Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-09-22
Ported from the following upstream stable releases:
v6.18.51, v7.2.5
from git://git.kernel.org/
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
drm/xe: Don't hand out the flat CCS storage as usable VRAM
drm/amd/display: fix division by zero in get_estimated_bw()
usb: image: mdc800: change kmalloc() to kzalloc()
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
media: usbtv: keep device alive while ALSA card exists
usb-storage: ene_ub6250: fix race between scan work and probe
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
usb: dwc3: clear forceRM when issuing EndTransfer
usb: storage: realtek_cr: fix use-after-free on disconnect
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
usb: typec: qcom-pmic: cancel reset_work on stop
usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
usb: typec: ucsi: displayport: Fix OOB altmode array index
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
usb: gadget: f_midi2: fix use-after-free in string attribute show path
usb: gadget: f_midi: initialize work in f_midi_alloc()
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
usb: gadget: fix null pointer dereference in usb_put_function_instance()
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
xhci: fix lost bounce buffers on TDs spanning several ring segments
thermal/drivers/imx: Disable clock on runtime resume failure
thermal/drivers/qoriq: Disable clock on resume failure
userfaultfd: reset err to be 0 when move_pages_ptes succeeded
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size
spi: bcm63xx-hsspi: disable clocks on resume failure
spi: bcm63xx: disable clock on resume failure
spi: bcmbca-hsspi: disable clocks on resume failure
spi: Fix DMA mapping ownership on partial map failure
scsi: target: iscsi: Reserve a terminator byte for the login payload
scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
scsi: pm8001: Use rollback index when freeing MSI-X vectors
mm/damon/vaddr-kunit: check region count in three_regions test
samples/damon/mtier: handle damon_start() failure
samples/damon/mtier: handle damon_stop() failure
samples/damon/prcl: handle damon_start() failure
samples/damon/prcl: stop and free damon ctx when damon_call() fails
samples/damon/wsse: handle damon_start() failure
samples/damon/wsse: stop and free damon ctx when damon_call() fails
mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs
mm/damon/sysfs-schemes: kobject_del() scheme dirs
mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
mm/damon/sysfs-schemes: kobject_del() scheme region dirs
mm/damon/sysfs: kobject_del() region and target (error) dirs
mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
mm/damon/core-kunit: check region count before testing in split_at()
futex: Prevent rcuwait use-after-free during requeue PI
ftrace: Synchronize the initialization of ftrace_ops
HID: bpf: serialize device reference release in struct_ops destroy path
HID: rmi: fix OOB access with undersized RMI reports
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
dm: fix race when loading and unloading a table
dm: fix resume-vs-remove race
dma-direct: return struct page from dma_direct_alloc_from_pool()
dmaengine: fsl-edma: tracing: no ptr dereference during log output
dmaengine: dw-edma: Fix HDMA channel status register access
dmaengine: dw-edma: Complete descriptors before pausing
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
cpuidle: dt_idle_genpd: kfree() the original name allocation
cpuidle: psci: Fix support for probe deferral by dropping the faux device
block: flag zoned disks with GENHD_FL_NO_PART
bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
ceph: lock mutex in ceph_mds_check_access()
ata: ahci: work around lost interrupts on Marvell 88SE61xx
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
kprobes: Protect kprobe_blacklist with RCU
mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
Input: aiptek - validate raw macro indices before updating state
memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done
memcg: make the v1 soft limit knob inert
rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt
rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
perf/x86/intel: Fix kernel address leakages in LBR stack
perf trace: Factor out BPF loop body
perf trace: Refactor augmented_raw_syscalls using bpf_for
perf hisi-ptt: Fix PTT trace TLP header parsing
i2c: designware: Enable interrupt mask workaround for HJMC3001
i2c: qcom-geni: update frequency table to fix timing parameters
i2c: core: fix debugfs UAF on adapter removal
i2c: mux: Fix channel node leak on adapter add failure
arm64: mm: Fix the lockless page-table walk in show_pte()
arm64: errata: pass REVIDR when matching target implementation CPUs
ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
ALSA: harmony: initialize locks before requesting IRQ
ALSA: pcm: Fix race between non-atomic ops and trigger-start
nvme-fabrics: fix DHCHAP secret leak on parse failure
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
nvme-tcp: check the data direction of a C2HData PDU
nvme: add missing SRCU grace period in error path
nvmet-auth: Synchronize timeout work during SQ teardown
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
nvmet-tcp: reject unsolicited H2CData PDUs
pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
Revert "irqchip/mbigen: Fix mbigen node address layout"
mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
mm/hugetlb: keep max_huge_pages when dissolving surplus folios
mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
nvdimm/btt: reject an arena whose nfree is below the lane count
parisc: eisa: Fix infinite loop when parsing invalid IRQ value
parisc: Fix alignment of asm statements in head.S
powerpc/kexec_file: Fix null-ptr-def in extra size calculation
powerpc/kexec_file: Prevent kexec range truncation
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
powerpc/pseries: Handle and log pseries-wdt registration failures
powerpc/pseries: Move H_WATCHDOG definitions to a common header
powerpc/crash: stop watchdogs before booting kdump kernel
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
s390/vfio-ap: Fix stale do_remove flag across iterations in
vfio_ap_mdev_cfg_remove
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
mtd: afs: validate v2 image info bounds
mtd: mtdoops: free page bitmap when the backing MTD is removed
mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
mtd: rawnand: validate ONFI extended parameter page sections
batman-adv: fix stale receive device on merged fragments
batman-adv: mcast: ensure unshared skb for multicast packets
batman-adv: mcast: linearize skbuff for packet generation
batman-adv: dat: avoid unaligned fault in IP extraction
batman-adv: bla: fix freeing of claims on meshif deletion
batman-adv: bla: prevent CRC corruptions after claim flush
clk: clocking-wizard: fix integer overflow in rate calculation
clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen
clk: meson: align gxbb_32k_clk_sel number of parents with actual count
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
ASoC: cs35l33: drain threaded IRQ before runtime suspend
ASoC: cs35l34: drain threaded IRQ before runtime suspend
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division
ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
AsoC: intel: sst: fix PCI device reference leak on probe failure
ASoC: loongson: Fix error handling in ACPI property parsing
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment
without of_node_get
iio: adc: adi-axi-adc: add data size support for AD408X backend
iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
