[ubuntu/plucky-proposed] linux 6.14.0-34.34 (Accepted)
Andy Whitcroft
apw at canonical.com
Mon Sep 22 16:41:09 UTC 2025
linux (6.14.0-34.34) plucky; urgency=medium
* plucky/linux: 6.14.0-34.34 -proposed tracker (LP: #2123945)
* [25.04 FEAT] [post announcement] [KRN2304] CPU-MF Counters for new IBM Z
hardware - perf part (LP: #2103415)
- perf list: Add IBM z17 event descriptions
* Kernel fails to build when coresight is enabled (LP: #2122527)
- Coresight: Introduce a new struct coresight_path
- Coresight: Change functions to accept the coresight_path
- coresight: change coresight_device lock type to raw_spinlock_t
* memory leaks when configuring a small rate limit in audit (LP: #2122554)
- audit: fix skb leak when audit rate limit is exceeded
* [UBUNTU 24.04] s390/pci: Don't abort recovery for user-space drivers
(LP: #2121150)
- s390/pci: Allow automatic recovery with minimal driver support
* [AMDGPU] Call trace occurs when unplugging a HDMI/DP/VGA cable on Dell
platforms (LP: #2116908)
- drm/amd/display: limit clear_update_flags to dcn32 and above
- drm/amd/display: Allow DCN301 to clear update flags
* sources list generation using dwarfdump takes up to 0.5hr in build process
(LP: #2104911)
- [Packaging] Don't generate list of source files
* [SRU] Apparmor: Unshifted uids for hardlinks and unix sockets in user
namespaces (LP: #2121257)
- apparmor: shift ouid when mediating hard links in userns
- apparmor: shift uid when mediating af_unix in userns
* Plucky update: upstream stable patchset 2025-09-04 (LP: #2122072)
- rtc: pcf2127: add missing semicolon after statement
- rtc: pcf2127: fix SPI command byte for PCF2131
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt
- virtio-net: xsk: rx: fix the frame's length check
- virtio-net: ensure the received length does not exceed allocated size
- net: txgbe: request MISC IRQ in ndo_open
- vsock/vmci: Clear the vmci transport packet properly when initializing
it
- net: libwx: fix the incorrect display of the queue number
- mmc: sdhci: Add a helper function for dump register in dynamic debug
mode
- Revert "mmc: sdhci: Disable SD card clock before changing parameters"
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
- Bluetooth: HCI: Set extended advertising data synchronously
- Bluetooth: hci_sync: revert some mesh modifications
- Bluetooth: MGMT: set_mesh: update LE scan interval and window
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
- Input: cs40l50-vibra - fix potential NULL dereference in
cs40l50_upload_owt()
- usb: typec: altmodes/displayport: do not index invalid pin_assignments
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
- mtk-sd: Prevent memory corruption from DMA map failure
- mtk-sd: reset host->mrq on prepare_data() error
- drm/v3d: Disable interrupts before resetting the GPU
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node
- firmware: arm_ffa: Move memory allocation outside the mutex locking
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic
context
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
- scsi: sd: Fix VPD page 0xb7 length check
- scsi: ufs: core: Fix spelling of a sysfs attribute name
- RDMA/mlx5: Fix HW counters query for non-representor devices
- RDMA/mlx5: Fix CC counters query for MPV
- RDMA/mlx5: Fix vport loopback for MPV device
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
- Bluetooth: Prevent unintended pause by checking if advertising is active
- btrfs: fix missing error handling when searching for inode refs during
log replay
- btrfs: fix iteration of extrefs during log replay
- btrfs: return a btrfs_inode from btrfs_iget_logging()
- btrfs: return a btrfs_inode from read_one_inode()
- btrfs: fix invalid inode pointer dereferences during log replay
- btrfs: fix inode lookup error handling during log replay
- btrfs: record new subvolume in parent dir earlier to avoid dir logging
races
- btrfs: propagate last_unlink_trans earlier when doing a rmdir
- btrfs: use btrfs_record_snapshot_destroy() during rmdir
- ethernet: atl1: Add missing DMA mapping error checks and count errors
- dpaa2-eth: fix xdp_rxq_info leak
- drm/exynos: fimd: Guard display clock control with runtime PM calls
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer
- drm/i915/selftests: Change mock_request() to return error pointers
- nvme: Fix incorrect cdw15 value in passthru error logging
- nvmet: fix memory leak of bio integrity
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs
callbacks
- platform/x86: hp-bioscfg: Fix class device unregistration
- platform/x86: think-lmi: Fix class device unregistration
- platform/x86: dell-wmi-sysman: Fix class device unregistration
- platform/mellanox: mlxreg-lc: Fix logic error in power state check
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
- drm/i915/gt: Fix timeline left held on VMA alloc error
- drm/i915/gsc: mei interrupt top half should be in irq disabled context
- idpf: return 0 size for RSS key if not supported
- idpf: convert control queue mutex to a spinlock
- igc: disable L1.2 PCI-E link substate to avoid performance issue
- smb: client: set missing retry flag in smb2_writev_callback()
- smb: client: set missing retry flag in cifs_readv_callback()
- smb: client: set missing retry flag in cifs_writev_callback()
- netfs: Fix i_size updating
- lib: test_objagg: Set error message in check_expect_hints_stats()
- amd-xgbe: align CL37 AN sequence as per databook
- enic: fix incorrect MTU comparison in enic_change_mtu()
- rose: fix dangling neighbour pointers in rose_rt_device_down()
- nui: Fix dma_mapping_error() check
- amd-xgbe: do not double read link status
- smb: client: fix race condition in negotiate timeout by using more
precise timing
- crypto: iaa - Remove dst_null support
- crypto: iaa - Do not clobber req->base.data
- kunit: qemu_configs: sparc: use Zilog console
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC
- gfs2: Decode missing glock flags in tracepoints
- gfs2: Add GLF_PENDING_REPLY flag
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE
- gfs2: deallocate inodes in gfs2_create_inode
- btrfs: prepare btrfs_page_mkwrite() for large folios
- btrfs: fix wrong start offset for delalloc space release during mmap
write
- ASoC: tas2764: Extend driver to SN012776
- ASoC: tas2764: Reinit cache on part reset
- ACPI: thermal: Fix stale comment regarding trip points
- ACPI: thermal: Execute _SCP before reading trip points
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup"
bug
- sched_ext: Make scx_group_set_weight() always update tg->scx.weight
- drm/msm: Fix a fence leak in submit error path
- drm/msm: Fix another leak in the submit error path
- ALSA: sb: Don't allow changing the DMA mode during operations
- ALSA: sb: Force to disable DMAs once when DMA mode is changed
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
- ata: pata_cs5536: fix build on 32-bit UML
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks
list
- genirq/irq_sim: Initialize work context pointers properly
- powerpc: Fix struct termio related ioctl macros
- ASoC: amd: yc: update quirk data for HP Victus
- regulator: fan53555: add enable_time support and soft-start times
- scsi: target: Fix NULL pointer dereference in
core_scsi3_decode_spec_i_port()
- aoe: defer rexmit timer downdev work to workqueue
- wifi: mac80211: drop invalid source address OCB frames
- wifi: ath6kl: remove WARN on bad firmware input
- ACPICA: Refuse to evaluate a method if arguments are missing
- mtd: spinand: fix memory leak of ECC engine conf
- rcu: Return early if callback is not specified
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
