Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.221 upstream stable release
from git://git.kernel.org/
Linux 5.15.221
clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled
nvmet-rdma: fix queue leak when connect backlog is exceeded
kselftest/arm64: mte: Use the correct naming for tag check modes in
check_hugetlb_options.c
kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such
mappings
Bluetooth: L2CAP: Fix send LE flow credits in ACL link
ALSA: control: Fix unannotated kfree() cleanup
HID: fix an error code in hid_check_device_match()
RDMA/nldev: Check stat attribute before accessing it
clk: qcom: Drop mmcx gdsc supply for dispcc and videocc
nvme: target: rdma: fix ndev refcount leak on queue connect
net/sched: sch_htb: limit htb_classify inner-class filter hops
tcp: fix corruption of urgent data on multi-segment retransmit
usb: atm: usbatm: fix invalid ci_range initialization
net: fec: only stop PTP if it was initialized
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
net: stmmac: selftests: Account for the UC filter list for filtering tests
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
net: stmmac: selftests: Check multiple MMC counters
selftests/arm64: Treat KSM merge_across_nodes as optional
selftests/arm64: Print missing MTE TAP headers
selftests: arm64: add hugetlb mte tests
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
netfilter: xt_HL: add pr_fmt and checkentry validation
netfilter: xt_cgroup: Make it independent from net_cls
netfilter: nf_tables: move hardware offload step after building the chain blob
virtio-net: Ensure that TCP packets don't overflow gso_segs
net: stmmac: selftests: Pass the IP proto mask in the TC selftest
net: ethernet: sun4i-emac: Fix IRQ error handling
libceph: validate banner payload length
ASoC: dapm: Fix off-by-one check on the second enum channel
apparmor: policy_int make sure list heads are initialized before fail path
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
tpm: st33zp24: Validate locality read result
tpm: st33zp24: Return zero on status read failure
net/sched: sch_teql: restore skb->dev on the slave failure path
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
net/sched: fq_pie: clamp default quantum to avoid signed overflow
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
net/sched: fq_codel: clamp default quantum and mtu
net_sched: export pfifo_fast prio2band[]
net_sched: sch_fq: change how @inactive is tracked
net_sched: sch_fq: struct sched_data reorg
net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict()
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
cifs: fix clearing stats for fastest execution of each smb2 command
net/rds: use wq_has_sleeper() in rds_cong_map_updated()
octeontx2-af: Fix TL3/TL2 link config ENA clearing
net: qualcomm: rmnet: restore skb->dev on deaggregated frames
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
scsi: qla2xxx: Fix an loop timeout test
NFSv4/pnfs: key the data server cache on the NFS version
nfs: move the nfs4_data_server_cache into struct nfs_net
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
net/smc: free pending qentry in smc_llc_flow_stop() before memset
net: ipa: balance runtime PM reference on remove error
net: ipa: Convert to platform remove callback returning void
net: ipa: report when the driver has been removed
forcedeth: stop the tx_timeout register dump past the requested window
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
net: bridge: Reject descending VLAN tunnel ranges
RDMA/ucma: Allow path records to exactly fit the output buffer
ALSA: control: Use automatic cleanup of kfree()
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
rtc: pcf8563: fix clock provider leak on unbind
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
virtio_balloon: disable indirect descriptors
i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode
i3c: mipi-i3c-hci: Refactor PIO register initialization
i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
i3c: mipi-i3c-hci: Quieten initialization messages
i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1
i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes
bonding: initialize err for empty target lists
vsock: use sock_error() to consume sk_err after a failed connect
platform/x86: dell-wmi-sysman: Fix instance ID bounds
8139cp: fix Rx and Tx not being disabled in cp_suspend
ALSA: hda: Fix connection list comparison in proc output
fs/ntfs3: validate ef->size covers the record's name and value
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
cuse: wait for pending RCU callbacks on module exit
net: bridge: vlan: fix inverted default vlan notification
ipvs: fix integer overflow in ftp helper port/address parsing
net: hsr: Use full string description when opening HSR network device
hsr: Use a single struct for self_node.