iio: adc: pac1921: fix wrong channel used in trigger handler read
iio: buffer: Fix potential use-after-free in anonymous buffer release
iio: buffer: Make IIO DMA fence release RCU-safe
iio: buffer: Tie IIO dma fence lock lifetime to the fence
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
iio: chemical: sgp30: Handle IAQ thread creation failure
iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show
iio: dac: m62332: Fix regulator reference count imbalance
iio: gyro: mpu3050: fix sign of raw angular velocity readings
iio: light: cm32181: return zero after writing calibscale
iio: light: gp2ap002: Disable regulators on resume failure
iio: light: ltrf216a: fix runtime PM reference leak in error path
iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
iio: pressure: mpl115: Fix runtime PM cleanup
iio: srf04: fix pm_runtime handling on probe error path
iio: temperature: hid-sensor-temperature: switch to non-devm
iio_device_register()
iio: ti-ads7138: Disable STATS_EN bit while reading conversion results
iio: light: opt4060: Reject integration times with a non-zero seconds part
iio: light: opt4060: Fix incorrect register name in threshold read error message
iio: light: opt4001: Fix power down clearing bits of the wrong register
iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
iio: light: opt4001: Reject integration times with a non-zero seconds part
iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode
KVM: nVMX: Always flush vpid02 on first use
KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU
KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
KVM: x86: Serialize writes to disabled_quirks using kvm->lock
KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
KVM: s390: Fix length check __import_wp_info()
KVM: s390: Fix memory leak in guest debug handling
KVM: s390: Fix old_data leak in guest debug error path
KVM: s390: Free guest debug data on vcpu destroy
KVM: s390: Take srcu when importing watchpoint data
KVM: s390: Zero initialize irq in reinject_machine_check
KVM: s390: Fix memory corruption by not reinjecting CK machine checks
KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
KVM: s390: Restore sigset on error path
KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
KVM: arm64: Correctly handle end of VA space TLBI invalidation
KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
KVM: arm64: Sign-extend VA for range-based TLBI invalidation
KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
KVM: arm64: vgic: Fix detection of MI on no pending LR
KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
KVM: arm64: Correctly cap TLBI Range to the architural limit
LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path
LoongArch: KVM: Fix TOCTOU race on pv_features
LoongArch: KVM: Free init resources if kvm_init() fails
LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
LoongArch: BPF: Optimize redundant TCC loads in epilogue
LoongArch: BPF: Refactor jump offset calculation in tail call
LoongArch: Fix acpi_package_ids[] array overflow
LoongArch: Do not select HAVE_RUST when KASAN is enabled
LoongArch: Do not save/restore percpu base register in rethook trampoline
LoongArch: Avoid preempt count underflow without probe
rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
media: amphion: Remove obsolete frame_count check in venc_start_session
media: cec: disable delayed work before freeing an interrupted transmit
media: cec: extron-da-hd-4k-plus: add sanity check
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
media: cec: Serialize exclusive follower delivery
media: cedrus: fix memory leak in cedrus_init_ctrls()
media: cobalt: Avoid freeing ALSA private data twice
media: cx231xx: reject geometry changes while the VBI queue is busy
media: cx23885: cancel NetUP CI work before teardown
media: em28xx: defer audio-only extension registration
media: em28xx: fix use-after-free of dev_next->devlist on disconnect
media: go7007: defer the ALSA v4l2 put until card release
media: i2c: alvium: Fix: Correct name of register in
alvium_set_ctrl_auto_exposure
media: i2c: imx415: Release runtime PM reference on VBLANK error
media: i2c: imx415: Return test pattern write errors
media: i2c: ov02a10: fix endpoint parsing use-after-free
media: i2c: ov7740: fix use-after-destroy in remove
media: imx355: Avoid calling imx355_power_off twice in error path
media: intel/ipu6: fix async notifier cleanup leak on parse error
media: iris: Enumerate cap->bus_info to differentiate between encoder and
decoder
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
media: platform: mtk-mdp3: Fix SCP device refcounting
media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
media: nxp: imx8-isi: Correct color map between V4L2 and ISI
media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
media: rc: sunxi-cir: Unregister rc device on probe failure
media: rkvdec: Propagate platform_get_irq() errors
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
media: s2255: bound JPEG frame size before copying into the buffer
media: s2255: check firmware size before reading trailing marker
media: saa7164: fix cleanup on resource allocation failure
media: tda18250: fix possible integer overflow
media: v4l2-async: avoid deleting unlinked ASC entry on link error
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
media: venus: fix payload size calculation in parse_raw_formats()
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
media: vimc: fix pixel format lookup in enum_framesizes
media: zoran: Avoid freeing a registered video_device twice
media: qcom: iris: fix state-change debug log printing stale value
media: qcom: iris: use disable_irq() during power-off
media: chips-media: wave5: Guard bit depth check with initial_info_obtained
media: chips-media: wave5: Set inst->std during default format initialization
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
scsi: qla2xxx: Initialize NVMe abort_work once at submission
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
scsi: qla2xxx: Serialize flash version read in reset handler
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
scsi: qla2xxx: Don't query firmware state while chip is down
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
scsi: qla2xxx: Quiesce response IRQ before freeing request queue
scsi: qla2xxx: Avoid double completion in async IOCB timeout
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
f2fs: return symlink writeback errors
f2fs: reject overlapping move range after len expansion
f2fs: only redirty pinned folios in redirty_blocks
f2fs: fix to avoid move_range and defragment on device_alias file
f2fs: dirty directory inodes on mtime/ctime update
f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
f2fs: return writeback error from collapse range
f2fs: fix to avoid potential section-unaligned pinfile
f2fs: fix dentry folio leak in find_in_level
f2fs: avoid NULL checkpoint thread access in sysfs
f2fs: fix to migrate all curseg types during free_segment_range
f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
f2fs: fix i_size when pinned fallocate partially fails
f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
f2fs: fix to clear dirty flag on folio in error path
f2fs: fix valid block count leak on data block allocation failure
f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
f2fs: fix to zero post-EOF data when extending file size
drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
drm/xe/vram: report FLAT_CCS base misalignment
drm/panthor: harden firmware build-info bounds checks
drm/panthor: fix firmware control interface bounds checks
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
