** Description changed: + SRU Justification - SRU Justification + Impact: + The upstream process for stable tree updates is quite similar + in scope to the Ubuntu SRU process, e.g., each patch has to + demonstrably fix a bug, and each patch is vetted by upstream + by originating either directly from a mainline/stable Linux tree or + a minimally backported form of that patch. The following upstream + stable patches should be included in the Ubuntu kernel: - Impact: - The upstream process for stable tree updates is quite similar - in scope to the Ubuntu SRU process, e.g., each patch has to - demonstrably fix a bug, and each patch is vetted by upstream - by originating either directly from a mainline/stable Linux tree or - a minimally backported form of that patch. The following upstream - stable patches should be included in the Ubuntu kernel: + upstream stable patchset 2026-10-05 - upstream stable patchset 2026-10-05 + Ported from the following upstream stable releases: + v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153, v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105, v6.12.106, v6.12.107, v6.12.108, v6.12.109 - Ported from the following upstream stable releases: - v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153, v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105, v6.12.106, v6.12.107, v6.12.108, v6.12.109 - - from git://git.kernel.org/ + from git://git.kernel.org/ smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). ASoC: nau8821: Cancel delayed work on component remove bpf: Fix use-after-free in offloaded map/prog info fill riscv: Fix register corruption from uninitialized cregs on error ASoC: nau8821: Cancel pending work before suspend smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). selinux: switch two allocations to use kzalloc_objs() powerpc/hv-gpci: fix preempt count leak in sysfs show paths ksmbd: harden file lifetime during session teardown ext4: make some fast commit functions reuse extents path ext4: propagate errors from fast commit range replay nilfs2: correct return value kernel-doc descriptions for ioctl functions nilfs2: reject invalid block index in GC ioctl nfc: nci: add data_len bound checks to activation parameter extractors HID: magicmouse: re-enable multitouch after reset-resume HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() nvmet-tcp: bound SGL data length before allocating command buffers HID: nintendo: stop device IO before hid_hw_stop on probe failure HID: ft260: validate i2c input report length HID: ft260: fix stack-use-after-return write in I2C read race HID: uclogic: fix use-after-free of inrange_timer on remove HID: pidff: clang-format pass HID: pidff: fix OOB write when hid->inputs is empty Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Bluetooth: hci_sync: Fix accept list UAF during suspend xfs: remove file_path tracepoint data fpga: dfl: fme: add error handling accessibility: speakup: unregister tty ldisc on later init failures usb: xhci: Handle USB3 port events when there is one roothub xhci: dbgtty: Fix unregister on tty_register_driver() failure xhci: dbgtty: Fix unregister on tty_alloc_driver() failure fuse: fix invalidate lock leak on setattr writeback failure fuse: fix invalidate lock leak on open O_TRUNC DAX failure usb: usbtest: disable dynamic ID support usb: gadget: f_tcm: keep port count until LUN teardown completes tls: device: fix out-of-bounds write in tls_append_frag() x86/CPU/AMD: Carve out a Zen5 models range xfrm: espintcp: fix UAF during close xfrm: drop ESP-in-TCP packets with no ingress device xfrm: ah6: validate routing header segments_left xfrm: fix xfrm_state_construct() auth-trunc leak net: bridge: mcast: fix use-after-free of a master VLAN's multicast context ipv6: seg6: clear IPv4 control block on IPIP decapsulation mm/swap: reject swapon() on filesystem-level encrypted files crypto: atmel-tdes - use scatterlist length before DMA mapping crypto: qce - fix CCM AAD buffer underallocation crypto: mxs-dcp - fix source scatterlist length access crypto: qce - Remove unsafe/deprecated algorithms KVM: s390: vsie: zero stale crypto bits usb: core: Add lock to usb_wakeup_notification() usb: core: Strengthen error handling in hub_hub_status() ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() ALSA: usb-audio: Complete cleanup after system-resume errors USB: serial: option: fix slab OOB read in interrupt URB callback USB: serial: spcp8x5: drop broken carrier detect support USB: c67x00: fix use-after-free in c67x00_add_iso_urb() usb: usbfs: fix use-after-free of usb_device in usbdev_release() um: Add os_set_pdeathsig helper function um: Set parent death signal for winch thread/process um: Use os_set_pdeathsig helper in winch thread/process um: Set parent-death signal for ubd io thread/process um: Set parent-death signal for write_sigio thread/process um: Set parent death signal for userspace process kunit: tool: Terminate kernel under test on SIGINT kunit: tool: skip stty when stdin is not a tty um: Preserve errno within signal handler bpf: Reset register bounds before narrowing retval range in check_mem_access() pinctrl: qcom: Unconditionally mark gpio as wakeup enable btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation netfilter: nf_tables: make nft_object rhltable per table hwmon: (ina2xx) Add support for has_alerts configuration flag hwmon: (ina2xx) Add support for INA260 hwmon: (ina226) Add support for SY24655 hwmon: (ina2xx) Make it easier to add more devices hwmon: (ina2xx) Add support for INA234 hwmon: (ina2xx) Shift INA234 shunt and current registers hwmon: (ina2xx) Fix various overflow issues hwmon: (sht3x) Fix unaligned accesses net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() net: ethernet: mtk_eth_soc: support named IRQs net: ethernet: mtk_eth_soc: add consts for irq index net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller idpf: Fix mailbox IRQ name leak on request failure Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Bluetooth: ISO: fix leaking sk after socket release Bluetooth: ISO: avoid deadlocks in iso_sock_timeout tracing: Remove TRACE_EVENT_FL_FILTERED logic tracing/mmiotrace: Remove reference to unused per CPU data pointer tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() ALSA: seq: Fix division by zero in initialize_timer() ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes ata: libata-sata: fix ata_scsi_lpm_supported() iteration ALSA: usb-audio: fix stack info leak in RME Digiface status binfmt_misc: don't let an 'F' entry pin its own instance cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized power: supply: max17040: handle missing status supplier s390/pci: Fix s390_pci_mmio_write syscall error return without MIO drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames drm/amd/display: use proper context for logging Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes media: chips-media: wave5: Support CBP profile drm/amdgpu: Fix context pstate override handling drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] drm/xe/sched_job: Promote xe_sched_job_add_deps() drm/xe: Wait on external BO kernel fences in exec IOCTL drm/xe: Normalize bo flags macros drm/xe: Rename ___xe_bo_create_locked() drm/xe: Hold a dma-buf reference for imported BOs rxrpc: Generate rtt_min rxrpc: Adjust the rxrpc_rtt_rx tracepoint rxrpc: Fix the calculation and use of RTO rxrpc: Manage RTT per-call rather than per-peer drm/amd/display: Add AV mute wait frames to dce110_set_avmute drm/amd/display: Check for tg ops in dce110_set_avmute net: hns3: fix speed configuration residue after driver reload - enic: fix tx_hang_reset use-after-free on device removal pds_core: keep the health thread stopped during reset xsk: require at least 16 bytes of TX metadata net: usb: ipheth: fix carrier_work UAF on disconnect blk-mq: pop cached request if it is usable blk-mq: reinsert cached request to the list crypto: ccp - Add new SEV/SNP platform shutdown API KVM: SVM: Add support to initialize SEV/SNP functionality in KVM selftests/bpf: Ensure UDP sockets are bound nvmem: layouts: Add fixed-layout