[ubuntu/noble-updates] linux-ibm 6.8.0-1060.61 (Accepted)
Andy Whitcroft
apw at canonical.com
Tue Jun 30 22:26:19 UTC 2026
linux-ibm (6.8.0-1060.61) noble; urgency=medium
* noble/linux-ibm: 6.8.0-1060.61 -proposed tracker (LP: #2158403)
[ Ubuntu: 6.8.0-134.134 ]
* noble/linux: 6.8.0-134.134 -proposed tracker (LP: #2158432)
* ext4: writeback causes kernel oops when low on space (LP: #2158377)
- ext4: get rid of ppath in get_ext_path()
linux-ibm (6.8.0-1059.60) noble; urgency=medium
* noble/linux-ibm: 6.8.0-1059.60 -proposed tracker (LP: #2157168)
[ Ubuntu: 6.8.0-131.131 ]
* noble/linux: 6.8.0-131.131 -proposed tracker (LP: #2157196)
* Packaging resync (LP: #1786013)
- [Packaging] update annotations scripts
* CVE-2026-46244
- netfilter: nft_inner: Fix IPv6 inner_thoff desync
* CVE-2026-43185
- ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
* CVE-2026-46289
- lib/scatterlist: fix length calculations in extract_kvec_to_sg
* CVE-2026-46119
- libceph: Fix slab-out-of-bounds access in auth message processing
* CVE-2026-46135
- nvmet-tcp: fix race between ICReq handling and queue teardown
* CVE-2026-46185
- smb/client: fix out-of-bounds read in symlink_data()
* CVE-2026-46195
- smb: client: validate dacloffset before building DACL pointers
* CVE-2026-46115
- block: add pgmap check to biovec_phys_mergeable
* CVE-2026-43501
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
* CVE-2026-45988
- rxrpc: Fix re-decryption of RESPONSE packets
* CVE-2026-46043
- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
* CVE-2026-43493
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests
* CVE-2026-43071
- dcache: Limit the minimal number of bucket to two
* CVE-2026-31685
- netfilter: ip6t_eui64: reject invalid MAC header for all packets
* CVE-2026-43117
- btrfs: tracepoints: get correct superblock from dentry in event
btrfs_sync_file()
* CVE-2026-43114
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on
expiry
* CVE-2026-31607
- usbip: validate number_of_packets in usbip_pack_ret_submit()
* CVE-2026-31659
- batman-adv: reject oversized global TT response buffers
* CVE-2026-31649
- net: stmmac: fix integer underflow in chain mode
* CVE-2026-31657
- batman-adv: hold claim backbone gateways by reference
* CVE-2026-31637
- rxrpc: reject undecryptable rxkad response tickets
* CVE-2026-31669
- mptcp: fix slab-use-after-free in __inet_lookup_established
* CVE-2026-31668
- seg6: separate dst_cache for input and output paths in seg6 lwtunnel
* CVE-2026-43011
- net/x25: Fix potential double free of skb
* CVE-2026-43037
- ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
* CVE-2026-43341
- net/ipv6: ioam6: prevent schema length wraparound in trace fill
* CVE-2026-43038
- ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
* CVE-2026-31682
- bridge: br_nd_send: linearize skb before parsing ND options
* CVE-2026-31436
- dmaengine: idxd: fix possible wrong descriptor completion in
llist_abort_desc()
* CVE-2026-43384
- net/tcp-ao: Fix MAC comparison to be constant-time
* CVE-2026-31448
- ext4: get rid of ppath in ext4_find_extent()
- ext4: get rid of ppath in ext4_ext_create_new_leaf()
- ext4: get rid of ppath in ext4_ext_insert_extent()
- ext4: avoid infinite loops caused by residual data
* CVE-2026-31478
- ksmbd: replace hardcoded hdr2_len with offsetof() in
smb2_calc_max_out_buf_len()
* CVE-2026-23428
- ksmbd: fix use-after-free of share_conf in compound request
* CVE-2026-23450
- net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
* CVE-2026-23455
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
* CVE-2026-31402
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
* CVE-2026-43383
- net/tcp-md5: Fix MAC comparison to be constant-time
* CVE-2026-43378
- smb: server: fix use-after-free in smb2_open()
* CVE-2026-46243
- smb: client: reject userspace cifs.spnego descriptions
* CVE-2026-43414
- scsi: qla2xxx: Completely fix fcport double free
* CVE-2026-43407
- libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
* CVE-2026-43406
- libceph: prevent potential out-of-bounds reads in
process_message_header()
linux-ibm (6.8.0-1058.59) noble; urgency=medium
* noble/linux-ibm: 6.8.0-1058.59 -proposed tracker (LP: #2151919)
[ Ubuntu: 6.8.0-130.130 ]
* noble/linux: 6.8.0-130.130 -proposed tracker (LP: #2154560)
* Noble update: upstream stable patchset 2026-03-26 (LP: #2146465)
- Revert "UBUNTU: SAUCE: Fix skb_vlan_inet_prepare() usage"
* Kernel regression (6.8.0-117.generic) (LP: #2153556)
- net: bonding: update the slave array for broadcast mode
- bonding: do not set usable_slaves for broadcast mode
* perf_cpu_map__merge fails to compile on ppc46el, s390x on noble linux
(LP: #2152194)
- SAUCE: temporary fix attempt for size eceed
* Some powerpc test from ubuntu_kernel_selftests timeout with 45 seconds
(LP: #2141536)
- selftests/powerpc: Lower run time of count_stcx_fail test
- selftests/powerpc: Give all tests 2 minutes timeout
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809)
- auxdisplay: arm-charlcd: fix release_mem_region() size
- hfsplus: return error when node already exists in hfs_bnode_create
- rcu: s/boost_kthread_mutex/kthread_mutex
- rcu/exp: Move expedited kthread worker creation functions above
rcutree_prepare_cpu()
- rcu: Refactor expedited handling check in rcu_read_unlock_special()
- rcu: Remove local_irq_save/restore() in
rcu_preempt_deferred_qs_handler()
- rcu: Fix rcu_read_unlock() deadloop due to softirq
- audit: move the compat_xxx_class[] extern declarations to audit_arch.h
- i3c: Move device name assignment after i3c_bus_init
- fs: add <linux/init_task.h> for 'init_fs'
- i3c: master: Update hot-join flag only on success
- gfs2: Retries missing in gfs2_{rename,exchange}
- gfs2: Fix use-after-free in iomap inline data write path
- i3c: dw: Initialize spinlock to avoid upsetting lockdep
- tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
- tpm: st33zp24: Fix missing cleanup on get_burstcount() error
- btrfs: qgroup: return correct error when deleting qgroup relation item
- btrfs: fix block_group_tree dirty_list corruption
- smb: client: fix potential UAF and double free in smb2_open_file()
- xen/virtio: Don't use grant-dma-ops when running as Dom0
- ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
- io_uring/sync: validate passed in offset
- cpuidle: menu: Cleanup after loadavg removal
- cpuidle: governors: menu: Always check timers with tick stopped