- RDMA/mlx5: Fix cache entry update on dereg error
- IB/mlx5: Fix potential deadlock in MR deregistration
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper"
- usb: xhci: quirk for data loss in ISOC transfers
- xhci: dbctty: disable ECHO flag by default
- xhci: dbc: Flush queued requests before stopping dbc
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
- Input: xpad - support Acer NGR 200 Controller
- Input: iqs7222 - explicitly define number of external channels
- usb: cdnsp: do not disable slot for disabled slot
- usb: cdnsp: Fix issue with CV Bad Descriptor test
- usb: dwc3: Abort suspend on soft disconnect failure
- usb: chipidea: udc: disconnect/reconnect from host when do
suspend/resume
- usb: acpi: fix device link removal
- smb: client: fix readdir returning wrong type with POSIX extensions
- cifs: all initializations for tcon should happen in tcon_info_alloc
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2
- i2c/designware: Fix an initialization issue
- Logitech C-270 even more broken
- optee: ffa: fix sleep in atomic context
- iommu/rockchip: prevent iommus dead loop when two masters share one
IOMMU
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be
changed
- riscv: cpu_ops_sbi: Use static array for boot_data
- platform/x86: think-lmi: Create ksets consecutively
- platform/x86: think-lmi: Fix kobject cleanup
- platform/x86: think-lmi: Fix sysfs group cleanup
- mm/vmalloc: fix data race in show_numa_info()
- x86/bugs: Rename MDS machinery to something more generic
- x86/microcode/AMD: Add TSA microcode SHAs
- x86/process: Move the buffer clearing before MONITOR
- iommufd/selftest: Add missing close(mfd) in memfd_mmap()
- iommufd/selftest: Add asserts testing global mfd
- xfs: actually use the xfs_growfs_check_rtgeom tracepoint
- mmc: sdhci-uhs2: Adjust some error messages and register dump for SD
UHS-II card
- mmc: core: Adjust some error messages for SD UHS-II cards
- RDMA/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup
- scsi: core: Enforce unlimited max_segment_size when virt_boundary_mask
is set
- btrfs: fix failure to rebuild free space tree using multiple
transactions
- nvme-pci: refresh visible attrs after being checked
- drm/bridge: panel: move prepare_prev_first handling to
drm_panel_bridge_add_typed
- netfs: Fix hang due to missing case in final DIO read result collection
- netfs: Fix looping in wait functions
- netfs: Fix ref leak on inserted extra subreq in write retry
- drm/xe/guc: Enable w/a 16026508708
- drm/xe/guc_pc: Add _locked variant for min/max freq
- drm/xe: Split xe_device_td_flush()
- drm/xe/bmg: Update Wa_14022085890
- drm/xe/bmg: Update Wa_22019338487
- net: ipv4: fix stat increase when udp early demux drops the packet
- smb: client: fix native SMB symlink traversal
- netfs: Fix double put of request
- drm/xe: Allow dropping kunit dependency as built-in
- x86/platform/amd: move final timeout check to after final sleep
- usb: dwc3: gadget: Fix TRB reclaim logic for short transfers and ZLPs
- dt-bindings: i2c: realtek,rtl9301: Fix missing 'reg' constraint
- x86/bugs: Add a Transient Scheduler Attacks mitigation
- [Config] Enable MITIGATION_TSA
- KVM: x86: Sort CPUID_8000_0021_EAX leaf bits properly
- KVM: SVM: Advertise TSA CPUID bits to guests
- Upstream stable to v6.12.37, v6.15.6
* [UBUNTU 24.04] s390/pci: Fix stale function handles in error handling
(LP: #2121149) // Plucky update: upstream stable patchset 2025-09-04
(LP: #2122072)
- s390/pci: Fix stale function handles in error handling
- s390/pci: Do not try re-enabling load/store if device is disabled
* Plucky update: upstream stable patchset 2025-08-22 (LP: #2121266)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request
- cifs: Fix cifs_query_path_info() for Windows NT servers
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE
mode
- NFSv4: Always set NLINK even if the server doesn't support it
- NFSv4.2: fix listxattr to return selinux security label
- NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps
are delegated
- mailbox: Not protect module_put with spin_lock_irqsave
- mfd: max14577: Fix wakeup source leaks on device unbind
- sunrpc: don't immediately retransmit on seqno miss
- dm vdo indexer: don't read request structure after enqueuing
- leds: multicolor: Fix intensity setting while SW blinking
- fuse: fix race between concurrent setattrs from multiple nodes
- cxl/region: Add a dev_err() on missing target list entries
- NFSv4: xattr handlers should check for absent nfs filehandles
- hwmon: (pmbus/max34440) Fix support for max34451
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix
extension
- ksmbd: provide zero as a unique ID to the Mac client
- rust: module: place cleanup_module() in .exit.text section
- rust: arm: fix unknown (to Clang) argument '-mno-fdpic'
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq
driver before using
- dmaengine: xilinx_dma: Set dma_device directions
- PCI: dwc: Make link training more robust by setting
PORT_LOGIC_LINK_WIDTH to one lane
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
- PCI: imx6: Add workaround for errata ERR051624
- nvme-tcp: fix I/O stalls on congested sockets
- nvme-tcp: sanitize request list handling
- md/md-bitmap: fix dm-raid max_write_behind setting
- amd/amdkfd: fix a kfd_process ref leak
- bcache: fix NULL pointer in cache_set_flush()
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock
- drm/scheduler: signal scheduled fence when kill job
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
- um: use proper care when taking mmap lock during segfault
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0
and later devices
- coresight: Only check bottom two claim bits
- usb: dwc2: also exit clock_gating when stopping udc while suspended
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
- usb: potential integer overflow in usbg_make_tpg()
- tty: serial: uartlite: register uart driver in init
- usb: common: usb-conn-gpio: use a unique name for usb connector device
- usb: Add checks for snprintf() calls in usb_alloc_dev()
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
- usb: gadget: f_hid: wake up readers on disable/unbind
- usb: typec: displayport: Receive DP Status Update NAK request exit dp
altmode
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
- riscv: add a data fence for CMODX in the kernel mode
- ALSA: hda: Ignore unsol events for cards being shut down
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
- ASoC: rt1320: fix speaker noise when volume bar is 100%
- ceph: fix possible integer overflow in ceph_zero_objects()
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan
- ovl: Check for NULL d_inode() in ovl_dentry_upper()
- btrfs: handle csum tree error with rescue=ibadroots correctly
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
- btrfs: factor out nocow ordered extent and extent map generation into a
helper
- btrfs: use unsigned types for constants defined as bit shifts
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent
- fs/jfs: consolidate sanity checking in dbMount
- jfs: validate AG parameters in dbMount() to prevent crashes
- ASoC: codec: wcd9335: Convert to GPIO descriptors
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies
- f2fs: don't over-report free space or inodes in statvfs
- PCI: apple: Use helper function for_each_child_of_node_scoped()
- PCI: apple: Set only available ports up
- accel/ivpu: Add debugfs interface for setting HWS priority bands
- accel/ivpu: Trigger device recovery on engine reset/resume failure
- af_unix: Don't leave consecutive consumed OOB skbs.