drm/panel-edp: fix i2c adapter leak on probe failure
drm: fix race between partial drm_dev_register() failure and ioctl
drm/i915: Guard against NULL driver_data in i915_pci_probe()
drm/ssd130x: fix column and row end address in partial updates for ssd132x
drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
drm/ssd130x: fix column and row end address in partial updates in ssd133x
drm/nouveau/disp/r535: Add scanline position support + head state support
drm/hibmc: Fix list of formats on the primary plane
drm/hibmc: Use drm_atomic_helper_check_plane_state()
drm/amd/display: avoid divide-by-zero in __is_lut_linear()
drm/amd/display: fix dc_lock leak on GPU reset error paths
drm/amd/display: validate plane degamma LUT size for private color prop
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
drm/gud: NUL-terminate TV mode names read from the device
drm/gud: validate TV mode names before creating enum property
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
drm/amdgpu: check thunderbolt before switcheroo registration
drm/amdgpu: clamp the isolation index for rings outside a partition
drm/amdgpu: Disable runtime PM for externally attached dGPUs
drm/amdgpu: fix autosuspend cleanup during removal
drm/amdgpu: Skip accessing psp rum time db for APUs
drm/amdgpu: update the fw version for gfx11 userqueues
drm/amdgpu: update the fw version for gfx12 userqueues
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
drm/sysfb: simpledrm: Improve framebuffer-size validation
drm/sysfb: simpledrm: Improve panel-size validation
drm/sysfb: simpledrm: Improve stride validation
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware
drm/nouveau: unsubscribe the channel-kill event before the fence context
drm/nouveau: Use write-combined maps for coherent
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c
drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp
drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks
drm/nouveau/disp: fix HDMI vendor infoframes on GB20x
drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x
drm/nouveau/disp: fix head state readback on GB20x
drm/nouveau/gsp: fix vblank interrupts on GB20x
ksmbd: fix use-after-free in oplock break notification
fuse: split off fuse_args and related definitions into a separate header
fuse: remove fm arg of args->end callback
crypto: atmel-ecc - replace min_t with min
mm/hugetlb: defer vmemmap population for bootmem hugepages
mm/hugetlb: refactor code around vmemmap_walk
mm/page_alloc: don't spin_trylock() in NMI on UP
USB: gadget: ffs: fix mm lifetime handling
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
NFSD: Guard admin state-revocation walks with NFSD_NET_UP
ceph: properly decrypt filenames in vmalloc() buffers
HID: sony: use guard() and scoped_guard()
HID: sony: clean up device list on probe failure
ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
ACPI: x86: cmos_rtc: Create a CMOS RTC platform device
ACPI: TAD: Rearrange RT data validation checking
ACPI: TAD: Add locking around AML evaluations
bpf: Factor stackid_init function from __bpf_get_stackid
bpf: Factor stackid_fastpath function from __bpf_get_stackid
bpf: Factor stackid_new_bucket from __bpf_get_stackid
bpf: Use stack id functions instead of __bpf_get_stackid
bpf: Disable preemption in bpf_get_stackid
rpcrdma: arm rn_done before publishing the notification
sched: Add assert_balance_callbacks_empty helper
sched: Rework prev_balance() to avoid stale prev references
sched/core: Make core-sched flips wait for in-flight selections
remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
NFSD: Consolidate the revocation-path client unpin
NFSD: Prevent client use-after-free during blocked-lock reaping
NFSD: Prevent client use-after-free during close_lru reaping
mm: rework compound_head() for power-of-2 sizeof(struct page)
hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU
Docs/ABI/damon: fix typo in intervals_goal sysfs path
power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
power: supply: ab8500_fg: fix use-after-free on remove
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
mm/damon/vaddr: drop last same folio access check optimization
mm/damon/paddr: drop last same folio access check reuse optimization
mm/damon/ops-common: use nr_accesses moving sum for quota score
mm/damon/core: skip aging from repeated aggressive merging
mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
mm/damon/core-kunit: handle region split failure in filter_out()
mm/damon/core: initialize damos->last_applied
mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
ksmbd: zero pipe read compound padding
zram: move lockmap to be per-zram instead per table
zram: fix slot lock bit position on big-endian 64-bit
ACPI: battery: Use kstrtoul() over sscanf("%lu\n")
ACPI: battery: Protect all properties with a separated mutex
KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
NFSD: Annotate caller preconditions for the state-table walkers
usb: cdnsp: fix wakeup from S3 after controller context loss
usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
usb: typec: hd3ss3220: track VBUS enable state per consumer
usb: gadget: f_mass_storage: fix null pointer dereference in
fsg_common_set_num_buffers()
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
tracing/probes: Fix anon_stack check for unnamed bitfields in
btf_find_struct_member
tracing: Have show_event_filters/triggers files take trace array ref
tracing: Remove the backup instance automatically after read
tracing: Take trace_array reference when opening options file
soc: fsl: qe: Add chained_irq_{enter,exit}() calls in cascade handler
mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()
mm/damon/core-kunit: skip wrong dest walk in commit_dests_for()
mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals()
mm/damon/core-kunit: skip wrong region walk in commit_target_regions()
mm/secretmem: properly account locked pages
futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
ftrace: Take trace_array reference before accessing its ftrace_ops
dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
bpf, riscv: Make arena support depend on ZACAS
misc: fastrpc: don't publish fd before copy_to_user() succeeds
mm/huge_memory: transfer the pmd dirty bit to the folio on zap
perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
perf build: Add clang and rust target flags for LoongArch
perf/core: Fix deadlock in perf_mmap() failure path
perf: Fix use-after-free when perf mmap() revival races with the last munmap()
i2c: qcom-cci: Do not check return value of cci_init()
i2c: qcom-cci: Remove overcautious disable_irq() calls
i2c: qcom-cci: fix autosuspend cleanup
arm64: Don't read GMID_EL1 when MTE is disabled
ring-buffer: Show persistent buffer dropped events in trace_pipe file
ring-buffer: Allow splice reads on static buffers
accel/amdxdna: return early from a zero-length flush
accel/ethosu: check MMIO mapping errors in probe
dma-buf: add dma_fence_was_initialized function v2
accel/ethosu: fix job completion fence cleanup
nvme: fold nvme_config_discard() into nvme_update_disk_info()
nvme: skip the zoned limits update if the zone info query failed
Revert "once: don't use a work queue to reset sleepable static key"
mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
mm/migrate_device: avoid out-of-bounds writes for compound folios
mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
mtd: rawnand: sunxi: group controller delay tables
mtd: rawnand: sunxi: describe tADL and tWHR delays
mtd: rawnand: sunxi: fix H6/H616 controller timings
batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
clk: microchip: mpfs: fix regmap_update_bits() mask/val order
