Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-11-03
Ported from the following upstream stable releases:
v6.6.160, v6.12.114
from git://git.kernel.org/
xfrm: prevent policy_hthresh.work from racing with netns teardown
Bluetooth: btqcomsmd: Convert to platform remove callback returning void
ieee802154: cc2520: fix FIFOP work use-after-free
openvswitch: prepare for stolen verdict coming from conntrack and nat engine
perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix
sample classification
scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr
net: add and use skb_get_hash_net
usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
drm/amd/display: Mark DCE 6.4 as not APU
erofs: avoid infinite loops due to corrupted subpage compact indexes
erofs: unify lcn as u64 for 32-bit platforms
iio: adc: axp288: Add TS bias override for Haier HV103H
HID: core: introduce hid_safe_input_report()
HID: uhid: convert to hid_safe_input_report()
netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting
pmdomain: rockchip: propagate subdomain add errors
iio: light: Drop ROHM BU27034
UBUNTU: [Config] remove CONFIG_ROHM_BU27034
dlm: validate length in dlm_search_rsb_tree
HID: steam: Clean up locking
ip6_gre: remove obsolete ERSPAN PMTU update
mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
ALSA: pcm: oss: Fix setup list UAF on proc write error
ALSA: mixer: oss: Add card disconnect checkpoints
net: team: rename team to team_core for linking
net: team: Remove unused team_mode_op, port_enabled
net: team: Rename port_disabled team mode op to port_tx_disabled
net: team: fix NULL pointer dereference in team_xmit during mode change
net: team: stop reusing skb after queue override
Bluetooth: hci_sync: Fix command skb lifetime during scan setup
Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
drm/vmwgfx: validate pitch coming from userspace
namespace: don't inherit MNT_UMOUNT in clone_mnt()
namespace: check the mounts before reading their parents in pivot_root()
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
scsi: ch: Do not keep references to data transfer element devices
scsi: ufs: mcq: Remove unused parameters
scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
scsi: ufs: core: Add debug log for MCQ command timeout
scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()
scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
drm/vc4: Fix firmware reference leak in vc4_drm_bind()
namespace: unhash a dentry before detaching the mounts on it
namespace: check the target before walking it in do_mount_setattr()
fcntl: refuse F_SET_RW_HINT on an immutable inode
namespace: handle mount locking for automounts correctly
tty: add break_wait kernel-doc
net: nexthop: Have all NH notifiers carry NH ID
net: nexthop: Increase weight to u16
drm/amdgpu: change vm->task_info handling
bpf: Take return from set_memory_rox() into account with
bpf_jit_binary_lock_ro()
ice: Don't process extts if PTP is disabled
ice: Fix improper extts handling
gve: Account for stopped queues when reading NIC stats
serial: sc16is7xx: fix TX fifo corruption
scsi: lpfc: Fix failure to delete vports when discovery is in progress
scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs
scsi: lpfc: Change nlp state statistic counters into atomic_t
scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock
scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask
l2tp: prevent possible tunnel refcount underflow
fuse: Fix missing FOLL_PIN for direct-io
udmabuf: change folios array from kmalloc to kvmalloc
udmabuf: fix memory leak on last export_udmabuf() error path
PCI: imx6: Fix suspend/resume support on i.MX6QDL
RDMA/siw: Remove direct link to net_device
mm: clear uffd-wp PTE/PMD state on mremap()
btrfs: do proper folio cleanup when run_delalloc_nocow() failed
btrfs: do proper folio cleanup when cow_file_range() failed
ax25: Remove broken autobind
RISC-V: KVM: Teardown riscv specific bits after kvm_exit
wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info
wifi: ath12k: fix incorrect TID updation in DP monitor status path
wifi: ath12k: Avoid explicit type cast in monitor status parse handler
wifi: ath12k: Avoid memory leak while enabling statistics
perf: Fix hang while freeing sigtrap event
smb: client: allocate crypto only for primary server
smb: client: fix UAF in decryption with multichannel
ublk: fix handling recovery & reissue in ublk_abort_queue()
fs/ntfs3: Use function file_inode to get inode from file
fs/ntfs3: Separete common code for file_read/write iter/splice
fs/ntfs3: Keep write operations atomic
drm/amd/display: prevent hang on link training fail
kasan: avoid sleepable page allocation from atomic context
clk: sunxi-ng: h616: Reparent CPU clock during frequency changes
clk: sunxi-ng: h616: Reparent GPU clock during frequency changes
dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from
k3_udma_glue_reset_rx_chn
virtio: make virtio_bus const
virtio: hookup irq_get_affinity callback
virtio: break and reset virtio devices on device_shutdown()
wifi: iwlwifi: don't warn when if there is a FW error
coresight: holding cscfg_csdev_lock while removing cscfg from csdev
riscv: save the SR_SUM status over switches
s390/mm: Fix in_atomic() handling in do_secure_storage_access()
drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
rv: Use strings in da monitors tracepoints
wifi: iwlwifi: return ERR_PTR from opmode start()
wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
net/sched: Fix backlog accounting in qdisc_dequeue_internal
mm/smaps: fix race between smaps_hugetlb_range and migration
crypto: x86/aegis128 - eliminate some indirect calls
crypto: x86/aegis128 - optimize length block preparation using SSE4.1
crypto: x86/aegis128 - improve assembly function prototypes
crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
crypto: x86/aegis - Add missing error checks
ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
wifi: mt76: mt7915: fix list corruption after hardware restart
mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
smb: client: let recv_done verify data_offset, data_length and
remaining_data_length
dm-verity: provide dma_alignment limit in io_hints
dm-stripe: limit chunk_sectors to the stripe size
iommu/s390: Make attach succeed when the device was surprise removed
bpf: improve error message for unsupported helper
bpf: add a get_helper_proto() utility function
bpf: Check the helper function is valid in get_helper_proto
RISC-V: KVM: Write hgatp register with valid mode bits
tcp_metrics: use dst_dev_net_rcu()
crypto: hisilicon/qm - request reserved interrupt for virtual function
net: use dst_dev_rcu() in sk_setup_caps()
ASoC: Intel: avs: Do not share the name pointer between components
tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
mlx5: Fix default values in create CQ
drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
scsi: ufs: qcom : Refactor phy_power_on/off calls
scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
scsi: imm: Fix use-after-free bug caused by unfinished delayed work
gfs2: Prevent recursive memory reclaim
coresight: ETR: Fix ETR buffer use-after-free issue
wifi: ath12k: Fix MSDU buffer types handling in RX error path
scsi: qla2xxx: Clear cmds after chip reset
Input: alps - fix use-after-free bugs caused by dev3_register_work
Input: lkkbd - disable pending work before freeing device
usb: gadget: Support already-mapped DMA SGs
usb: gadget: functionfs: Factorize wait-for-endpoint code
functionfs, gadgetfs: use simple_recursive_removal()
functionfs: fix the open/removal races
wifi: mac80211: don't WARN for connections on invalid channels
PCI: endpoint: Add missing NULL check for alloc_workqueue()
bpf: Mark bpf_refcount field as unique
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
of: unittest: Fix memory leak in unittest_data_add()
ALSA: usb-audio: Prevent excessive number of frames
tcp: secure_seq: add back ports to TS offset
cxl/mbox: validate payload size before accessing contents in
cxl_payload_from_user_allowed()
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
fs: super_set_uuid()
ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API
drm/amdgpu: prevent immediate PASID reuse case
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
s390/mm: Add missing secure storage access fixups for donated memory
KVM: SEV: Use long-term pin when registering encrypted memory regions
KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
usb: gadget: f_hid: don't call cdev_init while cdev in use
rxrpc: proc: size address buffers for %pISpc output
net: lan966x: fix page pool leak in error paths
Bluetooth: hci_event: move wake reason storage into validated event handlers
bpf: Fix incorrect pruning due to atomic fetch precision tracking
Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
mpls: add seqcount to protect the platform_label{,s} pair
HID: core: Add reserved item tag for main items
HID: rate-limit hid_warn to prevent log flooding
HID: core: Mitigate potential OOB by removing bogus memset()
ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
types: move struct rcuwait into types.h
irqwork: Move data struct to a types header
srcu: Use irq_work to start GP in tiny SRCU
btrfs: tree-log: don't use token set/get accessors in fill_inode_item()
btrfs: fix zero size inode with non-zero size after log replay
fs/ntfs3: Accumulated refactoring changes
ntfs3: fix circular locking dependency in run_unpack_ex
wifi: iwlwifi: fix 22000 series SMEM parsing
wifi: rtw89: pci: validate sequence number of TX release report
team: avoid NETDEV_CHANGEMTU event when unregistering slave
drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
drm/amdgpu: Skip vcn poison irq release on VF
btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
iommu/vt-d: Clear Present bit before tearing down PASID entry
bpf: Fix tcx/netkit detach permissions when prog fd isn't given
btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
net: stmmac: fix oops when split header is enabled
gfs2: fix memory leaks in gfs2_fill_super error path
KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
dm-verity-fec: fix reading parity bytes split across blocks (take 3)
spi: microchip-core-qspi: control built-in cs manually
riscv: kvm: fix vector context allocation leak
f2fs: fix fsck inconsistency caused by FGGC of node block
RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
spi: mpc52xx: fix controller deregistration
drm/amd/display: Fix dc_link NULL handling in HPD init
coresight: tmc-etr: Fix race condition between sysfs and perf mode
selinux: allow multiple opens of /sys/fs/selinux/policy
netfilter: nf_tables: use list_del_rcu for netlink hooks
Revert "net/smc: Introduce TCP ULP support"
tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
sched/psi: fix race between file release and pressure write
netfilter: nat: use kfree_rcu to release ops
ice: fix double-free of tx_buf skb
f2fs: fix data loss caused by incorrect use of nat_entry flag
f2fs: avoid reading already updated pages during GC
greybus: raw: fix use-after-free on cdev close
iommu/amd: Fix clone_alias() to use the original device's devid
net: pull headers in qdisc_pkt_len_segs_init()
powerpc/64s: Fix unmap race with PMD migration entries
powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy
vdpa: use generic driver_override infrastructure
PCI: use generic driver_override infrastructure
fs/mbcache: cancel shrink work before destroying the cache
staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
Staging: rtl8723bs: Remove dead code from _rtw_free_network()
Staging: rtl8723bs: Delete dead code from update_current_network()
staging: rtl8723bs: clean up redundant & parentheses
staging: rtl8723bs: fix buffer over-read in rtw_update_protection
wifi: fix leak if split 6 GHz scanning fails
l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
btrfs: only release the dirty pages io tree after successful writes
net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
net: mana: Guard mana_remove against double invocation
wifi: mt76: mt7921: Place upper limit on station AID
drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
drm/msm: always recover the gpu
fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
fbdev: omap2: fix use-after-free in omapfb_mmap
f2fs: read COW data with the original inode during atomic write
gcov: use atomic counter updates to fix concurrent access crashes
drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
drm/amdgpu: fix amdgpu_hmm_range_get_pages
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
net/handshake: Drain pending requests at net namespace exit
ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
cgroup/rstat: validate cpu before css_rstat_cpu() access
hwmon: (lm90) Stop work before releasing hwmon device
netfilter: bridge: eb_tables: close module init race
netfilter: ebtables: move to two-stage removal scheme
mm/util: Introduce kmemdup_array()
netfilter: Use kmemdup_array instead of kmemdup for multiple allocation
netfilter: x_tables: allow initial table replace without emitting audit log
message
netfilter: x_tables: allocate hook ops while under mutex
wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
erofs: fix metabuf leak in inode xattr initialization
drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
hwmon: (lm90) Add lock protection to lm90_alert
smb/client: fix chown/chgrp with SMB3 POSIX Extensions
ksmbd: validate NTLMv2 response before updating session key
ksmbd: prevent path traversal bypass by restricting caseless retry
ALSA: hda/cs35l41: Fix firmware load work teardown
net/handshake: Take a long-lived file reference at submit
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
LoongArch: Move jump_label_init() before parse_early_param()
drm/vc4: Shut down BO cache timer before teardown
drm/amdgpu: Use dbg level for VBIOS check messages
drm/amdgpu: Add wrapper for freeing vbios memory
drm/amdgpu: Release VFCT ACPI table reference
drm/i915/mst: limit DP MST ESI service loop
drm/i915/gt: Fix NULL deref on sched_engine alloc failure
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
cifs: prevent readdir from changing file size due to stale directory metadata
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
tipc: serialize udp bearer replicast list updates
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
wifi: cfg80211: use wiphy work for socket owner autodisconnect
wifi: mac80211: refactor populating mesh related fields in sinfo
wifi: cfg80211: add link_station_info structure to support MLO statistics
wifi: mac80211: defer link RX stats percpu free to RCU
RDMA/irdma: Prevent user-triggered null deref on QP create
xfrm: fix stale skb->prev after async crypto steals a GSO segment
LoongArch: Fix address space mismatch in kexec command line lookup
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
ovl: check access to copy_file_range source with src mounter creds
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
wifi: ieee80211: validate MLE common info length
mmc: vub300: fix use-after-free on probe failure
dm-verity: fix buffer overflow in FEC calculation
ocfs2: correct l_next_free_rec in online check
ocfs2: add suballoc slot check in ocfs2_validate_inode_block()
ocfs2: validate i_refcount_loc when refcount flag is set
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
fs: Remove NTFS classic
UBUNTU: [Config] remove classic NTFS options
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI
disabling
ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
net/liquidio: drop cached VF pci_dev LUT
Bluetooth: 6lowpan: avoid untracked enable work
net/mlx5e: Fix publication race for priv->channel_stats[]
afs: Fix reinitialisation of the inode, in particular ->lock_work
xen/pvcalls: bound backend response req_id before indexing rsp[]
sctp: fix addr_wq_timer race in sctp_free_addr_wq()
hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
sctp: add INIT verification after cookie unpacking
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
bpf: net: netfilter: drop dead NULL checks
bpf: Guard conntrack opts error writes
md/raid10: fix writes_pending leak on write request failures
md/raid1: fix writes_pending and barrier reference leaks on write failures
soundwire: fix bug in sdw_add_element_group_count found by syzkaller
RDMA/irdma: Replace waitqueue and flag with completion
RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
RDMA/bnxt_re: Initialize dpi variable to zero
sockmap: Fix use-after-free in udp_bpf_recvmsg()
ALSA: seq: fifo: Use guard() for locking
ALSA: seq: Clean up fifo locking with guard
ALSA: seq: avoid stale FIFO cells during resize
net: watchdog: fix refcount tracking races
bnxt: fix head underflow on XDP head-grow
cxl/region: Block region delete during region creation
ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
ixgbe: do not configure xps for XDP queues
bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
bpf: Clear rb node linkage when freeing bpf_rb_root
ocfs2: add extra consistency checks for chain allocator dinodes
ocfs2: validate fast symlink target during inode read
vhost: correct misleading printing information
vhost: move smp_rmb() into vhost_get_avail_idx()
wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
md/raid1,raid10: fix deadlock in read error recovery path
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
OPP: Fix race between OPP addition and lookup
wifi: ath11k: cancel SSR work items during PCI shutdown
s390/zcrypt: Close speculative mem read possibility
octeontx2-af: Block VFs from clobbering special CGX PKIND state
Bluetooth: ISO: hold sk properly in iso_conn_ready
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
btrfs: skip global block reserve accounting for rescue mounts
mm/page_table_check: skip special zero mappings
eventfs: Use children field for rcu head and add memory barriers
selftests: tls: add test with a partially invalid iov
selftests: tls: add rekey tests
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
watchdog: at91sam9_wdt: prevent timer rearm during teardown
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
hwmon: (pmbus) Fix type confusion in notification logic
vhost_iotlb: bound map allocation in add_range
bpf: Fix netns reference imbalance in conntrack kfuncs
btrfs: lzo: reject inline extents without valid headers
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
firewire: ohci: fix NULL pointer dereference in ar_context_release
ipvs: revalidate ihl to prevent out-of-bounds access
sctp: validate cookie AUTH state before use
scsi: core: pair EH runtime PM get and put
tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
coresight: ete: Always save state on power down
ALSA: seq: oss: Serialize readq reset state with q->lock
btrfs: lzo: reject compressed segment that overflows the compressed input
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
EDAC/igen6: Fix call trace due to missing release()
scsi: hisi_sas: Add slave_destroy interface for v3 hw
cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
dmaengine: idxd: fix double free of wq, engine, and group structs
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
drm/amdkfd: Add bounds check for CRAT subtype length
Bluetooth: ISO: zero the sockaddr before returning it in getname
fbdev: Wrap user-invoked calls to fb_set_var() in helper
RDMA/rxe: Remove redundant scheduling of rxe_completer
RDMA/rxe: Merge request and complete tasks
tipc: avoid busy looping in tipc_exit_net()
NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
ntb: Store original DMA address for future release
tap: Keep hdr_len in tap_get_user()
net: tap: fix wrong transport_header when sending VLAN-tagged frame
io_uring: defer eventfd signaling when queued from a wakeup handler
wifi: iwlwifi: dvm: pair transport op-mode enter/leave
wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
power: supply: lp8788: Use devm_power_supply_register() helper
filelock: split common fields into struct file_lock_core
lockd: adapt to breakup of struct file_lock
svcrdma: Refactor the creation of listener CMA ID
sunrpc: xprtrdma: Use ERR_CAST() to return
svcrdma: Reject Read lists that exceed the page budget
svcrdma: Handle ADDR_CHANGE CM event properly
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
ext2: Fix lost inode updates for IS_SYNC inodes
smb: client: reject a tree connect response whose byte count is too small
smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
ceph: cap delegated inode count in ceph_parse_deleg_inos()
ceph: fix UAF in check_new_map() on session freed during unlock
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
nfsd: split sc_status out of sc_type
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
nfsd: Pass 'cred' instead of 'rqstp' to some functions.
mm/mglru: fix and remove redundant unevictable folio handling
ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect()
ksmbd: fix tree connection use-after-free in smb2_tree_connect()
drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
drm/amdgpu: force complete the KIQ ring fences on reset
f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
LoongArch: BPF: Refactor jump offset calculation in tail call
KVM: s390: Fix memory corruption by not reinjecting CK machine checks
mm/huge_memory: transfer the pmd dirty bit to the folio on zap
netfilter: nf_tables: skip double clone set expressions on element insert
net/sched: act_ife: Only operate on Ethernet frames
octeontx2-vf: fix workqueue and netdev race in probe/remove
Bluetooth: do not leak an hci_conn when a second LE connect is rejected
Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
net/sched: account classifier filter allocations to memcg
NFSv4.1: zero referring call lists before decoding
vxlan: fix reading neigh ha
net: bridge: arp/nd proxy: fix reading neigh ha
ip6mr: do not clone dst in ip6mr_cache_report()
ALSA: mtpav: shut down output timer before card teardown
filelock: add some new helper functions
NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
ksmbd: scope session state changes to bound connections
ksmbd: detach blocked lock requests before freeing
ksmbd: safely discard unregistered deferred locks
erofs: fix interlaced ztailpacking pclusters
ksmbd: defer publishing granted locks to prevent UAF/double-free race
ksmbd: serialize oplock close with pending break ownership
ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
apparmor: fix deadlock in complain-mode change_hat
blk-cgroup: delay freeing policy data after rcu grace period
blk-iocost: clear delay state when freeing policy data
blk-iolatency: clear delay state when freeing policy data
ocfs2: validate DIO orphan slot during inode read
ocfs2: validate orphan slot during inode read
nvmet: fix max_qid race between configfs and controller allocation
clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
amt: Don't support cross-netns setup.
