This bug was fixed in the package linux - 7.3.0-10.10
---------------
linux (7.3.0-10.10) stonking; urgency=medium
* stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)
* Rebase to v7.3 final (LP: #2169765)
CVE-2026-99999
- Linux 7.3
- firewire: core: fix race condition in split transaction handling
- x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()
- PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
- PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe
- printk: Postpone kthread startup
- wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
- Revert "namei: don't reveal overmounted entries in refwalk"
- perf: Update cgroup time when rotating multiplexed events
- perf: Fix perf_pmu_migrate_context() leaving events behind
- perf: Track the perf mlock gift separately
- sched/fair: Avoid overflow in place_entity()
- perf/x86/intel/uncore: Fix DMR CXL CM invert filter
- tracing: Check operator stack capacity before pushing
- tracing: Keep the predicate limit separate from program capacity
- tracing: Fix crash in print_graph_function_event()
- spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()
- spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct
spi_controller if possible
- spi: imx: fix slab corruption from undersized DMA bounce buffers
- i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
- drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
- drm/amdgpu: keep the eviction fence until the last handle is closed
- drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
- drm/amdgpu/userq: actually validate userq BOs
- drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES
- drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
- drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
- drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
- drm/amd/pm: add zero fan stop temperature support on smu 14.0.2
- drm/amdgpu: destroy mutex when tearing down ttm buffer entity
- drm/amdgpu: fix sched entity leak in ttm buffer entity init
- drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was
already set
- net: stmmac: dwmac1000: clear the RGMII status interrupt
- tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace
fields
- ring-buffer: Use subbuf_order in available memory estimation
- gpio: mxc: fix race between gpiochip registration and IRQ domain setup
- gpio: mxc: fix wakeup_pads bit operations
- gpio: mxc: fix both_edges bit operations
- gpio: mxc: fix race between chained IRQ handler install and probe
completion
- gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
- gpio: kunit: fix GPIO device reference leak with __free()
- gpio: shared: gracefully handle no-device lookup of shared GPIOs
- gpio: shared: fix use-after-free bug when adding shared proxies
- net/sched: fix use-after-free in __tcf_action_put()
- calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
- net: bcmgenet: unshare the skb before writing the control block
- microchip: lan865x: move setting of netops to fix crash
- net: ti: icssm-prueth: Move setting of netops to fix crash
- net: ethernet: aeroflex: move setting of netops to fix crash
- net: ethoc: move setting of netops to fix crash
- net: au1000: move setting of netops to fix crash
- net: mv643xx: move setting of netops to fix crash
- net: ethernet: adi: Move setting of netops to fix crash
- net: ethernet: actions: Move setting of netops to fix crash
- net: hisilicon: hip04_eth: Move setting of netops to fix crash
- net: hisilicon: hisi_femac: Move setting of netops to fix crash
- netlink: avoid hashing the network namespace pointer
- scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
- scsi: libsas: Fix SMP IO deadlock during HA resume
- tracing: probes: error if BTF is required but unavailable
- ring-buffer: Skip si_mem_available() for persistent and remote buffers
- eventfs: Free the eventfs_inode after an rcu grace period too
- tracing: Do not initialize tracefs work if tracing is disabled
- tracing: Fix hist trigger timestamps for buffered events
- tracing: Fix ignored return value of resize_buffer_duplicate_size()
- ring-buffer: Fix false warning in ring_buffer_map_get_reader()
- tracing: Fix simple_ring_buffer undef check on sparc64
- tracing: Fix simple_ring_buffer undef check on parisc
- tracing: Fix empty symbol names in simple_ring_buffer undef check
- ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
- tracing: Fix the shift out of bounds in the log2 histogram modifier
- ring-buffer: Do not show buffer_meta for CPUs without a buffer
- tracing: Take trace_types_lock when dropping the buffer_meta reference
- tracing: Fix NULL dereference when copying keys for a field variable
- selftests/filesystems: test that a mntns file can't take over a lock
- fs: let idle threads share init_fs
- namespace: a mount that copy_tree() leaves out can't take over a lock
- namei: test for a negative dentry the way traverse_mounts() does
- fs: pass flags to copy_fs()
- ovl: reject lowerdir ending with unescaped backslash
- fsnotify: prevent mark additions during connector teardown
- pid_namespace: make zap_pid_ns_processes() freezable
- fs: drop the smp_mb()s that mnt_get_count() made redundant
- autofs: ignore notification errors from a replaced pipe
- ntfs3: free replaced mount options after a grace period
- ntfs3: free the sbi after a grace period
- unicode: free the map after a grace period
- ipc: drop the mqueue mount with kern_unmount() on setup failure
- eventfs: free the eventfs_inode after an rcu grace period too
- 9p: free the session after a grace period
- watch_queue: Fix note pool publication race in watch_queue_set_size()
- afs: free the super info after a grace period
- pipe: preserve existing fasync readers on writer setup failure
- ext4: free the sbi after a grace period
- exit: fix lost-update race on the child_subreaper bitfields
- samples: pidfd: fix userprogs typo
- ocfs2/dlm: Protect the recovery list during debugfs reads
- drm/panthor: fix immortalis condition
- drm/i915/cx0_phy: Fix ARL-S host bridge detection
- drm/i915/dmc: Add sanity check for DMC load address
- drm/i915/dmc: Harden DMC firmware payload parsing
- KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for
!VM-Entry
- x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
- iommupt/kunit: Use if_changed_rule for the kunit
- Revert "iommu/amd: Remove redundant check in irq_remapping_select()"
- entry: Account the deferred hrtimer rearm as hardirq context for lockdep
- futex: Fix mm reuse handling for FUT_OFF_MMSHARED
- sched/core: Call wakeup_preempt() for queued tasks during class change
- printk: fix kernel-doc name for nbcon_write_context_is_braille
- drm/exec: don't immediately add prelocked obj to array of locked objs
- nbcon/reboot: Switch NBCON consoles into the emergency mode in
emergency_restart()
- scsi: libiscsi: Validate the task named by a management response
- scsi: libiscsi: Validate the ITT reflected in a Reject PDU
- scsi: libiscsi: Reject a negative task index from parse_pdu_itt
- scsi: target: iscsi: Fix race in discovery auth updates
- scsi: target: Disable interrupts while holding delayed_cmd_lock
- scsi: st: Fix use-after-free race between st_remove() and st_open()
- scsi: st: Save the visited block for the partition the drive is in
- scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
- nios2: fix __wsum type degradation in csum_fold()
- drm/virtio: Reset device before deleting virtqueues on freeze
- spi: tegra114: assert CS GPIO for every transfer in a message
- sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
- sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()
- drm/xe: Bump LRU for external objects on exec and rebind
- drm/xe/oa: Zero OA buffer at allocation
- drm/xe: skip eviction of a BO with no resource
- Revert "dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels"
- ASoC: amd: yc: disable MSI on resume
- net/mlx5: HWS, fix flow meter offset within its bulk
- net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool
- accel/rocket: search every core slot when looking up a scheduler
- accel/rocket: search every core slot when a core is removed
- accel/rocket: clear rdev on device init failure
- i2c: qcom-cci: Fix HALT_ACK reset request being dropped
- netlink: reset skb headers before unicast and multicast filtering
- sctp: revalidate output stream after association connect wait
- regmap: Fix cache lifecycle locking and teardown
- regmap: Drop map lock during cache init and exit
- regmap: Remove debugfs before cache teardown
- i2c: qcom-geni: Restore the source-clock selection policy
- i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
- PCI: dw-rockchip: Move INTx IRQ setup to probe
- PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave
- ASoC: Fix controls that write another control's bits
- ASoC: nau8822: Fix the 128x oversampling switch bits
- ASoC: wm8978: Fix the 128x oversampling switch bits
- ASoC: max98371: Fix the Speaker DHT Min Volume bits
- ASoC: pcm3168a: Fix the DAC zero flag polarity bit
- ASoC: cs42l52: Fix the NG Type Switch bit
- ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
- sched_ext: idle: Respect task affinity in restricted CPU selection
- sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an
ancestor
- sched_ext: Propagate every bypass depth change to the descendants
- ASoC: stm32: spdifrx: fix synchronization state check
- ASoC: Intel: avs: Reset the stream unless it is already prepared
- KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
- accel/amdxdna: Fix Kconfig invalid configuration
- net/rds: don't let the rdma_cm destroy an id RDS still owns on route
failure
- net: rds: fix uninitialized trans dereference in CM event handler
- drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state
change
- vsock: treat TCP_CLOSING as once-established
- tools: gpio: fix building from the top level with O=
- gpio: nct6694: Mark the GPIO controller as sleeping
- power: sequencing: qcom-wcn: power off WLAN at probe
- drm/vc4: hdmi: Move packet RAM enable to PM runtime
- x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
- x86/kcfi: Decode the kCFI check from the trap address
- pinctrl: sunxi: dt: do not accumulate npins across probe attempts
- bootconfig: give the footer size static_assert a message
- Linux 7.3-rc7
- Revert "drm/virtio: Add pixel blend mode property to cursor plane"
- landlock: Drop __counted_by from landlock_domain.handled_masks
- xfs: fix exchange-range-to-eof file size exchange
- xfs: stop exchanging reflink flags when exchanging mappings
- sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred
reenqueue
- sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on
its CPU's local DSQ
- Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
- Input: xpad - add support for Corsair Novablade Pro
- Input: ati_remote2 - fix type confusion in device attribute handlers
- lib/crypto: tests: Add Poly1305 split-update carry regression test
- lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state
- lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()
- io_uring/cancel: don't spin on local work the task can't run
- io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
- io_uring/register: don't exempt disabled rings from task restrictions
- io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
- drm/nouveau: Skip the Turing CE workaround object for non-GR channels
- PCI/AER: Skip error recovery on false alarms
- drm/vc4: Fix binner slot allocation failing on an idle GPU
- drm/vc4: Disable the V3D interrupt across runtime suspend
- io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
- net: macb: copy shared skbs before appending the FCS
- net: macb: check TX ring before modifying skb
- vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
- wireguard: noise: reject response consumption after intermediate
initiation
- wireguard: queueing: preserve tstamp_type when encapsulating packet
- net: openvswitch: validate transport header presence in set_ipv6_addr
- net/smc: protect clcsock lifetime in smc_getname
- ipv6: do not warn on route notification size race
- ipv4: do not warn on route notification size race
- ipv4: validate checksum_start before completing checksum
- ptp: ocp: fix PCIe delay estimation calculation
- xen/netfront: don't leak the skb when xennet_fill_frags() fails
- net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
- xen/netfront: drop RX packets with a short Ethernet header
- net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
- net: sparx5: free the matchall entry on destroy
- selftests: mlxsw: Test port range occupancy on template create
- mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
- net: dsa: microchip: fix KSZ8765 fiber detection
- net/mlx5e: Order ICOSQ cc update after CQ doorbell
- selftests: net: veth: test peer ndo-xmit after GRO toggle while down
- veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
- net: mana: reserve RX buffer headroom to fix forwarding performance
- ext4: mark data=journal as deprecated and will be removed in January 2028.