pppox: drain queued packets on channel handoff
net: kcm: Hold RCU read lock while running BPF parser
NFSv4: remove callback IDR entry on client allocation failure
nfs: refactor pNFS functions using clear_and_wake_up_bit
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
bpf: Reject negative optlen in cgroup getsockopt hook
lwt_bpf: Restore reserved headroom after xmit program
smb/server: preserve error status in smb2_handle_negotiate()
hwmon: (emc1403) Add support for EMC1442
mailbox: rockchip: disable pclk on probe failure and unbind
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
bpf: Fix pending_pos walk on 32-bit ring position wrap
tracing: Have trace_event_update_all() only handle module that is loading
tracing: Remove "__attribute__()" from the type field of event format
ALSA: core: Fix use-after-free in snd_card_do_free()
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
Squashfs: check block offset is not negative
ocfs2: fix circular locking dependency in ocfs2_init_acl()
bpftool: Fix double close in map dump
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
clocksource/drivers/armada: Unwind timer clock on init failure
clocksource/drivers/clps711x: Do not unmap clocksource MMIO
s390/debug: Fix deadlock during unregister
xenbus: Unregister reboot notifier on init failure
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
power: supply: bq27xxx: bq27520g4: fix REG_TTES address
power: supply: bd99954: Drop bad register fields
spi: img-spfi: don't disable runtime PM on DMA deferred probe
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
selftests/bpf: Add description for running vmtest on RV64
selftests/bpf: Support local rootfs image for vmtest
selftests/bpf: Limit URLS parsing logic to actual scope in vmtest
selftests/bpf: Fix vmtest.sh getopts optstring
bpf/docs: Update list of architectures supported.
selfetests/bpf: Adapt vmtest.sh to s390 libbpf CI changes
selfetests/bpf: Update vmtest.sh defaults
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
ubi: Fix rollback for explicit UBI device numbers
ubi: fastmap: Add module parameter to control reserving filling pool PEBs
ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs
ubi: fastmap: Wait until there are enough free PEBs before filling pools
ubi: Simplify bool conversion
ubi: fastmap: Add fastmap control support for module parameter
ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
UBI: Preserve torture flag when rescheduling failed erasures
ubi: Replace erase_block() with sync_erase()
ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap
ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash
ubi: fastmap: Fix missed ec updating after erasing old fastmap data block
ubi: fastmap: Use the bitmap API to allocate bitmaps
ubi: Fix repeated words in comments
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
ASoC: pxa: Use devm_clk_get_optional() for extclk clock
RDMA/cma: Fix WARNING in res_to_rt
RDMA/cxgb4: Free debugfs on registration failure
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
nfc: digital: Do not dump a NULL response in command completion
nfc: pn533: hold a reference to the request skb during send_frame
nfc: llcp: bound SNL TLV parsing to the skb and add length checks
nfc: nci: fix double completion race in nci_data_exchange_complete
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
nfc: llcp: avoid userspace overflow on invalid optlen
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
spi: sprd-adi: Fix probe succeeding without registering the controller
powerpc/configs: enable CONFIG_RAS to fix EDAC support
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
m68k: Fix backtraces for non-running tasks
iommu/vt-d: Fix UCTP context table slot when copying root entries
fbdev: kyro: Validate overlay viewport coordinates
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
perf synthetic-events: Fix uninitialized pthread_join
perf stat: Fix evsel_list leak in cmd_stat
perf stat: Clear screen only if output file is a tty
ARM: dts: helios4: add SATA regulator supplies
ARM: dts: helios4: add vcc-supply to GPIO expander
ARM: dts: helios4: add vcc-supply to EEPROM
arm64: dts: turris-mox: fix usb3 phys
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
flow_offload: rename offload functions with offload instead of flow
iio: light: gp2ap002: re-enable irq if runtime suspend fails
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
Bluetooth: MSFT: validate evt_prefix_len against the response length
Bluetooth: virtio_bt: avoid OOB read of build info string
scsi: sd: Fix sd_done() sense handling condition
perf trace-event: Fix integer truncation in do_read() and skip()
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
sched/fair: Check CPU capacity before comparing group types during load balance
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
coresight: Change syncfreq to be a u8
coresight: etm4x: Cleanup TRCIDR5 register accesses
coresight: etm4x: Cleanup TRCIDR4 register accesses
coresight: etm4x: Cleanup TRCIDR3 register accesses
coresight: etm4x: Cleanup TRCIDR2 register accesses
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
hugetlbfs: release subpool on fill_super failure