driver ring-buffer: Prevent subbuf order change when resizing is disabled binfmt_misc: don't warn when the mount is completed from another user namespace ima: Instantiate file_truncate and path_truncate hooks fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions fsverity: Fix silent truncation in bpf_get_fsverity_digest() mtd: ubi: skip programming unused bits in ubi headers ubi: fastmap: fix ubi->fm memory leak crypto: ccp: Add external API interface for PSP module initialization KVM: SVM: Ensure PSP module is initialized if KVM module is built-in drm/amdgpu: reject oversized IBs with per-ring packet limits pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition drm/xe: Order ring writes before ring tail updates drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE xfs: clear zapped attr fork state when bmap repair finds no attr fork ceph: Convert ceph_find_incompatible() to take a folio ceph: Convert writepage_nounlock() to write_folio_nounlock() ceph: fix writeback_count leak in write_folio_nounlock() mm/khugepaged: guard is_zero_pfn() calls with pte_present() super: remove pointless s_root checks super: skip dying superblocks early eventpoll: pin files while checking reverse paths KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs binfmt_misc: don't leak the user namespace when the mount fails net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() drm/vmwgfx: take fman->lock around fence list mutation in fifo_down super: use a common iterator (Part 1) ata: libata-scsi: terminate deferred commands on time out super: use common iterator (Part 2) drm/amd/pm: Use same metric table for APU drm/amd/pm: Use macro to initialize metrics table drm/amdgpu: remove unused function parameter drm/amd/pm: adjust the visibility of pp_table sysfs node ring-buffer: Simplify functions with __free(kfree) to free allocations ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() x86/mce: Remove __mcheck_cpu_init_early() x86/mce: Set CR4.MCE last during init x86/mce: Set up the polling timer before CMCI discovery tcp: fix icsk_ack.ato bitfield overflow fs: unlock the superblock during iterate_supers_type ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name net: ethernet: mtk_eth_soc: improve support for named interrupts ALSA: scarlett2: Use a private URB for the notification endpoint hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx xfs: namespace the maximum length/refcount symbols xfs: check AGI unlinked inode buckets xfs: hoist per-bucket unlinked list check to helper xfs: don't livelock in scrub on a circular unlinked list net: dst: add four helpers to annotate data-races around dst->dev ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] ipv4: start using dst_dev_rcu() HID: nintendo: register input device after capabilities are set Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp selinux: fix style issues in security/selinux/ss/avtab.h selinux: fix style issues in security/selinux/ss/policydb.c selinux: use known type instead of void pointer selinux: avoid unnecessary indirection in struct level_datum selinux: make more use of str_read() when loading the policy selinux: fix style issues in security/selinux/ss/policydb.h selinux: use u16 for security classes selinux: fix style issues in security/selinux/ss/constraint.h selinux: more strict policy parsing selinux: reject a permission value exceeding the class permission count selinux: require a class's permission values to cover its permission count HID: pidff: Rework pidff_set_time() to fix warnings HID: pidff: Use ARRAY_SIZE macro instead of sizeof HID: asus: simplify RGB init sequence HID: asus: fix missing hid_is_usb() check gtp: serialize PDP context updates net/tcp: fix TCP-AO key deletion in VRFs tcp: fix AO info use-after-free in tcp_ao_connect_init() net/tcp-ao: fix use-after-free of current_key on reconnect to another peer batman-adv: reject unrepresentable multicast TVLV offsets vxlan: keep the last remote linked during FDB flush netfilter: nf_tables: don't queue packet path object notifications crypto: qcom-rng - rename *_of_data to *_match_data crypto: qcom-rng - Enable clock in hwrng case crypto: qcom-rng - Allow zero as a random number crypto: qcom-rng - Remove crypto_rng interface wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb bnxt_en: Mask the bd_cnt field in the TX BD properly md: make rdev_addable usable for rcu mode f2fs: convert f2fs_compress_ctx_add_page() to use folio f2fs: convert f2fs_handle_page_eio() to use folio f2fs: fix potential deadloop in prepare_compress_overwrite() block: mark GFP_NOIO around sysfs ->store() drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 perf/x86/intel/uncore: Fix die ID init and look up bugs wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() wifi: ath11k: fix memory leaks in beacon template setup drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally alpha: don't leak hardware-fabricated FP exception bits to user space clocksource/drivers/timer-sun4i: Advertise a real minimum delta powerpc/pseries/iommu: switch to Default DMA window during kdump timers/itimer: Zero-init old itimerval before copy to userspace apparmor: fix cred UAF caused by begin_current_label_crit_section() apparmor: fix out-of-bounds write when null terminating a label vec include/linux/list.h: mark list_add and __list_add as __always_inline mm/kmemleak: avoid soft lockup when scanning task stacks mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() mm/zswap: fix global shrinker when memory cgroup is disabled mm: memcg: stop reclaim when a limit update is superseded mm: mempolicy: fix automatic numa balancing for shmem tools/compiler: match glibc 2.42 definition of __attribute_const__ x86/tdx: Fix off-by-one in port I/O handling x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() x86/tdx: Fix zero-extension for 32-bit port I/O hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() tracing/user_events: Clear copied tracing state before fork duplication tracing: Fix crash passing ERR_PTR to kthread_stop() tracing: Fix logged instance name on creation failure tracing: Fix use-after-free in trace_pipe read on sub-buffer order change tracing: Fix use-after-free with same-name named triggers cdx: Fix double free when sysfs file creation fails device property: fix infinite loop in fwnode_for_each_child_node() misc: nsm: bound the device-reported response length powerpc/powermac: fix OF node refcount rapidio: mport_cdev: fix use-after-free in dma_req_free() Revert "media: v4l2-dev: fix error handling in __video_register_device()" serial: imx: serialize imx_uart_ports[] lifetime staging: greybus: hid: fix SET_REPORT return value usb: dwc2: gadget: Exit partial power down state when changing USB pull-up usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed USB: phy: fsl-usb: fix missing static keywords usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion usb: gadget: u_audio: Fix use-after-free on sound card disconnect usb: gadget: snps_udc_plat: clean up PHY on probe deferral usb: gadget: midi2: remove default configfs groups on teardown usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() usb: gadget: f_fs: Prevent deadlock during ep0 read loop fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() media: cec: stm32: prevent out-of-bounds write on RX overflow media: vicodec: fix out-of-bounds write in FWHT encoder nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation of: fix out-of-bounds read in of_alias_scan() stem parser ubifs: fix out-of-bounds read in signature length check zsmalloc: rename class stat mutators zsmalloc: account for handle size in class lookup NFSD: check truncate permission under inode lock NFSD: Encode only the status in NFS-ACL v2 GETACL error replies NFSD: Fix off-by-one in DRC bucket pruning limit NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path nfsd: release path refs on follow_down() error nfsd: Reset write verifier when async COPY writeback fails nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types nfsd: sample writeback error cursor before async COPY loop nfsd: size fh_verify server sockaddr slot by xpt_locallen nfsd: validate symlink target length in NFSv4 CREATE nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() nfsd: add filehandle match check to nfsd4_delegreturn() nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref nfsd: check client ownership when cancelling a copy-notify stateid nfsd: clear opcnt on compound arg release to prevent OOB read nfsd: defer vfree of compound ops to fix rpc_status UAF nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd: fix cpntf publish race in nfs4_init_cp_state nfsd: fix nfsd_file leak on inter-server COPY setup failure nfsd: fix version mismatch loops in nfsd_acl_init_request() nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd: gate nfs2 setacl by argp->mask nfsd: gate nfs3 setacl by argp->mask nfsd: initialize copy-notify stateid before publishing it nfsd: initialize DRC hash table before registering shrinker nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE nfsd: reject reclaim LOCK after RECLAIM_COMPLETE nfsd: revoke copy-notify stateids before dropping their reference NFSD: Prevent lock owner use-after-free during client teardown libceph: validate OSD extent maps before cursor advance libceph: reject buckets with mismatched CRUSH ids ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode ceph: bound copied dentry name length in NFS export get_name ceph: bound num_export_targets array for mds info v2/v3 ceph: bound xattr value length in __build_xattrs() ceph: do not repeat ceph_trim_dentries() if no progress possible btrfs: rename err to ret in btrfs_recover_relocation() btrfs: drop recovered reloc root refs on recovery failure audit: avoid dropping live tree ref on fsnotify rule autoremove cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 smb: client: clear ce->tgthint in free_tgts() smb: client: fix ALIGN() overflow in symlink_data() error context loop smb: client: harden DFS cache against invalid target hints HID: picolcd: clamp eeprom debugfs read to bytes actually received HID: roccat: free buffered reports when destroying device HID: sensor: custom: Fix field sysfs group cleanup on failure HID: mcp2221: stop device IO before hid_hw_stop HID: mcp2221: validate report size in mcp2221_raw_event() eventfs: Initialize ei->children and ei->list in init_ei() fs/ntfs3: validate dirty page table on log replay fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() fs/ntfs3: bound page_lcns[] index by the log record eCryptfs: bound the packet-length peek to the user buffer ecryptfs: fix tag 11 packet exact-fit size check ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs: pass packet set buffer size to parser ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet ecryptfs: reject too-small tag 70 packets ecryptfs: release message context on send failure ecryptfs: show filename encryption options efivarfs: Rate limit statfs() handler fat: restore original value when fat_ent_write failed fbdev: omapfb: panel-dsi-cm: initialize lock before registering display fbdev: pvr2fb: correct user pointer annotation and sentinel initializer fbdev: ssd1307fb: defer I2C transfers from damage callbacks fbdev: uvesafb: unregister connector callback on init failure forcedeth: fix off-by-one when saving/restoring non-PCI config space fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device ACPI: APEI: Fix ERST timeout unit conversion ACPI: APEI: GHES: fix ARM section length accounting after header ACPI: pfr_update: fix stack buffer overflow in query_capability() alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() alpha: marvel: Fix irq_set_status_flags to use correct IRQ number alpha: marvel: Fix lock ordering in init_io7_irqs() ARM: 9477/1: Disable broken eBPF JIT on the Risc PC ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes auxdisplay: charlcd: cancel backlight work on registration failure block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Bluetooth: eir: Fix OOB read in eir_get_service_data() bnx2x: fix double free in bnx2x_init_firmware() error path bpf: Disable preemption in __bpf_get_stack bpf: Harden bloom filter sizing and indexing on 32-bit kernels dm-era: fix shadowed superblock leak on take-snap failure dm raid1: reserve space for NUL-terminator in build_constructor_string() dm: Constify struct dm_block_validator dm array: validate array block headers on read dm array: reject an array block whose value size is not the caller's coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior cpufreq: schedutil: Fix rate limit overflow cxl/pmem: Format the nvdimm serial number as unsigned decimal Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Bluetooth: RFCOMM: serialize security confirmation handling Bluetooth: hci_conn: re-enable advertising only for peripheral role Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request kasan: fix cache shrink race with CPU hotplug ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_gre: fix hardware header length for NBMA tunnels ipv6: use RCU iterator to dump route exceptions libnvdimm/labels: Prevent integer overflow in __nd_label_validate() mailbox: qcom-ipcc: fix duplicate channel allocation across holes md: do overflow check for sb->bblog_shift in super_1_load() mpls: reload header after pskb_may_pull() mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction nouveau/gem: reserve the bo in the info ioctl around the vma lookup params: fix charp corruption on allocation failure SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry SUNRPC: svcauth_gss: enforce krb5 token minimum length SUNRPC: always drain cache_cleaner before destroying a cache_detail SUNRPC: Check svc pool percpu counter allocation SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat SUNRPC: harden gss_krb5_unwrap_v2 against short tokens SUNRPC: harden gss_unwrap_resp_priv length checks sunrpc: init gssp_lock before publishing proc entry SUNRPC: reject duplicate CREDS_VALUE options SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field SUNRPC: wait for in-flight client TLS handshake callback svcrdma: Fix offset arithmetic in read_chunk_range svcrdma: Fix pcl_for_each_segment for empty chunks jbd2: bound shrinker scans by examined checkpoint buffers jbd2: add prefix 'jbd2' for 'shrink_type' jbd2: check need_resched() when skipping busy checkpoint buffers ipip: fix skb leak in collect_md mode when metadata_dst allocation fails sunrpc: route to a populated pool in svc_pool_for_cpu() svcrdma: Fix unmatched rn_unregister on failed accept svcrdma: Reject connection when transport allocation fails svcrdma: Reject inline replies that overflow the pull-up buffer svcrdma: Validate Read chunk positions before reconstruction udf: reject VAT indexes equal to the entry count wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets staging: media: tegra-video: fix of_node_put() on VIP parse errors staging: media: tegra-video: vi: fix probe failure on skipped last port scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() rpmsg: glink: smem: order FIFO read after availability check arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio riscv: acpi: Handle LPI architectural context loss flags remoteproc: scp: Fix device reference leak on failed lookup qede: Fix NULL pointer dereference in TPA fragment processing RDMA/cxgb4: Cancel reg_work before freeing device on remove RDMA/ucma: Lock the handler in ucma_set_ib_path() regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata regulator: qcom-refgen: correct the regulator type to CURRENT ring-buffer: Free cpu_buffer::free_page with subbuf_order ring-buffer: Hold cpu_buffer::lock when resizing a subbuf orangefs: fix double-free of trailer_buf on readdir copy failure orangefs: skip leading spaces before parsing client debug masks ocfs2: always run deallocs on copy-on-write completion ocfs2: bound namelen in dlm_migrate_request_handler ocfs2: validate lengths in dlm_mig_lockres_handler ocfs2: validate rl_used against rl_count in refcount block validator ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item ocfs2: cluster: fix o2hb_dependent_users