** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Summary changed:
- Noble update: upstream stable patchset 2026-10-20
+ Noble update: upstream stable patchset 2026-10-21
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
- upstream stable patchset 2026-10-20
+ upstream stable patchset 2026-10-21
+
+ Ported from the following upstream stable releases:
+ v6.6.159, v6.12.113
+
from git://git.kernel.org/
+
+ netfilter: nfnetlink_queue: unbreak SCTP traffic
+ ipv4: validate checksum_start before completing checksum
+ ipv4: free inet_opt and ireq_opt after an RCU grace period
+ smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
+ smb: client: fix cifsFileInfo reference leak in deferred close
+ selftests/mm: hugetlb-mremap: add setup of HugeTLB pages
+ smb: client: use finish_no_open() for non-regular inodes
+ xfs: don't let memory failures leak blocks and kill repairs
+ RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr()
+ bpf, xdp: move offload check into dev_xdp_install()
+ ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture
+ Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
+ ASoC: SOF: ipc4-priv: Add kernel doc for fw_context_save of sof_ipc4_fw_data
+ ASoC: SOF: ipc4/Intel: Add support for library restore firmware functionality
+ smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
+ smb/client: pass cifs_open_info_data to SMB2_open()
+ smb: client: close handle after create-context parsing failure
+ Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
+ Bluetooth: ISO: release unused CIS holds after channel attach
+ smb: client: close completed creates on compound wait errors
+ xfs: fix cursor and pointer handling when recovering iunlink buckets
+ neighbour: Skip default parms when resumed in neightbl_dump_info().
+ ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
+ audit: fix exe mark UAF in kill_rules()
+ kprobes: Skip disarmed probes when checking optkprobe overlap
+ of/irq: Fix remaining refcount leaks in of_irq_init()
+ of/overlay: put property on deadprops only after changeset add succeeds
+ of/overlay: only treat a positive changeset id as registered
+ net: fix checksum offsets in skb_splice_from_iter()
+ netfilter: nft_flow_offload: drop flowtable reference on init error path
+ net/packet: prevent TX_RING byte count overflow
+ rtc: ac100: Assign .num before accessing .hws
+ rtc: spear: initialize IRQ state before requesting alarm IRQ
+ sctp: check RCV_SHUTDOWN after the sendmsg connect wait
+ smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix
extensions
+ rds_tcp: close NULL deref window in rds_tcp_set_callbacks
+ vt: skip screen update for DEC alignment test on backgroup consoles
+ wifi: wlcore: Fix runtime PM leak in wlcore_remove()
+ ALSA: caiaq: unregister the input device when probe fails
+ ALSA: line6: reject oversized playback packets
+ mm/secretmem: properly account locked pages
+ perf/core: Fix WARN in perf_sigtrap()
+ mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
+ iio: accel: kionix-kx022a: Fix array boundary check
+ mtd: core: call _get_device() with the master MTD
+ nvmet: preserve device path on allocation failure
+ of/overlay: don't leak fragment references when changeset init fails
+ of/overlay: don't create "//" paths for fragments targeting the root
+ ASoC: wm8903: Move the DRC QR threshold to the register that holds it
+ wifi: wfx: validate MIB read length before copying to caller
+ ASoC: tegra: Fix ASRC Stream6 input threshold control
+ wifi: ath11k: reset ar->num_stations on hardware start
+ wifi: ath9k: reject short WMI command responses
+ wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
+ rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
+ rtc: ac100: Fix clock provider use-after-free on probe failure
+ rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
+ wifi: cfg80211: preserve hidden-group beacon IE ownership
+ wifi: mac80211: Add multicast to unicast support for 802.3 path
+ wifi: mac80211: Add 802.3 multicast encapsulation offload support
+ wifi: mac80211: prevent AP VLAN tx from other interfaces
+ ASoC: codecs: rt286: Revert delay value for jack setup
+ ASoC: codecs: rt274: Fix format setting for 44100 rate
+ Bluetooth: hci_core: free the HCI ID if naming fails
+ Bluetooth: btintel: validate DDC record lengths
+ net/mctp: publish the mctp_dev only after it is initialised
+ net/sched: cls_api: reclaim an empty proto on the error path
+ ipv6: fix prefix route expiry in modify_prefix_route()
+ netfilter: ipset: do not update comments from kernel-side adds
+ Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
+ net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
+ net: systemport: Fix RUNT MIB counter register offset calculation
+ net/mlx5: LAG, Refactor lag logic
+ net/mlx5: Fix slab-out-of-bounds when handling team device events
+ octeontx2-af: mcs: Fix SC resource cleanup loop
+ tipc: prevent GCM nonce reuse on peer key changes
+ memcg: convert memcg->socket_pressure to u64
+ mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n.