- md/raid10: fix any_working flag handling in raid10_sync_request
- iomap: fix submission side handling of completion side errors
- ublk: Validate SQE128 flag before accessing the cmd
- x86/xen: make some functions static
- Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
- PM: wakeup: Handle empty list in wakeup_sources_walk_start()
- perf: arm_spe: Properly set hw.state on failures
- PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
- s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
- crypto: qat - fix warning on adf_pfvf_pf_proto.c
- selftests/bpf: veristat: fix printing order in output_stats()
- libbpf: Fix OOB read in btf_dump_get_bitfield_value
- ARM: VDSO: Patch out __vdso_clock_getres() if unavailable
- crypto: cavium - fix dma_free_coherent() size
- crypto: octeontx - fix dma_free_coherent() size
- crypto: hisilicon/zip - adjust the way to obtain the req in the callback
function
- crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware
queue unavailable
- hrtimer: Fix trace oddity
- bpf, sockmap: Fix incorrect copied_seq calculation
- bpf, sockmap: Fix FIONREAD for sockmap
- crypto: hisilicon/trng - modifying the order of header files
- crypto: hisilicon/trng - support tfms sharing the device
- bpf: Fix bpf_xdp_store_bytes proto for read-only arg
- scsi: efct: Use IRQF_ONESHOT and default primary handler
- EDAC/altera: Remove IRQF_ONESHOT
- mfd: wm8350-core: Use IRQF_ONESHOT
- sched/rt: Skip currently executing CPU in rto_next_cpu()
- pstore/ram: fix buffer overflow in persistent_ram_save_old()
- soc: qcom: smem: handle ENOMEM error during probe
- EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
- EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
- arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
- clk: qcom: Return correct error code in qcom_cc_probe_by_index()
- arm64: dts: qcom: sdm630: fix gpu_speed_bin size
- arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
- ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
- powerpc/uaccess: Move barrier_nospec() out of
allow_read_{from/write}_user()
- soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
cmd_db_dev_probe
- soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
- powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event
handling
- ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells
- arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree
node
- arm64: dts: amlogic: axg: assign the MMC signal clocks
- arm64: dts: amlogic: gx: assign the MMC signal clocks
- arm64: dts: amlogic: g12: assign the MMC B and C signal clocks
- arm64: dts: amlogic: g12: assign the MMC A signal clock
- arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0
- arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1
- arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
- workqueue: Factor out assign_rescuer_work()
- workqueue: Only assign rescuer work when really needed
- workqueue: Process rescuer work items one-by-one using a cursor
- smack: /smack/doi must be > 0
- smack: /smack/doi: accept previously used values
- ASoC: nau8821: Consistently clear interrupts before unmasking
- ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
- ASoC: nau8821: Fixup nau8821_enable_jack_detect()
- drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
- drm/msm/disp/dpu: add merge3d support for sc7280
- regulator: core: move supply check earlier in set_machine_constraints()
- HID: playstation: Add missing check for input_ff_create_memless
- drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
- media: ccs: Accommodate C-PHY into the calculation
- drm/msm/a2xx: fix pixel shader start on A225
- platform/chrome: cros_typec_switch: Don't touch struct
fwnode_handle::dev
- media: uvcvideo: Fix allocation for small frame sizes
- platform/chrome: cros_ec_lightbar: Fix response size initialization
- spi: tools: Add include folder to .gitignore
- Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
- PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
- Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
- PCI/PM: Avoid redundant delays on D3hot->D3cold
- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
- Documentation: tracing: Add ring-buffer mapping
- docs: fix WARNING document not included in any toctree
- Documentation: trace: Refactor toctree
- Documentation: tracing: Add PCI tracepoint documentation
- PCI: Do not attempt to set ExtTag for VFs
- PCI/portdrv: Fix potential resource leak
- quota: fix livelock between quotactl and freeze_super
- net: mctp-i2c: fix duplicate reception of old data
- mctp i2c: initialise event handler read bytes
- wifi: cfg80211: stop NAN and P2P in cfg80211_leave
- netfilter: nf_tables: reset table validation state on abort
- netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
- netfilter: nf_conncount: increase the connection clean up limit to 64
- netfilter: nft_compat: add more restrictions on netlink attributes
- netfilter: nf_conncount: fix tracking of connections from localhost
- module: add helper function for reading module_buildid()
- kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
- PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
- iommu/vt-d: Flush cache for PASID table before using it
- dm: use bio_clone_blkg_association
- nfsd: never defer requests during idmap lookup
- fat: avoid parent link count underflow in rmdir
- tcp: tcp_tx_timestamp() must look at the rtx queue
- wifi: ath10k: sdio: add missing lock protection in
ath10k_sdio_fw_crashed_dump()
- PCI: Initialize RCB from pci_configure_device()
- PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros
- PCI: Add defines for bridge window indexing
- PCI/ACPI: Restrict program_hpx_type2() to AER bits
- ipc: don't audit capability check in ipc_permissions()
- ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
- of: unittest: fix possible null-pointer dereferences in
of_unittest_property_copy()
- mptcp: fix receive space timestamp initialization
- octeontx2-af: Fix PF driver crash with kexec kernel booting
- bonding: only set speed/duplex to unknown, if getting speed failed
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
- nfc: hci: shdlc: Stop timers and work before freeing context
- netfilter: nft_set_hash: fix get operation on big endian
- netfilter: nft_counter: fix reset of counters on 32bit archs
- netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
- PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
- net: hns3: fix double free issue for tx spare buffer
- procfs: fix missing RCU protection when reading real_parent in
do_task_stat()
- smb: client: correct value for smbd_max_fragmented_recv_size
- net: sunhme: Fix sbus regression
- net: Add skb_dstref_steal and skb_dstref_restore
- net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
callers
- xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
- serial: caif: fix use-after-free in caif_serial ldisc_close()
- octeon_ep: disable per ring interrupts
- octeon_ep: ensure dbell BADDR updation
- ionic: Rate limit unknown xcvr type messages
- octeontx2-pf: Unregister devlink on probe failure
- RDMA/rtrs: server: remove dead code
- IB/cache: update gid cache on client reregister event
- RDMA/hns: Fix WQ_MEM_RECLAIM warning
- RDMA/hns: Notify ULP of remaining soft-WCs during reset
- power: supply: ab8500: Fix use-after-free in power_supply_changed()
- power: supply: act8945a: Fix use-after-free in power_supply_changed()
- power: supply: bq256xx: Fix use-after-free in power_supply_changed()
- power: supply: bq25980: Fix use-after-free in power_supply_changed()
- power: supply: cpcap-battery: Fix use-after-free in
power_supply_changed()
- power: supply: goldfish: Fix use-after-free in power_supply_changed()
- power: supply: rt9455: Fix use-after-free in power_supply_changed()
- power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
- power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
- power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
- power: supply: wm97xx: Fix NULL pointer dereference in
power_supply_changed()
- RDMA/rtrs-srv: fix SG mapping
- RDMA/rxe: Fix double free in rxe_srq_from_init
- tools/power/x86/intel-speed-select: Fix file descriptor leak in
isolate_cpus()
- mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
- crypto: ccp - Add an S4 restore flow
- crypto: ccp - Factor out ring destroy handling to a helper
- crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT
fails
- mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
- RDMA/rxe: Fix race condition in QP timer handlers
- svcrdma: Increase the per-transport rw_ctx count
- svcrdma: Reduce the number of rdma_rw contexts per-QP
- RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
- cxl: Fix premature commit_end increment on decoder commit failure
- mtd: parsers: ofpart: fix OF node refcount leak in
parse_fixed_partitions()
- mtd: spinand: Fix kernel doc
- power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
- RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
- scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
- scsi: ufs: host: mediatek: Require CONFIG_PM
- scsi: csiostor: Fix dereference of null pointer rn
- nvdimm: virtio_pmem: serialize flush requests
- fs/nfs: Fix readdir slow-start regression
- tracing: Properly process error handling in event_hist_trigger_parse()
- tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
- fbdev: of_display_timing: Fix device node reference leak in
of_get_display_timings()
- fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
- clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
- clk: qcom: rcg2: compute 2d using duty fraction directly
- clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
- clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
- clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
- clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
- clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
- clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
- clk: qcom: gcc-ipq5018: flag sleep clock as critical
- clk: Move clk_{save,restore}_context() to COMMON_CLK section
- clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
- clk: qcom: gfx3d: add parent to parent request map
- clk: mediatek: Fix error handling in runtime PM setup
- dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
- dma: dma-axi-dmac: fix SW cyclic transfers
- staging: greybus: lights: avoid NULL deref
- serial: imx: change SERIAL_IMX_CONSOLE to bool
- serial: SH_SCI: improve "DMA support" prompt
- mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
- iio: pressure: mprls0025pa: fix scan_type struct
- watchdog: starfive-wdt: Fix PM reference leak in probe error path
- coresight: etm3x: Fix cpulocked warning on cpuhp
- Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
- mfd: arizona: Fix regulator resource leak on
wm5102_clear_write_sequencer() failure
- mfd: simple-mfd-i2c: Add MAX77705 support
- mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
- mfd: simple-mfd-i2c: Add SpacemiT P1 support
- mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
- mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
- [Config] Disable new Delta TN48M CPLD support by default
- drivers: iio: mpu3050: use dev_err_probe for regulator request
- usb: bdc: fix sleep during atomic
- pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
- ovl: Fix uninit-value in ovl_fill_real
- iio: sca3000: Fix a resource leak in sca3000_probe()
- pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
- pinctrl: single: fix refcount leak in pcs_add_gpio_func()
- leds: qcom-lpg: Check the return value of regmap_bulk_write()
- backlight: qcom-wled: Support ovp values for PMI8994
- backlight: qcom-wled: Change PM8950 WLED configurations
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
- io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
- fs/ntfs3: prevent infinite loops caused by the next valid being the same
- fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
- ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
- powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
- kbuild: Add objtool to top-level clean target
- selftests/memfd: delete unused declarations
- selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT
- ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
- cpuidle: Skip governor when only one idle state is available
- selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2
- net: sparx5/lan969x: fix DWRR cost max to match hardware register width
- net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
- net: mscc: ocelot: split xmit into FDMA and register injection paths
- net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
- ipv6: Fix out-of-bound access in fib6_add_rt2node().