pinctrl: rockchip: Reset the pin count when recalculating SoC data
firmware_loader: do not queue completed sysfs fallback requests
firmware_loader: Check fw_state_is_done in loading_store
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
drm/amdgpu/gfx6: Use PFP on the compute queues too
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
perf trace-event: Fix buffer overflow in read_string()
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
ext4: fix spurious message about orphan cleanup on RO fs
drm/amdgpu/gfx6: Fixup emit_cntxcntl()
mfd: iqs62x: Reject zero-length firmware records
mfd: rave-sp: validate received frame payload lengths
arm64: hibernate: Restore DAIF state on error
arm64: hibernate: mask DAIF before restoring hibernated kernel
RDMA/siw: Fix use-after-free in siw_accept()
RDMA/siw: Introduce siw_free_cm_id
IB/isert: post the full-feature receive buffers after session registration
IB/isert: delay the final Login Response until the session is registered
cpufreq: imx6q: fix out-of-bounds write when probed more than once
cpufreq: imx6q: fix devres accumulation across driver rebind
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
drm/sun4i: dw-hdmi: Drop TCON TOP port reference
drm/sun4i: tcon: Drop remote endpoint reference
drm/sun4i: crtc: Propagate layer initialization error
drm/sun4i: tcon: Drop TCON TOP device reference
bitfield: Add non-constant field_{prep,get}() helpers
bitfield: Add less-checking __FIELD_{GET,PREP}()
of: property: use unsigned int return on of_graph_get_endpoint_count()
of: property: add missing kerneldoc for of_graph_get_endpoint_count()
drm/sun4i: vi scaler: Fix coefficient selection
ocfs2: synchronize heartbeat callbacks with o2net teardown
ocfs2: use bitmap API in fill_node_map
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
scripts/tags.sh: Prevent binary files appearing in cscope.files
scripts/tags.sh: improve compiled sources generation
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
remoteproc: Move resource table data structure to its own header
PCI/sysfs: Add static PCI resource attribute macros
drm/omap: dsi: Do not copy isr table
fat: release buffer head after rebuilding parent
rapidio: clear mport->net when rio_add_net() fails
pps-gpio: remove dead capture_clear code
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
pps: clients: gpio: Bypass edge's direction check when not needed
pps: don't try to wait for negative timeouts in PPS_FETCH
lib/string: fix memchr_inv() for large ranges
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
block/blk-iocost: collect per-cpu latency stats over possible CPUs
block/blk-stat: drain per-cpu callback stats over possible CPUs
phonet: pep: do not write beyond optlen in getsockopt
iio: light: tsl2583: return zero in write_raw() on success
iio: light: isl29028: return zero in write_raw() on success
iio: light: tsl2772: fix ALS calibscale readback
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
perf auxtrace: Fix queue grow overflow and old array leak
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
HID: lg4ff: validate report length before fixed offsets
HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling
HID: synchronize input before cleaning up a failed probe
HID: ensure timely release of driver-allocated resources
HID: split apart hid_device_probe to make logic more apparent
tty: clear cdev pointer after cdev_add() failure
serial: amba-pl011: unprepare console clock on unregister
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
firmware: coreboot: Validate table bounds
firmware: google: Add bounds checks in coreboot_table_populate()
wifi: mac80211: skip unused probe response countdown offsets
wifi: zd1211rw: reject secondary interfaces to prevent conflicts
wifi: mac80211: send TWT teardown to peer after setup TX failure
iommu/arm-smmu-v3: Convert to use atomic poll timeout
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
perf machine: Check snprintf truncation for guest kallsyms path
perf machine: Free scandir entries in guest kernel map creation
perf machine: Reset errno before strtol in guest kernel map creation
perf machine: Don't abort guest map creation on first inaccessible dir
perf machine: Check snprintf truncation in machines__findnew()
perf machine: Use snprintf() for guestmount path construction
perf machine: Guard against NULL strlist in machines__findnew()
regulator: core: use system_freezable_wq for init complete work
wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
perf: arm_spe: Make wakeup range check overflow safe
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
wifi: mt76: mt792x: Fix memory leak in SDIO TX path
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
fanotify: report full event length for FIONREAD
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
i3c: master: Fix device_register() error path
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
iommu/dma: Check atomic pool allocation result directly
clk: qcom: Return expected ENOMEM error on dynamic allocation failure
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
bpf: Fix potential UAF in bpf_netns_link_update_prog
power: supply: sc2731_charger: cancel work on remove
power: supply: sc2731_charger: Convert to platform remove callback returning