leak on pin failure ocfs2: fix readdir position truncation on 32-bit kernels openrisc: fix arbitrary kernel memory access via or1k_atomic syscall openvswitch: only skb_tx_error() a packet we are about to drop ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion arm64: compat: Fix decrementing LDM/STM alignment emulation ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC hwmon: (max6621) fix negative temperature offset and crit readings hwmon: (max6621) fix temperature clamp range lockd: pin next file across nlm_inspect_file lock-drop lockd: fix NULL dereference on lockowner allocation failure nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path nvme: zero the discard fallback page nvme-pci: disable controller on admin queue IRQ setup failure nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone nvme-tcp: fix host memory disclosure on R2T for a read command nvme-tcp: reject a read that transferred too few bytes sctp: stop processing a packet once its association is deleted sctp: drop a chunk if its transport was removed sctp: fix NULL deref on untransmitted RECONF completion sctp: distinguish sequence zero from wildcard in reconf lookup sctp: fix stream->outcnt underflow on duplicate RECONF responses power: supply: bq24257: fix use-after-free on remove power: supply: bq256xx: drain usb_work before freeing the charger power: supply: bq25890: Fix power_supply reference leak power: supply: charger-manager: register regulators before exposing sysfs power: supply: cros_usbpd-charger: bound the EC-reported port count power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS power: supply: lp8727: fix use-after-free in lp8727_release_irq() power: supply: lp8788-charger: fix use-after-free on remove power: supply: qcom_battmgr: terminate the strings from firmware power: supply: rt9455: quiesce delayed work before teardown power: supply: twl4030_charger: cancel workers via devm power: supply: ucs1002: fix use-after-free on remove power: supply: max17040: propagate register read errors power: supply: max17040: drop incorrect I2C functionality check power: supply: max17040: synchronize work cancellation on suspend s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks s390/dasd: Do not complete a failed ESE read as successful s390/dasd: Guard sysfs discipline callbacks against unallocated private data s390/dasd: Propagate partial completion length across ERP recovery PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk PCI: meson: Fix GPIO state while requesting PERST# PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses PCI/MSI: Enable memory decoding before restoring MSI-X messages PCI/proc: Avoid spurious runtime PM wakeup on config space accesses PCI/proc: Use file_ns_capable() when checking config space read access PCI/proc: Warn on writes to kernel-exclusive config space regions iommu/sva: Set handle->dev before the SVA handle is visible iommu/arm-smmu-v3: Manage teardown with devm iommu/vt-d: Fix no_iommu to disable platform opt-in iommu/vt-d: Force requesting ACS when tboot is enabled platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer platform/x86: ISST: Validate level in perf mask ioctls platform/x86: ISST: Validate socket ID in clos_assoc ioctl mmc: via-sdmmc: stop card-detect handling on probe failure platform/x86: ISST: Just allow 2 bits for SST feature enable platform/x86: ISST: Validate logical CPU id and clos id platform/x86: ISST: Validate parameter for core power state platform/x86: ISST: Validate parameter for frequency and priority platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path platform/chrome: sensorhub: Bound the EC-reported sensor number platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS platform/x86: hp-bioscfg: advance elem past consumed array elements platform/x86: hp-bioscfg: bound ordered-list parsing by the package count platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() platform/x86: hp-bioscfg: fix heap OOB read on empty password write platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed platform/x86: hp-bioscfg: pass validated element count to package parsers platform/x86: hp-bioscfg: warn on element type mismatch instead of failing interconnect: Fix use after free in icc_get() and of_icc_get_by_index() ipmi: ipmb: validate write message length ipmi: si: Fix NULL pointer dereference after failed registration net/iucv: filter frames in afiucv_hs_rcv() by ingress device xdp: fix zero-copy frame layout slip: fix use-after-free in sl_sync() net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition net: tun: bound receive headroom platform/x86: ISST: Add a NULL check for sst_inst[] platform/x86: ISST: Use PP level enable mask platform/x86: ISST: Return error during profile addition net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO net: ipa: fix stalled modem TX queue after runtime resume l2tp: improve tunnel/session refcount helpers l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname net: l2tp: do not propagate multicast notification errors net: openvswitch: fix flow mask use-after-free on flow deletion net: openvswitch: fix nf_connlabels leak in ovs_ct_init net: ravb: avoid dereferencing an invalid PTP clock net: ravb: serialize PTP clock teardown net: thunderbolt: Release the Rx HopID that was handed out on mismatch net: thunderbolt: Mark the connection down when bringing it up fails NTB: ntb_transport: Recycle TX entries before client callbacks NTB: ntb_transport: Fail TX enqueue when the QP link is down NTB: ntb_transport: Reject oversized TX buffers net: ntb_netdev: Avoid double-accounting netif_rx() drops net: ntb_netdev: Count packets dropped on RX refill failure net/smc: do not dereference an unset send buffer on the SMC-D teardown path net/smc: fix socket refcount leak in smc_switch_conns() net/smc: fix use-after-free in smc_rx_pipe_buf_release() net/smc: unregister the connection before draining the rx tasklet net: cap advertised IP tunnel headroom net: fix spurious TX timeout after dev_activate() net: skbuff: don't touch shared zerocopy state in skb_tx_error() seg6: reset IP6CB after IPv6 decapsulation mfd: sm501: Fix potential memory leaks during remove ALSA: 6fire: bound the MIDI event length from the device ALSA: aloop: Check card index validity at probe ALSA: bcd2000: clear the URB pointers on disconnect ALSA: mpu401: Check card index validity at probe ALSA: mts64: Check card index validity at probe ALSA: pcxhr: initialize mutexes before requesting threaded IRQ ALSA: portman2x4: Check card index validity at probe ALSA: serial-u16550: Check card index validity at probe ALSA: virmidi: Check card index validity at probe ring-buffer: Fix subbuf resize race with ring buffer readers iommu/amd: remove return value of amd_iommu_detect PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() dm-stats: fix a crash if allocation of per-cpu data fails dm-switch: use WRITE_ONCE() in switch_region_table_write() i3c: master: Fix info leak and UAF in device unregister path i3c: master: svc: bound IBI payload to the requested max_payload_len wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: rtl8xxxu: remove rtl8xxxu_ prefix from filenames wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop crypto: sun8i-ss - Remove crypto_rng interface UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_SS_PRNG crypto: sun8i-ce - Remove crypto_rng interface UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_CE_PRNG wifi: mwifiex: Detach sync cmd buffer on interrupted wait wifi: rtl818x: initialize eeprom_93cx6 struct to zero wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex vsock/virtio: flush works in dependency order w1: ds28e17: reject an oversize length on an I2C block read xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout sticon/parisc: Detect default STI graphics card for console output signal: avoid shared siginfo namespace rewrites smack: fix cred UAF in smack_file_send_sigiotask() taskstats: fix cpumask parsing cutting off the last character timer: Keep debugobjects state consistent in migrate_timer_list() udf: Fix i_lenExtents