Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-12
Ported from the following upstream stable releases:
v6.6.140, v6.12.89, v6.12.90
from git://git.kernel.org/
regset: use kvzalloc() for regset_get_alloc()
selftests/bpf: validate fake register spill/fill precision backtracking logic
exit: Sleep at TASK_IDLE when waiting for application core dump
HID: playstation: Clamp num_touch_reports
media: uvcvideo: Enable VB2_DMABUF for metadata stream
media: i2c: ov8856: free control handler on error in ov8856_init_controls()
spi: bcm63xx: fix controller deregistration
spi: atmel: fix controller deregistration
staging: media: atomisp: Disallow all private IOCTLs
regulator: mt6357: fix OF node reference imbalance
regulator: max77650: fix OF node reference imbalance
media: rc: xbox_remote: heed DMA restrictions
media: rc: streamzap: Error handling in probe
regulator: rk808: fix OF node reference imbalance
media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
regulator: act8945a: fix OF node reference imbalance
regulator: bd9571mwv: fix OF node reference imbalance
spi: lantiq-ssc: fix controller deregistration
spi: qup: fix controller deregistration
spi: at91-usart: fix controller deregistration
media: saa7164: add ioremap return checks and cleanups
platform/x86: hp-wmi: Ignore backlight and FnLock events
media: pci: zoran: fix potential memory leak in zoran_probe()
media: dib8000: avoid division by 0 in dib8000_set_dds()
media: i2c: imx412: Assert reset GPIO during probe
media: staging: imx: request mbus_config in csi_start
media: i2c: ov08d10: fix image vertical start setting
media: omap3isp: drop the use count of v4l2 pipeline
spi: dln2: fix controller deregistration
spi: s3c64xx: fix controller deregistration
spi: fsl-espi: fix controller deregistration
spi: omap2-mcspi: fix controller deregistration
spi: mtk-nor: fix controller deregistration
spi: sh-hspi: fix controller deregistration
spi: fsl: fix controller deregistration
spi: bcmbca-hsspi: fix controller deregistration
spi: coldfire-qspi: fix controller deregistration
spi: sprd: fix controller deregistration
spi: rspi: fix controller deregistration
spi: img-spfi: fix controller deregistration
spi: imx: fix runtime pm leak on probe deferral
spi: orion: fix runtime pm leak on unbind
spi: orion: fix clock imbalance on registration failure
spi: mpc52xx: fix use-after-free on unbind
spi: cadence: fix controller deregistration
spi: cadence: fix unclocked access on unbind
drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
drm/amdkfd: Add upper bound check for num_of_nodes
drm/amdgpu: Add bounds checking to ib_{get,set}_value
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
drm/amdgpu/vce: Prevent partial address patches
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
drm/gem: Fix inconsistent plane dimension calculation in
drm_gem_fb_init_with_funcs()
drm/amdkfd: validate SVM ioctl nattr against buffer size
drm/radeon: add missing revision check for CI
drm/amdgpu: zero-initialize GART table on allocation
drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
drm/amdgpu/pm: add missing revision check for CI
drm/amdgpu/pm: align Hawaii mclk workaround with radeon
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
batman-adv: fix integer overflow on buff_pos
batman-adv: reject new tp_meter sessions during teardown
batman-adv: stop caching unowned originator pointers in BAT IV
batman-adv: bla: prevent use-after-free when deleting claims
batman-adv: bla: only purge non-released claims
batman-adv: bla: put backbone reference on failed claim hash insert
ipmi:ssif: Fix a shutdown race
ipmi:ssif: Clean up kthread on errors
erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
ALSA: hda: cs35l56: Propagate ASP TX source control errors
ALSA: misc: Use guard() for spin locks
ALSA: core: Serialize deferred fasync state checks
ALSA: seq: Notify client and port info changes
ALSA: seq: Fix UMP group 16 filtering
Bluetooth: hci_conn: fix potential UAF in create_big_sync
spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
spi: zynq-qspi: fix controller deregistration
spi: tegra114: fix controller deregistration
spi: tegra20-sflash: fix controller deregistration
spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
spi: uniphier: fix controller deregistration
mm/hugetlb_cma: round up per_node before logging it
fbcon: Avoid OOB font access if console rotation fails
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
bonding: fix use-after-free due to enslave fail after slave array update
mm/damon/core: disallow time-quota setting zero esz
mm/damon/core: implement damon_kdamond_pid()
mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
usb: typec: tcpm: reset internal port states on soft reset AMS
mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`
pwm: imx-tpm: Count the number of enabled channels in probe