- swiotlb: fix default_swiotlb_limit() for non-growable default pool
- ASoC: SOF: sof-client: Use event-handler mutex consistently
- ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH
capture
- drm/imagination: Size page table preallocation by device address
- drm/imagination: Fix reference and vm_bo handling in remap()
- spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi
- riscv: fix load_unaligned_zeropad() fixup for RV32
- cipso: adjust cached option offsets when removing CIPSO
- bareudp: set the inner protocol to the protocol of the packet
- e1000e: add system to disable K1 list
- riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
- flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
- bnxt_en: fix DMA mapping length for padded small packets
- bnxt_en: Re-write the BARs following any type of PCIe errors
- bnxt_en: Fix driver init in kdump kernel
- bnxt_en: Add bnxt_clear_bars() helper
- net: usb: ax88179_178a: fix rx frame length for non-last packets
- Revert "wifi: libertas: reject short monitor TX frames"
- workqueue: Fix NULL current_pwq deref in mem-reclaim helper
- drm/amdgpu: make Mac FB workaround generic
- drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
- drm/amd/display: Don't replace a sink mode that shares the native totals
- drm/amdkfd: align SDMA doorbell base for shader doorbell writes
- drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
- drm/amdgpu: serialize vblank counter reads against GPU reset
- drm/amd/display: disable self-refresh on tearing flips
- drm/amdgpu/userq: return the memdup_user() error for the user MQD
- drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
- drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
- riscv: ptrace: Zero-initialize regset buffers before copyin
- riscv: ptrace: reject CFI regset access when extensions are absent
- riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
- riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
- riscv: futex: untag the user pointer before the atomic access
- ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts
- ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA
- drm/xe/i2c: cancel the client work on remove
- pinctrl: amd: Clear S4 wake bits when firmware has _AEI
- ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback
- ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI
- ASoC: cs35l56: Add DAI for SDCA OT25 stream
- wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
- wifi: mac80211: don't estimate airtime for unsupported rate widths
- arm64: irq: exclude the softirq stack switch from KCOV
- pfcp: make sure the SEID is linear before reading it
- net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET
- strparser: make sure __strp_recv isn't running before tearing down the
parser
- sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when
!streamoute
- Revert "net/mlx5: E-Switch, preserve max tx speed on vport state
modification"
- selftests: tc-testing: add cls_route no-routing-attribute change tests
- net/sched: cls_route: reject change with no routing attribute
- net: team: free skb when broadcast has no txable port
- net: team: stop reusing skb after queue override
- devlink: fix devlink_rel reference leak when notify work is pending
- net: sparx5: start the TOD counters on non-PTP lan969x variants
- mailmap: update entry for Andy Yan
- drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly
- selftests/mm: cleanup -Wformat issues in hugetlb-mmap
- mm: don't schedule deferred kernel page table freeing while booting
- mailmap: update addresses for John Garry
- mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
- mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
- ipv4: stop route notification sizing when nexthop group shrinks
- ipv4: stop exception dump when nexthop group shrinks
- ipv4: stop PMTU walk when nexthop group shrinks
- vsock/virtio: account only unread bytes in read_skb()
- ip6_gre: remove obsolete ERSPAN PMTU update
- namespace: simplify disconnect_mount()
- selftests/filesystems: test covered mounts
- namespace: rework connected mounts
- nullfs: add an empty immutable regular file
- selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM
- net: always dissect GSO packets in __virtio_net_hdr_to_skb()
- flow_dissector: avoid u16 truncation of skb->len when computing thoff
- cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in
cpuset_handle_hotplug()
- regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
- spi: sg2044-nor: Honor SPI clock limits
- spi: sg2044-nor: Return transfer errors
- ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