void
power: supply: isp1704_charger: cancel work on remove
selftests/zram: fix kernel_gte() for POSIX sh
md/raid5-ppl: fix use-after-free in ppl_do_flush()
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
IB/isert: reject login PDUs declaring more data than was received
IB/isert: reject PDUs declaring more data than was received
RDMA/cxgb4: free STAG index when TPT entry write fails
RDMA/mlx5: Send cong param changes to the resolved port mdev
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
scsi: smartpqi: Stop using the SCSI pointer
scsi: smartpqi: Fix BUILD_BUG_ON() statements
scsi: smartpqi: Switch to attribute groups
scsi: core: Register sysfs attributes earlier
scsi: smartpqi: Capture controller reason codes
nilfs2: prevent out-of-bounds read in super root block parsing
nilfs2: fix infinite loop in nilfs_clean_segments()
clk/x86: pmc_atom: add kasprintf return value check
clk: palmas: Manage external-control prepare with devm
clk: tegra: tegra124-emc: put EMC node on register failure
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
RDMA/efa: Fix PBL chunk length computation
fs/ntfs3: reject restart table growth beyond U16_MAX entries
staging: rtl8723bs: use kfree_sensitive() for key material
remoteproc: Prevent crash handling to race with rproc_del()
remoteproc: core: Attach rproc asynchronously in rproc_add() path via
schedule_work()
remoteproc: Use unbounded workqueue for recovery work
w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
isofs: release zisofs block pointer buffer head
RDMA/mlx5: Fix integer overflow of user QP buffer size
crypto: keembay - publish OF module alias for OCS AES/SM4
crypto: keembay - Initialize completion before requesting IRQ
power: supply: sbs-battery: Use a per-device serial number buffer
ARM: lpc32xx: only run SoC init on LPC32xx hardware
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru
arm64: dts: rockchip: Add gru-scarlet-dumo board
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
drm/tve200: add OF module alias for autoloading
leds: pca9532: Fix phantom device registration on missing hardware
perf cs-etm: Avoid truncating AUX buffer sizes to int
perf cs-etm: Flush thread stacks after decoder reset
ARM: dts: allwinner: a10: Fix PMU interrupt
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
ext4: fix buffer_head leak in ext4_init_orphan_info
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
ath11k: add trace log support
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
wifi: ath6kl: avoid buffer overreads in WMI event handlers
ext4: drain in-flight DIO before buffered write fallback
thermal: intel: int3400: clean up ODVP on probe failures
thermal: int340x_thermal: Consolidate priv->data_vault checks
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
iommu/qcom: Remove sysfs device on probe failure path
iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe
RDMA/core: Fix potential use after free in ib_free_cq()
RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()
RDMA/restrack: Fix typos in the comments
RDMA/nldev: Split nldev_stat_set_mode_doit out of nldev_stat_set_doit
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
ext4: skip extra isize expansion during mount to prevent deadlock
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
ACPI: processor: validate MADT IOAPIC entry bounds
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
RDMA/hfi1: Propagate sdma_txinit_ahg() errors
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
ASoC: meson: Keep link pointers valid on realloc failure
dmaengine: dw-edma: Clear stale requests on termination
dmaengine: dw-edma: Serialize channel state checks
dmaengine: dw-edma: Serialize abort state updates
driver core: soc: Unregister bus on early device registration failure
driver core: soc: remove layering violation for the soc_bus
software node: Fix software_node_get_reference_args() with index -1
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
mtd: mtdswap: Avoid freeing registered blktrans device twice
vfio/pci: clear vdev->msi_perm after freeing it on init failure
char: xilinx_hwicap: unregister class on init errors
ppdev: prevent overflow when setting port timeout
misc: ad525x_dpot: use driver core groups for sysfs files
misc: ad525x_dpot: Make ad_dpot_remove() return void
misc: rtsx: add missing write register handling
misc: bcm-vk: Use acquire/release for msgq_inited
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
accessibility: speakup: Fix incorrect string length computation in
report_char_chartab_status()
uio: Fix stale info pointer in failed registration path
UDF symlink pathComponent header OOB read
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
usb: gadget: f_uac1_legacy: remove broken string configfs attributes
ACPI: processor: idle: Expand _LPI package sanity checks
ACPI: move from strlcpy() with unused retval to strscpy()
crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
gpu: host1x: Avoid stack over-read in debug output helpers
gpu: host1x: Fix offset calculation in trace_write_gather
arm64: dts: qcom: sm8250: Add camcc DT node
arm64: dts: qcom: sm8250: remove mmcx regulator
arm64: dts: qcom: sm8250: Use QMP property to control load state
