** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Bethany Jamison (bjamison)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-08-21
+
+ Ported from the following upstream stable releases:
+ v6.6.143, v6.12.94
+
from git://git.kernel.org/
+
+ netfilter: bitwise: rename some boolean operation functions
+ netfilter: bitwise: add support for doing AND, OR and XOR directly
+ netfilter: nf_tables: fix dst corruption in same register operation
+ ksmbd: fix FSCTL permission bypass by adding a permission check for
FSCTL_SET_SPARSE
+ drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info
+ drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
+ arm64: io: Rename ioremap_prot() to __ioremap_prot()
+ arm64: io: Extract user memory type in ioremap_prot()
+ x86/kexec: add a sanity check on previous kernel's ima kexec buffer
+ soc/tegra: pmc: Fix unsafe generic_handle_irq() call
+ bpf: Free reuseport cBPF prog after RCU grace period.
+ USB: serial: mct_u232: fix memory corruption with small endpoint
+ Disable -Wattribute-alias for clang-23 and newer
+ i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
+ ipv6: mcast: Fix use-after-free when processing MLD queries
+ net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
+ tee: optee: prevent use-after-free when the client exits before the supplicant
+ netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
+ ipvs: clear the svc scheduler ptr early on edit
+ netfilter: synproxy: add mutex to guard hook reference counting
+ netfilter: conntrack_irc: fix possible out-of-bounds read
+ netfilter: nft_ct: bail out on template ct in get eval
+ netfilter: bridge: make ebt_snat ARP rewrite writable
+ dm cache policy smq: check allocation under invalidate lock
+ net/sched: act_api: use RCU with deferred freeing for action lifecycle
+ 6lowpan: fix off-by-one in multicast context address compression
+ drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
+ pcnet32: stop holding device spin lock during napi_complete_done
+ net: Annotate sk->sk_write_space() for UDP SOCKMAP.
+ hsr: Remove WARN_ONCE() in hsr_addr_is_self().
+ net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
+ net: lan743x: permit VLAN-tagged packets up to configured MTU
+ net: fec: fix pinctrl default state restore order on resume
+ Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
+ Bluetooth: MGMT: validate advertising TLV before type checks
+ Bluetooth: RFCOMM: validate skb length in MCC handlers
+ Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension
handling
+ Bluetooth: bnep: reject short frames before parsing
+ Bluetooth: fix memory leak in error path of hci_alloc_dev()
+ Bluetooth: MGMT: Fix backward compatibility with userspace
+ ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
+ ptp: vclock: Switch from RCU to SRCU
+ octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
+ vxlan: vnifilter: send notification on VNI add
+ vxlan: vnifilter: fix spurious notification on VNI update
+ ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
+ net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
+ ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp
+ signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
+ time: Fix off-by-one in settimeofday() usec validation
+ ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
+ tools/rv: Fix cleanup after failed trace setup
+ tap: free page on error paths in tap_get_user_xdp()
+ arm64: tlb: Allow XZR argument to TLBI ops
+ iomap: don't revert iov_iter on partially completed buffered writes
+ xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
+ netlabel: validate unlabeled address and mask attribute lengths
+ gpio: mvebu: fix NULL pointer dereference in suspend/resume
+ ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
+ tcp: restrict SO_ATTACH_FILTER to priv users
+ net/mlx4: avoid GCC 10 __bad_copy_from() false positive
+ net: phy: clean the sfp upstream if phy probing fails
+ net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
+ net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
+ net: openvswitch: fix possible kfree_skb of ERR_PTR
+ r8152: handle the return value of usb_reset_device()
+ net: guard timestamp cmsgs to real error queue skbs
+ net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
completion
+ ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
+ rds: mark snapshot pages dirty in rds_info_getsockopt()
+ netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
+ netfilter: x_tables: avoid leaking percpu counter pointers
+ netfilter: nf_log: validate MAC header was set before dumping it
+ netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
+ net: mvpp2: sync RX data at the hardware packet offset
+ net: mvpp2: limit XDP frame size to the RX buffer
+ net: mvpp2: Add metadata support for xdp mode
+ net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
+ ipv6: Fix a potential NPD in cleanup_prefix_route()
+ netfilter: ctnetlink: ensure safe access to master conntrack
+ clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
+ drm/virtio: Fix driver removal with disabled KMS
+ drm/vc4: fix krealloc() memory leak
+ Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
+ Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
+ tracing/probes: Point the error offset correctly for eprobe argument error
+ mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
+ KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
+ drm/i915/gem: Fix phys BO pread/pwrite with offset
+ ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
+ xfrm: espintcp: do not reuse an in-progress partial send
+ USB: serial: io_ti: fix heap overflow in get_manuf_info()
+ USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
+ USB: serial: option: add usb-id for Dell Wireless DW5826e-m
+ USB: serial: kl5kusb105: fix bulk-out buffer overflow
+ ALSA: timer: Fix UAF at snd_timer_user_params()
+ drm/virtio: fix dma_fence refcount leak on error in
virtio_gpu_dma_fence_wait()
+ drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
+ mm/damon/ops-common: call folio_test_lru() after folio_get()
+ RDMA/srp: bound SRP_RSP sense copy by the received length
+ zram: fix use-after-free in zram_bvec_write_partial()
+ udp: clear skb->dev before running a sockmap verdict
+ ARM: socfpga: Fix OF node refcount leak in SMP setup
+ ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
+ ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
+ mptcp: fix retransmission loop when csum is enabled
+ mptcp: close TOCTOU race while computing rcv_wnd
+ mptcp: allow subflow rcv wnd to shrink
+ mptcp: sockopt: check timestamping ret value
+ selftests: mptcp: add test for extra_subflows underflow on userspace PM
+ wifi: nl80211: reject oversized EMA RNR lists