- net: sparx5/lan969x: fix PTP clock max_adj value
- net: usb: catc: enable basic endpoint checking
- xen-netback: reject zero-queue configuration from guest
- net/rds: rds_sendmsg should not discard payload_len
- net: bridge: mcast: always update mdb_n_entries for vlan contexts
- selftests: forwarding: vxlan_bridge_1d: fix test failure with
br_netfilter enabled
- selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with
br_netfilter enabled
- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
- net: remove WARN_ON_ONCE when accessing forward path array
- ipv6: fix a race in ip6_sock_set_v6only()
- bpftool: Fix truncated netlink dumps
- ping: annotate data-races in ping_lookup()
- icmp: move icmp_global.credit and icmp_global.stamp to per netns storage
- icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns
- icmp: prevent possible overflow in icmp_global_allow()
- cache: add __cacheline_group_{begin, end}_aligned() (+ couple more)
- inet: move icmp_global_{credit,stamp} to a separate cache line
- octeontx2-af: Fix default entries mcam entry action
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down
- net/mlx5: Fix multiport device check over light SFs
- apparmor: fix NULL sock in aa_sock_file_perm
- apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
- apparmor: fix rlimit for posix cpu timers
- apparmor: remove apply_modes_to_perms from label_match
- apparmor: make label_match return a consistent value
- apparmor: fix invalid deref of rawdata when export_binary is unset
- apparmor: fix aa_label to return state from compount and component match
- drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
- drm/amdgpu: Fix memory leak in amdgpu_ras_init()
- drm/i915/acpi: free _DSM package when no connectors
- ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
- drm/amdkfd: fix debug watchpoints for logical devices
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
- spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname()
- spi: wpcm-fiu: Fix uninitialized res
- spi: wpcm-fiu: Simplify with dev_err_probe()
- spi: wpcm-fiu: Fix potential NULL pointer dereference in
wpcm_fiu_probe()
- s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
- efi: Fix reservation of unaccepted memory table
- btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
found
- x86/hyperv: Fix error pointer dereference
- ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk
- drm/amd/display: Use same max plane scaling limits for all 64 bpp
formats
- MIPS: Work around LLVM bug when gp is used as global register variable
- ext4: don't cache extent during splitting extent
- ext4: fix memory leak in ext4_ext_shift_extents()
- ext4: use optimized mballoc scanning regardless of inode format
- ata: pata_ftide010: Fix some DMA timings
- ata: libata-scsi: refactor ata_scsi_translate()
- SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
- SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
- ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
- ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
- perf test stat: Update test expectations and events
- perf test stat tests: Fix for virtualized machines
- perf unwind-libdw: Fix invalid reference counts
- perf callchain: Fix srcline printing with inlines
- libsubcmd: Fix null intersection case in exclude_cmds()
- libperf: Don't remove -g when EXTRA_CFLAGS are used
- libperf build: Always place libperf includes first
- rtc: interface: Alarm race handling should not discard preceding error
- hfsplus: fix volume corruption issue for generic/498
- fs/buffer: add alert in try_to_free_buffers() for folios without buffers
- hfsplus: pretend special inodes as regular files
- i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
- minix: Add required sanity checking to minix_check_superblock()
- btrfs: handle user interrupt properly in btrfs_trim_fs()
- smb: client: add proper locking around ses->iface_last_update
- gfs2: fiemap page fault fix
- smb: client: prevent races in ->query_interfaces()
- tools/power cpupower: Reset errno before strtoull()
- s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
- perf/arm-cmn: Support CMN-600AE
- arm64: Add support for TSV110 Spectre-BHB mitigation
- rnbd-srv: Zero the rsp buffer before using it
- x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE
is set
- EFI/CPER: don't dump the entire memory region
- APEI/GHES: ensure that won't go past CPER allocated record
- EFI/CPER: don't go past the ARM processor CPER record buffer
- ACPI: processor: Fix NULL-pointer dereference in
acpi_processor_errata_piix4()
- ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
- md-cluster: fix NULL pointer dereference in process_metadata_update
- cpufreq: dt-platdev: Block the driver from probing on more QC platforms
- s390/perf: Disable register readout on sampling events
- perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
- xenbus: Use .freeze/.thaw to handle xenbus devices
- blk-mq-debugfs: add missing debugfs_mutex in
blk_mq_debugfs_register_hctxs()
- sparc: Synchronize user stack on fork and clone
- sparc: don't reference obsolete termio struct for TC* constants
- bpf: verifier improvement in 32bit shift sign extension pattern
- clocksource/drivers/sh_tmu: Always leave device running after probe
- clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency
on OF
- PCI/MSI: Unmap MSI-X region on error
- crypto: hisilicon/qm - move the barrier before writing to the mailbox
register
- mailbox: bcm-ferxrm-mailbox: Use default primary handler
- char: tpm: cr50: Remove IRQF_ONESHOT
- pstore: ram_core: fix incorrect success return when vmap() fails
- arm64: tegra: smaug: Add usb-role-switch support
- parisc: Prevent interrupts during reboot
- drm/display/dp_mst: Add protection against 0 vcpi
- spi-geni-qcom: initialize mode related registers to 0
- spi-geni-qcom: use xfer->bits_per_word for can_dma()
- media: dvb-core: dmxdevfilter must always flush bufs
- spi: stm32: fix Overrun issue at < 8bpw
- drm/v3d: Set DMA segment size to avoid debug warnings
- media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
- media: omap3isp: isppreview: always clamp in preview_try_format()
- media: omap3isp: set initial format
- media: mediatek: vcodec: Don't try to decode 422/444 VP9
- drm/amdgpu: add support for HDP IP version 6.1.1
- drm/amdgpu: avoid a warning in timedout job handler
- HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
- ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
- ASoC: wm8962: Don't report a microphone if it's shorted to ground on
plug
- spi: spi-mem: Limit octal DTR constraints to octal DTR situations
- media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
- media: adv7180: fix frame interval in progressive mode
- media: pvrusb2: fix URB leak in pvr2_send_request_ex
- media: solo6x10: Check for out of bounds chip_id
- media: cx25821: Fix a resource leak in cx25821_dev_setup()
- media: v4l2-async: Fix error handling on steps after finding a match
- drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
- drm: Account property blob allocations to memcg
- hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
- virt: vbox: uapi: Mark inner unions in packed structs as packed
- drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
- drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
parts
- drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
- media: rkisp1: Fix filter mode register configuration
- HID: multitouch: add eGalaxTouch EXC3188 support
- HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
- ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
- gpio: aspeed-sgpio: Change the macro to support deferred probe
- ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
- spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
- ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional()
in max98390_i2c_probe()
- hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
- hwmon: (f71882fg) Add F81968 support
- ASoC: es8328: Add error unwind in resume
- modpost: Amend ppc64 save/restfpr symnames for -Os build
- ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
- jfs: Add missing set_freezable() for freezable kthread
- jfs: nlink overflow in jfs_rename
- wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
- wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
- dm: replace -EEXIST with -EBUSY
- dm: remove fake timeout to avoid leak request
- iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
- wifi: libertas: fix WARNING in usb_tx_block
- iommu/amd: move wait_on_sem() out of spinlock
- wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
- PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
- wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
- wifi: ath12k: fix preferred hardware mode calculation
- ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
- ipv6: exthdrs: annotate data-race over multiple sysctl
- ext4: mark group add fast-commit ineligible
- ext4: move ext4_percpu_param_init() before ext4_mb_init()
- ext4: mark group extend fast-commit ineligible
- netfilter: nf_conntrack: Add allow_clash to generic protocol handler
- netfilter: xt_tcpmss: check remaining length before reading optlen
- openrisc: define arch-specific version of nop()
- net: usb: r8152: fix transmit queue timeout
- wifi: iwlwifi: mvm: check the validity of noa_len
- net/rds: No shortcut out of RDS_CONN_ERROR
- gro: change the BUG_ON() in gro_pull_from_frag0()
- ipv4: igmp: annotate data-races around idev->mr_maxdelay
- net: hns3: extend HCLGE_FD_AD_QID to 11 bits
- wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
- wifi: iwlegacy: add missing mutex protection in
il3945_store_measurement()
- ipv4: fib: Annotate access to struct fib_alias.fa_state.