drm/bridge: tc358767: clamp the reported AUX read size to the request
remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
cpufreq: intel_pstate: Fix setting minimum P-state at init time
genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips()
irqdomain: Handle additional domain flags in irq_domain_instantiate()
irqdomain: Introduce irq_domain_instantiate()
irqdomain: Introduce irq_domain_free()
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
libnvdimm/labels: Bound the on-media label size before the shift
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
hfsplus: validate thread record before delete key rebuild
rpmsg: glink: fix deadlock in endpoint destroy during driver detach
rpmsg: glink: remove duplicate code for rpmsg device remove
rpmsg: glink: Remove the rpmsg dev in close_ack
isofs: fix out-of-bounds page array access on empty zisofs block
fs/isofs: replace kmap() with kmap_local_page()
RDMA/hfi1: Initialize debugfs after probe completes
RDMA/hfi1: Stop flushing the global IB workqueue
RDMA/hfi1: Create workqueues before device initialization
RDMA/hfi1: Remove redundant PCI device ID validation
RDMA/hfi1: Free RX data on late probe failure
RDMA/hfi1: Preserve unit 0 on allocation failure
misc: rtsx_usb: avoid USB I/O in runtime autosuspend
pmdomain: bcm: bcm2835: handle genpd provider registration errors
ALSA: hpi: Check transport errors during HPI6000 adapter initialization
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
hwrng: ks-sa - Fix runtime PM cleanup on registration failure
hwrng: ks-sa - access private data via struct hwrng
RDMA/ipoib: Drain RCU callbacks during module teardown
RDMA/mlx5: Drain RCU callbacks during module teardown
RDMA/mlx: Calling qp event handler in workqueue context
RDMA/mlx4: Avoid flush_scheduled_work() usage
RDMA/core: Wait for RCU callbacks before unloading ib_core
RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
drm/panel: samsung-s6d16d0: Power off on prepare failure
usb: renesas_usbhs: Fix power-off ordering on unbind
usb: mtu3: allow system suspend during active gadget connection
platform/surface: acpi-notify: Check ACPI companion before use
platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
usb: gadget: configfs: fix out-of-bounds read of qw_sign
hwspinlock: propagate errno when registering single lock
platform/x86: dell-wmi-base: Fix resource leak on module load failure
platform/x86: dell-privacy: Fix race condition
leds: pca9532: Fix inverted GPIO output polarity
iommu/amd: Fix false positive in SB IOAPIC IVRS validation
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
iommu/msm: Return -ENOMEM on memory allocation failure in probe
iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
efi: fix stale reference to efi_recover_from_page_fault()
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
udf: Mark LVID buffer as uptodate before marking it dirty
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
clk: qcom: gdsc: Release pm subdomains in reverse add order
clk: qcom: gdsc: enable optional power domain support
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
timekeeping: Account for monotonicity adjustment in ntp_error
y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
clocksource: Unregister subsystem on device registration failure
selftests: timers: leap-a-day: Fix -w option and update usage comment
irqchip/gic-v3-its: Fix memleak in its_probe_one()
selftests/bpf: Fix memory leak in msg_alloc_iov
selftests/bpf: Fix memory leak in msg_alloc_iov error path
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
staging: octeon: replace pr_warn with dev_warn in fill and rx paths
staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
staging: switch to netif_napi_add_weight()
netdev: reshuffle netif_napi_add() APIs to allow dropping weight
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
staging: fbtft: Use sysfs_emit_at() to print to sysfs file
greybus: audio: bound the topology section sizes against the fetched size
staging: sm750fb: gate dualview dataflow using g_dualview
staging: greybus: audio: correct sscanf() return value check
PM: sleep: Fix off-by-one in wakelocks number limit check
bus: ti-sysc: Fix /chosen node reference leak
nvmet-rdma: fix response resource leak on queue teardown
nvmet-rdma: factor out response resource cleanup
nvmet-rdma: use sbitmap to replace rsp free list
nvmet-rdma: avoid circular locking dependency on install_queue()
crypto: sa2ul - stop probe if context pool creation fails
crypto: sa2ul - Use the defined variable to clean code
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
crypto: atmel-ecc - reject hardware ECDH without a public key
crypto: atmel-ecc - clean up and improve ECDH comments
crypto: atmel-ecc - replace min_t with min
crypto: qat - clear AES key schedule from stack
platform/chrome: sensorhub: Fix memory overread in ring handler
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
csky: Fix a4/a5 restoration in syscall trace path
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and
device exposure
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA
interrupt handlers
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
tools/bpf/bpftool: Reset vmlinux BTF after map commands
