x86/bugs: Make Safe-RET robust against interrupt injection
netfilter: nf_conntrack_expect: restore helper propagation via expectation
netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
net: mpls: initialize rtm_tos in mpls_getroute()
HID: logitech-dj: Standardise hid_report_enum variable nomenclature
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
ata: sata_mv: accept 1 or 2 resources in platform probe
ata: libahci_platform: support non-consecutive port numbers
ahci: Introduce ahci_ignore_port() helper
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
btrfs: zoned: fix deadlock between metadata writeback and transaction commit
phy-zynqmp: Postpone getting clock rate until actually needed
phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
phy: zynqmp: fix runtime PM leak on probe allocation failure
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
drm/mediatek: Check CRTC state before freeing
keys: fix out-of-bounds read in keyring_get_key_chunk()
keys: make keyring key-chunk byte order agree with keyring_diff_objects()
assoc_array: trim the final shortcut word using the current chunk end
netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
ipvs: fix the checksum validations
ipvs: fix places with wrong packet offsets
ipvs: do not mangle ICMP replies for non-first fragments
netfilter: nft_payload: fix mask build for partial field offload
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
pinctrl-amd: Don't clear S4 wake bits at probe
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
smb: client: fix buffer leaks in SMB1 read and write
spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
hwmon: (lm90) Only report alarms if driver is ready
hwmon: (nzxt-smart2) DMA-align output buffer
net: do not send ICMP/NDISC Redirects when peer allocation fails
hwmon: (nct6775-core) Prevent access to unsupported weight registers
net: bridge: mrp: fix Option TLV length in MRP_Test frames
forcedeth: fix UAF of txrx_stats in nv_remove
hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
hwmon: (adt7470) Fix cache updated before hardware write on I2C error
hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
hwmon: (adt7470) Use cached PWM frequency value
hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
hwmon: (adt7470) Fix PWM auto temp state array and bounds check
powerpc/boot: Fix simpleboot CPU node lookup check
powerpc/boot: Fix treeboot-currituck CPU node lookup check
powerpc/boot: Fix treeboot-akebono CPU node lookup check
wifi: mac80211: validate individual TWT params before driver setup
hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
Bluetooth: btintel: Validate length before parsing diagnostics TLV
Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
net: phylink: put link_gpio if phylink_create fails
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
scsi: ufs: core: Cancel RTC work in active-active suspend
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
scsi: target: Clear cmd_cnt when initial counter enrollment fails
net: sxgbe: free TX rings on RX allocation failure
net: sxgbe: check descriptor ring allocation failures
can: isotp: check register_netdevice_notifier() error in module init
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
accel/qaic: use sizeof(*trans_hdr) for transaction length check
net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
octeontx2-pf: Set correct sequence for carrier off and tx queue stop
qede: sync udp_tunnel ports outside qede_lock in the recovery path
ksmbd: return success for deferred final close
ksmbd: fix use-after-free in __close_file_table_ids()
rhashtable: clear stale iter->p on table restart
pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
pinctrl: devicetree: don't free uninitialized dev_name on error path
erofs: cap LZMA stream pool size
pinctrl: bm1880: add missing select GENERIC_PINCONF
mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
mm/hugetlb: fix list corruption in allocate_file_region_entries()
mm/vmstat: fold stranded per-cpu node stats when a node comes online
tracing/probes: Reject $arg0 in meta argument expansion
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
sctp: validate Adaptation Indication parameter length
audit: fix potential integer overflow in audit_log_n_string()
audit: fix potential use-after-free in audit_del_rule()
Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
Bluetooth: mgmt: fix pending command UAF in EIR updates
Bluetooth: mgmt: fix UAF in pair command cancellation
Bluetooth: HIDP: reject frames without a transaction header
Bluetooth: HIDP: validate numbered report payloads
bpf: lwt: Fix dst reference leak on reroute failure
ALSA: 6fire: Fix UAF at error handling during probe
ALSA: lx6464es: fix period byte count for 16-bit streams
ALSA: pcm: wake linked drain waiters on unlink
ALSA: ump: fix double free of out_cvts on rawmidi error
ASoC: tas2562: fix DVC coefficient write order
ASoC: tas2562: fix broken entries in the volume lookup table
ata: libata-eh: Increase STANDBY IMMEDIATE timeout
ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
ALSA: usb-audio: Clamp frame size in implicit-feedback mode
