[ubuntu/jammy-security] linux-ibm 5.15.0-1084.87 (Accepted)
Andy Whitcroft
apw at canonical.com
Wed Aug 20 07:40:53 UTC 2025
linux-ibm (5.15.0-1084.87) jammy; urgency=medium
* jammy/linux-ibm: 5.15.0-1084.87 -proposed tracker (LP: #2119244)
[ Ubuntu: 5.15.0-152.162 ]
* jammy/linux: 5.15.0-152.162 -proposed tracker (LP: #2117618)
* [UBUNTU 22.04] kernel: Fix z17 elf platform recognition (LP: #2114450)
- s390: add z16 elf platform
- s390: Add z17 elf platform
* Jammy update: v5.15.185 upstream stable release (LP: #2115240)
- dma-mapping: avoid potential unused data compilation warning
- cgroup: Fix compilation issue due to cgroup_mutex not being exported
- net: enetc: refactor bulk flipping of RX buffers to separate function
- bpf: fix possible endless loop in BPF map iteration
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
- kconfig: merge_config: use an empty file as initfile
- NFSv4: Check for delegation validity in
nfs_start_delegation_return_locked()
- tracing: Mark binary printing functions with __printf() attribute
- mailbox: use error ret code of of_parse_phandle_with_args()
- fbdev: fsl-diu-fb: add missing device_remove_file()
- fbcon: Use correct erase colour for clearing in fbcon
- fbdev: core: tileblit: Implement missing margin clearing for tileblit
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
- SUNRPC: rpcbind should never reset the port to the value '0'
- thermal/drivers/qoriq: Power down TMU on system suspend
- dql: Fix dql->limit value when reset.
- lockdep: Fix wait context check on softirq for PREEMPT_RT
- PCI: dwc: ep: Ensure proper iteration over outbound map windows
- tools/build: Don't pass test log files to linker
- pNFS/flexfiles: Report ENETDOWN as a connection error
- PCI: vmd: Disable MSI remapping bypass under Xen
- mmc: host: Wait for Vdd to settle on card power off
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
- i2c: qup: Vote for interconnect bandwidth to DRAM
- i2c: pxa: fix call balance of i2c->clk handling routines
- btrfs: make btrfs_discard_workfn() block_group ref explicit
- btrfs: avoid linker error in btrfs_find_create_tree_block()
- btrfs: get zone unusable bytes while holding lock at
btrfs_reclaim_bgs_work()
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too
long
- i3c: master: svc: Fix missing STOP for master request
- dlm: make tcp still work in multi-link env
- um: Store full CSGSFS and SS register from mcontext
- um: Update min_low_pfn to match changes in uml_reserved
- ext4: reorder capability check last
- scsi: st: Tighten the page format heuristics with MODE SELECT
- scsi: st: ERASE does not change tape location
- vfio/pci: Handle INTx IRQ_NOTCONNECTED
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
- rtc: rv3032: fix EERD location
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
- kbuild: fix argument parsing in scripts/config
- crypto: octeontx2 - suppress auth failure screaming due to negative
tests
- dm: restrict dm device size to 2^63-512 bytes
- xen: Add support for XenServer 6.1 platform device
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
- posix-timers: Add cond_resched() to posix_timer_add() search loop
- timer_list: Don't use %pK through printk()
- netfilter: conntrack: Bound nf_conntrack sysctl writes
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
- mmc: sdhci: Disable SD card clock before changing parameters
- ipv6: save dontfrag in cork
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct
hd44780_common"
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
- cpufreq: tegra186: Share policy per cluster
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
- rtc: ds1307: stop disabling alarms on probe
- ieee802154: ca8210: Use proper setters and getters for bitwise types
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in
c8sectpfe_probe()
- remoteproc: qcom_wcnss: Handle platforms with only single power domain
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
- net: ethernet: ti: cpsw_new: populate netdev of_node
- net: pktgen: fix mpls maximum labels list parsing
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
- clk: imx8mp: inform CCF of maximum frequency of clocks
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
- hwmon: (gpio-fan) Add missing mutex locks
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
- fpga: altera-cvp: Increase credit timeout
- PCI: brcmstb: Expand inbound window size up to 64GB
- PCI: brcmstb: Add a softdep to MIP MSI-X driver
- net/mlx5: Avoid report two health errors on same syndrome
- selftests/net: have `gro.sh -t` return a correct exit code
- drm/amdkfd: KFD release_work possible circular locking
- net: xgene-v2: remove incorrect ACPI_PTR annotation
- bonding: report duplicate MAC address in all situations
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap
- x86/build: Fix broken copy command in genimage.sh when making isoimage
- drm/amd/display: handle max_downscale_src_width fail check
- x86/nmi: Add an emergency handler in nmi_desc & use it in
nmi_shootdown_cpus()
- cpuidle: menu: Avoid discarding useful information
- libbpf: Fix out-of-bound read
- x86/kaslr: Reduce KASLR entropy on most x86 systems
- MIPS: Use arch specific syscall name match function
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
- clocksource: mips-gic-timer: Enable counter when CPUs start
- scsi: mpt3sas: Send a diag reset if target reset fails
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
- EDAC/ie31200: work around false positive build warning
- RDMA/core: Fix best page size finding when it can cross SG entries
- can: c_can: Use of_property_present() to test existence of DT property
- eth: mlx4: don't try to complete XDP frames in netpoll
- PCI: Fix old_size lower bound in calculate_iosize() too
- ACPI: HED: Always initialize before evged
- net/mlx5: Modify LSB bitmask in temperature event to include only the
first bit
- net/mlx5: Apply rate-limiting to high temperature warning
- ASoC: ops: Enforce platform maximum on initial value
- ASoC: tas2764: Power up/down amp on mute ops
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
- pinctrl: devicetree: do not goto err when probing hogs in
pinctrl_dt_to_map
- smack: recognize ipv4 CIPSO w/o categories
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
- phy: core: don't require set_mode() callback for phy_get_mode() to work
- drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
- drm/amd/display: Initial psr_version with correct setting
