[ubuntu/resolute-proposed] linux-nvidia-bos 7.0.0-2019.19 (Accepted)

Timo Aaltonen tjaalton at ubuntu.com
Tue Sep 22 22:11:21 UTC 2026


linux-nvidia-bos (7.0.0-2019.19) resolute; urgency=medium

  * resolute/linux-nvidia-bos: 7.0.0-2019.19 -proposed tracker (LP: #2167398)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.nvidia-bos/dkms-versions -- remove dkms-versions
      (main/d2026.09.10)

  * Backport "RDMA/cgroup: Disambiguate devices across net namespaces"
    (LP: #2167390)
    - cgroup/rdma: refactor resource parsing with match_table_t/match_token()
    - RDMA/cgroup: Disambiguate devices across net namespaces

  * ALSA: hda/acpi: audio fails and resume is delayed after S3 (LP: #2167235)
    - ALSA: hda/acpi: add runtime PM suspend/resume to the ACPI controller
    - NVIDIA: SAUCE: ALSA: hda/acpi: use pm_ptr() for the PM ops

  * cxl: DVSEC enable restore and require cache for cxl reset (LP: #2167292)
    - NVIDIA: VR: SAUCE: cxl: Restore CXL Device DVSEC enable state
    - NVIDIA: VR: SAUCE: cxl: Require enabled cache for CXL Reset

  * Backport upstream fixes for the vfio/pci and iommufd dma-buf series
    (LP: #2167041)
    - dma-buf: Rename dma_buf_move_notify() to dma_buf_invalidate_mappings()
    - RDMA/uverbs: Update for semantic conflict with drm-misc
    - vfio: Wait for dma-buf invalidation to complete
    - PCI/P2PDMA: Avoid returning a provider for non_mappable_bars
    - iommufd: Destroy the pages content after detaching from dmabuf
    - iommufd: Clarify IOAS_MAP_FILE dma-buf support
    - vfio/pci: fix dma-buf kref underflow after revoke
    - iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get()
    - iommufd: Reject DMABUF pages from the access pin path

  * ASoC: sdw_utils: clear stale device references in exit hooks
    (LP: #2166188)
    - ASoC: sdw_utils: fix double put_device() on aggregated amps
    - NVIDIA: SAUCE: ASoC: sdw_utils: clear stale RT711 device reference

  * PCI/MSI: Skip MSI/MSI-X programming while the channel is offline
    (LP: #2167038)
    - NVIDIA: SAUCE: PCI/MSI: Skip MSI/MSI-X programming while the channel is
      offline