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
e1000: fix memory leak in e1000_probe()
igbvf: Fix leak in TX DMA error cleanup
ipvs: do not propagate one-packet flag to synced conns
net/smc: fix socket use-after-free during link group termination
netfilter: ipset: do not update comments from kernel-side hash adds
tipc: avoid use-after-free in poll trace queue dumps
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
binfmt_misc: reject a flag character as the field delimiter
mm/page_reporting: use system_freezable_wq to fix UAF during suspend
net: bridge: stop fast-leave after deleting a port group
net: ipv6: clear suppressed fib6 rule result
powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
um: vector: fix use-after-free in vector_mmsg_rx()
vxlan: re-fetch eth header after route_shortcircuit()
vxlan: unclone skb head before modifying eth header in route_shortcircuit()
vxlan: use neigh_ha_snapshot() in route_shortcircuit()
vxlan: use pskb_network_may_pull() in route_shortcircuit()
ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
tracing: Check return value of __register_event() in trace_module_add_events()
tracing/filters: Fix false positive match in regex_match_full()
spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
selftests/mm: fix potential wild pointer access of getline due to missing init
selftests/clone3: fix wild pointer access of getline due to missing init
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
sctp: reject stale cookies with mismatched verification tags
sctp: prevent peer transport count overflow
hwmon: (npcm750-pwm-fan): stop fan timer on device detach
hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
i2c: amd-mp2: Unregister callback on adapter add failure
gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
power: supply: bq25890: fix the -10 C NTC lookup entry
s390/qeth: Check CAP_NET_ADMIN for private ioctls
s390/dasd: Fix potential NULL pointer dereference
s390/dasd: Fix undersized format-check buffer
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
s390/zcrypt: Validate length for CCA AES cipher key requests
s390/zcrypt: Validate length for CCA ECC private key requests
phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
phy: zynqmp: use read-modify-write for SERDES scrambler bypass
phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
net: openvswitch: fix potential UAF on meter attach failure
net: openvswitch: fix skb leak on flow key update failure during recirculation
net: openvswitch: fix skb leak on flow key update failure during ct
ice: wait for reset completion in ice_resume()
ice: fix memory leak in ice_lbtest_prepare_rings()
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
i2c: imx: Fix slave registration race and error handling
i2c: imx: Cancel hrtimer before clearing slave pointer
can: c_can: c_can_chip_config(): keep controller in init mode until bittiming
is configured
can: ems_usb: validate CPC message lengths
can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit
failure
can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation
failure
can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in
kvaser_usb_hydra_get_busparams()
can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command
extents
can: softing: fw_parse(): validate firmware record spans
can: peak_usb: add bounds check for USB channel index
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB
submit error
can: peak_usb: validate uCAN receive record lengths
can: ctucanfd: add missing MODULE_DEVICE_TABLE()
can: ctucanfd: use self-test mode for PRESUME_ACK
can: ctucanfd: unmap BAR0 using base address
can: ctucanfd: handle bus error interrupts
can: ctucanfd: mark error-active controller status valid
drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
drm/vc4: Zero the tile state data array before each BIN job
drm/mediatek: ovl_adaptor: balance component registrations
drm/amdgpu: restore UMD profile pstate after runtime resume
drm/amdgpu: cap GTT size to physical RAM on APUs
drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
drm/amdkfd: fix QID bit leak in pqm_create_queue()
drm/amdkfd: Handle invalid event type in CRIU event restore
drm/amdkfd: hold event_mutex while checkpointing CRIU events
drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
drm/vmwgfx: reject DX_BIND_QUERY without a DX context
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
drm/vmwgfx: bound DMA command body size against suffix pointer
drm/vmwgfx: use check_add_overflow for shader size+offset bound
drm/vmwgfx: validate external BO copy bounds for both stride paths
spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
HID: logitech-dj: Fix maxfield check in DJ short report validation
ata: libahci_platform: Do not set mask_port_map when not needed
ata: ahci: Make ahci_ignore_port() handle empty mask_port_map
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
gpio: pch: use raw_spinlock_t for the register lock
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
usb: typec: ucsi: Only enable supported notifications
usb: typec: ucsi: split connector lock classes
UBUNTU: SAUCE: Revert "UBUNTU: SAUCE: usb: typec: ucsi: Fix workqueue