bpftool: Fix pretty print dump for maps without BTF loaded
bpftool: Use libbpf_get_error() to check error
bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
perf tests: Fix flakiness in BPF counters test on hybrid systems
perf test: Fix perf stat --bpf-counters on hybrid machines
perf test: Use sqrtloop workload to test bperf event
perf test stat_bpf_counter.sh: Stabilize the test results
perf test bpf-counters: Add test for BPF event modifier
perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test
perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
pinctrl: bcm2835: Don't remove an unregistered GPIO chip
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
drm/lima: call drm_mm_init() with a valid allocation range
clk: imx: scu: drop redundant init.ops variable assignment
ARM: imx: fix device_node refcount leaks in imx7_src_init()
ARM: imx: fix device_node refcount leak in imx_src_init()
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
ASoC: rt700-sdw: always drain jack work on remove
clk: moxart: remove unused variables, fix refcount leak
media: cec-pin: Fix event FIFO ordering
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
HID: roccat: bound device-supplied profile index
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
smack: restrict smackfs/{direct,mapped} values to 0-255
smack: deduplicate smackfs/{direct,mapped} file_operations
smack: simplify write handlers of sysfs entries
smack: fix incorrect task context in smack_msg_queue_msgrcv
Smack: fix W=1 build warnings
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
bpf: Enforce expected_attach_type for tailcall compatibility
clk: meson: align gxbb_32k_clk_sel number of parents with actual count
firmware: stratix10-svc: Add mutex in stratix10 memory management
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
batman-adv: bla: avoid CRC corruption due to parallel claim add
batman-adv: dat: atomically update mac addresses
ksmbd: fix FSCTL permission bypass by adding a permission check for
FSCTL_SET_SPARSE
ksmbd: fix overflow in dacloffset bounds check
net: hns3: don't auto enable misc vector
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
net: af_key: zero aligned sockaddr tail in PF_KEY exports
bridge: mrp: reject zero test interval to avoid OOM panic
net: fix NULL pointer dereference in l3mdev_l3_rcv
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
ax25: fix use-after-free bugs caused by ax25_ds_del_timer
bpf: Guard stack limits against 32bit overflow
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
mm/damon/vaddr-kunit: check region count in three_regions test
mm/damon/vaddr: drop last same folio access check optimization
mm/damon/core-kunit: check region count before testing in split_at()
tcp: clear sock_ops cb flags before force-closing a child socket
xhci: fix lost bounce buffers on TDs spanning several ring segments
drm/nouveau: Use write-combined maps for coherent
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
drm/gud: validate TV mode names before creating enum property
drm/gud: NUL-terminate TV mode names read from the device
drm/amd/display: avoid divide-by-zero in __is_lut_linear()
drm/hibmc: Fix list of formats on the primary plane
drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
drm: fix race between partial drm_dev_register() failure and ioctl
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
f2fs: fix i_size when pinned fallocate partially fails
f2fs: return writeback error from collapse range
f2fs: reject overlapping move range after len expansion
f2fs: return symlink writeback errors
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
scsi: qla2xxx: Avoid double completion in async IOCB timeout
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
scsi: qla2xxx: Don't query firmware state while chip is down
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
scsi: qla2xxx: Serialize flash version read in reset handler
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
media: vimc: fix pixel format lookup in enum_framesizes
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
media: venus: fix payload size calculation in parse_raw_formats()
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
media: tda18250: fix possible integer overflow
media: s2255: check firmware size before reading trailing marker
media: s2255: bound JPEG frame size before copying into the buffer
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
media: rc: sunxi-cir: Unregister rc device on probe failure
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
media: i2c: ov7740: fix use-after-destroy in remove
media: i2c: ov02a10: fix endpoint parsing use-after-free
media: go7007: defer the ALSA v4l2 put until card release
media: em28xx: fix use-after-free of dev_next->devlist on disconnect
media: em28xx: defer audio-only extension registration
media: cx23885: cancel NetUP CI work before teardown
media: cx231xx: reject geometry changes while the VBI queue is busy
media: cobalt: Avoid freeing ALSA private data twice
media: cedrus: fix memory leak in cedrus_init_ctrls()
media: cec: Serialize exclusive follower delivery
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
KVM: s390: Restore sigset on error path
