on output open()
+ UBUNTU: Upstream stable to v6.18.2, v6.12.64, v6.18.3
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2142250
Title:
Questing update: upstream stable patchset 2026-02-19
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2142250/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