destruction race during connector cleanup"
usb: typec: ucsi: Fix race condition and ordering in port unregistration
drm/fb-helper: Allocate and release fb_info in single place
drm/tegra: fbdev: Remove offset into framebuffer memory
drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
drm/i915/vrr: require valid min/max vfreq for VRR
media: i2c: imx219: Rename VTS to FRM_LENGTH
media: imx219: Fix maximum frame length in lines
rxrpc: Fix irq-disabled in local_bh_enable()
netfilter: nf_tables: clone set on flush only
wifi: ath6kl: fix use-after-free in aggr_reset_state()
wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
wifi: brcmfmac: drain bus_reset work on device removal
can: use skb hash instead of private variable in headroom
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
mptcp: pm: avoid code duplication to lookup endp
mptcp: add mptcp_userspace_pm_lookup_addr helper
mptcp: pm: use addr entry for get_local_id
mptcp: pm: userspace: fix use-after-free in get_local_id
drm/i915/fbc: Extract intel_fbc_has_fences()
drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind
drm/i915/hdcp: Move to using intel_display in intel_hdcp
drm/i915/hdcp: require monotonically increasing seq_num_v
drm/i915/hdcp: check streams[] bounds before overflow
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
mount: honour SB_NOUSER in the new mount API
selftests/bpf: Fail unbound UDP on sockmap update
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
ARM: npcm: Fix OF node refcount leaks in SMP setup
ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
drm/bridge: ps8640: propagate AUX transfer register errors
Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
netfilter: ipset: switch ext_size to atomic64_t
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
ipvs: return the csum validation for forward hook
btrfs: fix memory leak in btrfs_do_encoded_write()
bpf: Preserve pointer state for commuted arithmetic
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in
smc_llc_event_handler()
net/sched: cls_route: fix fastmap use-after-free on filter
net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
devlink: fix net namespace reference leak in reload
net/mlx5: fw_tracer, return NULL on create error
counter: microchip-tcb-capture: Fix DT channel validation
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
bpf: tcp: Get rid of st_bucket_done
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
bpf: tcp: Avoid socket skips and repeats during iteration
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
vhost/vdpa: reject overflowing PA map page counts on 32-bit
tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
udp: fix potential use-after-free in tunnel segmentation
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
net/openvswitch: check Ethernet header length in key_extract()
net: sched: cls_api: add skip_sw counter
net: sched: cls_api: add filter counter
net: sched: make skip_sw actually skip software
net: sched: cls_api: fix slab-use-after-free in fl_dump_key
net: sched: refine software bypass handling in tc_run
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
hwmon: (nzxt-smart2) Check return value of init_device() in probe
hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
selftests/ftrace: refactor eprobes test to fix argument checks
bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
bnxt_en: Fix PTP PPS setting bug
sctp: fix addip_serial increment on ASCONF_ACK allocation failure
tcp: fix TFO max_qlen accounting across reuseport migration
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
net: prestera: validate firmware header length
net: remove WARN_ON_ONCE() from sk_mc_loop()
net/smc: fix TOCTOU race between smc_listen_out() and listener close
net: thunderbolt: Tear down DMA paths before stopping the rings
ata: pata_sl82c105: fix bridge revision use-after-free
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
sctp: clear control chunk transport if it is being removed
tls: don't abort the connection on signal-interrupted sends
hwmon: (corsair-psu) fix possible out-of-bounds access on missing string
termination
regulator: devres: add API for reference voltage supplies
hwmon: (ads7828) Fix external VREF regulator handling
net: fec: do not release NULL pages when RX buffer allocation fails
spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
Input: evdev - sanitize event type index when fetching event masks
ALSA: usb-audio: fix OOB write on Type II inbound URBs
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
thunderbolt: icm: Preserve USB4 proxy data-valid bit
usb: cdnsp: fix incorrect endian conversions for APB timeout register
usb: gadget: f_ncm: Use unsigned int for ndp_index
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
vt: add permission check for KDSKBMETA ioctl
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
Input: evdev - fix information leak in evdev_pass_values()
ima: fix out-of-bounds read in xattr_verify()
ipvs: stop estimator after disabled calc phase
ipvs: add totalconns for dest
ipvs: properly update the overload flag on dest edit
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