KVM: s390: Zero initialize irq in reinject_machine_check
KVM: s390: Free guest debug data on vcpu destroy
KVM: s390: Fix old_data leak in guest debug error path
KVM: s390: Fix memory leak in guest debug handling
KVM: s390: Fix length check __import_wp_info()
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
KVM: nVMX: Always flush vpid02 on first use
iio: temperature: hid-sensor-temperature: switch to non-devm
iio_device_register()
iio: srf04: fix pm_runtime handling on probe error path
iio: light: gp2ap002: Disable regulators on resume failure
iio: light: cm32181: return zero after writing calibscale
iio: gyro: mpu3050: fix sign of raw angular velocity readings
iio: dac: m62332: Fix regulator reference count imbalance
iio: chemical: sgp30: Handle IAQ thread creation failure
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment
without of_node_get
AsoC: intel: sst: fix PCI device reference leak on probe failure
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
ASoC: cs35l34: drain threaded IRQ before runtime suspend
ASoC: cs35l33: drain threaded IRQ before runtime suspend
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
batman-adv: bla: prevent CRC corruptions after claim flush
batman-adv: bla: fix freeing of claims on meshif deletion
batman-adv: dat: avoid unaligned fault in IP extraction
batman-adv: fix stale receive device on merged fragments
mtd: rawnand: validate ONFI extended parameter page sections
mtd: mtdoops: free page bitmap when the backing MTD is removed
mtd: afs: validate v2 image info bounds
parisc: Fix alignment of asm statements in head.S
parisc: eisa: Fix infinite loop when parsing invalid IRQ value
nvdimm/btt: reject an arena whose nfree is below the lane count
Revert "irqchip/mbigen: Fix mbigen node address layout"
nvmet-tcp: reject unsolicited H2CData PDUs
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
nvme-tcp: check the data direction of a C2HData PDU
ALSA: pcm: Fix race between non-atomic ops and trigger-start
ALSA: harmony: initialize locks before requesting IRQ
i2c: mux: Fix channel node leak on adapter add failure
i2c: core: fix debugfs UAF on adapter removal
perf/x86/intel: Fix kernel address leakages in LBR stack
Input: aiptek - switch to using dev_groups for driver-specific attributes
Input: aiptek - validate raw macro indices before updating state
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
ata: ahci: work around lost interrupts on Marvell 88SE61xx
block: flag zoned disks with GENHD_FL_NO_PART
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
dmaengine: dw-edma: Complete descriptors before pausing
dm: fix resume-vs-remove race
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
HID: rmi: fix OOB access with undersized RMI reports
scsi: pm8001: Use rollback index when freeing MSI-X vectors
scsi: target: iscsi: Reserve a terminator byte for the login payload
thermal/drivers/qoriq: Disable clock on resume failure
thermal/drivers/imx: Disable clock on runtime resume failure
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
usb: gadget: fix null pointer dereference in usb_put_function_instance()
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
usb: typec: ucsi: displayport: Fix OOB altmode array index
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
usb-storage: ene_ub6250: fix race between scan work and probe
media: usbtv: keep device alive while ALSA card exists
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
usb: image: mdc800: change kmalloc() to kzalloc()
espintcp: remove encap socket caching to avoid reference leak
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
tracing/mmiotrace: Remove reference to unused per CPU data pointer
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
net: ntb_netdev: Fix TX busy and drop handling
ALSA: seq: Fix port lock leak in deliver_to_subscribers()
selinux: reject an unclaimed class value in security_get_classes()
selinux: avoid implicit conversions in services code
tcp: fix potential race in tcp_v6_syn_recv_sock()
fsnotify: Fix stale object mask after concurrent mark updates
entry: Fix seccomp bypass after ptrace with TSYNC
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
openvswitch: Fix CT limit teardown use-after-free
net: openvswitch: fix kernel-doc warnings in internal headers
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
udf: Fix i_lenExtents truncation on 32-bit kernels
timer: Keep debugobjects state consistent in migrate_timer_list()
taskstats: fix cpumask parsing cutting off the last character
smack: fix cred UAF in smack_file_send_sigiotask()
signal: avoid shared siginfo namespace rewrites
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
w1: ds28e17: reject an oversize length on an I2C block read
vsock/virtio: flush works in dependency order
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
i3c: master: svc: bound IBI payload to the requested max_payload_len
i3c: master: Fix info leak and UAF in device unregister path
dm-switch: use WRITE_ONCE() in switch_region_table_write()
dm-stats: fix a crash if allocation of per-cpu data fails
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
ALSA: virmidi: Check card index validity at probe
ALSA: serial-u16550: Check card index validity at probe