  * Sync MPAM patches with latest from upstream (LP: #2167008)
    - Revert "NVIDIA: SAUCE: PCI/MSI: Enable memory decoding before restoring
      MSI-X messages"
    - Revert "NVIDIA: SAUCE: arm_mpam: Apply T241-MPAM-6 to 63-bit counters"
    - Revert "NVIDIA: SAUCE: Fix mbm_L3_assign and mon_local_bytes"
    - Revert "NVIDIA: VR: SAUCE: resctrl: add MBA max_lim sysfs and visibility
      from init"
    - Revert "NVIDIA: VR: SAUCE: resctrl/mpam: probe MPAMF_MBW_IDR MAX_LIM and
      hardlim_rw"
    - Revert "NVIDIA: SAUCE: resctrl/mpam: reset RIS by applying explicit
      default config"
    - Revert "NVIDIA: SAUCE: arm_mpam: Include all associated MSC components
      during domain setup"
    - Revert "NVIDIA: VR: SAUCE: arm_mpam: Avoid MSC teardown for the SW
      programming errors"
    - Revert "NVIDIA: SAUCE: arm_mpam: resctrl: Determine if any exposed
      counter can overflow"
    - Revert "NVIDIA: VR: SAUCE: fs/resctrl: Add support for assigning
      iommu_groups to resctrl groups"
    - Revert "NVIDIA: VR: SAUCE: iommu: Add helpers to get and set the QoS
      state"
    - Revert "NVIDIA: VR: SAUCE: iommu/arm-smmu-v3: Add mpam helpers to query
      and set state"
    - Revert "NVIDIA: VR: SAUCE: iommu/arm-smmu-v3: Register SMMU capabilities
      with MPAM"
    - Revert "NVIDIA: VR: SAUCE: fs/resctrl: Add this_is_not_abi mount option"
    - Revert "NVIDIA: VR: SAUCE: arm_mpam: Allow MSC to be forced to have an
      unknown location"
    - Revert "NVIDIA: VR: SAUCE: arm_mpam: Allow the maximum partid to be
      overridden from the command line"
    - Revert "NVIDIA: VR: SAUCE: arm_mpam: Split the locking around the
      mon_sel registers"
    - Revert "NVIDIA: VR: SAUCE: arm_mpam: Expose the number of NRDY retries
      in debugfs"
    - Revert "NVIDIA: VR: SAUCE: arm_mpam: Add debugfs entries to show the
      MSC/RIS the driver discovered"
    - Revert "NVIDIA: VR: SAUCE: fs/resctrl: Avoid a race with dom_data_exit()
      and rmid_ptrs[]"
    - Revert "NVIDIA: SAUCE: arm_mpam: resctrl: Add resctrl_arch_cntr_read() &
      resctrl_arch_reset_cntr()"
    - Revert "NVIDIA: SAUCE: arm_mpam: resctrl: Add resctrl_arch_rmid_read()
      and resctrl_arch_reset_rmid()"
    - Revert "NVIDIA: SAUCE: arm_mpam: resctrl: Add resctrl_arch_config_cntr()
      for ABMC use"
    - Revert "NVIDIA: VR: SAUCE: arm_mpam: resctrl: Add kunit test for
      ABMC/CDP interactions"
    - Revert "NVIDIA: SAUCE: arm_mpam: resctrl: Pre-allocate assignable
      monitors"
    - Revert "NVIDIA: SAUCE: arm_mpam: resctrl: Pre-allocate free running
      monitors"
    - Revert "NVIDIA: SAUCE: untested: arm_mpam: resctrl: pick classes for use
      as mbm counters"
    - PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder
      value
    - PCI: Allow per function PCI slots to fix slot reset on s390
    - PCI: Avoid saving config space state if inaccessible
    - PCI: Fail FLR when config space is inaccessible
    - PCI/MSI: Enable memory decoding before restoring MSI-X messages
    - KVM: arm64: Force guest EL1 to use user-space's partid configuration
    - arm_mpam: Update architecture version check for MPAM MSC
    - NVIDIA: SAUCE: arm_mpam: let low level MSC accessors return an error
    - NVIDIA: SAUCE: resctrl/mpam: probe MPAMF_MBW_IDR MAX_LIM and hardlim_rw
    - NVIDIA: SAUCE: arm_mpam: propagate MSC access errors for hw_probe
      functions
    - NVIDIA: SAUCE: arm_mpam: propagate MSC access errors for MBWU counters
    - NVIDIA: SAUCE: arm_mpam: propagate MSC access errors for msmon helpers
    - NVIDIA: SAUCE: arm_mpam: propagate MSC access errors for
      __ris_msmon_read()
    - NVIDIA: SAUCE: arm_mpam: propagate MSC access errors for state saving
      function