packet: use consistent hard_header_len in non-ring send paths
packet: use consistent hard_header_len in TX_RING send path
net/packet: reset the MAC header on the packet-socket transmit path
packet: synchronize pressure clearing with ring reconfiguration
net: openvswitch: reallocate update replies for mismatched IDs
net/sched: reject overly deep qdisc hierarchies
net: octeontx2-pf: Fix UB in shift operation
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
mac802154: fix netdev use-after-free in beacon worker
netfilter: ebt_nflog: pin the NFLOG backend
net: bridge: mrp: fix uninitialised bytes on the wire
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
KVM: s390: pci: Fix missing error codes and memory unaccounting
KVM: s390: pci: Fix resource leak on IRQ registration failure
KVM: s390: pci: Fix aisb calculation
dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
futex: Prevent robust futex exit race some more
fortify: refactor test_fortify Makefile to fix some build problems
fortify: Disable -Wstringop-overread in tests
pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
selftests/bpf: Adapt sockmap update error handling
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
ipv4: fix use-after-free in fib_nhc_update_mtu()
mei: pull kvfree out of spinlock
serial: 8250_dma: Clear stale RX state on shutdown
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
staging: rtl8723bs: fix OOB read in WMM_param_handler()
staging: rtl8723bs: fix missing shared-key auth challenge length check
staging: rtl8723bs: validate monitor transmit frame lengths
misc: fastrpc: fix channel ctx ref leak when session alloc fails
misc: fastrpc: Remove buffer from list prior to unmap operation
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
ALSA: usx2y: bound the hwdep mmap fault offset
tracing: Fix race between update_event_fields and, event_define_fields
fbdev: bitblit: bound-check glyph index in bit_cursor()
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
netfilter: bridge: release template ct on non-IP path
netfilter: nf_conntrack: defer invalid log until after unlock
net: atlantic: free stranded TX buffers on ring deinit
net: atlantic: free RX pages of consumed but not refilled buffers
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
net/sched: act_gact, act_police: range check the fallback control action
ovl: don't warn when the mount is completed from another user namespace
xdp: reject clones that overrun skb_shared_info tailroom
vxlan: do not arm the ageing timer on a device that is down
vsock/virtio: read virtqueues under worker locks
vsock/virtio: avoid refilling the RX queue after teardown
veth: fix skb length accounting after XDP frag adjustment
vhost: reset the vring metadata cache on vring reconfiguration
tls: don't leave a full plaintext sk_msg ring unpushed
tipc: read le->link under the node lock in tipc_node_link_down()
smb: client: Fix use-after-free in cifs_try_adding_channels()
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
eventfs: Fix use-after-free in eventfs_remove_rec()
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
ptp: ocp: Fix board ID over-read
ipv6: fix Route Information option length validation
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
bpf, sockmap: Fix sk_redir use-after-free in send verdict
scsi: scsi_debug: Negate wrapped memcmp() result
sctp: keep chunk->transport in step with the list it is queued on
sctp: fix use-after-free of cached ASCONF chunk
sctp: clear new_transport when removing a peer
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
bpf: tcp: fix double sock release on batch realloc
regulator: devres: fix devm_regulator_get_enable_read_voltage() return
block: stop the timeout timer when releasing a never added disk
f2fs: fix UAF issue in f2fs_merge_page_bio()
ipvs: separate destination availability state
net: mana: Fix EQ leak in mana_remove on NULL port
selinux: require every boolean value to be defined
selinux: reject a class permission count below its inherited common
selinux: do not cancel a policy conversion that never started
selinux: reject an unclaimed class value in security_get_classes()
selftests: mptcp: join: mark tests with data corruption as failed
mptcp: avoid combining some incoming suboptions
mptcp: options: reset DSS fields in case of unexpected size
mptcp: fastopen: only mark MPTFO subflows with SYN data
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
ASoC: cs4265: sort the register default table
ASoC: cs35l45: sort the register default table
ASoC: cs35l41: sort the register default table
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
fbdev: core: Fix pointer desynchronization in fb_io_read()
drm/amdgpu: fix aperture iounmap skipped on device removal
Input: xpad - add support for ZENAIM LEVERLESS
powerpc/pseries: pci - logic bug
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Input: psxpad-spi - set driver data before use
Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
Input: iforce - validate input packet lengths
powerpc/pseries: lparcfg - fix kbuf[] underflow
Input: synaptics-rmi4 - zero report size on F54 work error
