Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-11-03
Ported from the following upstream stable releases:
v6.18.60, v7.2.14
from git://git.kernel.org/
rose: clear stale N(R)/N(S) before (re)transmitting a data frame
netrom: linearize and validate lengths in nr_rx_frame()
netrom: require full NET/ROM headers in nr_route_frame()
net: netrom: validate source address in nr_find_socket()
netrom: bound fragment reassembly in nr_queue_rx_frame()
ax25: fix OOB read after address header strip in ax25_rcv()
ax25: check frame length in ax25_decode() and ax25_rx_iframe()
net: ax25: fix integer overflow in ax25_rx_fragment()
netrom: use a single lock for the node and neighbour lists
netrom: look up and update routes in one critical section
netrom: fix reference count leak in nr_rt_device_down
netrom: clear nr_neigh->ax25 under the routing lock in nr_link_failed()
netrom: fix nr_node leak when nr_del_node() removes the last route
rose: clear through routes when a neighbour is removed from the tables
rose: restart the link of a neighbour created over a live AX.25 connection
ax25: serialise the transmission of I frames on a connection
rose: process received frames and send with the socket locked
ax25: don't create two connections for the same link in ax25_send_frame()
ax25: read the connection's ax25_dev only once when walking ax25_list
ax25: wait for ax25_send_frame() before detaching the connections of a device
ax25: don't accept frames on a device that is going down
ax25: send a private copy of each I frame
rose: clear the circuits of a neighbour that restarts the link
ax25: send unacknowledged I frames again when a link is re-established
rose: bring up the link of the preferred route passed over by a connect request
ax25: don't free an incoming SABM skb left on the listener's queue
block: avoid potential deadlock on zone revalidation failure
mm/damon/core: error damos_commit_quota_goal() for zero target_value
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
tracing: Hold trace_types_lock when updating modules in persistent instances
tracing: Hold trace_types_lock when resetting last boot data from readers
tracing: Reject incomplete event filter expressions
tracing: Save the event file instead of the compatible histogram
tracing: Unregister field variable histograms when the command fails
tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
tracing/histograms: Verify event_call identity when updating synth_event
refcount
io-wq: order the exit bit against worker creation task work
io_uring/waitid: own the request before clearing ->head
io_uring/cmd: don't leave list poison in ->hash_node
io_uring/wait: don't spin on a stuck overflow list
io_uring/io-wq: don't lose the signal that ends work
io_uring/io-wq: don't hide a link from cancellations
io_uring: don't flood a cancelling task with task_work
io_uring/io-wq: don't go to sleep on pending work
io_uring/io-wq: don't strand work when a worker exits
io_uring/io-wq: don't exit with a creation pending
io_uring/io-wq: let cancel find picked up hashed work
io_uring/poll: don't lose a cancel as io-wq arms poll
io_uring: don't lose a cancel as io-wq parks a request
io_uring/cancel: don't forget that the work was running
io_uring/cancel: recognize "no timeout" on 32-bit
io_uring/cancel: let CANCEL_ALL find parked requests
io_uring: wake ring pollers for local task_work
io_uring/wait: look at all CQ waiters on wake up
io_uring/poll: drop stale double poll entry on rearm
io_uring/futex: allocate private hash before waiting
io_uring: drop the CQE cache if a refill fails
io_uring/register: don't wrap 32b CQEs when resizing
io_uring/register: handle index wrap when resizing
io_uring/fdinfo: fix CQE dump of CQE32 rings
io_uring/timeout: don't skip over reached sequences
io_uring/timeout: keep repeat count on multishot update
io_uring/wait: no early -ETIME if min_wait finds work
io_uring/napi: make stale entries time out after 60s
io_uring/napi: don't busy poll past an expired timeout
io_uring/zcrx: fix buffer offsets in areas above 4GB
io_uring/kbuf: handle index wrap in last buffer check
io_uring/sqpoll: let the thread sleep on disabled rings
io_uring/openclose: keep the lock in io_pipe_fixed()
io_uring: don't pass restart error codes to userspace
io_uring/net: don't retry recv on uncommitted buffers
io_uring/timeout: no ABS update of multishot timeouts
io_uring/timeout: don't end a linked timeout with 1
io_uring: look up the file before queueing to io-wq
io_uring/poll: avoid retry wakeup loss when dropping ownership
io_uring/timeout: don't put a sequence target behind the last flush
io_uring/timeout: don't flush with the sequence behind the last flush