- i2c: tiny-usb: disable zero-length read messages
- i2c: robotfuzz-osif: disable zero-length read messages
- smb: client: remove \t from TP_printk statements
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path
on write
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
- s390/pkey: Prevent overflow in size calculation for memdup_user()
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
- Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"
- drm/xe/display: Add check for alloc_ordered_workqueue()
- HID: wacom: fix crash in wacom_aes_battery_handler()
- atm: clip: prevent NULL deref in clip_push()
- Bluetooth: hci_core: Fix use-after-free in vhci_flush()
- ALSA: usb-audio: Fix out-of-bounds read in
snd_usb_get_audioformat_uac3()
- attach_recursive_mnt(): do not lock the covering tree when sliding
something under it
- libbpf: Fix null pointer dereference in btf_dump__free on allocation
failure
- ethernet: ionic: Fix DMA mapping tests
- wifi: mac80211: fix beacon interval calculation overflow
- af_unix: Don't set -ECONNRESET for consumed OOB skb.
- wifi: mac80211: Add link iteration macro for link data
- wifi: mac80211: Create separate links for VLAN interfaces
- wifi: mac80211: finish link init before RCU publish
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
- bnxt: properly flush XDP redirect lists
- um: ubd: Add missing error check in start_io_thread()
- libbpf: Fix possible use-after-free for externs
- net: enetc: Correct endianness handling in _enetc_rd_reg64
- netlink: specs: tc: replace underscores with dashes in names
- atm: Release atm_dev_mutex after removing procfs in
atm_dev_deregister().
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
- net: selftests: fix TCP packet checksum
- drm/amdgpu/discovery: optionally use fw based ip discovery
- drm/amd: Adjust output for discovery error handling
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
- drm/xe: Process deferred GGTT node removals on device unwind
- smb: client: fix potential deadlock when reconnecting channels
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions
- smb: client: make use of common smbdirect_pdu.h
- smb: smbdirect: add smbdirect.h with public structures
- smb: smbdirect: add smbdirect_socket.h
- smb: client: make use of common smbdirect_socket
- smb: smbdirect: introduce smbdirect_socket_parameters
- smb: client: make use of common smbdirect_socket_parameters
- cifs: Fix the smbd_response slab to allow usercopy
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
- x86/traps: Initialize DR6 by writing its architectural reset value
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
- serial: core: restore of_node information in sysfs
- serial: imx: Restore original RXTL for console to fix data loss
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation
- dm-raid: fix variable in journal device check
- btrfs: fix a race between renames and directory logging
- btrfs: update superblock's device bytes_used when dropping chunk
- spi: spi-cadence-quadspi: Fix pm runtime unbalance
- net: libwx: fix the creation of page_pool
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
- f2fs: fix to zero post-eof page
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
- HID: wacom: fix memory leak on kobject creation failure
- HID: wacom: fix memory leak on sysfs attribute creation failure
- HID: wacom: fix kobject reference count leak
- scsi: megaraid_sas: Fix invalid node index
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
- drm/ast: Fix comment on modeset lock
- drm/etnaviv: Protect the scheduler's pending list with its lock
- drm/tegra: Assign plane type before registration
- drm/tegra: Fix a possible null pointer dereference
- drm/udl: Unregister device before cleaning up on disconnect
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot
- drm/amdkfd: Fix race in GWS queue scheduling
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so
- drm/bridge: cdns-dsi: Fix connecting to next bridge
- drm/bridge: cdns-dsi: Check return value when getting default PHY config
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
- drm/amd/display: Add null pointer check for get_first_active_display()
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
- drm/amd/display: Correct non-OLED pre_T11_delay.