- ASoC: adau1372: two small bugfixes for the codec
- ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
- ASoC: adau1372: allow sleepy powerdown GPIOs
- Revert "wifi: ath12k: add panic handler"
- wifi: nxpwifi: do not delete Rx reorder entries under RCU
- wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion
- wifi: nxpwifi: handle authentication frame allocation failures
- wifi: nxpwifi: fix the authentication frame length handling
- wifi: nxpwifi: zero the channel statistics array
- wifi: nxpwifi: free the aggregation buffer when the RA list disappears
- wifi: nxpwifi: wait for the wakeup timer before the adapter is freed
- wifi: nxpwifi: delete the station entry on the uAP deauth event
- wifi: nxpwifi: protect sta_list against concurrent add and delete
- drm/xe/sysctrl: Fix mailbox header handling
- drm/i915/gt: Unmask interrupts only when ACTIVE is true
- drm/i915/gem: Prevent overstepping exec array boundary
- drm/gud: don't keep a connector without a CRTC as connector_state
- wifi: mt76: mt7996: fix uninitialized buf read in
mt7996_variant_fem_init()
- wifi: mt76: mt792x: pick the SAR table layout from the table itself
- wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
- wifi: mt76: mt7603: initialize global station WCID
- wifi: mt76: mt7925: don't put the band auto marker in TGID
- wifi: mt76: mt7915: disable rx napi when removing device
- wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
- wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
- wifi: mt76: use ALTX queue for packets to disassociated stations
- wifi: mt76: account non-AQL frames per peer rather than per link
- wifi: mt76: mt7996: take over connection monitoring
- pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12
- scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
- scsi: ufs: core: Avoid unsafe MMIO reads in
ufshcd_mcq_compl_all_cqes_lock()
- scsi: ch: Do not keep references to data transfer element devices
- scsi: ufs: mediatek: Handle mPHY power-on failures
- Revert "net: stmmac: propagate PTP addend and system time programming
errors"
- riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
- riscv: patch: fix handling of bpf-jit execmem addresses
- RISC-V: Clear HSTATUS.HU on CPU initialization
- RISC-V: errata: Add SiFive MAL-9092 workaround
- riscv: vector: Fix output operands in context save
- riscv: vector: Fix data pointer constraints in context save/restore
- riscv: limit sifive errata to CONFIG_64BIT
- riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
- net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()
- gve: fix napi_disable deadlock when attempting to disable XSK pools
- gve: fix XSK buffer leak on error descriptor
- gve: fix XSK buffer leak when rings are stopped
- net: stmmac: Disable S-Tag processing on dwmac4
- net: stmmac: Do not advertise S-VLAN stripping when it is disabled
- net: stmmac: Rename double VLAN references to svlan
- net: stmmac: Stop toggling the EDVLP bit
- net: stmmac: Remove VLAN perfect matching dead code
- ipv4: free inet_opt and ireq_opt after an RCU grace period
- net/mlx5: Lag, split aggregate speed into oper and max helpers
- net: make dev_xdp_sb_prog_count() see programs attached through a link
- drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
- drm/xe: Fix shrinker accounting double-subtraction on nested external pins
- drm/xe: Do not emit Wa_16010904313 twice
- drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums
- EDAC/amd64: Mask UMC chip select to the four implemented selects
- x86/CPU/AMD: Fix AMD TLBI Erratum #1718
- Bluetooth: ISO: Serialize concurrent connect calls
- Bluetooth: ISO: Reject concurrent BIS listener setup
- Bluetooth: hci_sync: Fix command skb lifetime during scan setup
- Bluetooth: hci_sock: Serialize dead-device detachment
- ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
- btrfs: fix lost error return value in btrfs_listxattr()
- btrfs: fix xattr replace when multiple xattrs are packed in the same item
- btrfs: don't stash io_uring encoded data across -EAGAIN
- btrfs: unlock inode and extent in caller when io_uring read extent fails
- btrfs: free iov when btrfs_uring_read_extent() fails
- btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
- btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
- btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from
record_root_in_trans()
- Revert "nvme: do not reset controllers in NVME_CTRL_NEW state"
- zloop: zero out only the unread tail of short reads
- i2c: qcom-geni: release runtime PM reference when set_rate fails
- fsverity: RCU-delay the freeing of struct fsverity_info