truncation on 32-bit kernels platform/chrome: sensorhub: Fix dropped timestamp events and log spam mm: avoid unnecessary use of is_swap_pmd() mm: provide mm_struct and address to huge_ptep_get() mm/rmap: use huge_ptep_get() in try_to_unmap_one() UBUNTU: Upstream stable to v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153, v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105, v6.12.106, v6.12.107, v6.12.108, v6.12.109
** Description changed: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-10-05 Ported from the following upstream stable releases: v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153, v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105, v6.12.106, v6.12.107, v6.12.108, v6.12.109 from git://git.kernel.org/ smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). ASoC: nau8821: Cancel delayed work on component remove bpf: Fix use-after-free in offloaded map/prog info fill riscv: Fix register corruption from uninitialized cregs on error ASoC: nau8821: Cancel pending work before suspend smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). selinux: switch two allocations to use kzalloc_objs() powerpc/hv-gpci: fix preempt count leak in sysfs show paths ksmbd: harden file lifetime during session teardown ext4: make some fast commit functions reuse extents path ext4: propagate errors from fast commit range replay nilfs2: correct return value kernel-doc descriptions for ioctl functions nilfs2: reject invalid block index in GC ioctl nfc: nci: add data_len bound checks to activation parameter extractors HID: magicmouse: re-enable multitouch after reset-resume HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() nvmet-tcp: bound SGL data length before allocating command buffers HID: nintendo: stop device IO before hid_hw_stop on probe failure HID: ft260: validate i2c input report length HID: ft260: fix stack-use-after-return write in I2C read race HID: uclogic: fix use-after-free of inrange_timer on remove HID: pidff: clang-format pass HID: pidff: fix OOB write when hid->inputs is empty Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Bluetooth: hci_sync: Fix accept list UAF during suspend xfs: remove file_path tracepoint data fpga: dfl: fme: add error handling accessibility: speakup: unregister tty ldisc on later init failures usb: xhci: Handle USB3 port events when there is one roothub xhci: dbgtty: Fix unregister on tty_register_driver() failure xhci: dbgtty: Fix unregister on tty_alloc_driver() failure fuse: fix invalidate lock leak on setattr writeback failure fuse: fix invalidate lock leak on open O_TRUNC DAX failure usb: usbtest: disable dynamic ID support usb: gadget: f_tcm: keep port count until LUN teardown completes tls: device: fix out-of-bounds write in tls_append_frag() x86/CPU/AMD: Carve out a Zen5 models range xfrm: espintcp: fix UAF during close xfrm: drop ESP-in-TCP packets with no ingress device xfrm: ah6: validate routing header segments_left xfrm: fix xfrm_state_construct() auth-trunc leak net: bridge: mcast: fix use-after-free of a master VLAN's multicast context ipv6: seg6: clear IPv4 control block on IPIP decapsulation mm/swap: reject swapon() on filesystem-level encrypted files crypto: atmel-tdes - use scatterlist length before DMA mapping crypto: qce - fix CCM AAD buffer underallocation crypto: mxs-dcp - fix source scatterlist length access crypto: qce - Remove unsafe/deprecated algorithms KVM: s390: vsie: zero stale crypto bits usb: core: Add lock to usb_wakeup_notification() usb: core: Strengthen error handling in hub_hub_status() ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() ALSA: usb-audio: Complete cleanup after system-resume errors USB: serial: option: fix slab OOB read in interrupt URB callback USB: serial: spcp8x5: drop broken carrier detect support USB: c67x00: fix use-after-free in c67x00_add_iso_urb() usb: usbfs: fix use-after-free of usb_device in usbdev_release() um: Add os_set_pdeathsig helper function um: Set parent death signal for winch thread/process um: Use os_set_pdeathsig helper in winch thread/process um: Set parent-death signal for ubd io thread/process um: Set parent-death signal for write_sigio thread/process um: Set parent death signal for userspace process kunit: tool: Terminate kernel under test on SIGINT kunit: tool: skip stty when stdin is not a tty um: Preserve errno within signal handler bpf: Reset register bounds before narrowing retval range in check_mem_access() pinctrl: qcom: Unconditionally mark gpio as wakeup enable btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation netfilter: nf_tables: make nft_object rhltable per table hwmon: (ina2xx) Add support for has_alerts configuration flag hwmon: (ina2xx) Add support for INA260 hwmon: (ina226) Add support for SY24655 hwmon: (ina2xx) Make it easier to add more devices hwmon: (ina2xx) Add support for INA234 hwmon: (ina2xx) Shift INA234 shunt and current registers hwmon: (ina2xx) Fix various overflow issues hwmon: (sht3x) Fix unaligned accesses net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() net: ethernet: mtk_eth_soc: support named IRQs net: ethernet: mtk_eth_soc: add consts for irq index net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller idpf: Fix mailbox IRQ name leak on request failure Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Bluetooth: ISO: fix leaking sk after socket release Bluetooth: ISO: avoid deadlocks in iso_sock_timeout tracing: Remove TRACE_EVENT_FL_FILTERED logic tracing/mmiotrace: Remove reference to unused per CPU data pointer tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() ALSA: seq: Fix division by zero in initialize_timer() ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes ata: libata-sata: fix ata_scsi_lpm_supported() iteration ALSA: usb-audio: fix stack info leak in RME Digiface status binfmt_misc: don't let an 'F' entry pin its own instance cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized power: supply: max17040: handle missing status supplier s390/pci: Fix s390_pci_mmio_write syscall error return without MIO drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames drm/amd/display: use proper context for logging Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes media: chips-media: wave5: Support CBP profile drm/amdgpu: Fix context pstate override handling drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] drm/xe/sched_job: Promote xe_sched_job_add_deps() drm/xe: Wait on external BO kernel fences in exec IOCTL drm/xe: Normalize bo flags macros drm/xe: Rename ___xe_bo_create_locked() drm/xe: Hold a dma-buf reference for imported BOs rxrpc: Generate rtt_min rxrpc: Adjust the rxrpc_rtt_rx tracepoint rxrpc: Fix the calculation and use of RTO rxrpc: Manage RTT per-call rather than per-peer drm/amd/display: Add AV mute wait frames to dce110_set_avmute drm/amd/display: Check for tg ops in dce110_set_avmute net: hns3: fix speed configuration residue after driver reload pds_core: keep the health thread stopped during reset xsk: require at least 16 bytes of TX metadata net: usb: ipheth: fix carrier_work UAF on disconnect blk-mq: pop cached request if it is usable blk-mq: reinsert cached request to the list crypto: ccp - Add new SEV/SNP platform shutdown API KVM: SVM: Add support to initialize SEV/SNP functionality in KVM selftests/bpf: Ensure UDP sockets are bound nvmem: layouts: Add fixed-layout driver ring-buffer: Prevent subbuf order change when resizing is disabled binfmt_misc: don't warn when the mount is completed from another user namespace ima: Instantiate file_truncate and path_truncate hooks fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions fsverity: Fix silent truncation in bpf_get_fsverity_digest() mtd: ubi: skip programming unused bits in ubi headers ubi: fastmap: fix ubi->fm memory leak crypto: ccp: Add external API interface for PSP module initialization KVM: SVM: Ensure PSP module is initialized if KVM module is built-in drm/amdgpu: reject oversized IBs with per-ring packet limits pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition drm/xe: Order ring writes before ring tail