- drm/xe/vm: move rebind_work init earlier
- drm/xe/guc_submit: add back fix
- drm/amd/display: Fix RMCM programming seq errors
- drm/amdgpu: Add kicker device detection
- drm/amd/display: Check dce_hwseq before dereferencing it
- drm/xe: Fix memset on iomem
- drm/xe: Fix taking invalid lock on wedge
- drm/xe: Fix early wedge on GuC load failure
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
- drm/amdgpu: switch job hw_fence to amdgpu_fence
- drm/amd/display: Fix mpv playback corruption on weston
- media: uvcvideo: Rollback non processed entities on error
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
- x86/pkeys: Simplify PKRU update in signal frame
- io_uring: fix potential page leak in io_sqe_buffer_register()
- io_uring/rsrc: fix folio unpinning
- io_uring/net: mark iov as dynamically allocated even for single segments
- mm/vma: reset VMA iterator on commit_merge() OOM failure
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA
- mfd: max77541: Fix wakeup source leaks on device unbind
- mfd: 88pm886: Fix wakeup source leaks on device unbind
- mfd: sprd-sc27xx: Fix wakeup source leaks on device unbind
- hwmon: (isl28022) Fix current reading calculation
- cxl: core/region - ignore interleave granularity when ways=1
- bus: mhi: host: pci_generic: Add Telit FN920C04 modem support
- iio: dac: adi-axi-dac: add cntrl chan check
- iio: adc: ad7606_spi: check error in ad7606B_sw_mode_config()
- iio: hid-sensor-prox: Add support for 16-bit report size
- usb: typec: tcpci: Fix wakeup source leaks on device unbind
- usb: typec: tipd: Fix wakeup source leaks on device unbind
- s390/mm: Fix in_atomic() handling in do_secure_storage_access()
- riscv: misaligned: declare misaligned_access_speed under
CONFIG_RISCV_MISALIGNED
- riscv: save the SR_SUM status over switches
- media: uvcvideo: Keep streaming state in the file handle
- media: uvcvideo: Create uvc_pm_(get|put) functions
- media: uvcvideo: Increase/decrease the PM counter per IOCTL
- drm/i915/display: Add check for alloc_ordered_workqueue() and
alloc_workqueue()
- i2c: imx: fix emulated smbus block read
- LoongArch: KVM: Avoid overflow with array index
- LoongArch: KVM: Check validity of "num_cpu" from user space
- LoongArch: KVM: Disable updating of "num_cpu" and "feature"
- LoongArch: KVM: Add address alignment check for IOCSR emulation
- LoongArch: KVM: Fix interrupt route update with EIOINTC
- LoongArch: KVM: Check interrupt route from physical CPU
- scripts/gdb: fix dentry_name() lookup
- smb: client: fix regression with native SMB symlinks
- riscv: vector: Fix context save/restore with xtheadvector
- riscv: export boot_cpu_hartid
- io_uring/rsrc: don't rely on user vaddr alignment
- drm/amd/display: Add sanity checks for drm_edid_raw()
- drm/xe: Move DSB l2 flush to a more sensible place
- drm/xe: move DPT l2 flush to a more sensible place
- HID: Intel-thc-hid: Intel-quicki2c: Enhance QuickI2C reset flow
- scsi: fnic: Fix missing DMA mapping error in fnic_send_frame()
- nvme: refactor the atomic write unit detection
- nvme: fix atomic write size validation
- drm/xe/guc: Explicitly exit CT safe mode on unwind
- bcache: remove unnecessary select MIN_HEAP
- Revert "bcache: update min_heap_callbacks to use default builtin swap"
- Revert "bcache: remove heap-related macros and switch to generic
min_heap"
- selinux: change security_compute_sid to return the ssid or tsid on match
- mm: userfaultfd: fix race of userfaultfd_move and swap cache
- mm/shmem, swap: fix softlockup with mTHP swapin
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out
- scsi: fnic: Turn off FDMI ACTIVE flags on link down
- drm/cirrus-qemu: Fix pitch programming
- drm/panel: simple: Tianma TM070JDHG34-00: add delays
- drm/simpledrm: Do not upcast in release helpers
- drm/i915/ptl: Use everywhere the correct DDI port clock select mask
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after
SINK_COUNT_ESI read
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees
- drm/amd/display: Add dc cap for dp tunneling
- Revert "UBUNTU: SAUCE: arm64: dts: qcom: x1e80100-crd: mark l12b and
l15b always-on"
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on
- Revert "UBUNTU: SAUCE: arm64: dts: qcom: x1e78100-t14s: mark l12b and
l15b always-on"
- arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
- crypto: powerpc/poly1305 - add depends on BROKEN for now
- [Config] Disable CRYPTO_POLY1305_P10
- drm/amdgpu/mes: add missing locking in helper functions
- Revert "UBUNTU: SAUCE: arm64: dts: qcom: x1e78100-t14s: fix missing HID
supplies"
- arm64: dts: qcom: x1e78100-t14s: fix missing HID supplies
- drm/amd/display: Add early 8b/10b channel equalization test pattern
sequence
- drm/amd/display: Get LTTPR IEEE OUI/Device ID From Closest LTTPR To Host
- rust: completion: implement initial abstraction
- rust: revocable: indicate whether `data` has been revoked already
- rust: devres: fix race in Devres::drop()
- rust: devres: do not dereference to the internal Revocable
- io_uring/kbuf: flag partial buffer mappings
- riscv: uaccess: Only restore the CSR_STATUS SUM bit
- drm/amd/display: Add debugging message for brightness caps
- drm/amd/display: Fix default DC and AC levels
- drm/amd/display: Only read ACPI backlight caps once
- usb: typec: displayport: Fix potential deadlock
- NFSv4.2: another fix for listxattr
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
- nvme: revert the cross-controller atomic write size validation
- scripts: gdb: vfs: support external dentry names
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
- Upstream stable to v6.12.36, v6.15.5
* Plucky update: upstream stable patchset 2025-08-18 (LP: #2120812)
- configfs: Do not override creating attribute file failure in
populate_attrs()
- crypto: marvell/cesa - Do not chain submitted requests
- gfs2: move msleep to sleepable context
- crypto: qat - add shutdown handler to qat_c3xxx
- crypto: qat - add shutdown handler to qat_420xx
- crypto: qat - add shutdown handler to qat_4xxx
- crypto: qat - add shutdown handler to qat_c62x
- crypto: qat - add shutdown handler to qat_dh895xcc
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
- ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in
create_sdw_dailinks()
- io_uring: account drain memory to cgroup
- io_uring/kbuf: account ring io_buffer_list memory
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power
states
- regulator: max20086: Fix MAX200086 chip id
- regulator: max20086: Change enable gpio to optional
- net/mlx5_core: Add error handling
inmlx5_query_nic_vport_qkey_viol_cntr()
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
- wifi: mt76: mt7925: fix host interrupt register initialization
- wifi: ath11k: fix rx completion meta data corruption
- wifi: rtw88: usb: Upload the firmware in bigger chunks
- Revert "UBUNTU: SAUCE: wifi: ath11k: fix ring-buffer corruption"
- wifi: ath11k: fix ring-buffer corruption
- NFSD: unregister filesystem in case genl_register_family() fails
- NFSD: fix race between nfsd registration and exports_proc
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
- NFSv4: Don't check for OPEN feature support in v4.1
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
- Revert "UBUNTU: SAUCE: wifi: ath12k: fix ring-buffer corruption"
- wifi: ath12k: fix ring-buffer corruption
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
- svcrdma: Unregister the device if svc_rdma_accept() fails