NFS: Return a delegation the client fails to record
bpf: Fix mmap_lock leak in irq_work path
Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
btrfs: check if root is readonly when setting posix acl
btrfs: always wait for ordered extents to avoid OE races
btrfs: defrag: fix deadlock between defrag and delalloc space reservation
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
drm/amd/display: Resize MST HDCP per-connector arrays to 32
bpf: Clear buf on error in __bpf_get_task_stack
ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
ocfs2: o2hb: quiesce negotiate handlers and timeout work
thermal: hwmon: Remove hwmon class device along with its parent
ocfs2: validate inline xattrs during inode block validation
ublk: check import_ubuf() return value
blk-cgroup: fix race between policy activation and blkg destruction
HID: steam: Reject short reads
HID: logitech-hidpp: Fix FF device cleanup on init failure
tty: skip cdev_del() when no cdev is registered
serial: core: clear freed pointers on uart_register_driver() failure
serial: core: do fallible allocations before the console can be registered
wifi: cfg80211: stop PMSR before P2P and NAN teardown
wifi: brcmfmac: fix P2P action frame handling without device vif
wifi: nl80211: check link is beaconing for color change
wifi: nl80211: clean up color-change beacon data on errors
arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
wifi: mt76: cancel reset and rc work on device unregister
wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
wifi: mt76: mt7915: allocate vif wcid in the same range as stations
wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()
wifi: mt76: mt7915: unwind state on add_interface failure
wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
PCI: Make pci_match_one_device() match on ID instead of device
PCI: Fix dyn_id add TOCTOU
PCI: Fix UAF when probe runs concurrent to dyn ID removal
clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
scsi: ufs: core: Convert string descriptor format macros to enum
scsi: ufs: core: Validate string descriptors
pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
bpf: Fix WARNING in bpf_tracing_link_release
ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
bpf: remove unused parameter in bpf_jit_binary_pack_finalize
bpf: Zero queue and stack outputs on lock failure
drm/sched: Use struct for drm_sched_init() params
drm/msm: Only fini scheduler after successful init
firmware: arm_scmi: Fix SCMI device destroy lifetimes
RDMA/rvt: Return NULL after port allocation failure
esp: do not unref managed frag pages in esp_ssg_unref()
platform/x86: asus-wmi: fix resource leaks on probe failure
usb: gadget: uac: validate rate list length before storing
bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
platform/x86: lg-laptop: Fix LED resource handling
platform/x86: dell-wmi-base: Fix handling of ultra performance key
bpf: Reject writes through untrusted BTF pointers
time/namespace: Validate nanosecond field in proc_timens_set_offset()
bpf: Reject MEM_ALLOC BTF accesses past object bounds
cgroup/cpuset: introduce cpuset-v1.c
dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
drm/amd/display: Fix dangling pointer in CRTC reset function
drm/amd/display: Fix dangling pointer in plane reset function
i3c: master: Fix recursive locking during device registration
mm/page_owner: use memcg_data snapshot to avoid TOCTOU in
print_page_owner_memcg()
nfsd: convert nfsd_net boolean flags to unsigned long flags word
ACPI: bus: Introduce acpi_bus_get_primary_device()
powerpc/xive: add error return value to xive_smp_probe()
powerpc/xive: propagate IPI init errors to prevent use-after-free
remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
ksmbd: remove redundant DACL check in smb_check_perm_dacl
ksmbd: fix maximum allowed access checks
drm/amdkfd: fix SMI event cross-process information leak
drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq
wifi: iwlwifi: mvm: fix P2P-Device binding handling
RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
virt: acrn: Fix irqfd use-after-free during eventfd shutdown
driver core: Avoid warning when removing a device while its supplier is
unbinding
serial: 8250: invert serial8250_register_8250_port() CIR condition
tty: serial: 8250: protect against NULL uart->port.dev in register
drm/amdgpu: Remove unused amdgpu_i2c functions
drm/amdgpu/atombios: drop empty function
drm/amdgpu: rework i2c init and fini
drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
net: dsa: b53: do not enable EEE on bcm63xx
ACPI: platform: Use acpi_bus_get_primary_device()
drm/msm: Recover HW before retire hung submit
ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
RDMA/efa: Fix use of completion ctx after free
ASoC: qcom: q6asm: handle the responses after closing
ASoC: qcom: q6asm: drop DSP responses for closed data streams
media: hantro: Disable multicore support
media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
hwrng: core - use RCU and work_struct to fix race condition
KVM: SVM: Add missing save/restore handling of LBR MSRs
ceph: fix num_ops off-by-one when crypto allocation fails
greybus: raw: fix use-after-free if write is called after disconnect
erofs: fix use-after-free on sbi->sync_decompress
net/handshake: hand off the pinned file reference to accept_doit
cxl/region: Resolve region deletion races
md/raid1,raid10: fix bio accounting for split md cloned bios
md/raid1,raid10: fix error-path detection with md_cloned_bio()
iommu: Pass domain to remove_dev_pasid() op
nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
ocfs2: validate external xattr entries when reading metadata
fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
ALSA: usx2y: Use standard print API
perf/x86/intel: Prevent drain_pebs() reentry
net/mlx5e: Move representor vnic reporter to eswitch devlink port
Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
vhost: invalidate vring access on IOTLB transitions
vduse: validate virtqueue alignment
virtio_ring: fix stale descriptor flags after a failed packed add
iommu/amd: Do not reallocate GA log buffers on resume
bpf: mark a NULL call argument precise
bpf: Preserve inner map identity in callback frames
bpf: Mark NULL kptr stores precise
bpf: Don't infer non-NULL from a pointer with an unbounded offset
nvme_core: scan namespaces asynchronously
bpf: Mark syscall helpers as sleepable
erofs: disable LZ4 rolling decompression for now
net: plumb extack in __dev_change_net_namespace()
net: Remove conflicting altnames for dying netns in
__dev_change_net_namespace().
btrfs: zstd: fix lost wakeup when waiting for a workspace
bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
smb/client: invalidate fscache for fallocate range operations
smb/client: fix stale page cache in insert/collapse range
bpf: check_cond_jmp_op(): properly infer if register is null
drm/gud: validate GUD_ROTATION_0 is present in supported rotations
drm/virtio: use the DMA API for resource backing on Xen
smb/server: fix tree connection leak in smb2_tree_connect()
r8169: remove original workaround for RTL8125 broken rx issue
ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14
Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in
ksmbd_rdma_capable_netdev()"
Revert "mm/filemap: avoid buffered read/write race to read inconsistent data"
xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
xfs: catch stale AGF/AGF metadata
xfs: rearrange code in xfs_buf_item.c
xfs: factor out stale buffer item completion
xfs: fix unmount hang with unflushable inodes stuck in the AIL
bpf, sockmap: Account for receive queue in FIONREAD without a verdict program
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
KVM: x86: Use active memslots for the per-vCPU MMIO cache
spi: mpc52xx: clean up interrupt handling
iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported
iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init()
xfs: avoid dquot buffer pin deadlock
drm/amd: Create a device link between APU display and XHCI devices
ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
wifi: mt76: connac: tolerate inactive BSS deactivation
drm/vmwgfx: Stop using dev_private to store driver data.
net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
riscv: Use offset_in_page() in text patching functions
riscv: patch: Avoid early phys_to_page()
riscv: patch: fix handling of bpf-jit execmem addresses
drm/vc4: Use video aperture helpers
smb: client: improve compound padding in encryption
smb: client: get rid of bounds check in SMB2_ioctl_init()
smb: client: fix compound alignment with encryption
drm/i915/display: support struct intel_atomic_state in to_intel_display()
drm/i915/display: pass display to intel_crtc_for_pipe()
drm/i915/vga: Convert VGA code to intel_display
drm/i915/display: convert I915_STATE_WARN() to struct intel_display
drm/i915/de: register wait function renames
drm/i915: add generic __to_intel_display()
drm/i915/display: accept either i915 or display for feature tests
drm/i915/de: allow intel_display and drm_i915_private for de functions
drm/i915/gmbus: convert to struct intel_display
drm/i915/crt: convert to struct intel_display
drm/i915: Grab intel_display from the encoder to avoid potential oopsies
f2fs: quota: fix to avoid warning in dquot_writeback_dquots()
perf/dwc_pcie: Add support for QCOM vendor devices
perf/dwc_pcie: Qualify RAS DES VSEC Capability by Vendor, Revision
perf/dwc_pcie: fix duplicate pci_dev devices
ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
wifi: ath12k: convert struct ath12k_sta::update_wk to use struct wiphy_work
wifi: ath12k: prepare vif data structure for MLO handling
wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
mm: fix uprobe pte be overwritten when expanding vma
riscv: Enable cbo.zero only when all harts support Zicboz
riscv: Add support for per-thread envcfg CSR values
s390/kvm: Remove kvm_arch_fault_in_page()
s390/mm: Simplify get_fault_type()
s390/mm: Get rid of fault type switch statements
platform/x86/amd/pmf: Switch to platform_get_resource() and
devm_ioremap_resource()
platform/x86/amd: pmf: Use device managed allocations
drm/rockchip: vop2: Consistently use dev_err_probe()
drm/rockchip: vop2: Register the primary plane and overlay plane separately
rv: Remove trailing whitespace from tracepoint string
mm/mremap: fix WARN with uffd that has remap events disabled
iommu/s390: handle IOAT registration based on domain
iommu/s390: set appropriate IOTA region type
drm/xe: Don't allow evicting of BOs in same VM in array of VM binds
ASoC: Intel: avs: Use topology information for endpoint numbers
sysfs: check visibility before changing group attribute ownership
amd/amdkfd: enhance kfd process check in switch partition
RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage
net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET
net/mlx5: Store the global doorbell in mlx5_priv
net/mlx5e: Prepare for using different CQ doorbells
net: vxlan: prevent NULL deref in vxlan_xmit_one
wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
accel/ivpu: Allow to import single buffer into multiple contexts
accel/ivpu: Rework bind/unbind of imported buffers
accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
accel/qaic: Add config structs for supported cards
net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
idpf: fix error handling in the init_task on load
riscv: trace: fix snapshot deadlock with sbi ecall
bpf: Fix exception exit lock checking for subprogs
drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register
dm: limit swapping tables for devices with zone write plugs
net: use synchronize_rcu_expedited in cleanup_net()
net: Factorise setup_net() and cleanup_net().
net: Add ops_undo_single for module load/unload.
net: Add ->exit_rtnl() hook to struct pernet_operations.
wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in
pre_exit
bnxt_en: set backing store type from query type
xfs: remove bp->b_error check in xfs_attr3_root_inactive
xfs: factor out xfs_attr3_node_entry_remove
xfs: close crash window in attr dabtree inactivation
drm/amd/display: Add a function for checking tmds mode
drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
media: chips-media: wave5: Fix Null reference while testing fluster
btrfs: remove 'reserved' argument from btrfs_pin_extent()
md raid: fix hang when stopping arrays with metadata through dm-raid
KVM: Rename symbols related to enabling virtualization hardware
KVM: Export hardware virtualization enabling/disabling functions
syscore: Pass context data to callbacks
wifi: iwlwifi: mvm: don't send a 6E related command when not supported
rxrpc: kdoc: Update function descriptions and add link from rxrpc.rst
rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
nouveau/gsp: drop WARN_ON in ACPI probes
KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap"
doc: Clarify use of slab constructors and SLAB_TYPESAFE_BY_RCU
refcount: provide ops for cases when object's memory can be reused
wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
wifi: mt76: Fix memory leak destroying device
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
drm/amd/display: Wrap DCN32 phantom-plane allocation in
DC_RUN_WITH_PREEMPTION_ENABLED
wifi: mt76: add wcid publish check in mt76_sta_add
netfs: Fix leak of request in netfs_write_begin() error handling
netfs: Fix zeropoint update where i_size > remote_i_size
KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state
KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c)
KVM: x86: Rename APIC base setters to better capture their relationship
KVM: x86: Move update_cr8_intercept() to lapic.c
KVM: x86: Unconditionally recompute CR8 intercept on PPR update
media: stm32: dcmipp: use v4l2_subdev_is_streaming
media: stm32: dcmipp: replace s_stream with enable/disable_streams
media: stm32-dcmipp: Return queued buffers on start_streaming() failure
idpf: fix max_vport related crash on allocation error during init
LoongArch: BPF: Zero-extend signed ALU32 div/mod results
bnxt_en: Handle partially initialized auxiliary devices
drm/xe/guc: Keep scheduler timeline name alive
Bluetooth: hci_sync: extend conn_hash lookup critical sections
bpf: Disable migration when destroying sock storage
bpf: Disable migration when cloning sock storage
rcu: add rcu_read_lock_dont_migrate()
bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
drm/amd/display: use kvzalloc to allocate struct dc
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
wifi: mac80211: validate extension-frame layout before RX
ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
mmc: vub300: Use devm_mmc_alloc_host() helper
mmc: vub300: fix use-after-free on disconnect
mmc: vub300: rename probe error labels
RDMA/bnxt_re: Free CQ toggle page after firmware teardown
nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
s390/ap: Move response_type struct into ap_msg struct
s390/ap/zcrypt: Rework AP message buffer allocation
s390/ap: Introduce ap message buffer pool
s390/ap/zcrypt: New xflag parameter
s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code
s390/zcrypt: Rework domain processing within zcrypt device driver
afs: Fix UAF when sending a message
Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
Bluetooth: ISO: lock sk in iso_connect_ind
xsk: drain continuation descs after overflow in xsk_build_skb()
xsk: provide sufficient space in pool->tx_descs
xsk: reclaim invalid Tx descriptors in ZC batch path
net: ibm: emac: use devm_platform_ioremap_resource
net: ibm: emac: use platform_get_irq
net: emac: Fix NULL pointer dereference in emac_probe
EDAC/igen6: Initialize edac_op_state according to the configuration data
EDAC/igen6: Add polling support
EDAC/igen6: Skip absent memory controllers
soc: xilinx: Fix race condition in event registration
idpf: add idpf_virtchnl.h
idpf: bound interrupt-vector register fill to the allocated array
btrfs: initialize inode mapping flags for cached inodes
svcrdma: Add Write chunk WRs to the RPC's Send WR chain
svcrdma: wake sq waiters when the transport closes
svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
drm/amdkfd: Fix partial migrate issue
drm/amdkfd: return migration pages from copy function
Revert "drm/amdkfd: return migration pages from copy function"
drm/amdkfd: return migration pages from copy function - again
drm/amdgpu: force complete the MES ring fences on reset
KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
netfilter: nf_tables: prefer nft_trans_elem_alloc helper
netfilter: nf_tables: add nft_trans_commit_list_add_elem helper
netfilter: nf_tables: prepare for multiple elements in nft_trans_elem structure
net_sched: sch_fq: add three drop_reason
net/sched: add qstats_cpu_drop_inc() helper
xsk: honor XDP_TX_METADATA in zero-copy path
dpll: fix NULL deref in dpll_device_ops() during teardown race
bpf: Compare iterator types during state pruning
apparmor: fix unconfined user namespace restriction forced stack
iommu/vt-d: Flush context cache with correct SID when tearing down aliases
btrfs: zoned: don't clobber the extent buffer when zeroing it out
wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
bpf: Reject >8 byte return values on return-reading trampoline paths
drm/msm: don't tear down KMS twice when KMS init fails
mm/hugetlb: refactor code around vmemmap_walk
mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
drm/amd/amdgpu: Update PF2VF Header
drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support
wifi: iwlwifi: simplify nested if checks
virt: acrn: Remove unused list 'acrn_irqfd_clients'
PM: sleep: Use bool for all 1-bit fields in struct dev_pm_info
PM: sleep: core: Synchronize runtime PM status of parents and children
PM: sleep: core: Restrict power.set_active propagation
PM: Rearrange documentation related to __pm_runtime_disable()
PM: Block enabling of runtime PM during system suspend
PM: runtime: Introduce pm_runtime_blocked()
PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally
PM: sleep: Fix bit masking operation
driver core: Add device_link_test() for testing device link flags
gpiolib: make value setters have return values
gpiolib: wrap gpio_chip::set()
gpiolib: rework the wrapper around gpio_chip::set_multiple()
gpiolib: introduce gpio_chip setters that return values
pinctrl: mediatek: paris: don't double-check the GPIO number
pinctrl: mediatek: paris: use new GPIO line value setter callbacks
genirq/proc: Switch to lock guards
genirq: Consistently use '%u' format specifier for unsigned int variables
media: chips-media: wave5: Release m2m_ctx after Instance Removed from List
i3c: master: svc: Fix npcm845 FIFO empty issue
i3c: master: svc: Fix npcm845 invalid slvstart event
i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
drm/amdgpu: skip the VMID 0 flush for VRAM
tracing: Fix subbuf resize races with trace_pipe_raw readers
bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
bpf: Reject legacy packet loads from callbacks
bpf: Check ancestor frames for rbtree callbacks
bpf: Mark signal tracepoint siginfo arguments as scalar
net: rename netns_local to netns_immutable
net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
drm/virtio: Use drm_gem_plane_helper_prepare_fb()
drm/virtio: Add a helper to map and note the dma addrs and lengths
firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor
firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
bpf: Remove migrate_{disable|enable} in bpf_obj_free_fields()
dm-integrity: replace forgeable discard filler with a keyed sector marker
perf/x86/intel/uncore: Fix uncore_box ref/unref ordering
xfs: remove unused trace event xfs_dqreclaim_dirty
ublk: fix dead loop when canceling io command
s390/kvm: Mask extra bits from program interrupt code
scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks
accel/ivpu: Fix race condition when mapping dmabuf
KVM: SEV: Drop FOLL_WRITE for encrypted region registration
net: Fix wild-memory-access in __register_pernet_operations() when
CONFIG_NET_NS=n.
media: verisilicon: Fix kernel panic due to __initconst misuse
soc/tegra: pmc: Document tegra_pmc.syscore field
soc/tegra: pmc: Add kerneldoc for wake-up variables
i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
sched/psi: Create the psimon kthread outside of cgroup_mutex
ocfs2: use correct endian in ocfs2_dinode_has_extents
s390/zcrypt: Fix memory leak with CCA cards used as accelerator
EDAC/igen6: Fix the flood of invalid error reports
netfilter: ctnetlink: do not expose expectation DEAD flag
EDAC/igen6: Fix NULL pointer dereference
Revert "esp: do not unref managed frag pages in esp_ssg_unref()"
mm: constify testing page/folio flags
mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
PM: sleep: Unblock runtime PM when device prepare fails
soundwire: intel_auxdevice: remove redundant assignment to variable link_flags
soundwire: intel_auxdevice: Fix system suspend/resume handling
gpiolib: Allow to use setters with return value for output-only gpios
gpiolib: initialize return value in gpiochip_set_multiple()
i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845
i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk
i3c: master: svc: Fix i3c_master_get_free_addr return check
tracing: Fix ring_buffer_read_page_size() kernel-doc
tracing: Fix comment in tracing_buffers_splice_read()
dm-integrity: fix buffer overflow with keyed discard
wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
UBUNTU: Upstream stable to v6.6.160, v6.12.114
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Manuel Diewald (diewald)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Manuel Diewald (diewald)
** Summary changed:
- Noble update: upstream stable patchset 2026-11-04
+ Noble update: upstream stable patchset 2026-11-03
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
- upstream stable patchset 2026-11-04
+ upstream stable patchset 2026-11-03
+
+ Ported from the following upstream stable releases:
+ v6.6.160, v6.12.114
+
from git://git.kernel.org/
+
+ xfrm: prevent policy_hthresh.work from racing with netns teardown
+ Bluetooth: btqcomsmd: Convert to platform remove callback returning void
+ ieee802154: cc2520: fix FIFOP work use-after-free
+ openvswitch: prepare for stolen verdict coming from conntrack and nat engine
+ perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
+ perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix
sample classification
+ scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr
+ net: add and use skb_get_hash_net
+ usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
+ drm/amd/display: Mark DCE 6.4 as not APU
+ erofs: avoid infinite loops due to corrupted subpage compact indexes
+ erofs: unify lcn as u64 for 32-bit platforms
+ iio: adc: axp288: Add TS bias override for Haier HV103H
+ HID: core: introduce hid_safe_input_report()
+ HID: uhid: convert to hid_safe_input_report()
+ netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting
+ pmdomain: rockchip: propagate subdomain add errors
+ iio: light: Drop ROHM BU27034
+ UBUNTU: [Config] remove CONFIG_ROHM_BU27034
+ dlm: validate length in dlm_search_rsb_tree
+ HID: steam: Clean up locking
+ ip6_gre: remove obsolete ERSPAN PMTU update
+ mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
+ mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
+ ALSA: pcm: oss: Fix setup list UAF on proc write error
+ ALSA: mixer: oss: Add card disconnect checkpoints
+ net: team: rename team to team_core for linking
+ net: team: Remove unused team_mode_op, port_enabled
+ net: team: Rename port_disabled team mode op to port_tx_disabled
+ net: team: fix NULL pointer dereference in team_xmit during mode change
+ net: team: stop reusing skb after queue override