+ net: Clean up __sk_mem_raise_allocated().
+ net-memcg: Introduce mem_cgroup_from_sk().
+ net: add <net/proto_memory.h>
+ net-memcg: Introduce mem_cgroup_sk_enabled().
+ net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
+ net/sched: fq_codel: match the no-drop threshold to the packet size
+ net/sched: sch_codel: match the no-drop threshold to the packet size
+ virtio_blk: set the zone write granularity
+ net: bcmgenet: fix NULL dereference in set_coalesce before first open
+ net: cap skb->queue_mapping when the tx queue is picked
+ net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
+ tcp: refresh TS.Recent for accepted old ACKs
+ ipvs: fix missing counter decrement in lblc
+ ipvs: do not create invisible templates
+ ipvs: filter some flags received in the backup server
+ netfilter: bpf: reject invalid NAT manipulation types
+ netfilter: flowtable: generalize pending status bit
+ net: microchip: vcap: stop scanning after deleting key field
+ net: sparx5: make ports inherit the switch base mac address type
+ net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
+ ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
+ xdp, xsk: constify read-only arguments of some static inline helpers
+ net: mvneta: clear XDP pfmemalloc flag between frames
+ i2c: at91: release DMA channels when probe defers
+ perf: Fix race between perf_event_exit_task() and perf_pending_task()
+ ALSA: core: Define auto-cleanup for snd_card_free()
+ ALSA: ice1712: Fix the error handling via auto-cleanup at probe
+ PCI: Accept AtomicOps already enabled by the hypervisor
+ drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
+ drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
+ drm/amd/pm/si: Fix updating clock limits on AC/DC
+ drm/amdgpu/gfx6: fix firmware leak on teardown
+ drm/radeon: Read the VRAM VBIOS signature with readb()
+ drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
+ drm/mediatek: Fix ovl adaptor platform device leak
+ drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
+ drm/amdgpu: fix IP instance memory leak on kobject add failure
+ drm/amdgpu: fix ACP MFD device leak on init failure
+ binder: fix is_failure flag for superseded transaction cleanup
+ binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
+ kgdboc: Fix tty driver reference leak in configure_kgdboc()
+ Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
+ Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
+ Input: s6sy761 - fix resume ordering and restore sensing
+ Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
+ Input: synaptics - limit T440p InterTouch quirk to LEN0036
+ nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
+ soc: qcom: geni-se: Correct QUP Core ICC vote constants
+ USB: cdc-acm: fix racy TIOCMIWAIT implementation
+ USB: cdc-acm: skip URB restart in port_shutdown if disconnected
+ USB: serial: fix port tear down use-after-free
+ usb: storage: sierra_ms: reject short SWoC info transfers
+ usb: hub: use shorter 120ms post resume hold for SS root hubs
+ usb: octeon-hcd: fix the FIFO-flush timeout computation
+ usb: ohci-da8xx: disable controller wakeup on cleanup
+ usb: ohci-s3c2410: disable controller wakeup on removal
+ usb: ohci-st: disable controller wakeup on removal
+ usb: gadget: midi2: Fix the jack descriptor array sizes
+ usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
+ usb: typec: anx7411 - stop the IRQ before destroying the workqueue
+ usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
+ usb: gadget: aspeed-vhub: cancel wake work on device removal
+ USB: gadget: dummy-hcd: Fix wait for outstanding request completions
+ usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
+ usb: chipidea: tegra: disable runtime PM on resume failure
+ usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
+ usb: typec: tcpm: recover after failure to start the frs ams
+ usb: typec: tipd: don't send GAID when probe fails in APP mode
+ usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
+ usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
+ usb: typec: ucsi: Get the connector fwnode based on reg value
+ usb: typec: ucsi: displayport: Current CAM OOB index fixup
+ usb: cdns3: fix use-after-free in cdns3_gadget_exit()
+ usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
+ tty: vt: fix memory leak in vc_allocate()
+ tty: amiserial: fix broken TIOCMIWAIT
+ tty: vcc: zero-initialize control packet in vcc_send_ctl()
+ tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
+ tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
+ tty: abort break signalling on hangup
+ tty: serial: max3100: shut down timer before freeing port
+ serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
+ serial: fix TIOCMIWAIT race
+ serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
+ serial: tegra: don't clear the Tx FIFO on an Rx-only reset
+ serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
+ serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
+ ASoC: codecs: max98363: fix uninitialized stream_config->type
+ ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
+ ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
+ ALSA: seq: Serialize compat port-info ioctls
+ ALSA: ua101: reject mismatched capture/playback packet sizes
+ EDAC/altera: Fix memory leak on dci allocation failure
+ i2c: xiic: don't clobber msg->len to signal block-read completion
+ Bluetooth: RFCOMM: Fix initial port reference race
+ Bluetooth: hci_sync: Fix inquiry cache use-after-free
+ Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
+ Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
+ Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
+ Bluetooth: hci_core: Serialize fragmented ISO packet queueing
+ Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
+ ipvs: bound LBLCR and LBLC cache growth
+ HID: multitouch: stop the release timer from being rearmed on remove
+ net: extend IPv6 exthdr detection of tunneled packets
+ nvme-multipath: fix underflow in ANA log bounds checks
+ nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
+ nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
+ block2mtd: prevent direct access of bd_inode
+ mtd: block2mtd: Fix divide error when erase_size is zero
+ mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
+ mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
+ mtd: spinand: fix zero oobavail when no ECC engine is used
+ KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
+ KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
+ wifi: cw1200: fix TX padding OOB read leaking heap data to device
+ wifi: iwlegacy: 3945: free EEPROM data on remove
+ wifi: mac80211: keep paired old chanctx alive
+ wifi: mac80211: drain PS delivery work during station teardown
+ wifi: mac80211: account proxy paths against the mesh path limit
+ wifi: mac80211: keep fallback association elements alive
+ wifi: mac80211: minstrel_ht: validate fixed rate index
+ wifi: mac80211: release mesh path quota on failed additions
+ wifi: mac80211: fix mesh fast xmit path deletion UAF
+ wifi: mac80211: handle empty FILS association request payload
+ USB: serial: cp210x: add Corsair AX1500i Power Supply
+ USB: serial: quatech2: fix baud rate overflow
+ USB: serial: ssu100: fix baud rate overflow
+ USB: serial: fix dynamic id driver deregistration race
+ USB: serial: fix driver deregistration order
+ USB: serial: fix ioctl hangup race
+ USB: serial: option: add support for SIMCom SIM8260C
+ USB: serial: option: add Quectel EG060W
+ USB: serial: option: add Compal EXM-G1x support
+ USB: serial: option: add Quectel RG660QB
+ USB: serial: option: add Compal EXC-T1 support
+ thunderbolt: Fix KASAN reported use-after-free when request is canceled
+ thunderbolt: Disable CL states for the Anker Prime TB5 dock
+ thunderbolt: Reject oversized XDomain properties responses
+ smb: client: discard post-EOF pagecache when extending a file via zero range
+ smb: client: discard post-EOF pagecache when extending a file via copy range
+ smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
+ iio: accel: kxcjk-1013: reject duplicate event disable
+ iio: accel: sca3000: fix frequency divider condition check
+ iio: adc: stm32-adc: fix check on internal channel availability
+ iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
+ iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
+ iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
+ iio: admv1013: initialize callback mutex before registering notifier
+ iio: buffer: serialize buffer teardown with mode claims
+ iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
+ iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()
+ iio: gyro: adis16136: fix unprotected debugfs reads
+ iio: core: add accessors 'masklength'
+ iio: health: max30102: make use of iio_get_masklength()
+ iio: health: max30102: fix NULL dereference in interrupt handler
+ iio: imu: adis16400: fix unprotected debugfs reads
+ iio: imu: adis16480: fix unprotected debugfs reads