    - arm_mpam: Fix MPAMCFG_MBW_PBM register setting
    - NVIDIA: SAUCE: arm_mpam: propagate MSC access errors for
      mpam_reprogram_ris_partid()
    - NVIDIA: SAUCE: arm_mpam: propagate MSC access errors for interrupt
      control
    - NVIDIA: SAUCE: arm_mpam: prepare mon_sel locking for MPAM-Fb
    - NVIDIA: SAUCE: arm_mpam: add MPAM-Fb MSC firmware access support
    - NVIDIA: SAUCE: arm_mpam: Avoid MSC teardown for the SW programming
      errors
    - NVIDIA: SAUCE: arm_mpam: change MPAM-Fb error IRQ to use a threaded IRQ
      handler
    - NVIDIA: SAUCE: arm_mpam: detect and enable MPAM-Fb PCC support
    - fs/resctrl: Tidy up the error path in resctrl_mkdir_event_configs()
    - x86,fs/resctrl: Create 'event_filter' files read only if they're not
      configurable
    - fs/resctrl: Disallow the software controller when MBM counters are
      assignable
    - fs/resctrl: Add monitor property 'mbm_cntr_assign_fixed'
    - fs/resctrl: Continue counter allocation after failure
    - fs/resctrl: Document that automatic counter assignment is best effort
    - fs/resctrl: Document tasks file behaviour for task id 0 and idle tasks
    - arm_mpam: resctrl: Pick classes for use as MBM counters
    - arm_mpam: resctrl: Pre-allocate assignable monitors
    - arm_mpam: resctrl: Add resctrl_arch_config_cntr() for ABMC use
    - arm_mpam: resctrl: Add resctrl_arch_cntr_read() &
      resctrl_arch_reset_cntr()
    - arm64: mpam: Add memory bandwidth usage (MBWU) documentation
    - NVIDIA: SAUCE: arm_mpam: resctrl: Add kunit test for ABMC/CDP
      interactions
    - NVIDIA: SAUCE: fs/resctrl: Avoid a race with dom_data_exit() and
      rmid_ptrs[]
    - NVIDIA: SAUCE: arm_mpam: Allow the maximum partid to be overridden from
      the command line
    - NVIDIA: SAUCE: fs/resctrl: Add this_is_not_abi mount option
    - NVIDIA: SAUCE: arm_mpam: Allow MSC to be forced to have an unknown
      location
    - NVIDIA: SAUCE: iommu/arm-smmu-v3: Register SMMU capabilities with MPAM
    - NVIDIA: SAUCE: iommu/arm-smmu-v3: Add mpam helpers to query and set
      state
    - NVIDIA: SAUCE: iommu: Add helpers to get and set the QoS state
    - NVIDIA: SAUCE: fs/resctrl: Add support for assigning iommu_groups to
      resctrl groups
    - NVIDIA: SAUCE: arm_mpam: Add debugfs entries to show the MSC/RIS the
      driver discovered
    - NVIDIA: SAUCE: arm_mpam: Expose the number of NRDY retries in debugfs
    - NVIDIA: SAUCE: arm_mpam: resctrl: Determine if any exposed counter can
      overflow
    - NVIDIA: SAUCE: resctrl: add MBA max_lim sysfs and visibility from init
    - NVIDIA: SAUCE: arm_mpam: Include all MSC components during domain setup
    - NVIDIA: SAUCE: fs/resctrl: Fix incorrect PID parsing after IOMMU group
      token
    - NVIDIA: SAUCE: fs/resctrl: Remove unused 'of' parameter from
      rdtgroup_move_iommu()
    - NVIDIA: SAUCE: fs/resctrl: Migrate IOMMU groups when removing resource
      groups
    - NVIDIA: SAUCE: fs/resctrl: Fix redefinition of iommu helpers with
      CONFIG_RESCTRL_IOMMU=n
    - NVIDIA: SAUCE: arm_mpam: Ensure MBWU counters are reset on restore
    - NVIDIA: SAUCE: fs/resctrl: Fix iommu_group reference leaks when
      iterating groups
    - NVIDIA: SAUCE: arm_mpam: Use __ris_msmon_read() for saving MBWU state
    - arm_mpam: Apply T241-MPAM-6 to 63-bit counters
    - NVIDIA: SAUCE: arm_mpam: Initialize all of struct mon_read in
      mpam_restore_mbwu_state()
    - NVIDIA: SAUCE: arm_mpam: resctrl: Correct check that existing class is
      L3
    - NVIDIA: SAUCE: arm_mpam: Fix PCC channel lifetime during MSC removal
    - NVIDIA: SAUCE: arm_mpam: Quiesce error IRQ before MSC removal
    - NVIDIA: SAUCE: fs/resctrl: Continue IOMMU group migration after errors