- openvswitch: fix soft lockup in the netlink flow dump
- net: bridge: avoid recursive multicast port cleanup
- spi: cadence-qspi: Fix status polling with octal DTR chips
- spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock
- KEYS: Fix add_key() race with keyring restriction
- keys: finalize persistent keyring timeout after link attempt
- power: supply: core: prevent unregistering a power supply while a
callback runs
- regulator: of: Fixes to of_regulator_bulk_get_all()
- regulator: of: state who owns the array from of_regulator_bulk_get_all()
- regulator: of: fill in supply names in of_regulator_bulk_get_all()
- power: supply: generic-adc-battery: Fix temperature IIO channel conversion
- selftests/filesystems: check that reading the root of an empty mount
namespace stalls nobody
- selftests/filesystems: add a helper that holds a readdir in a page fault
- readdir: take no inode lock on an immutable directory
- nullfs: refuse file locks
- fsnotify: let a filesystem refuse marks on its objects
- namespace: nothing is mounted on or written through knullfs
- namespace: keep the private nullfs instance in knullfs
- fhandle: decide the subtree check under mount_lock
- selftests/filesystems: check that an automount below an overlay layer is
refused
- selftests/filesystems: check the atime of the empty mount namespace root
- selftests/filesystems: check that a lock lands on the right mount and
stays
- namespace: keep the lock on a mount that a propagated copy is moved
beneath
- namespace: never expire a locked mount
- nullfs: don't update the access time
- namespace: handle mount locking for automounts correctly
- namespace: refuse an automount below a mount that is in no namespace
- selftests/filesystems: check that an immutable inode takes no write hint
- fcntl: refuse F_SET_RW_HINT on an immutable inode
- namei: don't reveal overmounted entries in refwalk
- namespace: unhash a dentry before detaching the mounts on it
- arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
- sched_ext: Generate qseq from a per-task counter
- turbostat 2026.09.28
- tools/power turbostat: Fix add_counter issue if > 24 counters.
- tools/power turbostat: Fix PMT error path fd handling
- tools/power turbostat: Fix CWF PMT off-by-one
- tools/power turbostat: Fix fd_perf leak on reset
- tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages
- tools/power turbostat: add NULL check after calloc()
- tools/power turbostat: Warn, but don't Err on out-dated perf systems
- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx
(103c:8bfd)
- ALSA: hda/tas2781: Accept V1 calibration data without CRC
- ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
- ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H
- ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers
- nvmet: use the local P2P device on metadata allocation failure
- nvme-multipath: revalidate head zones after unfreezing the head queue
- nvme: fix swapped ZRASF zone state values for full and read only
- nvmet: return Invalid Field for invalid NSIDs feature 82h
- ice: fix metadata_dst refcount handling on representor teardown
- ice: Restore Ordered MMIO Writes for Tx Doorbells
- ice: fix use-after-free in dynamic port cleanup
- tcp: reject net_iov in zerocopy receive mapping hints
- net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
- bonding: fix the program leak when XDP is replaced
- cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
- Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
- Bluetooth: btintel_pcie: use managed IRQ teardown
- tee: optee: ffa: support shared memory offsets on large-page kernels
- optee: register TEE devices only once fully initialized
- tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
- net: allwinner: remove dmaengine_desc_free()
- net: stmmac: propagate PTP addend and system time programming errors
- wifi: mt76: mt7996: program a link again if the driver holds it
- cxgb4/ch_ktls: disable softirqs around tid_list erases
- braille: nbcon: Allow to use a serial console with NBCON API as Braille
console
- tipc: destroy topsrv workqueues before closing connections
- lib/dim: add KUnit test for dim_calc_stats()
- lib/dim: fix 32-bit overflow in dim_calc_stats() rates
- net/packet: guard the ll header push in packet_rcv_spkt()
- selftests: net: amt: check that the relay's queries bypass the amt device
- amt: send the relay's General Query directly from the receive path
- net/sched: em_text: reject unterminated algo before autoload
- srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()
- tipc: hold a reference to nodes found by link name
- ibmveth: fix TX LTB and filter unwind on open-fail