- Bluetooth: hci_conn: Set link_policy on incoming ACL connections
- Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
- Bluetooth: btusb: Add new VID/PID for RTL8852CE
- Bluetooth: btusb: Add device ID for Realtek RTL8761BU
- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
- wifi: rtw89: pci: restore LDO setting after device resume
- wifi: ath10k: fix lock protection in
ath10k_wmi_event_peer_sta_ps_state_chg()
- net: usb: sr9700: remove code to drive nonexistent multicast filter
- vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
- net/rds: Clear reconnect pending bit
- PCI: Mark ASM1164 SATA controller to avoid bus reset
- PCI: Fix pci_slot_lock () device locking
- PCI: Enable ACS after configuring IOMMU for OF platforms
- PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
- PCI: Mark Nvidia GB10 to avoid bus reset
- myri10ge: avoid uninitialized variable use
- nfc: nxp-nci: remove interrupt trigger type
- RDMA/rtrs-clt: For conn rejection use actual err number
- ata: libata: avoid long timeouts on hot-unplugged SATA DAS
- hisi_acc_vfio_pci: update status after RAS error
- scsi: buslogic: Reduce stack usage
- vhost: fix caching attributes of MMIO regions by setting them explicitly
- tracing: Fix false sharing in hwlat get_sample()
- remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
channel is uninitialized
- mailbox: pcc: Remove spurious IRQF_ONESHOT usage
- mailbox: imx: Skip the suspend flag for i.MX7ULP
- mailbox: sprd: mask interrupts that are not handled
- remoteproc: mediatek: Break lock dependency to `prepare_lock`
- mailbox: sprd: clear delivery flag before handling TX done
- clk: microchip: core: correct return value on *_get_parent()
- m68k: nommu: fix memmove() with differently aligned src and dest for
68000
- soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of
NUC15)
- staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
failure
- serial: 8250_dw: handle clock enable errors in runtime_resume
- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
- fpga: of-fpga-region: Fail if any bridge is missing
- dmaengine: sun6i: Choose appropriate burst length under maxburst
- dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
- misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
- misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
- staging: rtl8723bs: fix memory leak on failure path
- serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
termination is done
- fix it87_wdt early reboot by reporting running timer
- binder: don't use %pK through printk
- watchdog: imx7ulp_wdt: handle the nowayout option
- phy: mvebu-cp110-utmi: fix dr_mode property read from dts
- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
- Revert "mfd: da9052-spi: Change read-mask to write-mask"
- iio: Use IRQF_NO_THREAD
- iio: magnetometer: Remove IRQF_ONESHOT
- MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
- fs/ntfs3: drop preallocated clusters for sparse and compressed files
- fs/ntfs3: avoid calling run_get_entry() when run == NULL in
ntfs_read_run_nb_ra()
- ceph: supply snapshot context in ceph_uninline_data()
- libceph: define and enforce CEPH_MAX_KEY_LEN
- thermal: int340x: Fix sysfs group leak on DLVR registration failure
- include: uapi: netfilter_bridge.h: Cover for musl libc
- ARM: 9467/1: mm: Don't use %pK through printk
- drm/amd/display: Avoid updating surface with the same surface under MPO
- drm/amdgpu: Adjust usleep_range in fence wait
- ALSA: usb-audio: Update the number of packets properly at receiving
- drm/amdgpu: Add HAINAN clock adjustment
- drm/radeon: Add HAINAN clock adjustment
- ALSA: usb-audio: Add sanity check for OOB writes at silencing
- btrfs: replace BUG() with error handling in __btrfs_balance()
- drm/amd/display: Remove conditional for shaper 3DLUT power-on
- rtc: zynqmp: correct frequency value
- ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
- ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
- xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
- xfrm: skip templates check for packet offload tunnel mode
- ipmi: ipmb: initialise event handler read bytes
- xfrm: always flush state and policy upon NETDEV_UNREGISTER event
- net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
- net: usb: lan78xx: scan all MDIO addresses on LAN7801
- net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
- net: ethernet: xscale: Check for PTP support properly
- wifi: cfg80211: wext: fix IGTK key ID off-by-one
- Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
- [Config] Remove WARN_ALL_UNSEEDED_RANDOM
- Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
- Bluetooth: hci_qca: Cleanup on all setup failures
- Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
- Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
L2CAP_ECRED_CONN_REQ
- Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
- tipc: fix duplicate publication key in tipc_service_insert_publ()
- RDMA/core: Fix stale RoCE GIDs during netdev events at registration
- net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
- RDMA/efa: Fix typo in efa_alloc_mr()
- net: usb: pegasus: enable basic endpoint checking
- RDMA/umem: Fix double dma_buf_unpin in failure path
- net/mlx5: DR, Fix circular locking dependency in dump
- net/mlx5: Fix missing devlink lock in SRIOV enable error path
- net: consume xmit errors of GSO frames
- dpaa2-switch: validate num_ifs to prevent out-of-bounds write
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
- rpmsg: core: fix race in driver_override_show() and use core helper
- clk: renesas: rzg2l: Fix intin variable size
- clk: renesas: rzg2l: Select correct div round macro
- ASoC: SOF: ipc4-control: If there is no data do not send bytes update
- ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
- ASoC: SOF: ipc4-control: Use the correct size for
scontrol->ipc_control_data
- ASoC: SOF: ipc4-control: Keep the payload size up to date
- fpga: dfl: use subsys_initcall to allow built-in drivers to be added
- dm-verity: correctly handle dm_bufio_client_create() failure
- media: mediatek: encoder: Fix uninitialized scalar variable issue
- media: mtk-mdp: Fix error handling in probe function
- media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
- media: verisilicon: AV1: Fix enable cdef computation
- media: verisilicon: AV1: Fix tx mode bit setting
- ARM: omap2: Fix reference count leaks in omap_control_init()
- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
succeeding
- arm64: Disable branch profiling for all arm64 code
- HID: hid-pl: handle probe errors
- HID: magicmouse: Do not crash on missing msc->input
- HID: prodikeys: Check presence of pm->input_ep82
- HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
- arm64: dts: apple: t8112-j473: Keep the HDMI port powered on
- media: verisilicon: AV1: Set IDR flag for intra_only frame type
- media: radio-keene: fix memory leak in error path
- media: cx88: Add missing unmap in snd_cx88_hw_params()
- media: cx23885: Add missing unmap in snd_cx23885_hw_params()
- media: cx25821: Add missing unmap in snd_cx25821_hw_params()
- media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
- media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
- media: i2c: ov01a10: Fix the horizontal flip control
- media: i2c: ov01a10: Fix reported pixel-rate value
- media: i2c: ov01a10: Fix analogue gain range
- media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
- media: i2c: ov01a10: Fix test-pattern disabling