- wifi: rtw88: usb: Reduce control message timeout to 500 ms
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
- media: ov8856: suppress probe deferral errors
- media: ov5675: suppress probe deferral errors
- media: imx335: Use correct register width for HNUM
- media: nxp: imx8-isi: better handle the m2m usage_count
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
- media: cxusb: no longer judge rbuf when the write fails
- media: davinci: vpif: Fix memory leak in probe error path
- media: gspca: Add error handling for stv06xx_read_sensor()
- media: i2c: imx335: Fix frame size enumeration
- media: imagination: fix a potential memory leak in e5010_probe()
- media: intel/ipu6: Fix dma mask for non-secure mode
- media: ipu6: Remove workaround for Meteor Lake ES2
- media: mediatek: vcodec: Correct vsi_core framebuffer size
- media: omap3isp: use sgtable-based scatterlist wrappers
- media: v4l2-dev: fix error handling in __video_register_device()
- media: venus: Fix probe error handling
- media: videobuf2: use sgtable-based scatterlist wrappers
- media: vidtv: Terminating the subsequent process of initialization
failure
- media: vivid: Change the siize of the composing
- media: imx-jpeg: Drop the first error frames
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
- media: imx-jpeg: Reset slot data pointers when freed
- media: imx-jpeg: Cleanup after an allocation error
- media: uvcvideo: Return the number of processed controls
- media: uvcvideo: Send control events for partial succeeds
- media: uvcvideo: Fix deferred probing error
- arm64/mm: Close theoretical race where stale TLB entry remains valid
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
- ASoC: codecs: wcd9375: Fix double free of regulator supplies
- ASoC: codecs: wcd937x: Drop unused buck_supply
- block: use plug request list tail for one-shot backmerge attempt
- block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
- bus: mhi: ep: Update read pointer only after buffer is written
- bus: mhi: host: Fix conflict between power_up and SYSERR
- can: kvaser_pciefd: refine error prone echo_skb_max handling logic
- can: tcan4x5x: fix power regulator retrieval during probe
- ceph: avoid kernel BUG for encrypted inode with unaligned file size
- ceph: set superblock s_magic for IMA fsmagic matching
- cgroup,freezer: fix incomplete freezing when attaching tasks
- bus: firewall: Fix missing static inline annotations for stubs
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
- ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
- ata: ahci: Disallow LPM for Asus B550-F motherboard
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
- bus: fsl-mc: fix GET/SET_TAILDROP command ids
- ext4: inline: fix len overflow in ext4_prepare_inline_data
- ext4: fix calculation of credits for extent tree modification
- ext4: factor out ext4_get_maxbytes()
- ext4: ensure i_size is smaller than maxbytes
- ext4: only dirty folios when data journaling regular files
- Input: ims-pcu - check record size in ims_pcu_flash_firmware()
- Input: gpio-keys - fix possible concurrent access in
gpio_keys_irq_timer()
- f2fs: fix to do sanity check on ino and xnid
- f2fs: prevent kernel warning due to negative i_nlink from corrupted
image
- f2fs: fix to do sanity check on sit_bitmap_size
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
- NFC: nci: uart: Set tty->disc_data only in success path
- net/sched: fix use-after-free in taprio_dev_notifier
- net: ftgmac100: select FIXED_PHY
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in
fb_videomode_to_var
- EDAC/altera: Use correct write width with the INTTEST register
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
- parisc/unaligned: Fix hex output to show 8 hex chars
- vgacon: Add check for vc_origin address range in vgacon_scroll()
- parisc: fix building with gcc-15
- clk: meson-g12a: add missing fclk_div2 to spicc
- ipc: fix to protect IPCS lookups using RCU
- watchdog: fix watchdog may detect false positive of softlockup
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
- mm: fix ratelimit_pages update error in dirty_ratio_handler()
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
- configfs-tsm-report: Fix NULL dereference of tsm_ops
- firmware: arm_scmi: Ensure that the message-id supports fastchannel
- mtd: rawnand: sunxi: Add randomizer configuration in
sunxi_nfc_hw_ecc_write_chunk
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
- KVM: VMX: Flush shadow VMCS on emergency reboot
- dm-mirror: fix a tiny race condition
- dm-verity: fix a memory leak if some arguments are specified multiple
times
- mtd: rawnand: qcom: Fix read len for onfi param page
- ftrace: Fix UAF when lookup kallsym after ftrace disabled
- dm: lock limits when reading them
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
- net: ch9200: fix uninitialised access during mii_nway_restart
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
- sysfb: Fix screen_info type check for VGA
- video: screen_info: Relocate framebuffers behind PCI bridges
- pwm: axi-pwmgen: fix missing separate external clock
- staging: iio: ad5933: Correct settling cycles encoding per datasheet
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
- ovl: Fix nested backing file paths
- regulator: max14577: Add error check for max14577_read_reg()
- remoteproc: core: Cleanup acquired resources when
rproc_handle_resources() fails in rproc_attach()
- remoteproc: core: Release rproc->clean_table after rproc_attach() fails
- remoteproc: k3-m4: Don't assert reset in detach routine
- cifs: reset connections for all channels when reconnect requested
- cifs: update dstaddr whenever channel iface is updated
- cifs: dns resolution is needed only for primary channel
- smb: client: add NULL check in automount_fullpath
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page
boundary
- uio_hv_generic: Use correct size for interrupt and monitor pages
- uio_hv_generic: Align ring size to system page
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback
- PCI: Add ACS quirk for Loongson PCIe
- PCI: Fix lock symmetry in pci_slot_unlock()
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from
rockchip_pcie_link_up()
- PCI: dw-rockchip: Fix PHY function call sequence in
rockchip_pcie_phy_deinit()
- iio: accel: fxls8962af: Fix temperature scan element sign
- accel/ivpu: Improve buffer object logging
- accel/ivpu: Use firmware names from upstream repo
- accel/ivpu: Use dma_resv_lock() instead of a custom mutex
- accel/ivpu: Fix warning in ivpu_gem_bo_free()
- dummycon: Trigger redraw when switching consoles with deferred takeover
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
- iio: imu: inv_icm42600: Fix temperature calculation
- iio: adc: ad7944: mask high bits on direct read
- iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
- iio: adc: ad7606_spi: fix reg write value mask
- ACPICA: fix acpi operand cache leak in dswstate.c
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification
- power: supply: collie: Fix wakeup source leaks on device unbind
- mmc: Add quirk to disable DDR50 tuning
- ACPICA: Avoid sequence overread in call to strncmp()
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
- ASoC: intel/sdw_utils: Assign initial value in
asoc_sdw_rt_amp_spk_rtd_init()
- ACPI: bus: Bail out if acpi_kobj registration fails
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