io_uring/timeout: don't lose a cancel as io-wq arms a timeout
io_uring/poll: don't loop on HUP with multiple references
io_uring/net: keep recv buffer select length within MAX_RW_COUNT
io_uring/wait: wake real-time waiters from hard interrupt context
io_uring/waitid: prevent cancel reference wrap
io_uring: end the drain when the drain request completes
io_uring: keep the drain active when a deferred drain request is started
keys: Avoid the owner account dereference in named keyring lookup
keys: Check the authorization payload in process keyring searches
keys: Protect the type name while describing a key
keys: make keyring indexes independent of kernel addresses
keys: Protect the read method check against type removal
KEYS: Fix key_reject_and_link() race with keyring restriction
KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
keys/trusted_keys: return immediately after TPM unseal failure
asymmetric_keys: reject trust keys without IDs
ftrace: Initialize modname and offset in print_rec()
coredump: hold RCU while releasing parked threads
signal: don't retarget shared signals in a dying thread group
signal: only SIGKILL and the freezers interrupt a coredumping task
ptrace: refuse to change the signal mask of a user worker
fork: release the files of a failed fork after sched_cancel_fork()
exit: hang up the tty before closing the files
signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
tools/dma: fix building with O=
tracing/syscalls: Use copy_from_user for the faultable syscall buffer
io_uring/cancel: rearm local work wake up before sleep
io_uring: don't split 128b SQEs at the SQPOLL cap
io_uring/register: keep 128b SQEs intact on resize
coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
UBUNTU: Upstream stable to v6.18.60, v7.2.14
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Resolute)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Resolute)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Resolute)
Status: New => In Progress
** Changed in: linux (Ubuntu Resolute)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Summary changed:
- Resolute update: upstream stable patchset 2026-11-04
+ Resolute update: upstream stable patchset 2026-11-03
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
- upstream stable patchset 2026-11-04
+ upstream stable patchset 2026-11-03
+
+ Ported from the following upstream stable releases:
+ v6.18.60, v7.2.14
+
from git://git.kernel.org/
+
+ rose: clear stale N(R)/N(S) before (re)transmitting a data frame
+ netrom: linearize and validate lengths in nr_rx_frame()
+ netrom: require full NET/ROM headers in nr_route_frame()
+ net: netrom: validate source address in nr_find_socket()
+ netrom: bound fragment reassembly in nr_queue_rx_frame()
+ ax25: fix OOB read after address header strip in ax25_rcv()
+ ax25: check frame length in ax25_decode() and ax25_rx_iframe()
+ net: ax25: fix integer overflow in ax25_rx_fragment()
+ netrom: use a single lock for the node and neighbour lists
+ netrom: look up and update routes in one critical section
+ netrom: fix reference count leak in nr_rt_device_down
+ netrom: clear nr_neigh->ax25 under the routing lock in nr_link_failed()
+ netrom: fix nr_node leak when nr_del_node() removes the last route
+ rose: clear through routes when a neighbour is removed from the tables
+ rose: restart the link of a neighbour created over a live AX.25 connection
+ ax25: serialise the transmission of I frames on a connection
+ rose: process received frames and send with the socket locked
+ ax25: don't create two connections for the same link in ax25_send_frame()
+ ax25: read the connection's ax25_dev only once when walking ax25_list
+ ax25: wait for ax25_send_frame() before detaching the connections of a device
+ ax25: don't accept frames on a device that is going down
+ ax25: send a private copy of each I frame
+ rose: clear the circuits of a neighbour that restarts the link
+ ax25: send unacknowledged I frames again when a link is re-established
+ rose: bring up the link of the preferred route passed over by a connect
request
+ ax25: don't free an incoming SABM skb left on the listener's queue
+ block: avoid potential deadlock on zone revalidation failure
+ mm/damon/core: error damos_commit_quota_goal() for zero target_value
+ Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
+ tracing: Hold trace_types_lock when updating modules in persistent instances
+ tracing: Hold trace_types_lock when resetting last boot data from readers
+ tracing: Reject incomplete event filter expressions
+ tracing: Save the event file instead of the compatible histogram