  * NVIDIA: SAUCE: arm_mpam: Fix mbm_total_bytes and MBM counter assignment
    (LP: #2157922) // Sync MPAM patches with latest from upstream
    (LP: #2167008)
    - NVIDIA: SAUCE: arm_mpam: Fix monitor capability and MBM assign for MB
      events

  * linux-nvidia: Port MPAM Functionality into Kernel (LP: #2154527) // Sync
    MPAM patches with latest from upstream (LP: #2167008)
    - NVIDIA: SAUCE: resctrl/mpam: reset RIS by applying explicit default
      config
    - NVIDIA: SAUCE: Fix mbm_L3_assign and mon_local_bytes

  * Prefer PE0 for task placement on NVIDIA Olympus SMT cores (LP: #2166486)
    - NVIDIA: VR: SAUCE: arm64: topology: Prefer PE0 on NVIDIA Olympus SMT
      cores
    - NVIDIA: VR: SAUCE: sched/fair: Honor asymmetric SMT priority in idle
      selection

  * drm/ast: DisplayPort edid supports 256 bytes (LP: #2166545)
    - drm/ast: DisplayPort edid supports 256 bytes

  * tee: optee: support shared memory offsets on large-page kernels
    (LP: #2166792)
    - NVIDIA: VR: SAUCE: tee: optee: support shared memory offsets on large-
      page kernels

  * arm_ffa: Failing to load after kexec (LP: #2166208)
    - Revert "firmware: arm_ffa: Change initcall level of ffa_init() to
      rootfs_initcall"
    - firmware: arm_ffa: Register core as a platform driver
    - firmware: arm_ffa: Set the core device as FF-A device parent
    - firmware: arm_ffa: Defer probe until pKVM is initialized
    - security: lsm: allow LSMs to register for late_initcall_sync init
    - security: ima: introduce IMA_INIT_LATE_SYNC option
    - security: ima: rename boot_aggregate when ima is initialised at
      late_sync
    - tpm: tpm_crb_ffa: revert defered_probed when tpm_crb_ffa is built-in
    - firmware: arm_ffa: Tear down driver during shutdown
    - [Config] nvidia-bos: Enable IMA_INIT_LATE_SYNC

  * Backport watchdog: sbsa_gwdt: add early_enable module parameter
    (LP: #2166165)
    - watchdog: sbsa_gwdt: add early_enable module parameter

  * Backport: "block: check bio split for unaligned bvec" (LP: #2165055)
    - block: check bio split for unaligned bvec

  * Backport perf vendor events arm64: Fix Tegra410 Olympus PMU events
    (LP: #2164783)
    - perf vendor events arm64: fix swapped MetricGroup for Tegra410 L1
      prefetcher metrics
    - perf vendor events arm64: Fix Tegra410 Olympus event 0x0197

  * Miscellaneous Ubuntu changes
    - [Packaging] remove stale debian/dkms-versions scripting

  [ Ubuntu: 7.0.0-34.34 ]

  * resolute/linux: 7.0.0-34.34 -proposed tracker (LP: #2165995)

  [ Ubuntu: 7.0.0-32.32 ]