- ACPICA: fix acpi parse and parseext cache leaks
- ACPICA: Apply pack(1) to union aml_resource
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios
laptops
- power: supply: bq27xxx: Retrieve again when busy
- pmdomain: core: Reset genpd->states to avoid freeing invalid data
- ACPICA: utilities: Fix overflow check in vsnprintf()
- platform-msi: Add msi_remove_device_irq_domain() in
platform_device_msi_free_irqs_all()
- ASoC: tegra210_ahub: Add check to of_device_get_match_data()
- Make 'cc-option' work correctly for the -Wno-xyzzy pattern
- gpiolib: of: Add polarity quirk for s5m8767
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
- power: supply: max17040: adjust thermal channel scaling
- net: macb: Check return value of dma_set_mask_and_coherent()
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
- tipc: use kfree_sensitive() for aead cleanup
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
- i2c: designware: Invoke runtime suspend on quick slave re-registration
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
- emulex/benet: correct command version selection in be_cmd_get_stats()
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
- wifi: mt76: mt7925: introduce thermal protection
- wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
- sctp: Do not wake readers in __sctp_write_space()
- libbpf/btf: Fix string handling to support multi-split BTF
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
- i2c: tegra: check msg length in SMBUS block read
- i2c: npcm: Add clock toggle recovery
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
- net: dlink: add synchronization for stats update
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
- wifi: ath12k: fix a possible dead lock caused by ab->base_lock
- wifi: ath11k: Fix QMI memory reuse logic
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
- tcp: remove zero TCP TS samples for autotuning
- tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
- tcp: add receive queue awareness in tcp_rcv_space_adjust()
- x86/sgx: Prevent attempts to reclaim poisoned pages
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
- net: page_pool: Don't recycle into cache on PREEMPT_RT
- xfrm: validate assignment of maximal possible SEQ number
- net: atlantic: generate software timestamp just before the doorbell
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
- pinctrl: armada-37xx: propagate error from
armada_37xx_gpio_get_direction()
- bpf: Pass the same orig_call value to trampoline functions
- net: stmmac: generate software timestamp just before the doorbell
- pinctrl: armada-37xx: propagate error from
armada_37xx_pmx_gpio_set_direction()
- libbpf: Check bpf_map_skeleton link for NULL
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
- wifi: mac80211: do not offer a mesh path if forwarding is disabled
- clk: rockchip: rk3036: mark ddrphy as critical
- hid-asus: check ROG Ally MCU version and warn
- wifi: iwlwifi: mvm: fix beacon CCK flag
- f2fs: fix to bail out in get_new_segment()
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
- libbpf: Add identical pointer detection to btf_dedup_is_equiv()
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64
commands
- scsi: smartpqi: Add new PCI IDs
- iommu/amd: Ensure GA log notifier callbacks finish running before module
unload
- wifi: iwlwifi: pcie: make sure to lock rxq->read
- wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
- netdevsim: Mark NAPI ID on skb in nsim_rcv
- bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
- wifi: mac80211: VLAN traffic in multicast path
- Revert "mac80211: Dynamically set CoDel parameters per station"
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
- net: bridge: mcast: update multicast contex when vlan state is changed
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port
functions
- vxlan: Do not treat dst cache initialization errors as fatal
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
- wifi: ath12k: using msdu end descriptor to check for rx multicast
packets
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
- software node: Correct a OOB check in software_node_get_reference_args()
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
- pinctrl: mcp23s08: Reset all pins to input at probe
- wifi: ath12k: fix failed to set mhi state error during reboot with
hardware grouping
- scsi: lpfc: Use memcpy() for BIOS version
- sock: Correct error checking condition for (assign|release)_proto_idx()
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw
- ixgbe: Fix unreachable retry logic in combined and byte I2C write
functions
- RDMA/hns: initialize db in update_srq_db()
- ice: fix check for existing switch rule
- usbnet: asix AX88772: leave the carrier control to phylink
- f2fs: fix to set atomic write status more clear
- bpf, sockmap: Fix data lost during EAGAIN retries
- net: ethernet: cortina: Use TOE/TSO on all TCP
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
- wifi: ath11k: determine PM policy based on machine model
- wifi: ath12k: fix link valid field initialization in the monitor Rx
- wifi: ath12k: fix incorrect CE addresses
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for
160 MHz
- fbcon: Make sure modelist not set on unregistered console
- watchdog: da9052_wdt: respect TWDMIN
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
- tee: Prevent size calculation wraparound on 32-bit kernels
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices
first"
- fs/xattr.c: fix simple_xattr_list()
- platform/x86/amd: pmc: Clear metrics table at start of cycle
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
- platform/x86: dell_rbu: Fix list usage
- platform/x86: dell_rbu: Stop overwriting data buffer
- powerpc/vdso: Fix build of VDSO32 with pcrel
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH
recovery
- io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
- io_uring: fix task leak issue in io_wq_create()
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite
- platform/loongarch: laptop: Get brightness setting from EC on probe
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit
- platform/loongarch: laptop: Add backlight power control support
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
- jffs2: check that raw node were preallocated before writing summary
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
- cifs: deal with the channel loading lag while picking channels
- cifs: serialize other channels when query server interfaces is pending
- cifs: do not disable interface polling on failure
- smb: improve directory cache reuse for readdir operations
- scsi: storvsc: Increase the timeouts to storvsc_timeout
- scsi: s390: zfcp: Ensure synchronous unit_add
- nvme: always punt polled uring_cmd end_io work to task_work
- net_sched: sch_sfq: reject invalid perturb period
- net: clear the dst when changing skb protocol
- mm: close theoretical race where stale TLB entries could linger
- udmabuf: use sgtable-based scatterlist wrappers
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop
- ksmbd: fix null pointer dereference in destroy_previous_session
- platform/x86: ideapad-laptop: use usleep_range() for EC polling
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
- sched_ext, sched/core: Don't call scx_group_set_weight() prematurely
from sched_create_group()
- atm: Revert atm_account_tx() if copy_from_iter_full() fails.