+ Bluetooth: hci_sync: Fix command skb lifetime during scan setup
+ Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
+ drm/vmwgfx: validate pitch coming from userspace
+ namespace: don't inherit MNT_UMOUNT in clone_mnt()
+ namespace: check the mounts before reading their parents in pivot_root()
+ net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
+ ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
+ scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
+ scsi: ch: Do not keep references to data transfer element devices
+ scsi: ufs: mcq: Remove unused parameters
+ scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
+ scsi: ufs: core: Add debug log for MCQ command timeout
+ scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()
+ scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
+ drm/vc4: Fix firmware reference leak in vc4_drm_bind()
+ namespace: unhash a dentry before detaching the mounts on it
+ namespace: check the target before walking it in do_mount_setattr()
+ fcntl: refuse F_SET_RW_HINT on an immutable inode
+ namespace: handle mount locking for automounts correctly
+ tty: add break_wait kernel-doc
+ net: nexthop: Have all NH notifiers carry NH ID
+ net: nexthop: Increase weight to u16
+ drm/amdgpu: change vm->task_info handling
+ bpf: Take return from set_memory_rox() into account with
bpf_jit_binary_lock_ro()
+ ice: Don't process extts if PTP is disabled
+ ice: Fix improper extts handling
+ gve: Account for stopped queues when reading NIC stats
+ serial: sc16is7xx: fix TX fifo corruption
+ scsi: lpfc: Fix failure to delete vports when discovery is in progress
+ scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs
+ scsi: lpfc: Change nlp state statistic counters into atomic_t
+ scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock
+ scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask
+ l2tp: prevent possible tunnel refcount underflow
+ fuse: Fix missing FOLL_PIN for direct-io
+ udmabuf: change folios array from kmalloc to kvmalloc
+ udmabuf: fix memory leak on last export_udmabuf() error path
+ PCI: imx6: Fix suspend/resume support on i.MX6QDL
+ RDMA/siw: Remove direct link to net_device
+ mm: clear uffd-wp PTE/PMD state on mremap()
+ btrfs: do proper folio cleanup when run_delalloc_nocow() failed
+ btrfs: do proper folio cleanup when cow_file_range() failed
+ ax25: Remove broken autobind
+ RISC-V: KVM: Teardown riscv specific bits after kvm_exit
+ wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info
+ wifi: ath12k: fix incorrect TID updation in DP monitor status path
+ wifi: ath12k: Avoid explicit type cast in monitor status parse handler
+ wifi: ath12k: Avoid memory leak while enabling statistics
+ perf: Fix hang while freeing sigtrap event
+ smb: client: allocate crypto only for primary server
+ smb: client: fix UAF in decryption with multichannel
+ ublk: fix handling recovery & reissue in ublk_abort_queue()
+ fs/ntfs3: Use function file_inode to get inode from file
+ fs/ntfs3: Separete common code for file_read/write iter/splice
+ fs/ntfs3: Keep write operations atomic
+ drm/amd/display: prevent hang on link training fail
+ kasan: avoid sleepable page allocation from atomic context
+ clk: sunxi-ng: h616: Reparent CPU clock during frequency changes
+ clk: sunxi-ng: h616: Reparent GPU clock during frequency changes
+ dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from
k3_udma_glue_reset_rx_chn
+ virtio: make virtio_bus const
+ virtio: hookup irq_get_affinity callback
+ virtio: break and reset virtio devices on device_shutdown()
+ wifi: iwlwifi: don't warn when if there is a FW error
+ coresight: holding cscfg_csdev_lock while removing cscfg from csdev
+ riscv: save the SR_SUM status over switches
+ s390/mm: Fix in_atomic() handling in do_secure_storage_access()
+ drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
+ wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
+ rv: Use strings in da monitors tracepoints
+ wifi: iwlwifi: return ERR_PTR from opmode start()
+ wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
+ net/sched: Fix backlog accounting in qdisc_dequeue_internal
+ mm/smaps: fix race between smaps_hugetlb_range and migration
+ crypto: x86/aegis128 - eliminate some indirect calls
+ crypto: x86/aegis128 - optimize length block preparation using SSE4.1
+ crypto: x86/aegis128 - improve assembly function prototypes
+ crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
+ crypto: x86/aegis - Add missing error checks
+ ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
+ wifi: mt76: mt7915: fix list corruption after hardware restart
+ mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
+ smb: client: let recv_done verify data_offset, data_length and
remaining_data_length
+ dm-verity: provide dma_alignment limit in io_hints
+ dm-stripe: limit chunk_sectors to the stripe size
+ iommu/s390: Make attach succeed when the device was surprise removed
+ bpf: improve error message for unsupported helper
+ bpf: add a get_helper_proto() utility function
+ bpf: Check the helper function is valid in get_helper_proto
+ RISC-V: KVM: Write hgatp register with valid mode bits
+ tcp_metrics: use dst_dev_net_rcu()
+ crypto: hisilicon/qm - request reserved interrupt for virtual function
+ net: use dst_dev_rcu() in sk_setup_caps()
+ ASoC: Intel: avs: Do not share the name pointer between components
+ tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
+ mlx5: Fix default values in create CQ
+ drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
+ scsi: ufs: qcom : Refactor phy_power_on/off calls
+ scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
+ scsi: imm: Fix use-after-free bug caused by unfinished delayed work
+ gfs2: Prevent recursive memory reclaim
+ coresight: ETR: Fix ETR buffer use-after-free issue
+ wifi: ath12k: Fix MSDU buffer types handling in RX error path
+ scsi: qla2xxx: Clear cmds after chip reset
+ Input: alps - fix use-after-free bugs caused by dev3_register_work
+ Input: lkkbd - disable pending work before freeing device
+ usb: gadget: Support already-mapped DMA SGs
+ usb: gadget: functionfs: Factorize wait-for-endpoint code
+ functionfs, gadgetfs: use simple_recursive_removal()
+ functionfs: fix the open/removal races
+ wifi: mac80211: don't WARN for connections on invalid channels
+ PCI: endpoint: Add missing NULL check for alloc_workqueue()
+ bpf: Mark bpf_refcount field as unique
+ staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
+ of: unittest: Fix memory leak in unittest_data_add()
+ ALSA: usb-audio: Prevent excessive number of frames
+ tcp: secure_seq: add back ports to TS offset
+ cxl/mbox: validate payload size before accessing contents in
cxl_payload_from_user_allowed()
+ sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
+ ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
+ serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
+ fs: super_set_uuid()
+ ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
+ drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API
+ drm/amdgpu: prevent immediate PASID reuse case
+ cxl/port: Fix use after free of parent_port in cxl_detach_ep()
+ ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
+ s390/mm: Add missing secure storage access fixups for donated memory
+ KVM: SEV: Use long-term pin when registering encrypted memory regions
+ KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
+ usb: gadget: f_hid: don't call cdev_init while cdev in use
+ rxrpc: proc: size address buffers for %pISpc output
+ net: lan966x: fix page pool leak in error paths
+ Bluetooth: hci_event: move wake reason storage into validated event handlers
+ bpf: Fix incorrect pruning due to atomic fetch precision tracking
+ Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
+ mpls: add seqcount to protect the platform_label{,s} pair
+ HID: core: Add reserved item tag for main items
+ HID: rate-limit hid_warn to prevent log flooding
+ HID: core: Mitigate potential OOB by removing bogus memset()
+ ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
+ types: move struct rcuwait into types.h
+ irqwork: Move data struct to a types header
+ srcu: Use irq_work to start GP in tiny SRCU
+ btrfs: tree-log: don't use token set/get accessors in fill_inode_item()
+ btrfs: fix zero size inode with non-zero size after log replay
+ fs/ntfs3: Accumulated refactoring changes
+ ntfs3: fix circular locking dependency in run_unpack_ex
+ wifi: iwlwifi: fix 22000 series SMEM parsing
+ wifi: rtw89: pci: validate sequence number of TX release report
+ team: avoid NETDEV_CHANGEMTU event when unregistering slave
+ drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
+ drm/amdgpu: Skip vcn poison irq release on VF
+ btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
+ btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
+ i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
+ i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
+ ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
+ net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
+ iommu/vt-d: Clear Present bit before tearing down PASID entry
+ bpf: Fix tcx/netkit detach permissions when prog fd isn't given
+ btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
+ net: stmmac: fix oops when split header is enabled
+ gfs2: fix memory leaks in gfs2_fill_super error path
+ KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
+ KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
+ KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
+ dm-verity-fec: fix reading parity bytes split across blocks (take 3)
+ spi: microchip-core-qspi: control built-in cs manually
+ riscv: kvm: fix vector context allocation leak
+ f2fs: fix fsck inconsistency caused by FGGC of node block
+ RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
+ spi: mpc52xx: fix controller deregistration
+ drm/amd/display: Fix dc_link NULL handling in HPD init
+ coresight: tmc-etr: Fix race condition between sysfs and perf mode
+ selinux: allow multiple opens of /sys/fs/selinux/policy
+ netfilter: nf_tables: use list_del_rcu for netlink hooks
+ Revert "net/smc: Introduce TCP ULP support"
+ tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
+ libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
+ sched/psi: fix race between file release and pressure write
+ netfilter: nat: use kfree_rcu to release ops
+ ice: fix double-free of tx_buf skb
+ f2fs: fix data loss caused by incorrect use of nat_entry flag
+ f2fs: avoid reading already updated pages during GC
+ greybus: raw: fix use-after-free on cdev close
+ iommu/amd: Fix clone_alias() to use the original device's devid
+ net: pull headers in qdisc_pkt_len_segs_init()
+ powerpc/64s: Fix unmap race with PMD migration entries
+ powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy
+ vdpa: use generic driver_override infrastructure
+ PCI: use generic driver_override infrastructure
+ fs/mbcache: cancel shrink work before destroying the cache
+ staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
+ Staging: rtl8723bs: Remove dead code from _rtw_free_network()
+ Staging: rtl8723bs: Delete dead code from update_current_network()
+ staging: rtl8723bs: clean up redundant & parentheses
+ staging: rtl8723bs: fix buffer over-read in rtw_update_protection
+ wifi: fix leak if split 6 GHz scanning fails
+ l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
+ btrfs: only release the dirty pages io tree after successful writes
+ net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
+ net: mana: Guard mana_remove against double invocation
+ wifi: mt76: mt7921: Place upper limit on station AID
+ drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
+ drm/msm: always recover the gpu
+ fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
+ fbdev: omap2: fix use-after-free in omapfb_mmap
+ f2fs: read COW data with the original inode during atomic write