  * resolute/linux: 7.0.0-32.32 -proposed tracker (LP: #2165777)
  * CVE-2026-72064
    - net: mana: Sync page pool RX frags for CPU
  * CVE-2026-72065
    - net: mana: Validate the packet length reported by the NIC
  * CVE-2026-72098
    - dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS
    - dm-verity: fix buffer overflow in FEC calculation
  * CVE-2026-72248
    - netfilter: flowtable: support IPIP tunnel with direct xmit
    - netfilter: flowtable: use correct direction to set up tunnel route
  * CVE-2026-72249
    - netfilter: flowtable: use dst in this direction when pushing IPIP header
  * CVE-2026-72287
    - KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal"
      checks
  * CVE-2026-72329
    - net/liquidio: drop cached VF pci_dev LUT
  * CVE-2026-72355
    - netfs: Fix barriering when walking subrequest list
  * CVE-2026-72412
    - s390/mm: Fix handling of _PAGE_UNUSED pte bit
  * CVE-2026-72417
    - netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
  * CVE-2026-72442
    - netfilter: flowtable: fix and simplify IP6IP6 tunnel handling
  * CVE-2026-72463
    - xfrm: Fix dev use-after-free in xfrm async resumption
  * CVE-2026-72477
    - fs/ntfs3: call _ntfs_bad_inode() when failing to rename
  * CVE-2026-72493
    - net: serialize netif_running() check in enqueue_to_backlog()
  * CVE-2026-72494
    - RDMA/irdma: Replace waitqueue and flag with completion
  * CVE-2026-72496
    - RDMA/bnxt_re: Proper rollback if the ioremap fails
  * CVE-2026-74269
    - bnxt: fix head underflow on XDP head-grow
  * CVE-2026-74350
    - ocfs2: validate fast symlink target during inode read
  * CVE-2026-72495
    - RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
  * CVE-2026-72501
    - RDMA/bnxt_re: Initialize dpi variable to zero
  * CVE-2026-72278
    - KVM: arm64: nv: Re-translate VNCR before injecting abort
  * CVE-2026-68083
    - ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
  * CVE-2026-68457
    - ksmbd: use opener credentials for FSCTL mutations
  * CVE-2026-68476
    - ipvs: reload ip header after head reallocation
  * CVE-2026-68477
    - ipvs: fix more places with wrong ipv6 transport offsets
  * CVE-2026-72014
    - drbd: reject data replies with an out-of-range payload size
  * CVE-2026-72020
    - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
  * CVE-2026-72033
    - orangefs: keep the readdir entry size 64-bit in fill_from_part()
  * CVE-2026-72041
    - espintcp: use sk_msg_free_partial to fix partial send
  * CVE-2026-72046
    - gve: fix header buffer corruption with header-split and HW-GRO
  * CVE-2026-72069
    - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
  * CVE-2026-72083
    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
  * CVE-2026-72084
    - scsi: target: Bound PR-OUT TransportID parsing to the received buffer
  * CVE-2026-72085
    - scsi: xen: scsiback: Free unsubmitted command instead of double-putting
      it
  * CVE-2026-72129
    - nvmet-rdma: handle inline data with a nonzero offset
  * CVE-2026-72130
    - nvmet-auth: reject short AUTH_RECEIVE buffers
  * CVE-2026-64551
    - sctp: validate STALE_COOKIE cause length before reading staleness
  * CVE-2026-72137
    - xfrm: nat_keepalive: avoid double free on send error
  * CVE-2026-72139
    - tcp: defer md5sig_info kfree past RCU grace period in tcp_connect
  * CVE-2026-72191
    - ntfs3: validate split-point offset in indx_insert_into_buffer
  * CVE-2026-72192
    - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
  * CVE-2026-72194
    - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
  * CVE-2026-72217
    - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
  * CVE-2026-72220
    - sunrpc: harden rq_procinfo lifecycle to prevent double-free
  * CVE-2026-72221
    - sunrpc: wait for in-flight TLS handshake callback when cancel loses race
  * CVE-2026-72222
    - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
  * CVE-2026-72226
    - batman-adv: tt: prevent TVLV OOB check overflow
  * CVE-2026-72234
    - batman-adv: access unicast_ttvn skb->data only after skb realloc
  * CVE-2026-72251
    - netfilter: nf_nat_sip: reload possible stale data pointer
  * CVE-2026-72277
    - KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN
    - KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory
  * CVE-2026-72279
    - KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR
  * CVE-2026-72288
    - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI
      disabling
  * CVE-2026-72289
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it
  * CVE-2026-72296
    - net: ife: require ETH_HLEN to be pullable in ife_decode()