+ iio: light: gp2ap020a00f: drain irq_work after free_irq
+ iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
+ iio: proximity: isl29501: Fix return type of isl29501_register_write
+ iio: proximity: pulsedlight: fix iio_device left registered on PM setup
failure
+ iio: proximity: sx9324: Correct proximity channel resolution
+ iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
+ iio: trigger: cancel reenable_work before freeing trigger
+ ipv6: use RCU in ip6_output()
+ jfs: fix array-index-out-of-bounds read in add_missing_indices
+ KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
+ svcrdma: Use svc_xprt_put to free listener on create failure
+ drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
+ console: introduce console_lock guard()s
+ tty/vt: use guard()s
+ vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
+ mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
+ mptcp: prevent race between disconnect() and rtx
+ netfs: clear post-EOF pagecache when extending a file via write
+ net: usb: qmi_wwan: add Quectel EG120K-EA
+ xen/netfront: drop RX packets with a short Ethernet header
+ fs,fsverity: reject size changes on fsverity files in setattr_prepare
+ fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
+ drm/amd/display: Fix fast updates on DCE 8.1
+ usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
+ tty: fix saved termios reset race
+ perf: Remove unnecessary parameter of security check
+ perf/core: Check kernel access when kernel callchains are requested
+ perf: Require kernel access for text poke events
+ arm64/fpsimd: signal: Clear PSTATE.SM when restoring FPSIMD frame only
+ arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
+ Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
+ Bluetooth: Serialize SMP remote OOB data access
+ arm64: errata: Factor out broken AMU const counter cap
+ arm64: errata: Add Cortex-A725 erratum 3821522 workaround
+ UBUNTU: [Config] Enable ARM64 erratum workarounds for Cortex-A725 3821522
+ KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
+ fsverity: add dependency on 64K or smaller pages
+ drm/amdgpu: reset VI ASIC on MacBookPro15,1
+ drm/amdgpu: reset VI ASIC on MacBookPro14,3
+ usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()
+ usb: ohci-spear: disable controller wakeup on removal
+ USB: dwc2: shut down wakeup timer before freeing HCD state
+ drm/amd/display: Preserve eDP mode on initial ASSR failure
+ usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
+ tty: introduce tty_port_tty guard()
+ tty: tty_port: use guard()s
+ tty: tty_port: restore TTY_IO_ERROR on activation failure
+ tty: n_gsm: fix missing modem controls after DLCI open in convergence layer
type 2
+ perf: Replace perf_event_header__init_id with full header init
+ ALSA: hda/tegra: Re-enable SDO workaround for Tegra194
+ i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to
facilitate atomic mode
+ i2c: xiic: preserve PEC byte length in SMBus block read setup
+ drm/amd/display: Mark DCE 6.4 as not APU
+ mtd: spinand: fix NULL pointer dereference with no ECC engine
+ wifi: mac80211: shut down RX BA session timer on teardown
+ mtd: spinand: Enable QE on all dies
+ bnxt_en: fix DMA mapping length for padded small packets
+ tty: port: fix tty_port_tty_vhangup() race
+ wifi: mac80211: count only matching reservations in reserved switch
+ fs: Free any excess xarray nodes in clear_inode()
+ net/mlx5e: Prevent stale XSK buffer release on refill retry
+ net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
+ net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
+ net: mana: Skip WQ object destruction for uninitialized RXQ
+ net: mana: remove double CQ cleanup in mana_create_rxq error path
+ KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
+ wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
+ wifi: mac80211: set info->band for 802.3 encap offload frames
+ iio: accel: kx022a: Use cleanup.h helpers
+ iio: accel: kionix-kx022a: Prevent memory leak and fix state
+ iio: adc: ad_sigma_delta: Follow renaming of SPI "master" to "controller"
+ iio: introduce struct iio_scan_type
+ iio: adc: ad_sigma_delta: fix use-after-free on unbind
+ iio: adc: aspeed: Simplify with dev_err_probe
+ iio: adc: aspeed: propagate reset deassert errors
+ iio: adc: max1363: sign-extend bipolar differential channel reads
+ iio: adc: axp288: Add TS bias override for Haier HV103H
+ iio: adc: stm32-adc: fix possible division by zero in processed channel
+ smb: client: only require read lease for size-extending preallocate