+ gcov: use atomic counter updates to fix concurrent access crashes
+ drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
+ drm/amdgpu: fix amdgpu_hmm_range_get_pages
+ usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
+ usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
+ Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
+ net/handshake: Drain pending requests at net namespace exit
+ ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
+ cgroup/rstat: validate cpu before css_rstat_cpu() access
+ hwmon: (lm90) Stop work before releasing hwmon device
+ netfilter: bridge: eb_tables: close module init race
+ netfilter: ebtables: move to two-stage removal scheme
+ mm/util: Introduce kmemdup_array()
+ netfilter: Use kmemdup_array instead of kmemdup for multiple allocation
+ netfilter: x_tables: allow initial table replace without emitting audit log
message
+ netfilter: x_tables: allocate hook ops while under mutex
+ wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
+ wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
+ erofs: fix metabuf leak in inode xattr initialization
+ drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
+ hwmon: (lm90) Add lock protection to lm90_alert
+ smb/client: fix chown/chgrp with SMB3 POSIX Extensions
+ ksmbd: validate NTLMv2 response before updating session key
+ ksmbd: prevent path traversal bypass by restricting caseless retry
+ ALSA: hda/cs35l41: Fix firmware load work teardown
+ net/handshake: Take a long-lived file reference at submit
+ KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest
state
+ LoongArch: Move jump_label_init() before parse_early_param()
+ drm/vc4: Shut down BO cache timer before teardown
+ drm/amdgpu: Use dbg level for VBIOS check messages
+ drm/amdgpu: Add wrapper for freeing vbios memory
+ drm/amdgpu: Release VFCT ACPI table reference
+ drm/i915/mst: limit DP MST ESI service loop
+ drm/i915/gt: Fix NULL deref on sched_engine alloc failure
+ drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
+ cifs: prevent readdir from changing file size due to stale directory metadata
+ cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
+ tipc: serialize udp bearer replicast list updates
+ firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
+ wifi: cfg80211: use wiphy work for socket owner autodisconnect
+ wifi: mac80211: refactor populating mesh related fields in sinfo
+ wifi: cfg80211: add link_station_info structure to support MLO statistics
+ wifi: mac80211: defer link RX stats percpu free to RCU
+ RDMA/irdma: Prevent user-triggered null deref on QP create
+ xfrm: fix stale skb->prev after async crypto steals a GSO segment
+ LoongArch: Fix address space mismatch in kexec command line lookup
+ net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
+ ovl: check access to copy_file_range source with src mounter creds
+ s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
+ wifi: ieee80211: validate MLE common info length
+ mmc: vub300: fix use-after-free on probe failure
+ dm-verity: fix buffer overflow in FEC calculation
+ ocfs2: correct l_next_free_rec in online check
+ ocfs2: add suballoc slot check in ocfs2_validate_inode_block()
+ ocfs2: validate i_refcount_loc when refcount flag is set
+ ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
+ fs: Remove NTFS classic
+ UBUNTU: [Config] remove classic NTFS options
+ KVM: arm64: vgic: Handle race between interrupt affinity change and LPI
disabling
+ ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and
igmp_stop_timer()
+ net/liquidio: drop cached VF pci_dev LUT
+ Bluetooth: 6lowpan: avoid untracked enable work
+ net/mlx5e: Fix publication race for priv->channel_stats[]
+ afs: Fix reinitialisation of the inode, in particular ->lock_work
+ xen/pvcalls: bound backend response req_id before indexing rsp[]
+ sctp: fix addr_wq_timer race in sctp_free_addr_wq()
+ hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
+ sctp: add INIT verification after cookie unpacking
+ tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
+ bpf: net: netfilter: drop dead NULL checks
+ bpf: Guard conntrack opts error writes
+ md/raid10: fix writes_pending leak on write request failures
+ md/raid1: fix writes_pending and barrier reference leaks on write failures
+ soundwire: fix bug in sdw_add_element_group_count found by syzkaller
+ RDMA/irdma: Replace waitqueue and flag with completion
+ RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
+ RDMA/bnxt_re: Initialize dpi variable to zero
+ sockmap: Fix use-after-free in udp_bpf_recvmsg()
+ ALSA: seq: fifo: Use guard() for locking
+ ALSA: seq: Clean up fifo locking with guard
+ ALSA: seq: avoid stale FIFO cells during resize
+ net: watchdog: fix refcount tracking races
+ bnxt: fix head underflow on XDP head-grow
+ cxl/region: Block region delete during region creation
+ ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
+ ixgbe: do not configure xps for XDP queues
+ bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
+ bpf: Clear rb node linkage when freeing bpf_rb_root
+ ocfs2: add extra consistency checks for chain allocator dinodes
+ ocfs2: validate fast symlink target during inode read
+ vhost: correct misleading printing information
+ vhost: move smp_rmb() into vhost_get_avail_idx()
+ wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
+ md/raid1,raid10: fix deadlock in read error recovery path
+ ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
+ OPP: Fix race between OPP addition and lookup
+ wifi: ath11k: cancel SSR work items during PCI shutdown
+ s390/zcrypt: Close speculative mem read possibility
+ octeontx2-af: Block VFs from clobbering special CGX PKIND state
+ Bluetooth: ISO: hold sk properly in iso_conn_ready
+ net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
+ xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
+ btrfs: skip global block reserve accounting for rescue mounts
+ mm/page_table_check: skip special zero mappings
+ eventfs: Use children field for rcu head and add memory barriers
+ selftests: tls: add test with a partially invalid iov
+ selftests: tls: add rekey tests
+ tls: rx: restore msg_iter before TLS 1.3 optimistic retry
+ watchdog: at91sam9_wdt: prevent timer rearm during teardown
+ s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
+ netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
+ hwmon: (pmbus) Fix type confusion in notification logic
+ vhost_iotlb: bound map allocation in add_range
+ bpf: Fix netns reference imbalance in conntrack kfuncs
+ btrfs: lzo: reject inline extents without valid headers
+ soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
+ gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
+ firewire: ohci: fix NULL pointer dereference in ar_context_release
+ ipvs: revalidate ihl to prevent out-of-bounds access
+ sctp: validate cookie AUTH state before use
+ scsi: core: pair EH runtime PM get and put
+ tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
+ ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
+ coresight: ete: Always save state on power down
+ ALSA: seq: oss: Serialize readq reset state with q->lock
+ btrfs: lzo: reject compressed segment that overflows the compressed input
+ netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
+ EDAC/igen6: Fix call trace due to missing release()
+ scsi: hisi_sas: Add slave_destroy interface for v3 hw
+ cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
+ netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
+ Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
+ dmaengine: idxd: fix double free of wq, engine, and group structs
+ bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
+ drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
+ drm/amdkfd: Add bounds check for CRAT subtype length
+ Bluetooth: ISO: zero the sockaddr before returning it in getname
+ fbdev: Wrap user-invoked calls to fb_set_var() in helper
+ RDMA/rxe: Remove redundant scheduling of rxe_completer
+ RDMA/rxe: Merge request and complete tasks
+ tipc: avoid busy looping in tipc_exit_net()
+ NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
+ NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
+ ntb: Store original DMA address for future release
+ tap: Keep hdr_len in tap_get_user()
+ net: tap: fix wrong transport_header when sending VLAN-tagged frame
+ io_uring: defer eventfd signaling when queued from a wakeup handler
+ wifi: iwlwifi: dvm: pair transport op-mode enter/leave
+ wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
+ power: supply: lp8788: Use devm_power_supply_register() helper
+ filelock: split common fields into struct file_lock_core
+ lockd: adapt to breakup of struct file_lock
+ svcrdma: Refactor the creation of listener CMA ID
+ sunrpc: xprtrdma: Use ERR_CAST() to return
+ svcrdma: Reject Read lists that exceed the page budget
+ svcrdma: Handle ADDR_CHANGE CM event properly
+ SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
+ ext2: Fix lost inode updates for IS_SYNC inodes
+ smb: client: reject a tree connect response whose byte count is too small
+ smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
+ cifs: call pagecache_isize_extended() in cifs_setsize() when extending
+ ceph: cap delegated inode count in ceph_parse_deleg_inos()
+ ceph: fix UAF in check_new_map() on session freed during unlock
+ nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
+ nfsd: split sc_status out of sc_type
+ lockd, nfsd: RCU-protect nlmsvc_ops dispatch
+ nfsd: Pass 'cred' instead of 'rqstp' to some functions.
+ mm/mglru: fix and remove redundant unevictable folio handling
+ ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect()
+ ksmbd: fix tree connection use-after-free in smb2_tree_connect()
+ drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
+ drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
+ drm/amdkfd: Add TLB flush after MES queue eviction/suspension
+ drm/amdgpu: force complete the KIQ ring fences on reset
+ f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
+ LoongArch: BPF: Refactor jump offset calculation in tail call
+ KVM: s390: Fix memory corruption by not reinjecting CK machine checks
+ mm/huge_memory: transfer the pmd dirty bit to the folio on zap
+ netfilter: nf_tables: skip double clone set expressions on element insert
+ net/sched: act_ife: Only operate on Ethernet frames
+ octeontx2-vf: fix workqueue and netdev race in probe/remove
+ Bluetooth: do not leak an hci_conn when a second LE connect is rejected
+ Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
+ Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
+ net/sched: account classifier filter allocations to memcg
+ NFSv4.1: zero referring call lists before decoding
+ vxlan: fix reading neigh ha
+ net: bridge: arp/nd proxy: fix reading neigh ha
+ ip6mr: do not clone dst in ip6mr_cache_report()
+ ALSA: mtpav: shut down output timer before card teardown
+ filelock: add some new helper functions
+ NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
+ ksmbd: scope session state changes to bound connections
+ ksmbd: detach blocked lock requests before freeing
+ ksmbd: safely discard unregistered deferred locks
+ erofs: fix interlaced ztailpacking pclusters
+ ksmbd: defer publishing granted locks to prevent UAF/double-free race
+ ksmbd: serialize oplock close with pending break ownership
+ ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
+ apparmor: fix deadlock in complain-mode change_hat
+ blk-cgroup: delay freeing policy data after rcu grace period
+ blk-iocost: clear delay state when freeing policy data
+ blk-iolatency: clear delay state when freeing policy data
+ ocfs2: validate DIO orphan slot during inode read
+ ocfs2: validate orphan slot during inode read
+ nvmet: fix max_qid race between configfs and controller allocation
+ clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
+ amt: Don't support cross-netns setup.