- ibmveth: h_free logical LAN on open-fail after register
- usb: f81604: fix struct f81604_int_data size mismatch
- can: fix unique skb identifier regression under RPS
- can: dev: init_can_skb(): restore skb header initialization
- tools/power turbostat: Read complete CPU lists
- drm/vc4: Use kvmalloc_objs() for the BO cache size list
- drm/vc4: Free the BO cache size list on teardown
- drm/aspeed: Balance the display clock enable on teardown
- drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
- pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions
- gpio: mpsse: fix race when arming the IRQ poll worker
- namespace: don't let a pseudo dentry become the root of a mount
- unshare: don't drop active namespace references that were never taken
- dcache: don't put a mountpoint on a dentry that's being removed
- namespace: remove the fsnotify marks of a mount namespace in process
context
- selftests/filesystems: check that the nullfs root can't be reconfigured
- namespace: don't reconfigure internal superblocks via remount and umount
- namespace: check the mounts before reading their parents in pivot_root()
- selftests/filesystems: check that a mount namespace file on top doesn't
bury a mount
- namespace: look at the topmost mount for a mount namespace file
- selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered
- namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
- selftests/filesystems: check that a recursive bind mount can't pin the
caller's mount namespace
- namespace: check a recursive bind mount for mount namespace loops
- selftests/filesystems: check that a busy submount survives a synchronous
umount
- namespace: check a submount for references right before unmounting it
- namespace: queue a mount only once for mount notifications
- dm-integrity: validate the superblock on resume
- gpio: exar: initialize the ID before registering its cleanup
- power: sequencing: pcie-m2: Fix leaking array from
of_regulator_bulk_get_all()
- nouveau: check gsp->rm as well as gsp pointer before gcx ready
- drm/dp: don't mark the AUX backlight enabled when enabling failed
- selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
- selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ
moves
- sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ
- cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
- memstick: rtsx_usb_ms: complete requests after eject instead of dropping
them
- drm/panthor: validate userspace queue count against initialized firmware
slot count
- regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
- KVM: x86: Use active memslots for the per-vCPU MMIO cache
- KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
- KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails
- KVM: SVM: Use "is AVIC-addressable" helper to sanity check load()/put()
- KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable
- dm-snap: reject the transient exception store for snapshot-merge
- dm: fix reading free memory in do_resume
- drm/bridge: Fix unlocked list access in drm_bridge_attach()
- drm/bridge: Fix unlocked list_del in drm_bridge_add()
- ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
- usb: mtu3: Fix double dereference in TP_printk
- Bluetooth: MGMT: Fix status of pending commands flushed on power off
- Bluetooth: btintel_pcie: Add shared HW reset for clean start
- Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
- Bluetooth: btintel_pcie: fix TX descriptor bounds check
- memstick: core: wait for request completion before freeing card
- workqueue: Fix NULL current_pwq deref in chained work check
- pinctrl: qcom: spmi-gpio: make direction changes exclusive
- Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
- sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF
scheduler
- ice: skip unnecessary VF reset when setting trust
- iavf: send MAC change request synchronously
- i40e: skip unnecessary VF reset when setting trust
- mmc: cavium-thunderx: destroy slot platform devices on remove
- mmc: cavium-octeon: destroy slot platform devices on remove
- Bluetooth: RFCOMM: free the skb when the DLC has no owner
- mmc: sdhci-sprd: disable runtime PM on remove
- mmc: mtk-sd: Cancel request timeout work on remove
- drm/vmwgfx: Add blend mode property
- drm/vmwgfx: validate pitch coming from userspace
- pmdomain: rockchip: don't ignore clock lookup errors on attach
- pmdomain: rockchip: fix clock leak on domain probe failure
- pmdomain: rockchip: propagate subdomain add errors
- gpio: xilinx: fix runtime PM leak on request error path
- drm/bridge: th1520-dw-hdmi: Fix remove() callback
- drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return
value
- drm/vc4: Fix firmware reference leak in vc4_drm_bind()
- selftests/filesystems: check that a dead mount's overmount isn't followed
- selftests/filesystems: check that an unmounted mount tree isn't walked
- namespace: drop the file's reference first in dissolve_on_fput()
- fs: put the old fs_struct before the old namespaces in unshare()
- fs: refuse fspick() on internal superblocks
- namespace: check the target before walking it in do_mount_setattr()
- namespace: don't copy an unmounted mount tree
- namespace: don't inherit MNT_UMOUNT in clone_mnt()
- statmount: read the parent of an unmounted mount under mount_lock
- namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
- scsi: qedi: Initialize callback state before registration
- scsi: ufs: core: Hold a clock reference across the probe
- selinux: fix data race on AVC latest_notif
- docs: update the unmount propagation rule
- fs: don't let a migrating task hide its reference from do_umount()
- selftests/filesystems: check that a busy propagated copy blocks a
synchronous umount
- fs: don't silently unmount busy mounts
- selftests/move_mount_set_group: check that an unbindable target is refused
- mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount
- selftests/filesystems: check that a copied mount namespace keeps
unbindable
- mount: keep a copied mount unbindable
- drm/vc4: drain the hangcheck timer and works on V3D unbind
- media: em28xx: use video_unregister_device for radio_dev
- pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
- iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys
- power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850
subsystem PCI ids
- pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13
- PCI: hv: Warn when wait_for_response() waits indefinitely
- dm ioctl: don't let data_start run past the buffer
- dm-crypt: reject the lmk IV mode with AEAD ciphers
- dm-integrity: fix buffer overflow in inline mode with large tag size
- ARM: configs: sama5: enable current Microchip KSZ DSA symbols
- PCI: hv: Probe vPCI buses asynchronously
- mshv_vtl: Check per-CPU register page before mmap
- tools/hv: fix typo "retrive" in comment
- Drivers: hv: vmbus: fix typo "substract" in comment
- pinctrl: qcom: qcs8300: Fix intr_target_width
- pinctrl: qcom: maili: Fix intr_target_width
- pinctrl: qcom: hawi: Fix intr_target_width
- pinctrl: qcom: nord: fix GPIO interrupt target width
- Drivers: hv: Don't reset VMBus connection state on error/exit paths
- x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
- x86/hyperv: Fix stale comments after stimer message mode removal
- Drivers: hv: Avoid infinite retry loop in init_vp_index()
- arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply
- soc/tegra: pmc: Fix uninitialised clock rate
- power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
- power: supply: Fix maintenance charge table kernel-doc
- power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT
parsing
- riscv: dts: microchip: beaglev-fire: remove double definition of gpio
interrupts
- pinctrl: qcom: ipq5210: Publish the OF module alias
- pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions
- arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
- arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
- arm64: dts: lx2160a: fix incorrect pinmux
- regmap: irq: Free the irqdomain we create
- clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable
- clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable
- clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks
- clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks
- clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks
- ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition
- arm64: dts: qcom: x1-denali: Fix microphone distortion
- soc/tegra: fuse: Add missing newline to APBMISC error message
- arm64: tegra: Add PCIe root ports on Tegra264
- arm64: tegra: Reorder reg and reg-names to match bindings
- arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit
- arm64: tegra: Add PWM controllers on Tegra264
- tee: qcomtee: fix kernel-doc warnings
-- Timo Aaltonen <[email protected]> Thu, 22 Oct 2026
08:35:41 +0300
** Changed in: linux (Ubuntu Stonking)
Status: Fix Committed => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2026-99999
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169765
Title:
Keyboard is not functional on some Snapdragon laptops due to 7.3
kernel regression
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169765/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