ASoC: adau1761: sort the register default table
ASoC: cx2072x: sort the register default table
ASoC: fsl_easrc: sort the register default table
ASoC: max9860: sort the register default table
ASoC: ml26124: sort the register default table
ASoC: pcm512x: sort the register default table
ASoC: pm4125-sdw: sort the register default table
ASoC: rt1017-sdca-sdw: sort the register default table
ASoC: rt1316-sdw: sort the register default table
ASoC: rt1318-sdw: sort the register default table
ASoC: rt1318: sort the register default table
ASoC: rt274: sort the register default table
ASoC: rt286: sort the register default table
ASoC: rt298: sort the register default table
ASoC: rt700: drop duplicate reg_default entry
ASoC: rt700: sort the register default table
ASoC: rt711-sdca: sort the register default tables
ASoC: rt711: sort the register default table
ASoC: rt712-sdca-dmic: sort the register default table
ASoC: rt712-sdca-sdw: sort the register default table
ASoC: rt715-sdca: drop duplicate reg_default entries
ASoC: rt715-sdca: sort the register default tables
ASoC: rt715: sort the register default table
ASoC: rt721-sdca-sdw: sort the register default table
ASoC: sgtl5000: sort the register default table
ASoC: sti-sas: sort the register default table
ASoC: tas2552: sort the register default table
ASoC: tas2764: sort the register default table
ASoC: tas2780: sort the register default table
ASoC: tas2783-sdw: drop duplicate reg_default entry
ASoC: tas2783-sdw: sort the register default table
iio: adc: ad4080: configure backend data size
iio: adc: max14001: add missing 'select REGMAP' to Kconfig
iio: dac: ad5446: fix OF module device table
iio: dac: mcp47feb02: add missing 'select REGMAP_I2C' to Kconfig
iio: light: apds9306: fix PM reference leak in apds9306_read_data()
KVM: x86: Move some EFER bits enablement to common code
KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup
KVM: s390: Zero initialize data structures for inject_pfault_token
KVM: s390: keyop: use mmu_lock to read gmap->asce
KVM: arm64: nv: Fully update VNCR fixmap state in kvm_translate_vncr()
KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping
KVM: arm64: Remove VM-wide VNCR mapping counter
LoongArch: Expand module virtual address space to 2GB
LoongArch: BPF: Move arena register slot below TCC context
LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()
media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP
media: i2c: vd55g1: Fix manual digital gain on color variant
media: i2c: vd55g1: Fix media bus code initialization
media: mali-c55: fix dropped last AEC histogram zone weight
media: mali-c55: Fix clock leak on reset deassert failure
media: mali-c55: Fix AEXP IHIST disable bit shift
media: mali-c55: Fix scaler factor overflow for large crop sizes
media: rkvdec: hevc: tighten EXT SPS RPS control dimensions
media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow
media: ti: vpe: quiesce overflow recovery before freeing streams
media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
media: chips-media: wave5: avoid skipping device_run while VPU has work
media: chips-media: wave5: Add timeout while stop_streaming
media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued
media: chips-media: wave5: Fix pipeline stall when queuing fails
media: chips-media: wave5: Resume device before setting EOS flag
scsi: qla2xxx: Fix BSG job leak on validate flash image error path
scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
f2fs: validate MOVE_RANGE destination size
f2fs: limit recovery filename logging to stored length
f2fs: embed f2fs_gc_kthread in f2fs_sb_info
f2fs: fix folio_nr_pages() race after put in large folio invalidate
f2fs: fix to return -EFSCORRUPTED in f2fs_get_node_info() correctly
f2fs: protect critical_task_priority updates with s_umount
f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
drm/amdgpu: avoid force-completing uninitialized UVD rings
drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable
drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
drm/ttm: Drop tt->restore after successful restore
drm/amdgpu: force complete the KIQ ring fences on reset
drm/amdgpu: force complete the MES ring fences on reset
drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
drm/nouveau/dmem: fix callocated underflow on large folio split
drm/nouveau/dmem: fix mismatched DMA unmap size for large folios
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
PCI: Allow per function PCI slots to fix slot reset on s390
UBUNTU: Upstream stable to v6.18.51, v7.2.5
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Resolute)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Resolute)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Resolute)
Status: New => In Progress
** Changed in: linux (Ubuntu Resolute)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-09-22
+
+ Ported from the following upstream stable releases:
+ v6.18.51, v7.2.5
+
from git://git.kernel.org/
+
+ net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
+ fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()
+ drm/xe: Don't hand out the flat CCS storage as usable VRAM
+ drm/amd/display: fix division by zero in get_estimated_bw()
+ usb: image: mdc800: change kmalloc() to kzalloc()
+ ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
+ clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
+ media: usbtv: keep device alive while ALSA card exists
+ usb-storage: ene_ub6250: fix race between scan work and probe
+ usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
+ usb: dwc3: clear forceRM when issuing EndTransfer
+ usb: storage: realtek_cr: fix use-after-free on disconnect
+ usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
+ usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
+ usb: typec: qcom-pmic: cancel reset_work on stop
+ usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
+ usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
+ usb: typec: ucsi: displayport: Fix OOB altmode array index
+ usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
+ usb: gadget: f_midi2: fix use-after-free in string attribute show path
+ usb: gadget: f_midi: initialize work in f_midi_alloc()
+ USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
+ usb: gadget: fix null pointer dereference in usb_put_function_instance()
+ staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
+ staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
+ xhci: fix lost bounce buffers on TDs spanning several ring segments
+ thermal/drivers/imx: Disable clock on runtime resume failure
+ thermal/drivers/qoriq: Disable clock on resume failure
+ userfaultfd: reset err to be 0 when move_pages_ptes succeeded
+ ublk: clear VM_MAYWRITE on read-only ublk char device mmap
+ soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size
+ spi: bcm63xx-hsspi: disable clocks on resume failure
+ spi: bcm63xx: disable clock on resume failure
+ spi: bcmbca-hsspi: disable clocks on resume failure
+ spi: Fix DMA mapping ownership on partial map failure
+ scsi: target: iscsi: Reserve a terminator byte for the login payload
+ scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
+ scsi: pm8001: Use rollback index when freeing MSI-X vectors
+ mm/damon/vaddr-kunit: check region count in three_regions test
+ samples/damon/mtier: handle damon_start() failure
+ samples/damon/mtier: handle damon_stop() failure
+ samples/damon/prcl: handle damon_start() failure
+ samples/damon/prcl: stop and free damon ctx when damon_call() fails
+ samples/damon/wsse: handle damon_start() failure
+ samples/damon/wsse: stop and free damon ctx when damon_call() fails
+ mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs
+ mm/damon/sysfs-schemes: kobject_del() scheme dirs
+ mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
+ mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
+ mm/damon/sysfs-schemes: kobject_del() scheme region dirs
+ mm/damon/sysfs: kobject_del() region and target (error) dirs
+ mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
+ mm/damon/core-kunit: check region count before testing in split_at()
+ futex: Prevent rcuwait use-after-free during requeue PI
+ ftrace: Synchronize the initialization of ftrace_ops
+ HID: bpf: serialize device reference release in struct_ops destroy path
+ HID: rmi: fix OOB access with undersized RMI reports
+ HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
+ dm: fix race when loading and unloading a table
+ dm: fix resume-vs-remove race
+ dma-direct: return struct page from dma_direct_alloc_from_pool()
+ dmaengine: fsl-edma: tracing: no ptr dereference during log output
+ dmaengine: dw-edma: Fix HDMA channel status register access
+ dmaengine: dw-edma: Complete descriptors before pausing
+ dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
+ cpuidle: dt_idle_genpd: kfree() the original name allocation
+ cpuidle: psci: Fix support for probe deferral by dropping the faux device
+ block: flag zoned disks with GENHD_FL_NO_PART
+ bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
+ ceph: lock mutex in ceph_mds_check_access()
+ ata: ahci: work around lost interrupts on Marvell 88SE61xx
+ ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
+ irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
+ kprobes: Protect kprobe_blacklist with RCU
+ mm/mempolicy: fix sleeping allocation in
alloc_pages_bulk_weighted_interleave()
+ fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
+ Input: aiptek - validate raw macro indices before updating state
+ memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is
done
+ memcg: make the v1 soft limit knob inert
+ rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt
+ rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
+ rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
+ rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
+ perf/x86/intel: Fix kernel address leakages in LBR stack
+ perf trace: Factor out BPF loop body
+ perf trace: Refactor augmented_raw_syscalls using bpf_for
+ perf hisi-ptt: Fix PTT trace TLP header parsing
+ i2c: designware: Enable interrupt mask workaround for HJMC3001
+ i2c: qcom-geni: update frequency table to fix timing parameters
+ i2c: core: fix debugfs UAF on adapter removal
+ i2c: mux: Fix channel node leak on adapter add failure
+ arm64: mm: Fix the lockless page-table walk in show_pte()
+ arm64: errata: pass REVIDR when matching target implementation CPUs
+ ALSA: rawmidi: Return the error from snd_rawmidi_input_params()
+ ALSA: harmony: initialize locks before requesting IRQ
+ ALSA: pcm: Fix race between non-atomic ops and trigger-start
+ nvme-fabrics: fix DHCHAP secret leak on parse failure
+ nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
+ nvme-tcp: check the data direction of a C2HData PDU
+ nvme: add missing SRCU grace period in error path
+ nvmet-auth: Synchronize timeout work during SQ teardown
+ nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
+ nvmet-tcp: reject unsolicited H2CData PDUs
+ pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig
+ Revert "irqchip/mbigen: Fix mbigen node address layout"
+ mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
+ mm/hugetlb: keep max_huge_pages when dissolving surplus folios
+ mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()
+ nvdimm/btt: reject an arena whose nfree is below the lane count
+ parisc: eisa: Fix infinite loop when parsing invalid IRQ value
+ parisc: Fix alignment of asm statements in head.S
+ powerpc/kexec_file: Fix null-ptr-def in extra size calculation
+ powerpc/kexec_file: Prevent kexec range truncation
+ powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
+ powerpc/pseries: Handle and log pseries-wdt registration failures
+ powerpc/pseries: Move H_WATCHDOG definitions to a common header
+ powerpc/crash: stop watchdogs before booting kdump kernel
+ s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
+ s390/vfio-ap: Fix stale do_remove flag across iterations in
vfio_ap_mdev_cfg_remove
+ s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
+ s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
+ s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
+ s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev
objects
+ s390/vfio-ap: Fix NULL deref in status_show() during queue probe
+ s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
+ s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev
object
+ mtd: afs: validate v2 image info bounds
+ mtd: mtdoops: free page bitmap when the backing MTD is removed
+ mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
+ mtd: rawnand: validate ONFI extended parameter page sections
+ batman-adv: fix stale receive device on merged fragments
+ batman-adv: mcast: ensure unshared skb for multicast packets
+ batman-adv: mcast: linearize skbuff for packet generation
+ batman-adv: dat: avoid unaligned fault in IP extraction
+ batman-adv: bla: fix freeing of claims on meshif deletion
+ batman-adv: bla: prevent CRC corruptions after claim flush
+ clk: clocking-wizard: fix integer overflow in rate calculation
+ clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen
+ clk: meson: align gxbb_32k_clk_sel number of parents with actual count
+ clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
+ clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
+ clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
+ clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
+ clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
+ clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
+ clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
+ clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
+ i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
+ ASoC: cs35l33: drain threaded IRQ before runtime suspend
+ ASoC: cs35l34: drain threaded IRQ before runtime suspend
+ ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
+ ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division
+ ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
+ AsoC: intel: sst: fix PCI device reference leak on probe failure
+ ASoC: loongson: Fix error handling in ACPI property parsing
+ ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment
without of_node_get
+ iio: adc: adi-axi-adc: add data size support for AD408X backend
+ iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig
+ iio: adc: pac1921: fix wrong channel used in trigger handler read
+ iio: buffer: Fix potential use-after-free in anonymous buffer release
+ iio: buffer: Make IIO DMA fence release RCU-safe
+ iio: buffer: Tie IIO dma fence lock lifetime to the fence
+ iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
+ iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
+ iio: chemical: sgp30: Handle IAQ thread creation failure
+ iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show
+ iio: dac: m62332: Fix regulator reference count imbalance
+ iio: gyro: mpu3050: fix sign of raw angular velocity readings
+ iio: light: cm32181: return zero after writing calibscale
+ iio: light: gp2ap002: Disable regulators on resume failure
+ iio: light: ltrf216a: fix runtime PM reference leak in error path
+ iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
+ iio: pressure: mpl115: Fix runtime PM cleanup
+ iio: srf04: fix pm_runtime handling on probe error path