updates drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE xfs: clear zapped attr fork state when bmap repair finds no attr fork ceph: Convert ceph_find_incompatible() to take a folio ceph: Convert writepage_nounlock() to write_folio_nounlock() ceph: fix writeback_count leak in write_folio_nounlock() mm/khugepaged: guard is_zero_pfn() calls with pte_present() super: remove pointless s_root checks super: skip dying superblocks early eventpoll: pin files while checking reverse paths KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs binfmt_misc: don't leak the user namespace when the mount fails net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() drm/vmwgfx: take fman->lock around fence list mutation in fifo_down super: use a common iterator (Part 1) ata: libata-scsi: terminate deferred commands on time out super: use common iterator (Part 2) drm/amd/pm: Use same metric table for APU drm/amd/pm: Use macro to initialize metrics table drm/amdgpu: remove unused function parameter drm/amd/pm: adjust the visibility of pp_table sysfs node ring-buffer: Simplify functions with __free(kfree) to free allocations ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() x86/mce: Remove __mcheck_cpu_init_early() x86/mce: Set CR4.MCE last during init x86/mce: Set up the polling timer before CMCI discovery tcp: fix icsk_ack.ato bitfield overflow fs: unlock the superblock during iterate_supers_type ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name net: ethernet: mtk_eth_soc: improve support for named interrupts ALSA: scarlett2: Use a private URB for the notification endpoint hwmon: (ltc4286) Fix symbol namespace of MODULE_IMPORT_NS() serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx xfs: namespace the maximum length/refcount symbols xfs: check AGI unlinked inode buckets xfs: hoist per-bucket unlinked list check to helper xfs: don't livelock in scrub on a circular unlinked list net: dst: add four helpers to annotate data-races around dst->dev ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] ipv4: start using dst_dev_rcu() HID: nintendo: register input device after capabilities are set Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp selinux: fix style issues in security/selinux/ss/avtab.h selinux: fix style issues in security/selinux/ss/policydb.c selinux: use known type instead of void pointer selinux: avoid unnecessary indirection in struct level_datum selinux: make more use of str_read() when loading the policy selinux: fix style issues in security/selinux/ss/policydb.h selinux: use u16 for security classes selinux: fix style issues in security/selinux/ss/constraint.h selinux: more strict policy parsing selinux: reject a permission value exceeding the class permission count selinux: require a class's permission values to cover its permission count HID: pidff: Rework pidff_set_time() to fix warnings HID: pidff: Use ARRAY_SIZE macro instead of sizeof HID: asus: simplify RGB init sequence HID: asus: fix missing hid_is_usb() check gtp: serialize PDP context updates net/tcp: fix TCP-AO key deletion in VRFs tcp: fix AO info use-after-free in tcp_ao_connect_init() net/tcp-ao: fix use-after-free of current_key on reconnect to another peer batman-adv: reject unrepresentable multicast TVLV offsets vxlan: keep the last remote linked during FDB flush netfilter: nf_tables: don't queue packet path object notifications crypto: qcom-rng - rename *_of_data to *_match_data crypto: qcom-rng - Enable clock in hwrng case crypto: qcom-rng - Allow zero as a random number crypto: qcom-rng - Remove crypto_rng interface wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb bnxt_en: Mask the bd_cnt field in the TX BD properly md: make rdev_addable usable for rcu mode f2fs: convert f2fs_compress_ctx_add_page() to use folio f2fs: convert f2fs_handle_page_eio() to use folio f2fs: fix potential deadloop in prepare_compress_overwrite() block: mark GFP_NOIO around sysfs ->store() drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 perf/x86/intel/uncore: Fix die ID init and look up bugs wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() wifi: ath11k: fix memory leaks in beacon template setup drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally alpha: don't leak hardware-fabricated FP exception bits to user space clocksource/drivers/timer-sun4i: Advertise a real minimum delta powerpc/pseries/iommu: switch to Default DMA window during kdump timers/itimer: Zero-init old itimerval before copy to userspace apparmor: fix cred UAF caused by begin_current_label_crit_section() apparmor: fix out-of-bounds write when null terminating a label vec include/linux/list.h: mark list_add and __list_add as __always_inline mm/kmemleak: avoid soft lockup when scanning task stacks mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() mm/zswap: fix global shrinker when memory cgroup is disabled mm: memcg: stop reclaim when a limit update is superseded mm: mempolicy: fix automatic numa balancing for shmem tools/compiler: match glibc 2.42 definition of __attribute_const__ x86/tdx: Fix off-by-one in port I/O handling x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() x86/tdx: Fix zero-extension for 32-bit port I/O hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() tracing/user_events: Clear copied tracing state before fork duplication tracing: Fix crash passing ERR_PTR to kthread_stop() tracing: Fix logged instance name on creation failure tracing: Fix use-after-free in trace_pipe read on sub-buffer order change tracing: Fix use-after-free with same-name named triggers cdx: Fix double free when sysfs file creation fails device property: fix infinite loop in fwnode_for_each_child_node() misc: nsm: bound the device-reported response length powerpc/powermac: fix OF node refcount rapidio: mport_cdev: fix use-after-free in dma_req_free() Revert "media: v4l2-dev: fix error handling in __video_register_device()" serial: imx: serialize imx_uart_ports[] lifetime staging: greybus: hid: fix SET_REPORT return value usb: dwc2: gadget: Exit partial power down state when changing USB pull-up usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed USB: phy: fsl-usb: fix missing static keywords usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion usb: gadget: u_audio: Fix use-after-free on sound card disconnect usb: gadget: snps_udc_plat: clean up PHY on probe deferral usb: gadget: midi2: remove default configfs groups on teardown usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() usb: gadget: f_fs: Prevent deadlock during ep0 read loop fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() media: cec: stm32: prevent out-of-bounds write on RX overflow media: vicodec: fix out-of-bounds write in FWHT encoder nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation of: fix out-of-bounds read in of_alias_scan() stem parser ubifs: fix out-of-bounds read in signature length check zsmalloc: rename class stat mutators zsmalloc: account for handle size in class lookup NFSD: check truncate permission under inode lock NFSD: Encode only the status in NFS-ACL v2 GETACL error replies NFSD: Fix off-by-one in DRC bucket pruning limit NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path nfsd: release path refs on follow_down() error nfsd: Reset write verifier when async COPY writeback fails nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types nfsd: sample writeback error cursor before async COPY loop nfsd: size fh_verify server sockaddr slot by xpt_locallen nfsd: validate symlink target length in NFSv4 CREATE nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() nfsd: add filehandle match check to nfsd4_delegreturn() nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref nfsd: check client ownership when cancelling a copy-notify stateid nfsd: clear opcnt on compound arg release to prevent OOB read nfsd: defer vfree of compound ops to fix rpc_status UAF nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd: fix cpntf publish race in nfs4_init_cp_state nfsd: fix nfsd_file leak on inter-server COPY setup failure nfsd: fix version mismatch loops in