+ NFS: Return a delegation the client fails to record
+ bpf: Fix mmap_lock leak in irq_work path
+ Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
+ Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
+ btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
+ btrfs: check if root is readonly when setting posix acl
+ btrfs: always wait for ordered extents to avoid OE races
+ btrfs: defrag: fix deadlock between defrag and delalloc space reservation
+ scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
+ coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
+ drm/amd/display: Resize MST HDCP per-connector arrays to 32
+ bpf: Clear buf on error in __bpf_get_task_stack
+ ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
+ ocfs2: o2hb: quiesce negotiate handlers and timeout work
+ thermal: hwmon: Remove hwmon class device along with its parent
+ ocfs2: validate inline xattrs during inode block validation
+ ublk: check import_ubuf() return value
+ blk-cgroup: fix race between policy activation and blkg destruction
+ HID: steam: Reject short reads
+ HID: logitech-hidpp: Fix FF device cleanup on init failure
+ tty: skip cdev_del() when no cdev is registered
+ serial: core: clear freed pointers on uart_register_driver() failure
+ serial: core: do fallible allocations before the console can be registered
+ wifi: cfg80211: stop PMSR before P2P and NAN teardown
+ wifi: brcmfmac: fix P2P action frame handling without device vif
+ wifi: nl80211: check link is beaconing for color change
+ wifi: nl80211: clean up color-change beacon data on errors
+ arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
+ wifi: mt76: cancel reset and rc work on device unregister
+ wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
+ wifi: mt76: mt7915: allocate vif wcid in the same range as stations
+ wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()
+ wifi: mt76: mt7915: unwind state on add_interface failure
+ wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
+ RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
+ PCI: Make pci_match_one_device() match on ID instead of device
+ PCI: Fix dyn_id add TOCTOU
+ PCI: Fix UAF when probe runs concurrent to dyn ID removal
+ clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
+ scsi: ufs: core: Convert string descriptor format macros to enum
+ scsi: ufs: core: Validate string descriptors
+ pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
+ bpf: Fix WARNING in bpf_tracing_link_release
+ ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
+ bpf: remove unused parameter in bpf_jit_binary_pack_finalize
+ bpf: Zero queue and stack outputs on lock failure
+ drm/sched: Use struct for drm_sched_init() params
+ drm/msm: Only fini scheduler after successful init
+ firmware: arm_scmi: Fix SCMI device destroy lifetimes
+ RDMA/rvt: Return NULL after port allocation failure
+ esp: do not unref managed frag pages in esp_ssg_unref()
+ platform/x86: asus-wmi: fix resource leaks on probe failure
+ usb: gadget: uac: validate rate list length before storing
+ bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
+ platform/x86: lg-laptop: Fix LED resource handling
+ platform/x86: dell-wmi-base: Fix handling of ultra performance key
+ bpf: Reject writes through untrusted BTF pointers
+ time/namespace: Validate nanosecond field in proc_timens_set_offset()
+ bpf: Reject MEM_ALLOC BTF accesses past object bounds
+ cgroup/cpuset: introduce cpuset-v1.c
+ dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
+ drm/amd/display: Fix dangling pointer in CRTC reset function
+ drm/amd/display: Fix dangling pointer in plane reset function
+ i3c: master: Fix recursive locking during device registration
+ mm/page_owner: use memcg_data snapshot to avoid TOCTOU in
print_page_owner_memcg()
+ nfsd: convert nfsd_net boolean flags to unsigned long flags word
+ ACPI: bus: Introduce acpi_bus_get_primary_device()
+ powerpc/xive: add error return value to xive_smp_probe()
+ powerpc/xive: propagate IPI init errors to prevent use-after-free
+ remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
+ ksmbd: remove redundant DACL check in smb_check_perm_dacl
+ ksmbd: fix maximum allowed access checks
+ drm/amdkfd: fix SMI event cross-process information leak
+ drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq
+ wifi: iwlwifi: mvm: fix P2P-Device binding handling
+ RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
+ virt: acrn: Fix irqfd use-after-free during eventfd shutdown
+ driver core: Avoid warning when removing a device while its supplier is
unbinding
+ serial: 8250: invert serial8250_register_8250_port() CIR condition
+ tty: serial: 8250: protect against NULL uart->port.dev in register
+ drm/amdgpu: Remove unused amdgpu_i2c functions
+ drm/amdgpu/atombios: drop empty function
+ drm/amdgpu: rework i2c init and fini
+ drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
+ pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
+ genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
+ bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
+ net: dsa: b53: do not enable EEE on bcm63xx
+ ACPI: platform: Use acpi_bus_get_primary_device()
+ drm/msm: Recover HW before retire hung submit
+ ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
+ RDMA/efa: Fix use of completion ctx after free
+ ASoC: qcom: q6asm: handle the responses after closing
+ ASoC: qcom: q6asm: drop DSP responses for closed data streams
+ media: hantro: Disable multicore support
+ media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
+ media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
+ hwrng: core - use RCU and work_struct to fix race condition
+ KVM: SVM: Add missing save/restore handling of LBR MSRs
+ ceph: fix num_ops off-by-one when crypto allocation fails
+ greybus: raw: fix use-after-free if write is called after disconnect
+ erofs: fix use-after-free on sbi->sync_decompress
+ net/handshake: hand off the pinned file reference to accept_doit
+ cxl/region: Resolve region deletion races
+ md/raid1,raid10: fix bio accounting for split md cloned bios
+ md/raid1,raid10: fix error-path detection with md_cloned_bio()
+ iommu: Pass domain to remove_dev_pasid() op
+ nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
+ ocfs2: validate external xattr entries when reading metadata
+ fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
+ smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
+ smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
+ ALSA: usx2y: Use standard print API
+ perf/x86/intel: Prevent drain_pebs() reentry
+ net/mlx5e: Move representor vnic reporter to eswitch devlink port
+ Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
+ vhost: invalidate vring access on IOTLB transitions
+ vduse: validate virtqueue alignment
+ virtio_ring: fix stale descriptor flags after a failed packed add
+ iommu/amd: Do not reallocate GA log buffers on resume
+ bpf: mark a NULL call argument precise
+ bpf: Preserve inner map identity in callback frames
+ bpf: Mark NULL kptr stores precise
+ bpf: Don't infer non-NULL from a pointer with an unbounded offset
+ nvme_core: scan namespaces asynchronously
+ bpf: Mark syscall helpers as sleepable
+ erofs: disable LZ4 rolling decompression for now
+ net: plumb extack in __dev_change_net_namespace()
+ net: Remove conflicting altnames for dying netns in
__dev_change_net_namespace().
+ btrfs: zstd: fix lost wakeup when waiting for a workspace
+ bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
+ bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
+ ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
+ smb/client: invalidate fscache for fallocate range operations
+ smb/client: fix stale page cache in insert/collapse range
+ bpf: check_cond_jmp_op(): properly infer if register is null
+ drm/gud: validate GUD_ROTATION_0 is present in supported rotations
+ drm/virtio: use the DMA API for resource backing on Xen
+ smb/server: fix tree connection leak in smb2_tree_connect()
+ r8169: remove original workaround for RTL8125 broken rx issue
+ ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14
+ Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in
ksmbd_rdma_capable_netdev()"
+ Revert "mm/filemap: avoid buffered read/write race to read inconsistent data"
+ xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
+ xfs: catch stale AGF/AGF metadata
+ xfs: rearrange code in xfs_buf_item.c
+ xfs: factor out stale buffer item completion
+ xfs: fix unmount hang with unflushable inodes stuck in the AIL
+ bpf, sockmap: Account for receive queue in FIONREAD without a verdict program
+ ksmbd: fix heap out-of-bounds write in krb5_authenticate()
+ KVM: x86: Use active memslots for the per-vCPU MMIO cache
+ spi: mpc52xx: clean up interrupt handling
+ iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported
+ iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init()
+ xfs: avoid dquot buffer pin deadlock
+ drm/amd: Create a device link between APU display and XHCI devices
+ ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
+ wifi: mt76: connac: tolerate inactive BSS deactivation
+ drm/vmwgfx: Stop using dev_private to store driver data.
+ net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
+ riscv: Use offset_in_page() in text patching functions
+ riscv: patch: Avoid early phys_to_page()
+ riscv: patch: fix handling of bpf-jit execmem addresses
+ drm/vc4: Use video aperture helpers
+ smb: client: improve compound padding in encryption
+ smb: client: get rid of bounds check in SMB2_ioctl_init()
+ smb: client: fix compound alignment with encryption
+ drm/i915/display: support struct intel_atomic_state in to_intel_display()
+ drm/i915/display: pass display to intel_crtc_for_pipe()
+ drm/i915/vga: Convert VGA code to intel_display
+ drm/i915/display: convert I915_STATE_WARN() to struct intel_display
+ drm/i915/de: register wait function renames
+ drm/i915: add generic __to_intel_display()
+ drm/i915/display: accept either i915 or display for feature tests
+ drm/i915/de: allow intel_display and drm_i915_private for de functions
+ drm/i915/gmbus: convert to struct intel_display
+ drm/i915/crt: convert to struct intel_display
+ drm/i915: Grab intel_display from the encoder to avoid potential oopsies
+ f2fs: quota: fix to avoid warning in dquot_writeback_dquots()
+ perf/dwc_pcie: Add support for QCOM vendor devices
+ perf/dwc_pcie: Qualify RAS DES VSEC Capability by Vendor, Revision
+ perf/dwc_pcie: fix duplicate pci_dev devices
+ ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
+ wifi: ath12k: convert struct ath12k_sta::update_wk to use struct wiphy_work
+ wifi: ath12k: prepare vif data structure for MLO handling
+ wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
+ mm: fix uprobe pte be overwritten when expanding vma
+ riscv: Enable cbo.zero only when all harts support Zicboz
+ riscv: Add support for per-thread envcfg CSR values
+ s390/kvm: Remove kvm_arch_fault_in_page()
+ s390/mm: Simplify get_fault_type()
+ s390/mm: Get rid of fault type switch statements
+ platform/x86/amd/pmf: Switch to platform_get_resource() and
devm_ioremap_resource()
+ platform/x86/amd: pmf: Use device managed allocations
+ drm/rockchip: vop2: Consistently use dev_err_probe()
+ drm/rockchip: vop2: Register the primary plane and overlay plane separately
+ rv: Remove trailing whitespace from tracepoint string
+ mm/mremap: fix WARN with uffd that has remap events disabled
+ iommu/s390: handle IOAT registration based on domain
+ iommu/s390: set appropriate IOTA region type
+ drm/xe: Don't allow evicting of BOs in same VM in array of VM binds
+ ASoC: Intel: avs: Use topology information for endpoint numbers
+ sysfs: check visibility before changing group attribute ownership
+ amd/amdkfd: enhance kfd process check in switch partition
+ RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage
+ net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET
+ net/mlx5: Store the global doorbell in mlx5_priv
+ net/mlx5e: Prepare for using different CQ doorbells
+ net: vxlan: prevent NULL deref in vxlan_xmit_one
+ wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
+ accel/ivpu: Allow to import single buffer into multiple contexts
+ accel/ivpu: Rework bind/unbind of imported buffers
+ accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
+ accel/qaic: Add config structs for supported cards
+ net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
+ idpf: fix error handling in the init_task on load
+ riscv: trace: fix snapshot deadlock with sbi ecall
+ bpf: Fix exception exit lock checking for subprogs
+ drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register
+ dm: limit swapping tables for devices with zone write plugs
+ net: use synchronize_rcu_expedited in cleanup_net()
+ net: Factorise setup_net() and cleanup_net().