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
- net/mlx5e: set the tx_queue_len for pfifo_fast
- net/mlx5e: reduce rep rxq depth to 256 for ECPF
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
- arch/powerpc/perf: Check the instruction type before creating sample
with perf_mem_data_src
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
- r8152: add vendor/device ID pair for Dell Alienware AW1022z
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
- hwmon: (xgene-hwmon) use appropriate type for the latency value
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is
available
- r8169: don't scan PHY addresses > 0
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
- rcu: fix header guard for rcu_all_qs()
- net/mana: fix warning in the writer of client oob
- scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
- scsi: st: Restore some drive settings after reset
- HID: usbkbd: Fix the bit shift number for LED_KANA
- drm/ast: Find VBIOS mode from regular display size
- bpftool: Fix readlink usage in get_fd_type
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
- wifi: rtw88: Don't use static local variable in
rtw8822b_set_tx_power_index_by_rate
- spi: zynqmp-gqspi: Always acknowledge interrupts
- regulator: ad5398: Add device tree support
- wifi: ath9k: return by of_get_mac_address
- drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
- drm: Add valid clones check
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
- xenbus: Allow PVH dom0 a non-local xenstore
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
- xfrm: Sanitize marks before insert
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level
- bridge: netfilter: Fix forwarding of fragmented packets
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1
- octeontx2-af: Set LMT_ENA bit for APR table entries
- llc: fix data loss when reading from a socket in llc_ui_recvmsg()
- drm/edid: fixed the bug that hdr metadata was not reset
- memcg: always call cond_resched() after fn()
- mm/page_alloc.c: avoid infinite retries caused by cpuset race
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
- spi: spi-fsl-dspi: restrict register range for regmap access
- spi: spi-fsl-dspi: Halt the module after a new message transfer
- spi: spi-fsl-dspi: Reset SR flags before sending a new message
- kbuild: Disable -Wdefault-const-init-unsafe
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
- xen/swiotlb: relax alignment requirements
- drm/i915/gvt: fix unterminated-string-initialization warning
- x86/its: Fix undefined reference to cpu_wants_rethunk_at()
- smb: client: Reset all search buffer pointers when releasing buffer
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node
- coredump: fix error handling for replace_fd()
- pid: add pidfd_prepare()
- fork: use pidfd_prepare()
- coredump: hand a pidfd to the usermode coredump helper
- HID: quirks: Add ADATA XPG alpha wireless mouse support
- nfs: don't share pNFS DS connections between net namespaces
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
- um: let 'make clean' properly clean underlying SUBARCH as well
- spi: spi-sun4i: fix early activation
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro
- tpm: tis: Double the timeout B to 4s
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
- platform/x86: thinkpad_acpi: Ignore battery threshold change event
notification
- perf/arm-cmn: Initialise cmn->cpu earlier
- Linux 5.15.185
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38051
- smb: client: Fix use-after-free in cifs_fill_dirent
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38030
- Revert "drm/amd: Keep display off while going into S4"
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38077
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in
current_password_store()
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38078
- ALSA: pcm: Fix race of buffer access at PCM OSS layer
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38003
- can: bcm: add missing rcu read protection for procfs content
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38004
- can: bcm: add locking for bcm_op runtime updates
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38031
- padata: do not leak refcount in reorder_work
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38079
- crypto: algif_hash - fix double free in hash_accept
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38052
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38058
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38034
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38035
- nvmet-tcp: don't restore null sk_state_change
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38037
- vxlan: Annotate FDB data races
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38061
- net: pktgen: fix access outside of user given buffer in
pktgen_thread_write()
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38043
- firmware: arm_ffa: Set dma_mask for ffa devices
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38044
- media: cx231xx: set device_caps for 417
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38065
- orangefs: Do not truncate file size
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38066
- dm cache: prevent BUG_ON by blocking retries on failed device resumes
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38068
- crypto: lzo - Fix compression buffer overrun
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38072
- libnvdimm/labels: Fix divide error in nd_label_data_init()
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38048
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
* Jammy update: v5.15.185 upstream stable release (LP: #2115240) //
CVE-2025-38075
- scsi: target: iscsi: Fix timeout on deleted connection
* Packaging resync (LP: #1786013)
- [Packaging] update annotations scripts
* raid10: block discard causes a NULL pointer dereference after
5.15.0-144-generic (LP: #2117395)
- md: move initialization and destruction of 'io_acct_set' to md.c
* CVE-2025-38083
- net_sched: prio: fix a race in prio_tune()
* CVE-2024-50073
- tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
Date: 2025-08-01 20:28:13.509000+00:00
Changed-By: Ian Whitfield <ian.whitfield at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux-ibm/5.15.0-1084.87
-------------- next part --------------
Sorry, changesfile not available.
More information about the jammy-changes
mailing list