+ iio: cdc: ad7150: fix OF matching and publish module aliases
+ iio: bu27034: simplify using guard(mutex)
+ iio: light: rohm-bu27034: Fix infinite delay on error
+ iio: light: rohm-bu27034: Fix error return
+ tools: ynl-gen: support using pre-defined values in attr checks
+ ynl: ensure exact-len value is resolved
+ tools: ynl-gen: use names of constants in generated limits
+ tools: ynl-gen: support limits using definitions
+ tools: ynl: add scope qualifier for definitions
+ doc/netlink: netlink-raw: Add max check
+ f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
+ f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
+ f2fs: fix to reset all pinned status during fggc
+ mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
+ mm/damon/core: fix unconditionally skip last region
+ Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
+ wifi: ath12k: fix reusing m3 memory
+ crypto: drbg - Fix ineffective sanity check
+ ipv4: stop PMTU walk when nexthop group shrinks
+ ipv4: stop exception dump when nexthop group shrinks
+ ipv4: stop route notification sizing when nexthop group shrinks
+ ipv4: do not warn on route notification size race
+ ipv6: do not warn on route notification size race
+ Input: xpad - add support for Corsair Novablade Pro
+ arm64: irq: exclude the softirq stack switch from KCOV
+ ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
+ btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
+ dm ioctl: don't let data_start run past the buffer
+ usb: f81604: fix struct f81604_int_data size mismatch
+ vsock/virtio: account only unread bytes in read_skb()
+ wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
+ wireguard: queueing: preserve tstamp_type when encapsulating packet
+ wireguard: noise: reject response consumption after intermediate initiation
+ workqueue: Fix NULL current_pwq deref in chained work check
+ xen/netfront: don't leak the skb when xennet_fill_frags() fails
+ tee: optee: Move pool_op helper functions
+ tee: fix memory leak in tee_dyn_shm_alloc_helper
+ tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
+ strparser: make sure __strp_recv isn't running before tearing down the parser
+ swiotlb: fix default_swiotlb_limit() for non-growable default pool
+ tipc: destroy topsrv workqueues before closing connections
+ tipc: hold a reference to nodes found by link name
+ Revert "wifi: libertas: reject short monitor TX frames"
+ selinux: fix data race on AVC latest_notif
+ selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
+ sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when
!streamoute
+ EDAC/amd64: Mask UMC chip select to the four implemented selects
+ gpio: xilinx: fix runtime PM leak on request error path
+ ibmveth: h_free logical LAN on open-fail after register
+ ibmveth: fix TX LTB and filter unwind on open-fail
+ ice: fix metadata_dst refcount handling on representor teardown
+ keys: finalize persistent keyring timeout after link attempt
+ KEYS: Fix add_key() race with keyring restriction
+ memstick: core: wait for request completion before freeing card
+ memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
+ dm-crypt: reject the lmk IV mode with AEAD ciphers
+ dm-snap: reject the transient exception store for snapshot-merge
+ dm: fix reading free memory in do_resume
+ mmc: cavium-octeon: destroy slot platform devices on remove
+ mmc: cavium-thunderx: destroy slot platform devices on remove
+ mmc: mtk-sd: Cancel request timeout work on remove
+ mmc: sdhci-sprd: disable runtime PM on remove
+ net/packet: guard the ll header push in packet_rcv_spkt()
+ net/smc: protect clcsock lifetime in smc_getname
+ net: bridge: avoid recursive multicast port cleanup
+ net: dsa: microchip: fix KSZ8765 fiber detection
+ net: usb: ax88179_178a: fix rx frame length for non-last packets
+ nvme: fix swapped ZRASF zone state values for full and read only
+ openvswitch: fix soft lockup in the netlink flow dump
+ optee: register TEE devices only once fully initialized
+ regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
+ regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
+ pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
+ pmdomain: rockchip: don't ignore clock lookup errors on attach
+ pmdomain: rockchip: fix clock leak on domain probe failure
+ pmdomain: rockchip: propagate subdomain add errors
+ scsi: qedi: Initialize callback state before registration
+ riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