nfsd_acl_init_request() nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd: gate nfs2 setacl by argp->mask nfsd: gate nfs3 setacl by argp->mask nfsd: initialize copy-notify stateid before publishing it nfsd: initialize DRC hash table before registering shrinker nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE nfsd: reject reclaim LOCK after RECLAIM_COMPLETE nfsd: revoke copy-notify stateids before dropping their reference NFSD: Prevent lock owner use-after-free during client teardown libceph: validate OSD extent maps before cursor advance libceph: reject buckets with mismatched CRUSH ids ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode ceph: bound copied dentry name length in NFS export get_name ceph: bound num_export_targets array for mds info v2/v3 ceph: bound xattr value length in __build_xattrs() ceph: do not repeat ceph_trim_dentries() if no progress possible btrfs: rename err to ret in btrfs_recover_relocation() btrfs: drop recovered reloc root refs on recovery failure audit: avoid dropping live tree ref on fsnotify rule autoremove cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 smb: client: clear ce->tgthint in free_tgts() smb: client: fix ALIGN() overflow in symlink_data() error context loop smb: client: harden DFS cache against invalid target hints HID: picolcd: clamp eeprom debugfs read to bytes actually received HID: roccat: free buffered reports when destroying device HID: sensor: custom: Fix field sysfs group cleanup on failure HID: mcp2221: stop device IO before hid_hw_stop HID: mcp2221: validate report size in mcp2221_raw_event() eventfs: Initialize ei->children and ei->list in init_ei() fs/ntfs3: validate dirty page table on log replay fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() fs/ntfs3: bound page_lcns[] index by the log record eCryptfs: bound the packet-length peek to the user buffer ecryptfs: fix tag 11 packet exact-fit size check ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs: pass packet set buffer size to parser ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet ecryptfs: reject too-small tag 70 packets ecryptfs: release message context on send failure ecryptfs: show filename encryption options efivarfs: Rate limit statfs() handler fat: restore original value when fat_ent_write failed fbdev: omapfb: panel-dsi-cm: initialize lock before registering display fbdev: pvr2fb: correct user pointer annotation and sentinel initializer fbdev: ssd1307fb: defer I2C transfers from damage callbacks fbdev: uvesafb: unregister connector callback on init failure forcedeth: fix off-by-one when saving/restoring non-PCI config space fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device ACPI: APEI: Fix ERST timeout unit conversion ACPI: APEI: GHES: fix ARM section length accounting after header ACPI: pfr_update: fix stack buffer overflow in query_capability() alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() alpha: marvel: Fix irq_set_status_flags to use correct IRQ number alpha: marvel: Fix lock ordering in init_io7_irqs() ARM: 9477/1: Disable broken eBPF JIT on the Risc PC ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes auxdisplay: charlcd: cancel backlight work on registration failure block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Bluetooth: eir: Fix OOB read in eir_get_service_data() bnx2x: fix double free in bnx2x_init_firmware() error path bpf: Disable preemption in __bpf_get_stack bpf: Harden bloom filter sizing and indexing on 32-bit kernels dm-era: fix shadowed superblock leak on take-snap failure dm raid1: reserve space for NUL-terminator in build_constructor_string() dm: Constify struct dm_block_validator dm array: validate array block headers on read dm array: reject an array block whose value size is not the caller's coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior cpufreq: schedutil: Fix rate limit overflow cxl/pmem: Format the nvdimm serial number as unsigned decimal Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Bluetooth: RFCOMM: serialize security confirmation handling Bluetooth: hci_conn: re-enable advertising only for peripheral role Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request kasan: fix cache shrink race with CPU hotplug ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_gre: fix hardware header length for NBMA tunnels ipv6: use RCU iterator to dump route exceptions libnvdimm/labels: Prevent integer overflow in __nd_label_validate() mailbox: qcom-ipcc: fix duplicate channel allocation across holes md: do overflow check for sb->bblog_shift in super_1_load() mpls: reload header after pskb_may_pull() mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction nouveau/gem: reserve the bo in the info ioctl around the vma lookup params: fix charp corruption on allocation failure SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry SUNRPC: svcauth_gss: enforce krb5 token minimum length SUNRPC: always drain cache_cleaner before destroying a cache_detail SUNRPC: Check svc pool percpu counter allocation SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat SUNRPC: harden gss_krb5_unwrap_v2 against short tokens SUNRPC: harden gss_unwrap_resp_priv length checks sunrpc: init gssp_lock before publishing proc entry SUNRPC: reject duplicate CREDS_VALUE options SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field SUNRPC: wait for in-flight client TLS handshake callback svcrdma: Fix offset arithmetic in read_chunk_range svcrdma: Fix pcl_for_each_segment for empty chunks jbd2: bound shrinker scans by examined checkpoint buffers jbd2: add prefix 'jbd2' for 'shrink_type' jbd2: check need_resched() when skipping busy checkpoint buffers ipip: fix skb leak in collect_md mode when metadata_dst allocation fails sunrpc: route to a populated pool in svc_pool_for_cpu() svcrdma: Fix unmatched rn_unregister on failed accept svcrdma: Reject connection when transport allocation fails svcrdma: Reject inline replies that overflow the pull-up buffer svcrdma: Validate Read chunk positions before reconstruction udf: reject VAT indexes equal to the entry count wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets staging: media: tegra-video: fix of_node_put() on VIP parse errors staging: media: tegra-video: vi: fix probe failure on skipped last port scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() rpmsg: glink: smem: order FIFO read after availability check arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio riscv: acpi: Handle LPI architectural context loss flags remoteproc: scp: Fix device reference leak on failed lookup qede: Fix NULL pointer dereference in TPA fragment processing RDMA/cxgb4: Cancel reg_work before freeing device on remove RDMA/ucma: Lock the handler in ucma_set_ib_path() regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata regulator: qcom-refgen: correct the regulator type to CURRENT ring-buffer: Free cpu_buffer::free_page with subbuf_order ring-buffer: Hold cpu_buffer::lock when resizing a subbuf orangefs: fix double-free of trailer_buf on readdir copy failure orangefs: skip leading spaces before parsing client debug masks ocfs2: always run deallocs on copy-on-write completion ocfs2: bound namelen in dlm_migrate_request_handler ocfs2: validate lengths in dlm_mig_lockres_handler ocfs2: validate rl_used against rl_count in refcount block validator ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item ocfs2: cluster: fix o2hb_dependent_users leak on pin failure ocfs2: fix readdir position truncation on 32-bit kernels openrisc: fix arbitrary kernel memory access via or1k_atomic syscall openvswitch: only skb_tx_error() a packet we are about to drop ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion arm64: compat: Fix decrementing LDM/STM alignment emulation ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC hwmon: (max6621) fix negative temperature offset and crit readings hwmon: (max6621) fix temperature clamp range lockd: pin next file across nlm_inspect_file lock-drop lockd: fix NULL dereference on lockowner allocation failure nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path