+ vsock/vmci: fix sk_ack_backlog leak on failed handshake
+ ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
+ bnxt_en: Fix NULL pointer dereference
+ inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
+ pidfd: refuse access to tasks that have started exiting harder
+ fuse: reject fuse_notify() pagecache ops on directories
+ i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
+ i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
+ i2c: tegra: Fix NOIRQ suspend/resume
+ Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
+ Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
+ ipc/shm: serialize orphan cleanup with shm_nattch updates
+ misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
+ misc: fastrpc: fix use-after-free race in fastrpc_map_create
+ misc: fastrpc: fix DMA address corruption due to find_vma misuse
+ misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
+ net/mlx5: Reorder completion before putting command entry in cmd_work_handler
+ net: bonding: fix NULL pointer dereference in bond_do_ioctl()
+ net: mv643xx: fix OF node refcount
+ net: rds: clear i_sends on setup unwind
+ nvmem: layouts: onie-tlv: fix hang on unknown types
+ octeontx2-af: fix memory leak in rvu_setup_hw_resources()
+ mm/hugetlb: restore reservation on error in hugetlb folio copy paths
+ mmc: core: Fix host controller programming for fixed driver type
+ mmc: litex_mmc: Set mandatory idle clocks before CMD0
+ mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
+ mmc: sdhci: add signal voltage switch in sdhci_resume_host
+ sctp: diag: reject stale associations in dump_one path
+ sctp: stream: fully roll back denied add-stream state
+ thunderbolt: Reject zero-length property entries in validator
+ thunderbolt: Bound root directory content to block size
+ thunderbolt: Clamp XDomain response data copy to allocation size
+ thunderbolt: Validate XDomain request packet size before type cast
+ thunderbolt: Limit XDomain response copy to actual frame size
+ slimbus: qcom-ngd-ctrl: fix OF node refcount
+ slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
+ drm/amdkfd: fix NULL dereference in get_queue_ids()
+ drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
+ drm/amdgpu: restart the CS if some parts of the VM are still invalidated
+ drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
+ drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
+ drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
+ drm/amd/display: Use krealloc_array() in dal_vector_reserve()
+ fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
+ driver core: reject devices with unregistered buses
+ mm/hugetlb: avoid false positive lockdep assertion
+ soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
+ ipmi:ssif: Remove unnecessary indention
+ ipmi:ssif: NULL thread on error
+ selftests: mptcp: drop nanoseconds width specifier
+ tty: serial: samsung: use u32 for register interactions
+ tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
+ serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ
+ netfilter: nft_fib: fix stale stack leak via the OIFNAME register
+ hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
+ RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
+ RDMA/umem: fix kernel-doc warnings
+ RDMA: Move DMA block iterator logic into dedicated files
+ RDMA/umem: Fix truncation for block sizes >= 4G
+ ipvs: skip ipv6 extension headers for csum checks
+ arm64: cputype: Add NVIDIA Olympus definitions
+ arm64: cputype: Add C1-Ultra definitions
+ arm64: cputype: Add C1-Premium definitions
+ arm64: errata: Mitigate TLBI errata on various Arm CPUs
+ arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
+ arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
+ UBUNTU: [Config] Enable CONFIG_ARM64_ERRATUM_4118414
+ mptcp: add-addr: always drop other suboptions
+ mptcp: fix missing wakeups in edge scenarios
+ Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"
+ netfilter: require Ethernet MAC header before using eth_hdr()
+ ARM: fix hash_name() fault
+ wifi: remove zero-length arrays
+ soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
+ l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
+ devlink: Release nested relation on devlink free
+ wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
+ Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
+ Bluetooth: ISO: Fix not using bc_sid as advertisement SID
+ Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
+ octeontx2-pf: Fix NDC sync operation errors
+ octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
+ ima: kexec: skip IMA segment validation after kexec soft reboot
+ ima: kexec: move IMA log copy from kexec load to execute
+ spi: cadence-quadspi: fix unclocked access on unbind
+ net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
+ gpio: zynq: fix runtime PM leak on remove
+ netfilter: revalidate bridge ports
+ writeback: Avoid contention on wb->list_lock when switching inodes
+ writeback: Fix use after free in inode_switch_wbs_work_fn()
+ xfrm: hold device only for the asynchronous decryption
+ xfrm: hold dev ref until after transport_finish NF_HOOK
+ KVM: VMX: Update SVI during runtime APICv activation
+ drm/xe: fix refcount leak in xe_range_fence_insert()
+ tee: shm: fix shm leak in register_shm_helper()
+ accel/ivpu: Add bounds checks for firmware log indices
+ accel/ivpu: Fix signed integer truncation in IPC receive
+ nvmem: core: fix use-after-free bugs in error paths
+ slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
+ slimbus: qcom-ngd-ctrl: Fix probe error path ordering
+ slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
+ slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
+ slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
+ slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
+ drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
+ drm/amd/pm: fix smu13 power limit default/cap calculation
+ drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range
+ drm/amd/display: Bound VBIOS record-chain walk loops
+ drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
+ mailbox: Fix NULL message support in mbox_send_message()
+ vsock/virtio: fix potential unbounded skb queue
+ vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
+ net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL()
+ mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
+ vsock/virtio: fix skb overhead overflow on 32-bit builds
+ UBUNTU: Upstream stable to v6.6.143, v6.12.94
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164796
Title:
Noble update: upstream stable patchset 2026-08-21
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2164796/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