+ riscv: fix load_unaligned_zeropad() fixup for RV32
+ Bluetooth: hci_sock: Serialize dead-device detachment
+ Bluetooth: ISO: Reject concurrent BIS listener setup
+ Bluetooth: ISO: Serialize concurrent connect calls
+ Bluetooth: MGMT: Fix status of pending commands flushed on power off
+ Bluetooth: RFCOMM: free the skb when the DLC has no owner
+ Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
+ drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
+ drm/gud: don't keep a connector without a CRTC as connector_state
+ drm/i915/gem: Prevent overstepping exec array boundary
+ drm/i915/gt: Unmask interrupts only when ACTIVE is true
+ drm/imagination: Size page table preallocation by device address
+ drm/vc4: drain the hangcheck timer and works on V3D unbind
+ drm/amdkfd: align SDMA doorbell base for shader doorbell writes
+ drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
+ drm/amdgpu: serialize vblank counter reads against GPU reset
+ drm/amdgpu: make Mac FB workaround generic
+ drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
+ drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
+ namespace: don't copy an unmounted mount tree
+ fs: refuse fspick() on internal superblocks
+ namespace: check a submount for references right before unmounting it
+ dcache: don't put a mountpoint on a dentry that's being removed
+ namei: don't reveal overmounted entries in refwalk
+ namespace: refuse an automount below a mount that is in no namespace
+ drm/dp: don't mark the AUX backlight enabled when enabling failed
+ gpio: exar: initialize the ID before registering its cleanup
+ drm/aspeed: Balance the display clock enable on teardown
+ drm/vc4: Free the BO cache size list on teardown
+ net/sched: em_text: reject unterminated algo before autoload
+ amt: send the relay's General Query directly from the receive path
+ cxgb4/ch_ktls: disable softirqs around tid_list erases
+ optee: sync secure world ABI headers
+ tee: optee: fix kernel-doc warnings
+ tee: optee: ffa: support shared memory offsets on large-page kernels
+ nvmet: use the local P2P device on metadata allocation failure
+ btrfs: fix xattr replace when multiple xattrs are packed in the same item
+ wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
+ wifi: mt76: mt7915: disable rx napi when removing device
+ wifi: mt76: mt7925: don't put the band auto marker in TGID
+ wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
+ wifi: mt76: mt792x: pick the SAR table layout from the table itself
+ ASoC: adau1372: allow sleepy powerdown GPIOs
+ ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
+ ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
+ cpuset: separate tmpmasks and cpuset allocation logic
+ cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in
cpuset_handle_hotplug()
+ flow_dissector: avoid u16 truncation of skb->len when computing thoff
+ devlink: fix devlink_rel reference leak when notify work is pending
+ net/sched: cls_route: reject change with no routing attribute
+ bnxt_en: Add bnxt_clear_bars() helper
+ bnxt_en: Fix driver init in kdump kernel
+ flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
+ drm/imagination: Fix reference and vm_bo handling in remap()
+ veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
+ net/mlx5e: Order ICOSQ cc update after CQ doorbell
+ mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
+ net: openvswitch: validate transport header presence in set_ipv6_addr
+ vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
+ drm/vc4: Make v3d paths unavailable on any generation newer than vc4
+ drm/vc4: Fix binner slot allocation failing on an idle GPU
+ io_uring/waitid: use io_waitid_remove_wq() consistently
+ io_uring/waitid: fix KCSAN warning on io_waitid->head
+ netfilter: conntrack: fix erronous removal of offload bit
+ netfilter: flowtable: fix offloaded ct timeout never being extended
+ wifi: mt76: mt7603: initialize global station WCID
+ can: fix unique skb identifier regression under RPS
+ drm/amd/display: Don't replace a sink mode that shares the native totals
+ HID: steam: Fully unregister controller when hidraw is opened
+ HID: steam: Rearrange teardown sequence
+ HID: steam: Refactor registration
+ HID: steam: Clean up locking
+ UBUNTU: Upstream stable to v6.6.159, v6.12.113
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171536
Title:
Noble update: upstream stable patchset 2026-10-21
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171536/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