+ net: Add ops_undo_single for module load/unload.
+ net: Add ->exit_rtnl() hook to struct pernet_operations.
+ wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in
pre_exit
+ bnxt_en: set backing store type from query type
+ xfs: remove bp->b_error check in xfs_attr3_root_inactive
+ xfs: factor out xfs_attr3_node_entry_remove
+ xfs: close crash window in attr dabtree inactivation
+ drm/amd/display: Add a function for checking tmds mode
+ drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on
DCN35
+ media: chips-media: wave5: Fix Null reference while testing fluster
+ btrfs: remove 'reserved' argument from btrfs_pin_extent()
+ md raid: fix hang when stopping arrays with metadata through dm-raid
+ KVM: Rename symbols related to enabling virtualization hardware
+ KVM: Export hardware virtualization enabling/disabling functions
+ syscore: Pass context data to callbacks
+ wifi: iwlwifi: mvm: don't send a 6E related command when not supported
+ rxrpc: kdoc: Update function descriptions and add link from rxrpc.rst
+ rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
+ nouveau/gsp: drop WARN_ON in ACPI probes
+ KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap"
+ doc: Clarify use of slab constructors and SLAB_TYPESAFE_BY_RCU
+ refcount: provide ops for cases when object's memory can be reused
+ wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
+ wifi: mt76: Fix memory leak destroying device
+ iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
+ drm/amd/display: Wrap DCN32 phantom-plane allocation in
DC_RUN_WITH_PREEMPTION_ENABLED
+ wifi: mt76: add wcid publish check in mt76_sta_add
+ netfs: Fix leak of request in netfs_write_begin() error handling
+ netfs: Fix zeropoint update where i_size > remote_i_size
+ KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
+ KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state
+ KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c)
+ KVM: x86: Rename APIC base setters to better capture their relationship
+ KVM: x86: Move update_cr8_intercept() to lapic.c
+ KVM: x86: Unconditionally recompute CR8 intercept on PPR update
+ media: stm32: dcmipp: use v4l2_subdev_is_streaming
+ media: stm32: dcmipp: replace s_stream with enable/disable_streams
+ media: stm32-dcmipp: Return queued buffers on start_streaming() failure
+ idpf: fix max_vport related crash on allocation error during init
+ LoongArch: BPF: Zero-extend signed ALU32 div/mod results
+ bnxt_en: Handle partially initialized auxiliary devices
+ drm/xe/guc: Keep scheduler timeline name alive
+ Bluetooth: hci_sync: extend conn_hash lookup critical sections
+ bpf: Disable migration when destroying sock storage
+ bpf: Disable migration when cloning sock storage
+ rcu: add rcu_read_lock_dont_migrate()
+ bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
+ wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
+ drm/amd/display: use kvzalloc to allocate struct dc
+ drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
+ wifi: mac80211: validate extension-frame layout before RX
+ ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
+ ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
+ mmc: vub300: Use devm_mmc_alloc_host() helper
+ mmc: vub300: fix use-after-free on disconnect
+ mmc: vub300: rename probe error labels
+ RDMA/bnxt_re: Free CQ toggle page after firmware teardown
+ nvmet-tcp: check return value of nvmet_tcp_set_queue_sock
+ s390/ap: Move response_type struct into ap_msg struct
+ s390/ap/zcrypt: Rework AP message buffer allocation
+ s390/ap: Introduce ap message buffer pool
+ s390/ap/zcrypt: New xflag parameter
+ s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code
+ s390/zcrypt: Rework domain processing within zcrypt device driver
+ afs: Fix UAF when sending a message
+ Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
+ Bluetooth: ISO: lock sk in iso_connect_ind
+ xsk: drain continuation descs after overflow in xsk_build_skb()
+ xsk: provide sufficient space in pool->tx_descs
+ xsk: reclaim invalid Tx descriptors in ZC batch path
+ net: ibm: emac: use devm_platform_ioremap_resource
+ net: ibm: emac: use platform_get_irq
+ net: emac: Fix NULL pointer dereference in emac_probe
+ EDAC/igen6: Initialize edac_op_state according to the configuration data
+ EDAC/igen6: Add polling support
+ EDAC/igen6: Skip absent memory controllers
+ soc: xilinx: Fix race condition in event registration
+ idpf: add idpf_virtchnl.h
+ idpf: bound interrupt-vector register fill to the allocated array
+ btrfs: initialize inode mapping flags for cached inodes
+ svcrdma: Add Write chunk WRs to the RPC's Send WR chain
+ svcrdma: wake sq waiters when the transport closes
+ svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
+ nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
+ drm/amdkfd: Fix partial migrate issue
+ drm/amdkfd: return migration pages from copy function
+ Revert "drm/amdkfd: return migration pages from copy function"
+ drm/amdkfd: return migration pages from copy function - again
+ drm/amdgpu: force complete the MES ring fences on reset
+ KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
+ netfilter: nf_tables: prefer nft_trans_elem_alloc helper
+ netfilter: nf_tables: add nft_trans_commit_list_add_elem helper
+ netfilter: nf_tables: prepare for multiple elements in nft_trans_elem
structure
+ net_sched: sch_fq: add three drop_reason
+ net/sched: add qstats_cpu_drop_inc() helper
+ xsk: honor XDP_TX_METADATA in zero-copy path
+ dpll: fix NULL deref in dpll_device_ops() during teardown race
+ bpf: Compare iterator types during state pruning
+ apparmor: fix unconfined user namespace restriction forced stack
+ iommu/vt-d: Flush context cache with correct SID when tearing down aliases
+ btrfs: zoned: don't clobber the extent buffer when zeroing it out
+ wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
+ bpf: Reject >8 byte return values on return-reading trampoline paths
+ drm/msm: don't tear down KMS twice when KMS init fails
+ mm/hugetlb: refactor code around vmemmap_walk
+ mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier
+ drm/amd/amdgpu: Update PF2VF Header
+ drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support
+ wifi: iwlwifi: simplify nested if checks
+ virt: acrn: Remove unused list 'acrn_irqfd_clients'
+ PM: sleep: Use bool for all 1-bit fields in struct dev_pm_info
+ PM: sleep: core: Synchronize runtime PM status of parents and children
+ PM: sleep: core: Restrict power.set_active propagation
+ PM: Rearrange documentation related to __pm_runtime_disable()
+ PM: Block enabling of runtime PM during system suspend
+ PM: runtime: Introduce pm_runtime_blocked()
+ PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally
+ PM: sleep: Fix bit masking operation
+ driver core: Add device_link_test() for testing device link flags
+ gpiolib: make value setters have return values
+ gpiolib: wrap gpio_chip::set()
+ gpiolib: rework the wrapper around gpio_chip::set_multiple()
+ gpiolib: introduce gpio_chip setters that return values
+ pinctrl: mediatek: paris: don't double-check the GPIO number
+ pinctrl: mediatek: paris: use new GPIO line value setter callbacks
+ genirq/proc: Switch to lock guards
+ genirq: Consistently use '%u' format specifier for unsigned int variables
+ media: chips-media: wave5: Release m2m_ctx after Instance Removed from List
+ i3c: master: svc: Fix npcm845 FIFO empty issue
+ i3c: master: svc: Fix npcm845 invalid slvstart event
+ i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
+ drm/amdgpu: skip the VMID 0 flush for VRAM
+ tracing: Fix subbuf resize races with trace_pipe_raw readers
+ bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
+ bpf: Reject legacy packet loads from callbacks
+ bpf: Check ancestor frames for rbtree callbacks
+ bpf: Mark signal tracepoint siginfo arguments as scalar
+ net: rename netns_local to netns_immutable
+ net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
+ drm/virtio: Use drm_gem_plane_helper_prepare_fb()
+ drm/virtio: Add a helper to map and note the dma addrs and lengths
+ firmware: arm_ffa: Add support for IMPDEF value in the memory access
descriptor
+ firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
+ pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
+ bpf: Remove migrate_{disable|enable} in bpf_obj_free_fields()
+ dm-integrity: replace forgeable discard filler with a keyed sector marker
+ perf/x86/intel/uncore: Fix uncore_box ref/unref ordering
+ xfs: remove unused trace event xfs_dqreclaim_dirty
+ ublk: fix dead loop when canceling io command
+ s390/kvm: Mask extra bits from program interrupt code
+ scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks
+ accel/ivpu: Fix race condition when mapping dmabuf
+ KVM: SEV: Drop FOLL_WRITE for encrypted region registration
+ net: Fix wild-memory-access in __register_pernet_operations() when
CONFIG_NET_NS=n.
+ media: verisilicon: Fix kernel panic due to __initconst misuse
+ soc/tegra: pmc: Document tegra_pmc.syscore field
+ soc/tegra: pmc: Add kerneldoc for wake-up variables
+ i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring
+ sched/psi: Create the psimon kthread outside of cgroup_mutex
+ ocfs2: use correct endian in ocfs2_dinode_has_extents
+ s390/zcrypt: Fix memory leak with CCA cards used as accelerator
+ EDAC/igen6: Fix the flood of invalid error reports
+ netfilter: ctnetlink: do not expose expectation DEAD flag
+ EDAC/igen6: Fix NULL pointer dereference
+ Revert "esp: do not unref managed frag pages in esp_ssg_unref()"
+ mm: constify testing page/folio flags
+ mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback
+ PM: sleep: Unblock runtime PM when device prepare fails
+ soundwire: intel_auxdevice: remove redundant assignment to variable link_flags
+ soundwire: intel_auxdevice: Fix system suspend/resume handling
+ gpiolib: Allow to use setters with return value for output-only gpios
+ gpiolib: initialize return value in gpiochip_set_multiple()
+ i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845
+ i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk
+ i3c: master: svc: Fix i3c_master_get_free_addr return check
+ tracing: Fix ring_buffer_read_page_size() kernel-doc
+ tracing: Fix comment in tracing_buffers_splice_read()
+ dm-integrity: fix buffer overflow with keyed discard
+ wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
+ UBUNTU: Upstream stable to v6.6.160, v6.12.114
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172887
Title:
Noble update: upstream stable patchset 2026-11-03
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172887/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