- media: qcom: camss: vfe: Fix out-of-bounds access in
vfe_isr_reg_update()
- media: ccs: Avoid possible division by zero
- media: i2c: ov5647: Initialize subdev before controls
- media: i2c: ov5647: Correct pixel array offset
- media: i2c: ov5647: Correct minimum VBLANK value
- media: i2c: ov5647: Sensor should report RAW color space
- media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
- media: i2c: ov5647: use our own mutex for the ctrl lock
- dm-integrity: fix a typo in the code for write/discard race
- dm: clear cloned request bio pointer when last clone bio completes
- soc: ti: k3-socinfo: Fix regmap leak on probe failure
- soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
- clk: clk-apple-nco: Add "apple,t8103-nco" compatible
- media: i2c: ov01a10: Fix digital gain range
- clk: tegra: tegra124-emc: Fix potential memory leak in
tegra124_clk_register_emc()
- s390/pci: Handle futile config accesses of disabled devices directly
- dm-integrity: fix recalculation in bitmap mode
- dm-unstripe: fix mapping bug when there are multiple targets in a table
- arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
- media: venus: vdec: fix error state assignment for zero bytesused
- media: venus: vdec: restrict EOS addr quirk to IRIS2 only
- drm: of: drm_of_panel_bridge_remove(): fix device_node leak
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
- selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
- xfs: mark data structures corrupt on EIO and ENODATA
- media: verisilicon: AV1: Fix tile info buffer size
- iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
scalable mode
- mfd: core: Add locking around 'mfd_of_node_list'
- xfs: delete attr leaf freemap entries when empty
- xfs: fix freemap adjustments when adding xattrs to leaf blocks
- xfs: fix remote xattr valuelblk check
- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
- PCI: endpoint: Fix swapped parameters in
pci_{primary/secondary}_epc_epf_unlink() functions
- md/bitmap: fix GPF in write_page caused by resize race
- nfsd: fix return error code for nfsd_map_name_to_[ug]id
- nvmem: Drop OF node reference on nvmem_add_one_cell() failure
- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
- bus: fsl-mc: fix an error handling in fsl_mc_device_add()
- dm mpath: make pg_init_delay_msecs settable
- tools: Fix bitfield dependency failure
- powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()
- iio: gyro: itg3200: Fix unchecked return value in read_raw
- mm/highmem: fix __kmap_to_page() build error
- rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
- ocfs2: fix reflink preserve cleanup issue
- kexec: derive purgatory entry from symbol
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
SR-IOV"
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
- arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
- btrfs: continue trimming remaining devices on failure
- remoteproc: imx_rproc: Fix invalid loaded resource table detection
- perf/arm-cmn: Reject unsupported hardware configurations
- scsi: ufs: core: Flush exception handling work when RPM level is zero
- usb: dwc3: gadget: Move vbus draw to workqueue context
- usb: dwc2: fix resume failure if dr_mode is host
- mtd: rawnand: pl353: Fix software ECC support
- tipc: fix RCU dereference race in tipc_aead_users_dec()
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
- net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe()
error path
- PCI: Fix pci_slot_trylock() error handling
- parisc: kernel: replace kfree() with put_device() in create_tree_node()
- staging: rtl8723bs: fix null dereference in find_network
- cifs: Fix locking usage for tcon fields
- MIPS: rb532: Fix MMIO UART resource registration
- ceph: supply snapshot context in ceph_zero_partial_object()
- LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE
- LoongArch: Prefer top-down allocation after arch_mem_init()
- LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT
- LoongArch: Disable instrumentation for setup_ptwalker()
- net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
- net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
- octeontx2-af: CGX: fix bitmap leaks
- net: macb: Fix tx/rx malfunction after phy link down and up
- tracing: Fix to set write permission to per-cpu buffer_size_kb
- io_uring/filetable: clamp alloc_hint to the configured alloc range
- net: intel: fix PCI device ID conflict between i40e and ipw2200
- atm: fore200e: fix use-after-free in tasklets during device removal
- ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
- fbcon: check return value of con2fb_acquire_newinfo()
- fbdev: vt8500lcdfb: fix missing dma_free_coherent()
- fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
- fbdev: ffb: fix corrupted video output on Sun FFB1
- fbcon: Remove struct fbcon_display.inverse
- cifs: some missing initializations on replay
- ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
- net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
- net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
- x86/kexec: Copy ACPI root pointer address from config table
- arm64: Force the use of CNTVCT_EL0 in __delay()
- net: nfc: nci: Fix parameter validation for packet data
- tracing: Fix checking of freed trace_event_file for hist files
- tracing: Wake up poll waiters for hist files when removing an event
- NTB: ntb_transport: Fix too small buffer for debugfs_name
- drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
- arm64: Fix sampling the "stable" virtual counter in preemptible section
- gfs2: Fix slab-use-after-free in qd_put
- io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
- thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
- OPP: Return correct value in dev_pm_opp_get_level
- cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
- perf/x86/core: Do not set bit width for unavailable counters
- genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
- platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
- media: pci: mg4b: Use IRQF_NO_THREAD
- firmware: arm_ffa: Correct 32-bit response handling in
NOTIFICATION_INFO_GET
- arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
AD7147
- arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
- arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
- arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models)
- media: chips-media: wave5: Fix memory leak on codec_info allocation
failure
- drm/amd: Drop "amdgpu kernel modesetting enabled" message
- drm/amdkfd: Fix signal_eviction_fence() bool return value
- drm/xe: Unregister drm device on probe error
- HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
- wifi: cfg80211: Fix use_for flag update on BSS refresh
- PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table
- netfilter: nfnetlink_queue: do shared-unconfirmed check before
segmentation
- netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
interval
- power: supply: pm8916_bms_vm: Fix use-after-free in
power_supply_changed()
- power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
- RDMA/mlx5: Fix UMR hang in LAG error state unload
- IB/mlx5: Fix port speed query for representors
- platform/x86/amd/pmf: Prevent TEE errors after hibernate
- crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
- power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
- clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
- clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
- clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
- dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
- iio: pressure: mprls0025pa: fix interrupt flag
- objpool: fix the overestimation of object pooling metadata size
- ipvs: do not keep dest_dst if dev is going down
- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
- AppArmor: Allow apparmor to handle unaligned dfa tables
- apparmor: Fix & Optimize table creation from possibly unaligned memory
- apparmor: avoid per-cpu hold underflow in aa_get_buffer
- drm/amd/display: Fix out-of-bounds stream encoder index v3
- btrfs: use the correct type to initialize block reserve for delayed refs
- Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
- i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
- APEI/GHES: ARM processor Error: don't go past allocated memory
- ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
- powercap: intel_rapl: Add PL4 support for Ice Lake
- alpha: fix user-space corruption during memory compaction
- ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
- ACPI: battery: fix incorrect charging status when current is zero
- perf/x86/msr: Add Airmont NP
- perf/x86/cstate: Add Airmont NP
- bpf: Recognize special arithmetic shift in the verifier
- firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
- gpu/panel-edp: add AUO panel entry for B140HAN06.4
- drm/amdgpu: fix NULL pointer issue buffer funcs
- ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET
- media: chips-media: wave5: Fix conditional in start_streaming
- media: chips-media: wave5: Process ready frames when CMD_STOP sent to
Encoder
- drm/amd/display: Fix dsc eDP issue
- drm/panel: Fix a possible null-pointer dereference in
jdi_panel_dsi_remove()
- media: mt9m114: Avoid a reset low spike during probe()
- media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
- ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
- PCI: Add Intel Nova Lake audio Device ID
- drm/amd/display: Disable FEC when powering down encoders
- drm/amd/display: avoid dig reg access timeout on usb4 link training fail
- hwmon: (dell-smm) Add support for Dell OptiPlex 7080
- HID: logitech-hidpp: Add support for Logitech K980
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference
- spi: geni-qcom: Fix abort sequence execution for serial engine errors
- ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
- wifi: rtw89: 8922a: set random mac if efuse contains zeroes
- wifi: rtw89: ser: enable error IMR after recovering from L1
- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
- wifi: rtw89: mac: correct page number for CSI response
- wifi: ath11k: Fix failure to connect to a 6 GHz AP
- ipv6: annotate data-races over sysctl.flowlabel_reflect
- ext4: use reserved metadata blocks when splitting extent on endio
- Bluetooth: btusb: Add support for MediaTek7920 0489:e158
- net: sfp: add quirk for Lantech 8330-265D
- PCI/AER: Clear stale errors on reporting agents upon probe
- scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
- riscv: vector: init vector context with proper vlenb
- HID: i2c-hid: Add FocalTech FT8112
- 9p/xen: protect xen_9pfs_front_free against concurrent calls
- soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
- most: remove usage of the deprecated ida_simple_xx() API
- most: core: fix resource leak in most_register_interface error paths
- usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
- serial: 8250: 8250_omap.c: Add support for handling UART error
conditions
- mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
- ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
- drm/amd/display: Fix writeback on DCN 3.2+
- drm/amd/display: Fix system resume lag issue
- drm/amd/display: bypass post csc for additional color spaces in dal
- spi: spidev: fix lock inversion between spi_lock and buf_lock
- Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings
- Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too
short
- kcm: fix zero-frag skb in frag_list on partial sendmsg error
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev
- net/mlx5e: Separate address related variables to be in struct
- net/mlx5e: Support routed networks during IPsec MACs initialization
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
- drm/tests: shmem: Swap names of export tests
- KVM: x86: Return "unsupported" instead of "invalid" on access to
unsupported PV MSR
- media: amphion: Drop min_queued_buffers assignment
- media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
- media: i2c: ov01a10: Fix passing stream instead of pad to
v4l2_subdev_state_get_format()
- media: ccs: Fix setting initial sub-device state
- platform/x86: ISST: Add missing write block check
- bus: omap-ocp2scp: fix OF populate on driver rebind
- media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
- drm/buddy: Prevent BUG_ON by validating rounded allocation
- xfs: remove xfs_attr_leaf_hasname
- mfd: qcom-pm8xxx: Fix OF populate on driver rebind
- mfd: omap-usb-host: Fix OF populate on driver rebind
- xfs: fix the xattr scrub to detect freemap/entries array collisions
- pinctrl: intel: Add code name documentation
- vhost: move vdpa group bound check to vhost_vdpa
- clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
- mm/slab: use unsigned long for orig_size to ensure proper metadata align
- drm/amd/display: Increase DCN35 SR enter/exit latency
- drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
- mm: numa_memblks: Identify the accurate NUMA ID of CFMW
- drm/amdgpu: keep vga memory on MacBooks with switchable graphics
- most: core: fix leak on early registration failure
- Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
- Upstream stable to v6.6.128, v6.12.75
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2026-23249
- xfs: check for deleted cursors when revalidating two btrees
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2025-71267
- fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2025-71265
- fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
metadata
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2025-71266
- fs: ntfs3: check return value of indx_find to avoid infinite loop
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2026-23241
- audit: add missing syscalls to read class
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2025-71239
- audit: add fchmodat2() to change attributes class
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2026-31411
- net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2026-23243
- RDMA/umad: Reject negative data_len in ib_umad_write
* Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
CVE-2026-23242
- RDMA/siw: Fix potential NULL pointer dereference in header processing
* Noble update: upstream stable patchset 2026-04-17 (LP: #2148714)
- scsi: qla2xxx: Fix bsg_done() causing double free
- PCI: endpoint: Remove unused field in struct pci_epf_group
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show
functions
- bus: fsl-mc: fix use-after-free in driver_override_show()
- ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock
- ALSA: hda/realtek: Add quirk for Inspur S14-G1
- ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
- romfs: check sb_set_blocksize() return value
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used
- platform/x86: classmate-laptop: Add missing NULL pointer checks
- ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
- ASoC: amd: yc: Add quirk for HP 200 G2a 16
- platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path
- ASoC: cs42l43: Correct handling of 3-pole jack load detection