+ tracing: Unregister field variable histograms when the command fails
+ tracing: Fix 64-bit and signed histogram fields on 32-bit kernels
+ tracing/histograms: Verify event_call identity when updating synth_event
refcount
+ io-wq: order the exit bit against worker creation task work
+ io_uring/waitid: own the request before clearing ->head
+ io_uring/cmd: don't leave list poison in ->hash_node
+ io_uring/wait: don't spin on a stuck overflow list
+ io_uring/io-wq: don't lose the signal that ends work
+ io_uring/io-wq: don't hide a link from cancellations
+ io_uring: don't flood a cancelling task with task_work
+ io_uring/io-wq: don't go to sleep on pending work
+ io_uring/io-wq: don't strand work when a worker exits
+ io_uring/io-wq: don't exit with a creation pending
+ io_uring/io-wq: let cancel find picked up hashed work
+ io_uring/poll: don't lose a cancel as io-wq arms poll
+ io_uring: don't lose a cancel as io-wq parks a request
+ io_uring/cancel: don't forget that the work was running
+ io_uring/cancel: recognize "no timeout" on 32-bit
+ io_uring/cancel: let CANCEL_ALL find parked requests
+ io_uring: wake ring pollers for local task_work
+ io_uring/wait: look at all CQ waiters on wake up
+ io_uring/poll: drop stale double poll entry on rearm
+ io_uring/futex: allocate private hash before waiting
+ io_uring: drop the CQE cache if a refill fails
+ io_uring/register: don't wrap 32b CQEs when resizing
+ io_uring/register: handle index wrap when resizing
+ io_uring/fdinfo: fix CQE dump of CQE32 rings
+ io_uring/timeout: don't skip over reached sequences
+ io_uring/timeout: keep repeat count on multishot update
+ io_uring/wait: no early -ETIME if min_wait finds work
+ io_uring/napi: make stale entries time out after 60s
+ io_uring/napi: don't busy poll past an expired timeout
+ io_uring/zcrx: fix buffer offsets in areas above 4GB
+ io_uring/kbuf: handle index wrap in last buffer check
+ io_uring/sqpoll: let the thread sleep on disabled rings
+ io_uring/openclose: keep the lock in io_pipe_fixed()
+ io_uring: don't pass restart error codes to userspace
+ io_uring/net: don't retry recv on uncommitted buffers
+ io_uring/timeout: no ABS update of multishot timeouts
+ io_uring/timeout: don't end a linked timeout with 1
+ io_uring: look up the file before queueing to io-wq
+ io_uring/poll: avoid retry wakeup loss when dropping ownership
+ io_uring/timeout: don't put a sequence target behind the last flush
+ io_uring/timeout: don't flush with the sequence behind the last flush
+ io_uring/timeout: don't lose a cancel as io-wq arms a timeout
+ io_uring/poll: don't loop on HUP with multiple references
+ io_uring/net: keep recv buffer select length within MAX_RW_COUNT
+ io_uring/wait: wake real-time waiters from hard interrupt context
+ io_uring/waitid: prevent cancel reference wrap
+ io_uring: end the drain when the drain request completes
+ io_uring: keep the drain active when a deferred drain request is started
+ keys: Avoid the owner account dereference in named keyring lookup
+ keys: Check the authorization payload in process keyring searches
+ keys: Protect the type name while describing a key
+ keys: make keyring indexes independent of kernel addresses
+ keys: Protect the read method check against type removal
+ KEYS: Fix key_reject_and_link() race with keyring restriction
+ KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
+ keys/trusted_keys: return immediately after TPM unseal failure
+ asymmetric_keys: reject trust keys without IDs
+ ftrace: Initialize modname and offset in print_rec()
+ coredump: hold RCU while releasing parked threads
+ signal: don't retarget shared signals in a dying thread group
+ signal: only SIGKILL and the freezers interrupt a coredumping task
+ ptrace: refuse to change the signal mask of a user worker
+ fork: release the files of a failed fork after sched_cancel_fork()
+ exit: hang up the tty before closing the files
+ signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
+ pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
+ tools/dma: fix building with O=
+ tracing/syscalls: Use copy_from_user for the faultable syscall buffer
+ io_uring/cancel: rearm local work wake up before sleep
+ io_uring: don't split 128b SQEs at the SQPOLL cap
+ io_uring/register: keep 128b SQEs intact on resize
+ coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
+ UBUNTU: Upstream stable to v6.18.60, v7.2.14
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173011
Title:
Resolute update: upstream stable patchset 2026-11-03
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173011/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
