linux-hwe-6.8 (6.8.0-79.79~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-79.79~22.04.1 -proposed tracker (LP: #2119917)
[ Ubuntu: 6.8.0-79.79 ]
* noble/linux: 6.8.0-79.79 -proposed tracker (LP: #2120415)
* CVE-2024-57996 // CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
* CVE-2025-38350
- net/sched: Always pass notifications when child class becomes empty
* CVE-2025-21887
- ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
-- Stefan Bader <stefan.bader@canonical.com> Fri, 15 Aug 2025 17:24:46 +0200
linux-hwe-6.8 (6.8.0-78.78~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-78.78~22.04.1 -proposed tracker (LP: #2120403)
[ Ubuntu: 6.8.0-78.78 ]
* noble/linux: 6.8.0-78.78 -proposed tracker (LP: #2120405)
* Incorrect backport for CVE-2025-21861 causes kernel hangs
(LP: #2120330) // CVE-2025-21861
- mm/migrate_device: don't add folio to be freed to LRU in
migrate_device_finalize()
* Incorrect backport for CVE-2025-21861 causes kernel hangs (LP: #2120330)
- SAUCE: Revert "mm/migrate_device: don't add folio to be freed to LRU in
migrate_device_finalize()"
- mm: migrate_device: use more folio in migrate_device_finalize()
-- Stefan Bader <stefan.bader@canonical.com> Wed, 13 Aug 2025 15:00:41 +0200
linux-hwe-6.8 (6.8.0-72.72~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-72.72~22.04.1 -proposed tracker (LP: #2117689)
[ Ubuntu: 6.8.0-72.72 ]
* noble/linux: 6.8.0-72.72 -proposed tracker (LP: #2117691)
* Packaging resync (LP: #1786013)
- [Packaging] update annotations scripts
- [Packaging] debian.master/dkms-versions -- update from kernel-versions
(main/2025.07.14)
* NVMe namespace ID mismatch on repeated map/unmap (LP: #2115209)
- nvme: requeue namespace scan on missed AENs
- nvme: re-read ANA log page after ns scan completes
- nvme: fixup scan failure for non-ANA multipath controllers
* integrated I219-LM network adapter appears to be running too fast, causing
synchronization issues when using the I219-LM PTP feature (LP: #2116072)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
* intel_rapl: support ARL-H hardware (LP: #2115652)
- powercap: intel_rapl_msr: Add PL4 support for ArrowLake-H
* Ubuntu 24.04+ arm64: screen resolution fixed to 1024x768 with last kernel
update (LP: #2115068)
- [Config] Replace FB_HYPERV with DRM_HYPERV
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212)
- arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings
- xfs: assert a valid limit in xfs_rtfind_forw
- xfs: validate inumber in xfs_iget
- xfs: fix a sloppy memory handling bug in xfs_iroot_realloc
- xfs: fix a typo
- xfs: skip background cowblock trims on inodes open for write
- xfs: don't free cowblocks from under dirty pagecache on unshare
- xfs: merge xfs_attr_leaf_try_add into xfs_attr_leaf_addname
- xfs: return bool from xfs_attr3_leaf_add
- xfs: distinguish extra split from real ENOSPC from xfs_attr3_leaf_split
- xfs: distinguish extra split from real ENOSPC from
xfs_attr_node_try_addname
- xfs: fold xfs_bmap_alloc_userdata into xfs_bmapi_allocate
- xfs: don't ifdef around the exact minlen allocations
- xfs: call xfs_bmap_exact_minlen_extent_alloc from xfs_bmap_btalloc
- xfs: support lowmode allocations in xfs_bmap_exact_minlen_extent_alloc
- xfs: Use try_cmpxchg() in xlog_cil_insert_pcp_aggregate()
- xfs: Remove empty declartion in header file
- xfs: pass the exact range to initialize to xfs_initialize_perag
- xfs: update the file system geometry after recoverying superblock
buffers
- xfs: error out when a superblock buffer update reduces the agcount
- xfs: don't use __GFP_RETRY_MAYFAIL in xfs_initialize_perag
- xfs: update the pag for the last AG at recovery time
- xfs: Reduce unnecessary searches when searching for the best extents
- xfs: streamline xfs_filestream_pick_ag
- xfs: Check for delayed allocations before setting extsize
- md/md-bitmap: replace md_bitmap_status() with a new helper
md_bitmap_get_stats()
- md/md-cluster: fix spares warnings for __le64
- md/md-bitmap: add 'sync_size' into struct md_bitmap_stats
- mm: update mark_victim tracepoints fields
- cpufreq: dt-platdev: add missing MODULE_DESCRIPTION() macro
- cpufreq: fix using cpufreq-dt as module
- Bluetooth: qca: Support downloading board id specific NVM for WCN7850
- Bluetooth: qca: Update firmware-name to support board specific nvm
- Bluetooth: qca: Fix poor RF performance for WCN6855
- Input: serio - define serio_pause_rx guard to pause and resume serio
ports
- ASoC: renesas: rz-ssi: Add a check for negative sample_space
- ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB]
- powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
- powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
- ALSA: seq: Drop UMP events when no UMP-conversion is set
- ibmvnic: Return error code on TX scrq flush fail
- ibmvnic: Introduce send sub-crq direct
- ibmvnic: Add stat for tx direct vs tx batched
- vsock/bpf: Warn on socket without transport
- tcp: adjust rcvq_space after updating scaling ratio
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- flow_dissector: Fix handling of mixed port and port-range keys
- flow_dissector: Fix port range key handling in BPF conversion
- net: Add non-RCU dev_getbyhwaddr() helper
- arp: switch to dev_getbyhwaddr() in arp_req_set_public()
- net: axienet: Set mac_managed_pm
- bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
- strparser: Add read_sock callback
- bpf: Fix wrong copied_seq calculation
- bpf: Disable non stream socket for strparser
- power: supply: da9150-fg: fix potential overflow
- nouveau/svm: fix missing folio unlock + put after
make_device_exclusive_range()
- drm/msm: Avoid rounding up to one jiffy
- nvme/ioctl: add missing space in err message
- bpf: skip non exist keys in generic_map_lookup_batch
- drm/nouveau/pmu: Fix gp10b firmware guard