ALSA: portman2x4: Check card index validity at probe
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
ALSA: mts64: Check card index validity at probe
ALSA: mpu401: Check card index validity at probe
ALSA: bcd2000: clear the URB pointers on disconnect
ALSA: aloop: Check card index validity at probe
ALSA: 6fire: bound the MIDI event length from the device
seg6: reset IP6CB after IPv6 decapsulation
net: cap advertised IP tunnel headroom
net/smc: fix socket refcount leak in smc_switch_conns()
net: ntb_netdev: Count packets dropped on RX refill failure
net: ntb_netdev: Avoid double-accounting netif_rx() drops
NTB: ntb_transport: Reject oversized TX buffers
NTB: ntb_transport: Fail TX enqueue when the QP link is down
NTB: ntb_transport: Recycle TX entries before client callbacks
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
net: openvswitch: fix flow mask use-after-free on flow deletion
net: tun: bound receive headroom
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
slip: fix use-after-free in sl_sync()
xdp: fix zero-copy frame layout
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
ipmi: si: Fix NULL pointer dereference after failed registration
ipmi: ipmb: validate write message length
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
platform/chrome: sensorhub: Bound the EC-reported sensor number
mmc: via-sdmmc: stop card-detect handling on probe failure
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
iommu/vt-d: Fix no_iommu to disable platform opt-in
PCI/proc: Use file_ns_capable() when checking config space read access
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
PCI: meson: Fix GPIO state while requesting PERST#
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
s390/dasd: Propagate partial completion length across ERP recovery
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
s390/dasd: Do not complete a failed ESE read as successful
power: supply: max17040: synchronize work cancellation on suspend
power: supply: ucs1002: fix use-after-free on remove
power: supply: twl4030_charger: cancel workers via devm
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
power: supply: cros_usbpd-charger: bound the EC-reported port count
power: supply: bq256xx: drain usb_work before freeing the charger
power: supply: bq24257: fix use-after-free on remove
sctp: fix stream->outcnt underflow on duplicate RECONF responses
sctp: distinguish sequence zero from wildcard in reconf lookup
sctp: fix NULL deref on untransmitted RECONF completion
sctp: drop a chunk if its transport was removed
sctp: stop processing a packet once its association is deleted
nvme-tcp: reject a read that transferred too few bytes
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
nvme: zero the discard fallback page
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
lockd: pin next file across nlm_inspect_file lock-drop
hwmon: (max6621) fix temperature clamp range
hwmon: (max6621) fix negative temperature offset and crit readings
openvswitch: only skb_tx_error() a packet we are about to drop
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
ocfs2: fix readdir position truncation on 32-bit kernels
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
ocfs2: validate rl_used against rl_count in refcount block validator
ocfs2: validate lengths in dlm_mig_lockres_handler
ocfs2: bound namelen in dlm_migrate_request_handler
ocfs2: always run deallocs on copy-on-write completion
orangefs: skip leading spaces before parsing client debug masks
orangefs: fix double-free of trailer_buf on readdir copy failure
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership
transferred to rdata
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving
dangling of_node pointer
RDMA/ucma: Lock the handler in ucma_set_ib_path()
RDMA/cxgb4: Cancel reg_work before freeing device on remove
qede: Fix NULL pointer dereference in TPA fragment processing
remoteproc: scp: Fix device reference leak on failed lookup
rpmsg: glink: smem: order FIFO read after availability check
staging: media: tegra-video: vi: fix probe failure on skipped last port
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
udf: reject VAT indexes equal to the entry count
svcrdma: Fix pcl_for_each_segment for empty chunks
svcrdma: Fix offset arithmetic in read_chunk_range
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
sunrpc: init gssp_lock before publishing proc entry
SUNRPC: harden gss_unwrap_resp_priv length checks
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
SUNRPC: always drain cache_cleaner before destroying a cache_detail
sunrpc: route to a populated pool in svc_pool_for_cpu()
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
mpls: reload header after pskb_may_pull()
md: do overflow check for sb->bblog_shift in super_1_load()
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
ipv6: use RCU iterator to dump route exceptions
ip6_gre: fix hardware header length for NBMA tunnels
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Confirmed
** Affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168726
Title:
Jammy update: v5.15.221 upstream stable release
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2168726/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