  * CVE-2026-72299
    - tipc: restrict socket queue dumps in enqueue tracepoints
  * CVE-2026-72317
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker
  * CVE-2026-72318
    - cifs: validate DFS referral string offsets
  * CVE-2026-72319
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
    - ipvs: ensure inner headers in ICMP errors are in headroom
  * CVE-2026-72320
    - netfilter: nft_lookup: fix catchall element handling with inverted
      lookups
  * CVE-2026-72322
    - ipv6: mcast: Fix potential UAF in MLD delayed work
  * CVE-2026-72323
    - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
  * CVE-2026-64541
    - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
  * CVE-2026-72339
    - qede: fix off-by-one in BD ring consumption on build_skb failure
  * CVE-2026-72348
    - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
  * CVE-2026-72351
    - gue: validate REMCSUM private option length
  * CVE-2026-72366
    - netfs: Fix netfs_create_write_req() to handle async cache object
      creation
  * CVE-2026-72381
    - ksmbd: fix use-after-free of fp->owner.name in durable handle owner
      check
  * CVE-2026-72393
    - eth: fbnic: don't cache shinfo across skb realloc
  * CVE-2026-72398
    - sctp: add INIT verification after cookie unpacking
  * CVE-2026-72399
    - net: enetc: check the number of BDs needed for xdp_frame
  * CVE-2026-64530
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
  * CVE-2026-72422
    - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2
      NEGOTIATE
  * CVE-2026-72429
    - ipv6: ioam: fix type confusion of dst_entry
  * CVE-2026-72436
    - netfilter: ipset: Fix data race between add and dump in all hash types
    - netfilter: ipset: annotate "pos" for concurrent readers/writers
    - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash
      types
  * CVE-2026-72451
    - xfrm: Fix xfrm state cache insertion race
  * CVE-2026-72466
    - xprtrdma: Fix bcall rep leak and unbounded peek
  * CVE-2026-72472
    - nfs: use nfsi->rwsem to protect traversal of the file lock list
  * CVE-2026-72473
    - xprtrdma: Avoid 250 ms delay on backlog wakeup
    - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
    - xprtrdma: Post receive buffers after RPC completion
    - xprtrdma: Use sendctx DMA state for Send signaling
    - xprtrdma: Decouple req recycling from RPC completion
  * CVE-2026-72491
    - net/9p: fix race condition on rdma->state in trans_rdma.c
  * CVE-2026-72495 // CVE-2026-72501
    - RDMA/bnxt_re: Move the UAPI methods to a dedicated file
  * CVE-2026-74255
    - tipc: fix UAF in tipc_l2_send_msg()
  * CVE-2026-74267
    - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek
      before restoring qlen
  * CVE-2026-74268
    - tcp: clear sock_ops cb flags before force-closing a child socket
  * CVE-2026-74287
    - sctp: validate embedded address parameter length
  * CVE-2026-74310
    - vhost/net: complete zerocopy ubufs only once
  * CVE-2026-74345
    - RDMA/siw: Fix endpoint/socket association handling
  * CVE-2026-74361
    - nvme: fix FDP fdpcidx bounds check
  * CVE-2026-74376
    - md/raid10: reset read_slot when reusing r10bio for discard
  * CVE-2026-74384
    - nvme-multipath: fix flex array size in struct nvme_ns_head
  * CVE-2026-74394
    - RDMA/srpt: fix integer overflow in immediate data length check
  * CVE-2026-74398
    - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
  * CVE-2026-74401
    - dlm: fix add msg handle in send_queue ordered
  * CVE-2026-74406
    - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
  * CVE-2026-74427
    - afs: Fix netns teardown to cancel the preallocation charger
    - afs: Fix further netns teardown to cancel the preallocation charger
  * CVE-2026-74428
    - rxrpc: Fix double unlock in rxrpc_recvmsg()
  * CVE-2026-74433
    - rxrpc: Fix UAF in rxgk_issue_challenge()
  * CVE-2026-74434
    - rxrpc: Don't move a peeked OOB message onto the pending queue
  * CVE-2026-74436
    - rxrpc: serialize kernel accept preallocation with socket teardown
  * CVE-2026-64535
    - nvmet-tcp: Fix potential UAF when ddgst mismatch
  * CVE-2026-74439
    - iommu/vt-d: Clear Present bit before tearing down scalable-mode context
      entry
  * CVE-2026-64534
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error
      path

Date: 2026-09-16 14:48:14.090709+00:00
Changed-By: Jacob Martin <jacob.martin at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux-nvidia-bos/7.0.0-2019.19
-------------- next part --------------
Sorry, changesfile not available.


More information about the Resolute-changes mailing list