nvme: zero the discard fallback page nvme-pci: disable controller on admin queue IRQ setup failure nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone nvme-tcp: fix host memory disclosure on R2T for a read command nvme-tcp: reject a read that transferred too few bytes sctp: stop processing a packet once its association is deleted sctp: drop a chunk if its transport was removed sctp: fix NULL deref on untransmitted RECONF completion sctp: distinguish sequence zero from wildcard in reconf lookup sctp: fix stream->outcnt underflow on duplicate RECONF responses power: supply: bq24257: fix use-after-free on remove power: supply: bq256xx: drain usb_work before freeing the charger power: supply: bq25890: Fix power_supply reference leak power: supply: charger-manager: register regulators before exposing sysfs power: supply: cros_usbpd-charger: bound the EC-reported port count power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS power: supply: lp8727: fix use-after-free in lp8727_release_irq() power: supply: lp8788-charger: fix use-after-free on remove power: supply: qcom_battmgr: terminate the strings from firmware power: supply: rt9455: quiesce delayed work before teardown power: supply: twl4030_charger: cancel workers via devm power: supply: ucs1002: fix use-after-free on remove power: supply: max17040: propagate register read errors power: supply: max17040: drop incorrect I2C functionality check power: supply: max17040: synchronize work cancellation on suspend s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks s390/dasd: Do not complete a failed ESE read as successful s390/dasd: Guard sysfs discipline callbacks against unallocated private data s390/dasd: Propagate partial completion length across ERP recovery PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk PCI: meson: Fix GPIO state while requesting PERST# - PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses PCI/MSI: Enable memory decoding before restoring MSI-X messages PCI/proc: Avoid spurious runtime PM wakeup on config space accesses PCI/proc: Use file_ns_capable() when checking config space read access PCI/proc: Warn on writes to kernel-exclusive config space regions iommu/sva: Set handle->dev before the SVA handle is visible iommu/arm-smmu-v3: Manage teardown with devm iommu/vt-d: Fix no_iommu to disable platform opt-in iommu/vt-d: Force requesting ACS when tboot is enabled platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer platform/x86: ISST: Validate level in perf mask ioctls platform/x86: ISST: Validate socket ID in clos_assoc ioctl mmc: via-sdmmc: stop card-detect handling on probe failure platform/x86: ISST: Just allow 2 bits for SST feature enable platform/x86: ISST: Validate logical CPU id and clos id platform/x86: ISST: Validate parameter for core power state platform/x86: ISST: Validate parameter for frequency and priority platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path platform/chrome: sensorhub: Bound the EC-reported sensor number platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS platform/x86: hp-bioscfg: advance elem past consumed array elements platform/x86: hp-bioscfg: bound ordered-list parsing by the package count platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() platform/x86: hp-bioscfg: fix heap OOB read on empty password write platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed platform/x86: hp-bioscfg: pass validated element count to package parsers platform/x86: hp-bioscfg: warn on element type mismatch instead of failing interconnect: Fix use after free in icc_get() and of_icc_get_by_index() ipmi: ipmb: validate write message length ipmi: si: Fix NULL pointer dereference after failed registration net/iucv: filter frames in afiucv_hs_rcv() by ingress device xdp: fix zero-copy frame layout slip: fix use-after-free in sl_sync() net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition net: tun: bound receive headroom platform/x86: ISST: Add a NULL check for sst_inst[] platform/x86: ISST: Use PP level enable mask platform/x86: ISST: Return error during profile addition net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO net: ipa: fix stalled modem TX queue after runtime resume l2tp: improve tunnel/session refcount helpers l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname net: l2tp: do not propagate multicast notification errors net: openvswitch: fix flow mask use-after-free on flow deletion net: openvswitch: fix nf_connlabels leak in ovs_ct_init net: ravb: avoid dereferencing an invalid PTP clock net: ravb: serialize PTP clock teardown net: thunderbolt: Release the Rx HopID that was handed out on mismatch net: thunderbolt: Mark the connection down when bringing it up fails NTB: ntb_transport: Recycle TX entries before client callbacks NTB: ntb_transport: Fail TX enqueue when the QP link is down NTB: ntb_transport: Reject oversized TX buffers net: ntb_netdev: Avoid double-accounting netif_rx() drops net: ntb_netdev: Count packets dropped on RX refill failure net/smc: do not dereference an unset send buffer on the SMC-D teardown path net/smc: fix socket refcount leak in smc_switch_conns() net/smc: fix use-after-free in smc_rx_pipe_buf_release() net/smc: unregister the connection before draining the rx tasklet net: cap advertised IP tunnel headroom net: fix spurious TX timeout after dev_activate() net: skbuff: don't touch shared zerocopy state in skb_tx_error() seg6: reset IP6CB after IPv6 decapsulation mfd: sm501: Fix potential memory leaks during remove ALSA: 6fire: bound the MIDI event length from the device ALSA: aloop: Check card index validity at probe ALSA: bcd2000: clear the URB pointers on disconnect ALSA: mpu401: Check card index validity at probe ALSA: mts64: Check card index validity at probe ALSA: pcxhr: initialize mutexes before requesting threaded IRQ ALSA: portman2x4: Check card index validity at probe ALSA: serial-u16550: Check card index validity at probe ALSA: virmidi: Check card index validity at probe ring-buffer: Fix subbuf resize race with ring buffer readers iommu/amd: remove return value of amd_iommu_detect PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() dm-stats: fix a crash if allocation of per-cpu data fails dm-switch: use WRITE_ONCE() in switch_region_table_write() i3c: master: Fix info leak and UAF in device unregister path i3c: master: svc: bound IBI payload to the requested max_payload_len wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: rtl8xxxu: remove rtl8xxxu_ prefix from filenames wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop crypto: sun8i-ss - Remove crypto_rng interface UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_SS_PRNG crypto: sun8i-ce - Remove crypto_rng interface UBUNTU: [Config] Remove CRYPTO_DEV_SUN8I_CE_PRNG wifi: mwifiex: Detach sync cmd buffer on interrupted wait wifi: rtl818x: initialize eeprom_93cx6 struct to zero wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex vsock/virtio: flush works in dependency order w1: ds28e17: reject an oversize length on an I2C block read xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout sticon/parisc: Detect default STI graphics card for console output signal: avoid shared siginfo namespace rewrites smack: fix cred UAF in smack_file_send_sigiotask() taskstats: fix cpumask parsing cutting off the last character timer: Keep debugobjects state consistent in migrate_timer_list() udf: Fix i_lenExtents truncation on 32-bit kernels platform/chrome: sensorhub: Fix dropped timestamp events and log spam mm: avoid unnecessary use of is_swap_pmd() mm: provide mm_struct and address to huge_ptep_get() mm/rmap: use huge_ptep_get() in try_to_unmap_one() UBUNTU: Upstream stable to v6.6.149, v6.6.150, v6.6.151, v6.6.152, v6.6.153, v6.6.154, v6.6.155, v6.6.156, v6.12.102, v6.12.103, v6.12.104, v6.12.105, v6.12.106, v6.12.107, v6.12.108, v6.12.109 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2169770 Title: Noble update: upstream stable patchset 2026-10-05 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169770/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