+ iio: temperature: hid-sensor-temperature: switch to non-devm
iio_device_register()
+ iio: ti-ads7138: Disable STATS_EN bit while reading conversion results
+ iio: light: opt4060: Reject integration times with a non-zero seconds part
+ iio: light: opt4060: Fix incorrect register name in threshold read error
message
+ iio: light: opt4001: Fix power down clearing bits of the wrong register
+ iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
+ iio: light: opt4001: Reject integration times with a non-zero seconds part
+ iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
+ KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode
+ KVM: nVMX: Always flush vpid02 on first use
+ KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02
+ KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit
+ KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
+ KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
+ KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()
+ KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
+ KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU
+ KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot
+ KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk
+ KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
+ KVM: x86: Serialize writes to disabled_quirks using kvm->lock
+ KVM: x86: Ensure runtime reads of disabled_quirks are resolved once
+ KVM: s390: Fix length check __import_wp_info()
+ KVM: s390: Fix memory leak in guest debug handling
+ KVM: s390: Fix old_data leak in guest debug error path
+ KVM: s390: Free guest debug data on vcpu destroy
+ KVM: s390: Take srcu when importing watchpoint data
+ KVM: s390: Zero initialize irq in reinject_machine_check
+ KVM: s390: Fix memory corruption by not reinjecting CK machine checks
+ KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
+ KVM: s390: Restore sigset on error path
+ KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page
+ KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
+ KVM: arm64: Correctly handle end of VA space TLBI invalidation
+ KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
+ KVM: arm64: Sign-extend VA for range-based TLBI invalidation
+ KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
+ KVM: arm64: vgic: Fix detection of MI on no pending LR
+ KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure
+ KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
+ KVM: arm64: Correctly cap TLBI Range to the architural limit
+ LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path
+ LoongArch: KVM: Fix TOCTOU race on pv_features
+ LoongArch: KVM: Free init resources if kvm_init() fails
+ LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY
+ LoongArch: Add DIRECT_MAP_PHYSMEM_END definition
+ LoongArch: BPF: Optimize redundant TCC loads in epilogue
+ LoongArch: BPF: Refactor jump offset calculation in tail call
+ LoongArch: Fix acpi_package_ids[] array overflow
+ LoongArch: Do not select HAVE_RUST when KASAN is enabled
+ LoongArch: Do not save/restore percpu base register in rethook trampoline
+ LoongArch: Avoid preempt count underflow without probe
+ rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments
+ media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL
deref
+ media: amphion: Remove obsolete frame_count check in venc_start_session
+ media: cec: disable delayed work before freeing an interrupted transmit
+ media: cec: extron-da-hd-4k-plus: add sanity check
+ media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs
clash
+ media: cec: Serialize exclusive follower delivery
+ media: cedrus: fix memory leak in cedrus_init_ctrls()
+ media: cobalt: Avoid freeing ALSA private data twice
+ media: cx231xx: reject geometry changes while the VBI queue is busy
+ media: cx23885: cancel NetUP CI work before teardown
+ media: em28xx: defer audio-only extension registration
+ media: em28xx: fix use-after-free of dev_next->devlist on disconnect
+ media: go7007: defer the ALSA v4l2 put until card release
+ media: i2c: alvium: Fix: Correct name of register in
alvium_set_ctrl_auto_exposure
+ media: i2c: imx415: Release runtime PM reference on VBLANK error
+ media: i2c: imx415: Return test pattern write errors
+ media: i2c: ov02a10: fix endpoint parsing use-after-free
+ media: i2c: ov7740: fix use-after-destroy in remove
+ media: imx355: Avoid calling imx355_power_off twice in error path
+ media: intel/ipu6: fix async notifier cleanup leak on parse error
+ media: iris: Enumerate cap->bus_info to differentiate between encoder and
decoder
+ media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
+ media: platform: mtk-mdp3: Fix SCP device refcounting
+ media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
+ media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
+ media: nxp: imx8-isi: Correct color map between V4L2 and ISI
+ media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
+ media: rc: sunxi-cir: Unregister rc device on probe failure
+ media: rkvdec: Propagate platform_get_irq() errors
+ media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA
leak
+ media: rtl2832_sdr: release URBs and stream buffers on start_streaming()
failure
+ media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement
+ media: s2255: bound JPEG frame size before copying into the buffer
+ media: s2255: check firmware size before reading trailing marker
+ media: saa7164: fix cleanup on resource allocation failure
+ media: tda18250: fix possible integer overflow
+ media: v4l2-async: avoid deleting unlinked ASC entry on link error
+ media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
+ media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
+ media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
+ media: venus: fix payload size calculation in parse_raw_formats()
+ media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
+ media: vimc: fix pixel format lookup in enum_framesizes
+ media: zoran: Avoid freeing a registered video_device twice
+ media: qcom: iris: fix state-change debug log printing stale value
+ media: qcom: iris: use disable_irq() during power-off
+ media: chips-media: wave5: Guard bit depth check with initial_info_obtained
+ media: chips-media: wave5: Set inst->std during default format initialization
+ scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
+ scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
+ scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
+ scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
+ scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
+ scsi: qla2xxx: Initialize NVMe abort_work once at submission
+ scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
+ scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
+ scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
+ scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
+ scsi: qla2xxx: Serialize flash version read in reset handler
+ scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
+ scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
+ scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
+ scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
+ scsi: qla2xxx: Don't query firmware state while chip is down
+ scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
+ scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
+ scsi: qla2xxx: Quiesce response IRQ before freeing request queue
+ scsi: qla2xxx: Avoid double completion in async IOCB timeout
+ scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
+ scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
+ scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
+ scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
+ scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
+ scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
+ scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
+ scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
+ f2fs: return symlink writeback errors
+ f2fs: reject overlapping move range after len expansion
+ f2fs: only redirty pinned folios in redirty_blocks
+ f2fs: fix to avoid move_range and defragment on device_alias file
+ f2fs: dirty directory inodes on mtime/ctime update
+ f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
+ f2fs: return writeback error from collapse range
+ f2fs: fix to avoid potential section-unaligned pinfile
+ f2fs: fix dentry folio leak in find_in_level
+ f2fs: avoid NULL checkpoint thread access in sysfs
+ f2fs: fix to migrate all curseg types during free_segment_range
+ f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
+ f2fs: fix i_size when pinned fallocate partially fails
+ f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
+ f2fs: fix to clear dirty flag on folio in error path
+ f2fs: fix valid block count leak on data block allocation failure
+ f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
+ f2fs: fix to zero post-EOF data when extending file size
+ drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
+ drm/xe/vram: report FLAT_CCS base misalignment
+ drm/panthor: harden firmware build-info bounds checks
+ drm/panthor: fix firmware control interface bounds checks
+ drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
+ drm/panel-edp: fix i2c adapter leak on probe failure
+ drm: fix race between partial drm_dev_register() failure and ioctl
+ drm/i915: Guard against NULL driver_data in i915_pci_probe()
+ drm/ssd130x: fix column and row end address in partial updates for ssd132x
+ drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
+ drm/ssd130x: fix column and row end address in partial updates in ssd133x
+ drm/nouveau/disp/r535: Add scanline position support + head state support
+ drm/hibmc: Fix list of formats on the primary plane
+ drm/hibmc: Use drm_atomic_helper_check_plane_state()
+ drm/amd/display: avoid divide-by-zero in __is_lut_linear()
+ drm/amd/display: fix dc_lock leak on GPU reset error paths
+ drm/amd/display: validate plane degamma LUT size for private color prop
+ drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
+ drm/gud: NUL-terminate TV mode names read from the device
+ drm/gud: validate TV mode names before creating enum property
+ drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
+ drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
+ drm/amdgpu: check thunderbolt before switcheroo registration
+ drm/amdgpu: clamp the isolation index for rings outside a partition
+ drm/amdgpu: Disable runtime PM for externally attached dGPUs
+ drm/amdgpu: fix autosuspend cleanup during removal
+ drm/amdgpu: Skip accessing psp rum time db for APUs
+ drm/amdgpu: update the fw version for gfx11 userqueues
+ drm/amdgpu: update the fw version for gfx12 userqueues
+ drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
+ drm/amdkfd: Add TLB flush after MES queue eviction/suspension
+ drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
+ drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
+ drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
+ drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
+ drm/sysfb: simpledrm: Improve framebuffer-size validation
+ drm/sysfb: simpledrm: Improve panel-size validation
+ drm/sysfb: simpledrm: Improve stride validation
+ drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
+ drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
+ drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware
+ drm/nouveau: unsubscribe the channel-kill event before the fence context
+ drm/nouveau: Use write-combined maps for coherent
+ drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
+ drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
+ drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
+ drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c
+ drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp
+ drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks
+ drm/nouveau/disp: fix HDMI vendor infoframes on GB20x
+ drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x
+ drm/nouveau/disp: fix head state readback on GB20x
+ drm/nouveau/gsp: fix vblank interrupts on GB20x
+ ksmbd: fix use-after-free in oplock break notification
+ fuse: split off fuse_args and related definitions into a separate header
+ fuse: remove fm arg of args->end callback
+ crypto: atmel-ecc - replace min_t with min
+ mm/hugetlb: defer vmemmap population for bootmem hugepages
+ mm/hugetlb: refactor code around vmemmap_walk
+ mm/page_alloc: don't spin_trylock() in NMI on UP
+ USB: gadget: ffs: fix mm lifetime handling
+ usb: gadget: f_fs: Fix Use-After-Free in AIO error path
+ NFSD: Guard admin state-revocation walks with NFSD_NET_UP
+ ceph: properly decrypt filenames in vmalloc() buffers
+ HID: sony: use guard() and scoped_guard()
+ HID: sony: clean up device list on probe failure
+ ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
+ ACPI: x86: cmos_rtc: Create a CMOS RTC platform device
+ ACPI: TAD: Rearrange RT data validation checking
+ ACPI: TAD: Add locking around AML evaluations
+ bpf: Factor stackid_init function from __bpf_get_stackid
+ bpf: Factor stackid_fastpath function from __bpf_get_stackid
+ bpf: Factor stackid_new_bucket from __bpf_get_stackid
+ bpf: Use stack id functions instead of __bpf_get_stackid
+ bpf: Disable preemption in bpf_get_stackid
+ rpcrdma: arm rn_done before publishing the notification
+ sched: Add assert_balance_callbacks_empty helper
+ sched: Rework prev_balance() to avoid stale prev references
+ sched/core: Make core-sched flips wait for in-flight selections
+ remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
+ NFSD: Consolidate the revocation-path client unpin
+ NFSD: Prevent client use-after-free during blocked-lock reaping
+ NFSD: Prevent client use-after-free during close_lru reaping
+ mm: rework compound_head() for power-of-2 sizeof(struct page)
+ hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU
+ Docs/ABI/damon: fix typo in intervals_goal sysfs path
+ power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
+ power: supply: ab8500_fg: fix use-after-free on remove
+ mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
+ mm/damon/vaddr: drop last same folio access check optimization
+ mm/damon/paddr: drop last same folio access check reuse optimization
+ mm/damon/ops-common: use nr_accesses moving sum for quota score
+ mm/damon/core: skip aging from repeated aggressive merging
+ mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()
+ mm/damon/core-kunit: handle region split failure in filter_out()
+ mm/damon/core: initialize damos->last_applied
+ mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
+ ksmbd: zero pipe read compound padding
+ zram: move lockmap to be per-zram instead per table
+ zram: fix slot lock bit position on big-endian 64-bit
+ ACPI: battery: Use kstrtoul() over sscanf("%lu\n")
+ ACPI: battery: Protect all properties with a separated mutex
+ KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
+ NFSD: Annotate caller preconditions for the state-table walkers
+ usb: cdnsp: fix wakeup from S3 after controller context loss
+ usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
+ usb: typec: hd3ss3220: track VBUS enable state per consumer
+ usb: gadget: f_mass_storage: fix null pointer dereference in
fsg_common_set_num_buffers()
+ staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
+ tracing/probes: Fix anon_stack check for unnamed bitfields in
btf_find_struct_member
+ tracing: Have show_event_filters/triggers files take trace array ref
+ tracing: Remove the backup instance automatically after read
+ tracing: Take trace_array reference when opening options file
+ soc: fsl: qe: Add chained_irq_{enter,exit}() calls in cascade handler
+ mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs()
+ mm/damon/core-kunit: skip wrong dest walk in commit_dests_for()
+ mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals()
+ mm/damon/core-kunit: skip wrong region walk in commit_target_regions()
+ mm/secretmem: properly account locked pages
+ futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
+ ftrace: Take trace_array reference before accessing its ftrace_ops
+ dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
+ bpf, riscv: Make arena support depend on ZACAS
+ misc: fastrpc: don't publish fd before copy_to_user() succeeds
+ mm/huge_memory: transfer the pmd dirty bit to the folio on zap
+ perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
+ perf build: Add clang and rust target flags for LoongArch
+ perf/core: Fix deadlock in perf_mmap() failure path
+ perf: Fix use-after-free when perf mmap() revival races with the last munmap()
+ i2c: qcom-cci: Do not check return value of cci_init()
+ i2c: qcom-cci: Remove overcautious disable_irq() calls
+ i2c: qcom-cci: fix autosuspend cleanup
+ arm64: Don't read GMID_EL1 when MTE is disabled
+ ring-buffer: Show persistent buffer dropped events in trace_pipe file
+ ring-buffer: Allow splice reads on static buffers
+ accel/amdxdna: return early from a zero-length flush
+ accel/ethosu: check MMIO mapping errors in probe
+ dma-buf: add dma_fence_was_initialized function v2
+ accel/ethosu: fix job completion fence cleanup
+ nvme: fold nvme_config_discard() into nvme_update_disk_info()
+ nvme: skip the zoned limits update if the zone info query failed
+ Revert "once: don't use a work queue to reset sleepable static key"
+ mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
+ mm/migrate_device: avoid out-of-bounds writes for compound folios
+ mm/hugetlb_cma: fix null nodemask dereference in
hugetlb_cma_alloc_frozen_folio
+ mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
+ mtd: rawnand: sunxi: group controller delay tables
+ mtd: rawnand: sunxi: describe tADL and tWHR delays
+ mtd: rawnand: sunxi: fix H6/H616 controller timings
+ batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
+ clk: microchip: mpfs: fix regmap_update_bits() mask/val order
+ ASoC: adau1761: sort the register default table
+ ASoC: cx2072x: sort the register default table
+ ASoC: fsl_easrc: sort the register default table
+ ASoC: max9860: sort the register default table
+ ASoC: ml26124: sort the register default table
+ ASoC: pcm512x: sort the register default table
+ ASoC: pm4125-sdw: sort the register default table
+ ASoC: rt1017-sdca-sdw: sort the register default table
+ ASoC: rt1316-sdw: sort the register default table
+ ASoC: rt1318-sdw: sort the register default table
+ ASoC: rt1318: sort the register default table
+ ASoC: rt274: sort the register default table
+ ASoC: rt286: sort the register default table
+ ASoC: rt298: sort the register default table
+ ASoC: rt700: drop duplicate reg_default entry
+ ASoC: rt700: sort the register default table
+ ASoC: rt711-sdca: sort the register default tables
+ ASoC: rt711: sort the register default table
+ ASoC: rt712-sdca-dmic: sort the register default table
+ ASoC: rt712-sdca-sdw: sort the register default table
+ ASoC: rt715-sdca: drop duplicate reg_default entries
+ ASoC: rt715-sdca: sort the register default tables
+ ASoC: rt715: sort the register default table
+ ASoC: rt721-sdca-sdw: sort the register default table
+ ASoC: sgtl5000: sort the register default table
+ ASoC: sti-sas: sort the register default table
+ ASoC: tas2552: sort the register default table
+ ASoC: tas2764: sort the register default table
+ ASoC: tas2780: sort the register default table
+ ASoC: tas2783-sdw: drop duplicate reg_default entry
+ ASoC: tas2783-sdw: sort the register default table
+ iio: adc: ad4080: configure backend data size
+ iio: adc: max14001: add missing 'select REGMAP' to Kconfig
+ iio: dac: ad5446: fix OF module device table
+ iio: dac: mcp47feb02: add missing 'select REGMAP_I2C' to Kconfig
+ iio: light: apds9306: fix PM reference leak in apds9306_read_data()
+ KVM: x86: Move some EFER bits enablement to common code
+ KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup
+ KVM: s390: Zero initialize data structures for inject_pfault_token
+ KVM: s390: keyop: use mmu_lock to read gmap->asce
+ KVM: arm64: nv: Fully update VNCR fixmap state in kvm_translate_vncr()
+ KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping
+ KVM: arm64: Remove VM-wide VNCR mapping counter
+ LoongArch: Expand module virtual address space to 2GB
+ LoongArch: BPF: Move arena register slot below TCC context
+ LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()
+ media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP
+ media: i2c: vd55g1: Fix manual digital gain on color variant
+ media: i2c: vd55g1: Fix media bus code initialization
+ media: mali-c55: fix dropped last AEC histogram zone weight
+ media: mali-c55: Fix clock leak on reset deassert failure
+ media: mali-c55: Fix AEXP IHIST disable bit shift
+ media: mali-c55: Fix scaler factor overflow for large crop sizes
+ media: rkvdec: hevc: tighten EXT SPS RPS control dimensions
+ media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow
+ media: ti: vpe: quiesce overflow recovery before freeing streams
+ media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
+ media: chips-media: wave5: avoid skipping device_run while VPU has work
+ media: chips-media: wave5: Add timeout while stop_streaming
+ media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued
+ media: chips-media: wave5: Fix pipeline stall when queuing fails
+ media: chips-media: wave5: Resume device before setting EOS flag
+ scsi: qla2xxx: Fix BSG job leak on validate flash image error path
+ scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
+ f2fs: validate MOVE_RANGE destination size
+ f2fs: limit recovery filename logging to stored length
+ f2fs: embed f2fs_gc_kthread in f2fs_sb_info
+ f2fs: fix folio_nr_pages() race after put in large folio invalidate
+ f2fs: fix to return -EFSCORRUPTED in f2fs_get_node_info() correctly
+ f2fs: protect critical_task_priority updates with s_umount
+ f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
+ drm/amdgpu: avoid force-completing uninitialized UVD rings
+ drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable
+ drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
+ drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
+ drm/ttm: Drop tt->restore after successful restore
+ drm/amdgpu: force complete the KIQ ring fences on reset
+ drm/amdgpu: force complete the MES ring fences on reset
+ drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
+ drm/nouveau/dmem: fix callocated underflow on large folio split
+ drm/nouveau/dmem: fix mismatched DMA unmap size for large folios
+ mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
+ PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
+ PCI: Allow per function PCI slots to fix slot reset on s390
+ UBUNTU: Upstream stable to v6.18.51, v7.2.5
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167950
Title:
Resolute update: upstream stable patchset 2026-09-22
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167950/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