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
- gpiolib: acpi: Fix gpio count with string references
- LoongArch: Rework KASAN initialization for PTW-enabled systems
- Revert "wireguard: device: enable threaded NAPI"
- mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
- mm/hugetlb: fix hugetlb_pmd_shared()
- mm/hugetlb: fix two comments related to huge_pmd_unshare()
- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using
mmu_gather
- cpuset: Fix missing adaptation for cpuset_is_populated
- LoongArch: Add writecombine support for DMW-based ioremap()
- fbdev: rivafb: fix divide error in nv3_arb()
- fbdev: smscufx: properly copy ioctl memory to kernelspace
- f2fs: fix to add gc count stat in f2fs_gc_range
- f2fs: fix out-of-bounds access in sysfs attribute read/write
- f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent
atomic commit and checkpoint writes
- f2fs: fix to avoid UAF in f2fs_write_end_io()
- f2fs: fix to avoid mapping wrong physical block for swapfile
- USB: serial: option: add Telit FN920C04 RNDIS compositions
- bnxt_en: Change FW message timeout warning
- bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code
- ALSA: hda/realtek: Enable headset mic for Acer Nitro 5
- drm/amd/display: remove assert around dpp_base replacement
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
- Upstream stable to v6.6.126, v6.6.127, v6.12.73, v6.12.74
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260)
- Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
- crypto: octeontx - Fix length check to avoid truncation in
ucode_load_store
- crypto: virtio - Remove duplicated virtqueue_kick in
virtio_crypto_skcipher_crypt_req
- scsi: qla2xxx: Allow recovery for tape devices
- scsi: qla2xxx: Query FW again before proceeding with login
- Revert "netfilter: nf_tables: missing objects with no memcg accounting"
- netfilter: nf_tables: missing objects with no memcg accounting
- vsock/test: verify socket options after setting them
- selftests: mptcp: pm: ensure unknown flags are ignored
- gpio: omap: do not register driver in probe()
- net: tunnel: make skb_vlan_inet_prepare() return drop reasons
- Upstream stable to v6.6.125, v6.12.71, v6.12.72
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2025-71233
- PCI: endpoint: Avoid creating sub-groups asynchronously
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2025-71231
- crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2026-23169
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2025-40005
- spi: cadence-quadspi: Implement refcount to handle unbind during busy
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2025-71232
- scsi: qla2xxx: Free sp in error path to fix system crash
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2025-71235
- scsi: qla2xxx: Delay module unload while fabric scan in progress
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2025-71236
- scsi: qla2xxx: Validate sp before freeing associated memory
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2025-71229
- wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2025-71237
- nilfs2: Fix potential block overflow that cause system hang
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2026-23229
- crypto: virtio - Add spinlock protection with virtqueue notification
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2026-23222
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2026-23228
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2026-23220
- ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
paths
* Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
CVE-2026-23230
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races
* CVE-2026-23272
- netfilter: nf_tables: unconditionally bump set->nelems before insertion
* CVE-2026-31418
- netfilter: ipset: drop logically empty buckets in mtype_del
* CVE-2026-23392
- netfilter: nf_tables: release flowtable after rcu grace period on error
* CVE-2026-23278
- netfilter: nf_tables: always walk all pending catchall elements
* GRO managed-frag use-after-free leading to local privilege escalation
(LP: #2154172)
- net: gro: don't merge zcopy skbs
* AppArmor Vulnerabilities (LP: #2151747)
- apparmor: Fix incorrect profile->signal range check
- SAUCE: apparmor: pass big_resp to handler
- SAUCE: apparmor: remove redundant kref_init for listener->count
- SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47337
- SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47336
- SAUCE: apparmor: fix use of unintialized variable in net opt level
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47335
- SAUCE: apparmor: fix possible NULL pointer dereference by adding a NULL
check
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47334
- SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47333
- SAUCE: apparmor: fix dfa unpacking size of the notification filter
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47332
- SAUCE: apparmor: fix size check against type instead of pointer
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47331
- SAUCE: apparmor: fix changing rules list without a lock
* apparmor: LLVM/clang build failure due to uninitialized variable in
notify.c (LP: #2148809) // CVE-2026-47330
- SAUCE: apparmor: initialize variable used in uninitialized context
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47329
- SAUCE: apparmor: fix name validation bypass on notification
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47327 //
CVE-2026-47328
- SAUCE: apparmor: fix glob memory leak after kstrdup
* AppArmor Vulnerabilities (LP: #2151747) // CVE-2026-47326
- SAUCE: apparmor: fix inverted NULL check after aa_get_buffer
* CVE-2026-46300
- net: skbuff: preserve shared-frag marker during coalescing
- net: skbuff: propagate shared-frag marker through frag-transfer helpers
* net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
- net/rds: reset op_nents when zerocopy page pin fails
* CVE-2026-46333
- ptrace: slightly saner 'get_dumpable()' logic
* CVE-2026-43500
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
- rxrpc: Parse received packets before dealing with timeouts
- rxrpc: Fix potential UAF after skb_unshare() failure
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
* CVE-2026-31676 // CVE-2026-43500
- rxrpc: only handle RESPONSE during service challenge
* CVE-2026-43284
- xfrm: esp: avoid in-place decrypt on shared skb frags
* CVE-2026-31419
- net: bonding: fix use-after-free in bond_xmit_broadcast()
* CVE-2026-31431
- crypto: scatterwalk - Backport memcpy_sglist()
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher
- crypto: algif_aead - Revert to operating out-of-place
- crypto: algif_aead - snapshot IV for async AEAD requests
- crypto: authenc - use memcpy_sglist() instead of null skcipher
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place
decryption
- crypto: authencesn - Fix src offset when decrypting in-place
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
- crypto: algif_aead - Fix minimum RX size check for decryption
* CVE-2026-31533
- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
* CVE-2026-31504
- net: fix fanout UAF in packet_release() via NETDEV_UP race
Date: 2026-06-29 09:45:12.851431+00:00
Changed-By: Alessio Faina <alessio.faina at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux-ibm/6.8.0-1060.61
-------------- next part --------------
Sorry, changesfile not available.
More information about the noble-changes
mailing list