- Input: sparcspkr - avoid unannotated fall-through
- arm64: Restrict pagetable teardown to avoid false warning
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound
card
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP
Victus 15-fa1xxx
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
- ALSA: hda/realtek: Add quirk for Asus GU605C
- mm/hugetlb: unshare page tables during VMA split, not before
- kbuild: rust: add rustc-min-version support function
- erofs: remove unused trace event erofs_destroy_inode
- nfsd: use threads array as-is in netlink interface
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
- drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
- Kunit to check the longest symbol length
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
- ipv6: replace ipcm6_init calls with ipcm6_init_sk
- smb: fix secondary channel creation issue with kerberos by populating
hostname when adding channels
- drm/msm/disp: Correct porch timing for SDM845
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
- drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
- drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
- drm/ssd130x: fix ssd132x_clear_screen() columns
- ionic: Prevent driver/fw getting out of sync on devcmd(s)
- drm/nouveau/bl: increase buffer size to avoid truncate warning
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
- hwmon: (occ) Rework attribute registration for stack usage
- hwmon: (occ) fix unaligned accesses
- hwmon: (ltc4282) avoid repeated register write
- pldmfw: Select CRC32 when PLDMFW is selected
- aoe: clean device rq_list in aoedev_downdev()
- io_uring/sqpoll: don't put task_struct on tctx setup failure
- net: ice: Perform accurate aRFS flow match
- ice: fix eswitch code memory leak in reset scenario
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
- ksmbd: add free_transport ops in ksmbd connection
- net: netmem: fix skb_ensure_writable with unreadable skbs
- bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
- bnxt_en: Add a helper function to configure MRU and RSS
- bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
- ptp: fix breakage after ptp_vclock_in_use() rework
- ptp: allow reading of currently dialed frequency to succeed on free-
running clocks
- wifi: carl9170: do not ping device which has failed to load firmware
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
- atm: atmtcp: Free invalid length skb in atmtcp_c_send().
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen()
behavior
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
- tcp: fix passive TFO socket having invalid NAPI ID
- eth: fbnic: avoid double free when failing to DMA-map FW msg
- net: lan743x: fix potential out-of-bounds write in
lan743x_ptp_io_event_clock_get()
- ublk: santizize the arguments from userspace when adding a device
- drm/xe/bmg: Update Wa_16023588340
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
- net: atm: add lec_mutex
- net: atm: fix /proc/net/atm/lec handling
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
- smb: Log an error when close_all_cached_dirs fails
- smb: client: fix first command failure during re-negotiation
- smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
- perf: Fix sample vs do_exit()
- perf: Fix cgroup state vs ERROR
- perf/core: Fix WARN in perf_cgroup_switch()
- arm64/ptrace: Fix stack-out-of-bounds read in
regs_get_kernel_stack_nth()
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
- gpio: pca953x: fix wrong error probe return value
- perf evsel: Missed close() when probing hybrid core PMUs
- perf test: Directory file descriptor leak
- gpio: mlxbf3: only get IRQ for device instance 0
- cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr()
function
- bpftool: Fix cgroup command to only show cgroup bpf programs
- alloc_tag: handle module codetag load errors as module load failures
- sched/rt: Fix race in push_rt_task
- sched/fair: Adhere to place_entity() constraints
- firmware: cs_dsp: Fix OOB memory read access in KUnit test
- ASoC: amd: amd_sdw: Fix unlikely uninitialized variable use in
create_sdw_dailinks()
- powerpc64/ftrace: fix clobbered r15 during livepatching
- powerpc/bpf: fix JIT code size calculation of bpf trampoline
- s390/pci: Fix __pcilg_mio_inuser() inline assembly
- anon_inode: raise SB_I_NODEV and SB_I_NOEXEC
- fs: add S_ANON_INODE
- nfsd: fix access checking for NLM under XPRTSEC policies
- NFS: always probe for LOCALIO support asynchronously
- media: ov08x40: Extend sleep after reset to 5 ms
- media: rcar-vin: Fix RAW10
- firmware: ti_sci: Convert CPU latency constraint from us to ms
- iommu: Allow attaching static domains in iommu_attach_device_pasid()
- mtd: rawnand: qcom: Fix last codeword read in
qcom_param_page_type_exec()
- dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits
- iio: accel: fxls8962af: Fix temperature calculation
- io_uring/net: only consider msg_inq if larger than 1
- iio: adc: ad7173: fix compiling without gpiolib
- iio: adc: ad7606: fix raw read for 18-bit chips
- power: supply: gpio-charger: Fix wakeup source leaks on device unbind
- EDAC/igen6: Skip absent memory controllers
- ALSA: hda/realtek: Add support for Acer Helios Laptops using CS35L41 HDA
- drm/amd/display: disable DPP RCG before DPP CLK enable
- drm/bridge: select DRM_KMS_HELPER for AUX_BRIDGE
- drm/amdgpu/gfx6: fix CSIB handling
- media: imx-jpeg: Check decoding is ongoing for motion-jpeg
- drm/rockchip: inno-hdmi: Fix video timing HSYNC/VSYNC polarity setting
for rk3036
- drm/dp: add option to disable zero sized address only transactions.