batman-adv: stop tp_meter sessions during mesh teardown
batman-adv: tp_meter: fix tp_num leak on kmalloc failure
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
info-leak
tracing/probes: Limit size of event probe to 3K
usb: dwc3: Move GUID programming after PHY initialization
vsock: fix buffer size clamping order
vsock/virtio: fix accept queue count leak on transport mismatch
vsock/virtio: fix length and offset in tap skb for split packets
drm/amdgpu/vcn3: Avoid overflow on msg bound check
drm/amdgpu/vcn4: Avoid overflow on msg bound check
mtd: spi-nor: sst: Fix SST write failure
media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init()
media: chips-media: wave5: add missing spinlock protection for send_eos_event()
media: chips-media: wave5: add missing spinlock protection for
handle_dynamic_resolution_change()
spi: st-ssc4: fix controller deregistration
spi: meson-spicc: fix controller deregistration
spi: aspeed-smc: fix controller deregistration
vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy
spi: mxs: fix controller deregistration
spi: pic32: fix controller deregistration
spi: pl022: fix controller deregistration
spi: npcm-pspi: fix controller deregistration
spi: pic32-sqi: fix controller deregistration
spi: mxic: fix controller deregistration
spi: orion: fix controller deregistration
spi: mpc52xx: fix use-after-free on registration failure
spi: mpc52xx: fix controller deregistration
drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
drm/amdgpu: gate VM CPU HDP flush on reset lock
drm/amd/display: Change dither policy for 10 bpc output back to dithering
drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
drm/exynos: remove bridge when component_add fails
drm/amdkfd: Make all TLB-flushes heavy-weight
btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
btrfs: fix double free in create_space_info_sub_group() error path
vsock/virtio: fix empty payload in tap skb for non-linear buffers
UBUNTU: Upstream stable to v6.6.140, v6.12.89, v6.12.90
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-12
+
+ Ported from the following upstream stable releases:
+ v6.6.140, v6.12.89, v6.12.90
+
from git://git.kernel.org/
+
+ regset: use kvzalloc() for regset_get_alloc()
+ selftests/bpf: validate fake register spill/fill precision backtracking logic
+ exit: Sleep at TASK_IDLE when waiting for application core dump
+ HID: playstation: Clamp num_touch_reports
+ media: uvcvideo: Enable VB2_DMABUF for metadata stream
+ media: i2c: ov8856: free control handler on error in ov8856_init_controls()
+ spi: bcm63xx: fix controller deregistration
+ spi: atmel: fix controller deregistration
+ staging: media: atomisp: Disallow all private IOCTLs
+ regulator: mt6357: fix OF node reference imbalance
+ regulator: max77650: fix OF node reference imbalance
+ media: rc: xbox_remote: heed DMA restrictions
+ media: rc: streamzap: Error handling in probe
+ regulator: rk808: fix OF node reference imbalance
+ media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
+ regulator: act8945a: fix OF node reference imbalance
+ regulator: bd9571mwv: fix OF node reference imbalance
+ spi: lantiq-ssc: fix controller deregistration
+ spi: qup: fix controller deregistration
+ spi: at91-usart: fix controller deregistration
+ media: saa7164: add ioremap return checks and cleanups
+ platform/x86: hp-wmi: Ignore backlight and FnLock events
+ media: pci: zoran: fix potential memory leak in zoran_probe()
+ media: dib8000: avoid division by 0 in dib8000_set_dds()
+ media: i2c: imx412: Assert reset GPIO during probe
+ media: staging: imx: request mbus_config in csi_start
+ media: i2c: ov08d10: fix image vertical start setting
+ media: omap3isp: drop the use count of v4l2 pipeline
+ spi: dln2: fix controller deregistration
+ spi: s3c64xx: fix controller deregistration
+ spi: fsl-espi: fix controller deregistration
+ spi: omap2-mcspi: fix controller deregistration
+ spi: mtk-nor: fix controller deregistration
+ spi: sh-hspi: fix controller deregistration
+ spi: fsl: fix controller deregistration
+ spi: bcmbca-hsspi: fix controller deregistration
+ spi: coldfire-qspi: fix controller deregistration
+ spi: sprd: fix controller deregistration
+ spi: rspi: fix controller deregistration
+ spi: img-spfi: fix controller deregistration
+ spi: imx: fix runtime pm leak on probe deferral
+ spi: orion: fix runtime pm leak on unbind
+ spi: orion: fix clock imbalance on registration failure
+ spi: mpc52xx: fix use-after-free on unbind
+ spi: cadence: fix controller deregistration
+ spi: cadence: fix unclocked access on unbind
+ drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
+ drm/amdkfd: Add upper bound check for num_of_nodes
+ drm/amdgpu: Add bounds checking to ib_{get,set}_value
+ drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
+ drm/amdgpu/vce: Prevent partial address patches
+ drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
+ drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
+ drm/gem: Fix inconsistent plane dimension calculation in
drm_gem_fb_init_with_funcs()
+ drm/amdkfd: validate SVM ioctl nattr against buffer size
+ drm/radeon: add missing revision check for CI
+ drm/amdgpu: zero-initialize GART table on allocation
+ drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
+ drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
+ drm/amdgpu/pm: add missing revision check for CI
+ drm/amdgpu/pm: align Hawaii mclk workaround with radeon
+ sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
+ batman-adv: fix integer overflow on buff_pos
+ batman-adv: reject new tp_meter sessions during teardown
+ batman-adv: stop caching unowned originator pointers in BAT IV
+ batman-adv: bla: prevent use-after-free when deleting claims
+ batman-adv: bla: only purge non-released claims
+ batman-adv: bla: put backbone reference on failed claim hash insert
+ ipmi:ssif: Fix a shutdown race
+ ipmi:ssif: Clean up kthread on errors
+ erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
+ ALSA: hda: cs35l56: Propagate ASP TX source control errors
+ ALSA: misc: Use guard() for spin locks
+ ALSA: core: Serialize deferred fasync state checks
+ ALSA: seq: Notify client and port info changes
+ ALSA: seq: Fix UMP group 16 filtering
+ Bluetooth: hci_conn: fix potential UAF in create_big_sync
+ spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
+ spi: zynq-qspi: fix controller deregistration
+ spi: tegra114: fix controller deregistration
+ spi: tegra20-sflash: fix controller deregistration
+ spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
+ spi: uniphier: fix controller deregistration
+ mm/hugetlb_cma: round up per_node before logging it
+ fbcon: Avoid OOB font access if console rotation fails
+ Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
+ bonding: fix use-after-free due to enslave fail after slave array update
+ mm/damon/core: disallow time-quota setting zero esz
+ mm/damon/core: implement damon_kdamond_pid()
+ mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
+ usb: typec: tcpm: reset internal port states on soft reset AMS
+ mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
+ mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`
+ pwm: imx-tpm: Count the number of enabled channels in probe
+ batman-adv: stop tp_meter sessions during mesh teardown
+ batman-adv: tp_meter: fix tp_num leak on kmalloc failure
+ btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
info-leak
+ tracing/probes: Limit size of event probe to 3K
+ usb: dwc3: Move GUID programming after PHY initialization
+ vsock: fix buffer size clamping order
+ vsock/virtio: fix accept queue count leak on transport mismatch
+ vsock/virtio: fix length and offset in tap skb for split packets
+ drm/amdgpu/vcn3: Avoid overflow on msg bound check
+ drm/amdgpu/vcn4: Avoid overflow on msg bound check
+ mtd: spi-nor: sst: Fix SST write failure
+ media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
+ media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init()
+ media: chips-media: wave5: add missing spinlock protection for
send_eos_event()
+ media: chips-media: wave5: add missing spinlock protection for
handle_dynamic_resolution_change()
+ spi: st-ssc4: fix controller deregistration
+ spi: meson-spicc: fix controller deregistration
+ spi: aspeed-smc: fix controller deregistration
+ vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy
+ spi: mxs: fix controller deregistration
+ spi: pic32: fix controller deregistration
+ spi: pl022: fix controller deregistration
+ spi: npcm-pspi: fix controller deregistration
+ spi: pic32-sqi: fix controller deregistration
+ spi: mxic: fix controller deregistration
+ spi: orion: fix controller deregistration
+ spi: mpc52xx: fix use-after-free on registration failure
+ spi: mpc52xx: fix controller deregistration
+ drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
+ drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
+ drm/amdgpu: gate VM CPU HDP flush on reset lock
+ drm/amd/display: Change dither policy for 10 bpc output back to dithering
+ drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
+ drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
+ drm/exynos: remove bridge when component_add fails
+ drm/amdkfd: Make all TLB-flushes heavy-weight
+ btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
+ btrfs: fix double free in create_space_info_sub_group() error path
+ vsock/virtio: fix empty payload in tap skb for non-linear buffers
+ UBUNTU: Upstream stable to v6.6.140, v6.12.89, v6.12.90
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2156619
Title:
Noble update: upstream stable patchset 2026-06-12
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2156619/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