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
Input: synaptics-rmi4 - block s_input when F54 queue is busy
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
Input: hynitron_cstxxx - validate touch count and finger IDs
crypto: qce - fix error path in devm_qce_register_algs
libceph: fix multiple unsafe decodes in decode_locker()
ftrace: Protect direct_functions in ftrace_find_rec_direct
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
openrisc: signal: do not restore privileged SR bits on sigreturn
Input: sur40 - fix input device registration ordering
Input: sur40 - fix V4L error path cleanup
libceph: Avoid using invalid osd indices from primary_temp
ceph: fix MDS random selection readiness predicate
libceph: tolerate addrvecs with multiple entries of the same type
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
mmc: sdhci: unmap the bounce buffer before device release
mmc: sdhci: make tuning_err a signed int
drm/radeon: fix autosuspend cleanup during teardown
s390/vfio_ccw: Limit the number of channel program segments
s390/vfio_ccw: Cancel existing workqueues
s390/vfio_ccw: Ensure index for read/write regions are within range
s390/vfio_ccw: Fix out of bounds check on CCW array
s390/vfio_ccw: Move cp cleanup out of not operational
s390/vfio_ccw: Selectively expand io_mutex
drm/amdgpu: Reject UVD message with invalid number of h265 refs
drm/amdgpu: validate GEM_CREATE domain combinations
drm/amdgpu: Reject UVD message with dimensions above 4096
drm/amdgpu: Implement insert_end for VCE 3
drm/amdgpu: Fix UVD min buffer sizes
drm/amdgpu: Fix UVD dpb min size calculation for H264
drm/amdgpu: Fix UVD decode image min size calculation
drm/amdgpu: disallow multiple FENCE chunks in one submit
xfs: only check mergeability of bnobt records
xfs: fix ilock leak on error in xfs_dq_get_next_id
xfs: don't swallow dquot recovery verification errors
xfs: check v5 superblock features early
ceph: avoid fs reclaim while using current->journal_info
ceph: Remove ceph_writepage()
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
ceph: Use a folio in ceph_page_mkwrite()
libceph: Amend checking to fix `make W=1` build breakage
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
mm: userfaultfd: add pgtable_supports_uffd_wp()
userfaultfd: move vma_can_userfault out of line
userfaultfd: prevent registration of special VMAs
libceph: fix two unsafe bare decodes in decode_lockers()
net/sched: serialize qdisc_rtab_list against concurrent get/put
super: fix emergency thaw deadlock on frozen block devices
smb: move smb_version_values to common/smbglob.h
smb: move get_rfc1002_len() to common/smbglob.h
smb/server: rename include guard in smb_common.h
ksmbd: rename smb2_get_msg to smb_get_msg
smb/server: fix minimum SMB2 PDU size
ksmbd: validate minimum PDU size for transform requests
tcp: Pass flags to __tcp_send_ack
tcp: fast path functions later
tcp: challenge ACK for non-exact RST in SYN-RECEIVED
btrfs: add debug build only WARN
btrfs: add space_info argument to btrfs_chunk_alloc()
btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
btrfs: zoned: fix missing chunk metadata reservation
mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
ASoC: tas2562: Validate values for volume writes
igc: remove napi_synchronize() in igc_down()
ksmbd: conn lock to serialize smb2 negotiate
ksmbd: reject repeated SMB2 NEGOTIATE requests
net: pktgen: fix code style (WARNING: Block comments)
net: pktgen: fix proc entry use-after-free
veth: convert frag_list skbs before running XDP
fs: don't block write during exec on pre-content watched files
binfmt_misc: restore write access when removing an entry
ice: fix VF interrupts cleanup
vxlan: Do not alloc tstats manually
net: core,vrf: Change pcpu_dstat fields to u64_stats_t
vrf: Make pcpu_dstats update functions available to other modules.
vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
vxlan: use pskb_network_may_pull() for transmit path header pulls
i2c: bcm-iproc: remove printout on handled timeouts
i2c: iproc: reset bus after timeout if START_BUSY is stuck
can: rcar_canfd: change the initializing flow for clocks and resets
drm/amd/pm: fix torn gpu metrics reads
drm/amd/pm: fix pptable use-after-free
drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
mm/pagewalk: split walk_page_range_novma() into kernel/user parts
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
mm/ptdump: always stabilise against page table freeing using init_mm
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
mm/huge_memory: fix huge_zero_pfn race
arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
crypto: ccm - Set rfc4309 maxauthsize from child
netfilter: ipset: fix refcount race between list:set GC and swap
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
netfilter: flowtable: publish GC-visible tuple last
netfilter: ipset: fix list type element drift bug
netfilter: ipset: let destroy callbacks adjust ext mem size
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
net: packet: fix wrong transport_header when sending VLAN-tagged frame
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
af_packet: Don't send zero-byte data in tpacket_snd().