- sunrpc: update nextcheck time when adding new cache entries
- drm/amdgpu: Fix API status offset for MES queue reset
- drm/amd/display: DCN32 null data check
- drm/xe: Fix CFI violation when accessing sysfs files
- drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling
disable_irq()
- workqueue: Fix race condition in wq->stats incrementation
- drm/panel/sharp-ls043t1le01: Use _multi variants
- exfat: fix double free in delayed_free
- drm/bridge: anx7625: enable HPD interrupts
- drm/panthor: Don't update MMU_INT_MASK in panthor_mmu_irq_handler()
- drm/bridge: anx7625: change the gpiod_set_value API
- exfat: do not clear volume dirty flag during sync
- drm/amdkfd: Drop workaround for GC v9.4.3 revID 0
- drm/amdgpu/gfx11: fix CSIB handling
- media: nuvoton: npcm-video: Fix stuck due to no video signal error
- drm/nouveau: fix hibernate on disabled GPU
- media: i2c: imx334: Enable runtime PM before sub-device registration
- drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
- drm/nouveau/gsp: fix rm shutdown wait condition
- drm/msm/hdmi: add runtime PM calls to DDC transfer function
- media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
- drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
- media: verisilicon: Enable wide 4K in AV1 decoder
- drm/amd/display: Skip to enable dsc if it has been off
- drm/amdgpu: Add basic validation for RAS header
- dlm: use SHUT_RDWR for SCTP shutdown
- drm/msm/a6xx: Increase HFI response timeout
- drm/amd/display: Do Not Consider DSC if Valid Config Not Found
- media: i2c: imx334: Fix runtime PM handling in remove function
- drm/amdgpu/gfx10: fix CSIB handling
- drm: panel-orientation-quirks: Add ZOTAC Gaming Zone
- media: ccs-pll: Better validate VT PLL branch
- media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition
- drm/amd/display: fix zero value for APU watermark_c
- drm/ttm/tests: fix incorrect assert in ttm_bo_unreserve_bulk()
- drm/amdgpu/gfx7: fix CSIB handling
- ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in
ext4_ext_remove_space()
- jfs: fix array-index-out-of-bounds read in add_missing_indices
- media: ti: cal: Fix wrong goto on error path
- drm/xe/vf: Fix guc_info debugfs for VFs
- drm/amd/display: Correct SSC enable detection for DCN351
- drm/amd/display: Fix Vertical Interrupt definitions for dcn32, dcn401
- media: cec: extron-da-hd-4k-plus: Fix Wformat-truncation
- media: rkvdec: Initialize the m2m context before the controls
- drm/amdgpu: fix MES GFX mask
- drm/amdgpu: Disallow partition query during reset
- sunrpc: fix race in cache cleanup causing stale nextcheck time
- ext4: prevent stale extent cache entries caused by concurrent get
es_cache
- drm/amdgpu/gfx8: fix CSIB handling
- drm/amdgpu/gfx9: fix CSIB handling
- drm/amd/display: Fix VUpdate offset calculations for dcn401
- jfs: Fix null-ptr-deref in jfs_ioc_trim
- drm/amd/pm: Reset SMU v13.0.x custom settings
- drm/amd/display: Correct prefetch calculation
- drm/amd/display: Restructure DMI quirks
- media: renesas: vsp1: Fix media bus code setup on RWPF source pad
- drm/msm/dpu: don't select single flush for active CTL blocks
- drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
- media: tc358743: ignore video while HPD is low
- media: platform: exynos4-is: Add hardware sync wait to
fimc_is_hw_change_mode()
- media: i2c: imx334: update mode_3840x2160_regs array
- nios2: force update_mmu_cache on spurious tlb-permission--related
pagefaults
- media: rcar-vin: Fix stride setting for RAW8 formats
- drm/amdgpu: Add indirect L1_TLB_CNTL reg programming for VFs
- drm/xe/uc: Remove static from loop variable
- media: qcom: venus: Fix uninitialized variable warning
- drm/panel: simple: Add POWERTIP PH128800T004-ZZA01 panel entry
- Bluetooth: btusb: Add RTL8851BE device 0x0bda:0xb850
- Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind
- Bluetooth: btmtksdio: Fix wakeup source leaks on device unbind
- i2c: pasemi: Enable the unjam machine
- i2c: pasemi: Add registers bits and switch to BIT()
- clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750
- net: phy: mediatek: do not require syscon compatible for pio property
- net/mlx5: HWS, fix counting of rules in the matcher
- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM
- ipmi:ssif: Fix a shutdown race
- rtla: Define __NR_sched_setattr for LoongArch
- wifi: iwlwifi: dvm: pair transport op-mode enter/leave
- net/mlx5: HWS, Fix IP version decision
- vxlan: Add RCU read-side critical sections in the Tx path
- wifi: ath12k: correctly handle mcast packets for clients
- wifi: ath12k: make assoc link associate first
- wifi: rtw88: Set AMPDU factor to hardware for RTL8814A
- wifi: ath12k: Fix incorrect rates sent to firmware
- wifi: ath12k: Fix the enabling of REO queue lookup table feature
- wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
- net/mlx5: HWS, Harden IP version definer checks
- watchdog: stm32: Fix wakeup source leaks on device unbind
- i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler()
- platform/x86/amd: pmf: Use device managed allocations
- io_uring/rsrc: validate buffer count with offset for cloning
- firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
- firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
- tracing: Fix regression of filter waiting a long time on RCU
synchronization
- x86/its: move its_pages array to struct mod_arch_specific
- io_uring/net: always use current transfer count for buffer put
- drm/msm/dp: Disable wide bus support for SDM845
- Octeontx2-pf: Fix Backpresure configuration
- tools: ynl: parse extack for sub-messages
- tools: ynl: fix mixing ops and notifications on one socket
- KVM: arm64: VHE: Synchronize restore of host debug registers
- perf/x86/intel: Fix crash in icl_update_topdown_event()
- EDAC/igen6: Fix NULL pointer dereference
- dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lock
- tracing: Do not free "head" on error path of
filter_free_subsystem_filters()
- mtd: spinand: Use more specific naming for the (single) read from cache
ops
- mtd: spinand: Use more specific naming for the (dual output) read from
cache ops
- mtd: spinand: Use more specific naming for the (dual IO) read from cache
ops
- mtd: spinand: Use more specific naming for the (quad output) read from
cache ops
- mtd: spinand: Use more specific naming for the (quad IO) read from cache
ops
- mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O
variants
- PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC
- Revert "drm/amd/display: Fix VUpdate offset calculations for dcn401"
- drm/i915: fix build error some more
- bridge: mcast: Fix use-after-free during router port configuration
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region
- kallsyms: fix build without execinfo
- ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk
- smb: client: fix warning when reconnecting channel
- tools/hv: fcopy: Fix irregularities with size of ring buffer
- Upstream stable to v6.12.35, v6.15.4
* CVE-2025-39682
- tls: fix handling of zero-length records on the rx_list
* CVE-2025-38541
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
* CVE-2025-38477
- net/sched: sch_qfq: Fix race condition on qfq_aggregate
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
qfq_delete_class
* CVE-2025-38500
- xfrm: interface: fix use-after-free after changing collect_md xfrm
interface
* CVE-2025-38617
- net/packet: fix a race in packet_set_ring() and packet_notifier()
* CVE-2025-38618
- vsock: Do not allow binding to VMADDR_PORT_ANY
* Packaging resync (LP: #1786013)
- [Packaging] resync git-ubuntu-log
Date: 2025-09-16 14:48:13.844273+00:00
Changed-By: Stefan Bader <stefan.bader at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux/6.14.0-34.34
-------------- next part --------------
Sorry, changesfile not available.
More information about the plucky-changes
mailing list