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
net/sched: cls_u32: skip hash tables in u32_bind_class()
m68k: Define NR_CPUS to 1
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
net/sched: cls_bpf: reject dev-bound programs bound to a different device
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
net/x25: fix use-after-free of the socket by its timers
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
ring-buffer: Use current_context for safe per-CPU buffer swap
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
rndis_host: add overflow check in rndis_rx_fixup()
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
serial: amba-pl011: synchronize DMA teardown
perf: Unify perf_event_free_task() / perf_event_exit_task_context()
perf/core: Fix group leader use-after-free after sibling detach
serial: qcom-geni: fix TX DMA buffer flush
serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants
serial: sc16is7xx: convert bitmask definitions to use BIT() macro
serial: sc16is7xx: rename EFR mutex with generic name
serial: sc16is7xx: use guards for simple mutex locks
serial: sc16is7xx: enable THRI before filling TX FIFO
inet: frags: add inet_frag_putn() helper
ipv4: frags: remove ipq_put()
inet: frags: change inet_frag_kill() to defer refcount updates
inet: frags: save a pair of atomic operations in reassembly
inet: frags: publish queues before arming timer
xfs: don't use a xfs_log_iovec for ri_buf in log recovery
xfs: bounds-check buffer log item's dirty bitmap
ALSA: dummy: Check card index validity at probe
ocfs2: fix missing metadata reservation for large xattrs
null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
kcov: fix data corruption and race conditions on PREEMPT_RT
ext4: stop retrying saturated xattr cache entries
ext4: clear error before retrying inode xattr space fallback
xfs: validate attr entry pointer before field access
gpio: ml-ioh: use raw_spinlock_t for the register lock
s390/vfio_ccw: Free all memory if cp_init() fails
s390/vfio_ccw: Ensure first IDAW remains constant
s390/vfio_ccw: Calculate idal length based on idaw type
s390/vfio_ccw: Implement a crw lock
drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
drm/amdgpu: check ASPM on the dGPU host link
nfc: digital: clamp SENSF_RES length to the destination buffer
nfc: fdp: bound the device-reported read length and fix an skb leak
nfc: microread: validate target discovery payload lengths
nfc: llcp: bound the connect_sn TLV walk to the skb
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
nfc: llcp: reject PDUs shorter than the LLCP header
nfc: pn533: purge fragmented skbs during cleanup
nfc: st21nfca: validate ATR_REQ length against the received frame
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
nfc: nci: free destination parameters when closing a connection
ndisc: ndisc_send_redirect() cleanup
Input: byd - synchronize timer deletion before freeing private data
libceph: fix OOB read in decode_watchers() via missing bounds check
ipv4: reject undersized MTUs in ip_do_fragment()
ipv6: fix use-after-free in ip6_finish_output2()
nvmet-auth: zero the AUTH_RECEIVE response buffer
nvmet-fc: fix invalid free in LS IOD error path
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
ASoC: sof: pcm: use snd_pcm_direction_name()
ASoC: SOF: Relocate and rework functionality for PCM stream freeing
ASoC: SOF: pcm: Move period/buffer configuration print after platform open
ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err()
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
mptcp: pm: fix data race in add_addr timer callback
HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
HID: magicmouse: do not keep a stale msc->input if no input is claimed
HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
HID: core: fix OOB read of field->usage in hid_set_field()
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
Bluetooth: hci_sync: Fix advertising data UAFs
Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
Input: atkbd - skip deactivate for HONOR ZQC-P
mptcp: pm: fix memory leak from alloc-during-teardown race
HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
HID: core: fix number/pointer type confusion on long items
HID: sensor: custom: Fix use-after-free in enable_sensor
HID: hyperv: validate initial device info bounds
Bluetooth: hci_event: fix LE list UAF on reset
Bluetooth: hci_event: validate LE Set CIG Parameters response
net: gro: properly validate BIG TCP aggregation criteria
inet: frags: strip GSO state from fragments before reassembly
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
KVM: x86/mmu: Check write tracking in all address spaces
ext4: don't enable DAX on new encrypted files
io_uring/io-wq: fix worker accounting when canceling creation callbacks
jfs: add check read-only before truncation in jfs_truncate_nolock()
jfs: add check read-only before txBeginAnon() call
ibmvnic: Use kernel helpers for hex dumps
jfs: Fix null-ptr-deref in jfs_ioc_trim
exfat: fix double free in delayed_free
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
mISDN: hfcpci: Fix warning when deleting uninitialized timer
can: j1939: implement NETDEV_UNREGISTER notification handler
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
can: j1939: make j1939_sk_bind() fail if device is no longer registered
smc: Fix use-after-free in __pnet_find_base_ndev().
KVM: arm64: Prevent access to vCPU events before init
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169770
Title:
Noble update: upstream stable patchset 2026-10-05
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169770/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