- drm/msm/dpu: Disable dither in phys encoder cleanup
- drm/i915: Make sure all planes in use by the joiner have their crtc
included
- drm/i915/dp: Fix error handling during 128b/132b link training
- soc: loongson: loongson2_guts: Add check for devm_kstrdup()
- lib/iov_iter: fix import_iovec_ubuf iovec management
- ASoC: fsl_micfil: Enable default case in micfil_set_quality()
- ALSA: hda: Add error check for snd_ctl_rename_id() in
snd_hda_create_dig_out_ctls()
- ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
- ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close
- acct: block access to kernel internal filesystems
- mm,madvise,hugetlb: check for 0-length range after end address
adjustment
- mtd: rawnand: cadence: fix error code in cadence_nand_init()
- mtd: rawnand: cadence: use dma_map_resource for sdma address
- mtd: rawnand: cadence: fix incorrect device in dma_unmap_single
- EDAC/qcom: Correct interrupt enable register configuration
- ftrace: Correct preemption accounting for function tracing.
- ftrace: Do not add duplicate entries in subops manager ops
- arm64: dts: rockchip: change eth phy mode to rgmii-id for orangepi r1
plus lts
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
- KVM: x86: Get vcpu->arch.apic_base directly and drop kvm_get_apic_base()
- KVM: x86: Inline kvm_get_apic_mode() in lapic.h
- KVM: Introduce vcpu->wants_to_run
- KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
- drm/amd/display: Refactoring if and endif statements to enable DC_LOGGER
- arm64: dts: mt8183: add dpi node to mt8183
- arm64: dts: mt8183: Add port node to dpi node
- arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface
- arm64: dts: mediatek: mt8183: Disable DPI display output by default
- arm64: dts: mediatek: mt8183-pumpkin: add HDMI support
- arm64: dts: mediatek: mt8183: Disable DSI display output by default
- accel/ivpu: Limit FW version string length
- accel/ivpu: Add coredump support
- accel/ivpu: Add FW state dump on TDR
- accel/ivpu: Fix error handling in recovery/reset
- ASoC: SOF: topology: dynamically allocate and store DAI widget->private
- ASoC: SOF: topology: Parse DAI type token for dspless mode
- ASoC: imx-audmix: remove cpu_mclk which is from cpu dai device
- vsock/virtio: fix variables initialization during resuming
- drm/msm/dpu: skip watchdog timer programming through TOP on >= SM8450
- drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields
- drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG0 updated from driver side
- drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG1 against clock driver
- drm/msm/dsi/phy: Do not overwite PHY_CMN_CLK_CFG1 when choosing bitclk
source
- nvme: tcp: Fix compilation warning with W=1
- nvme-tcp: fix connect failure on receiving partial ICResp PDU
- drm: panel: jd9365da-h3: fix reset signal polarity
- io_uring/rw: forbid multishot async reads
- arm64: dts: rockchip: Fix broken tsadc pinctrl names for rk3588
- arm64: dts: rockchip: Move uart5 pin configuration to px30 ringneck SoM
- arm64: dts: rockchip: Disable DMA for uart5 on px30-ringneck
- s390/boot: Fix ESSA detection
- xfs: fix online repair probing when CONFIG_XFS_ONLINE_REPAIR=n
- smb: client: fix chmod(2) regression with ATTR_READONLY
- tracing: Fix using ret variable in tracing_set_tracer()
- selftests/mm: build with -O2
- Upstream stable to v6.6.80, v6.12.17
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21861
- mm/migrate_device: don't add folio to be freed to LRU in
migrate_device_finalize()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21868
- net: allow small head cache usage with large MAX_SKB_FRAGS values
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21869
- powerpc/code-patching: Disable KASAN report during patching via
temporary mm
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21870
- ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21844
- smb: client: Add check for next_buffer in receive_encrypted_standard()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21846
- acct: perform last write from workqueue
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21847
- ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21848
- nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21862
- drop_monitor: fix incorrect initialization order
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21871
- tee: optee: Fix supplicant wait loop
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21863
- io_uring: prevent opcode speculation
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2024-58088
- bpf: Fix deadlock when freeing cgroup storage
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21853
- bpf: avoid holding freeze_mutex during mmap operation
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21867
- bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21864
- tcp: drop secpath at the same time as we currently drop dst
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21854
- sockmap, vsock: For connectible sockets allow only connected
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21855
- ibmvnic: Don't reference skb after sending to VIOS
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21856
- s390/ism: add release function for struct device
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21857
- net/sched: cls_api: fix error handling causing NULL dereference
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21858
- geneve: Fix use-after-free in geneve_find_dev().
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21866
- powerpc/code-patching: Fix KASAN hit by not flagging text patching area
as VM_ALLOC
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21859
- USB: gadget: f_midi: f_midi_complete to call queue_work
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21746
- Input: synaptics - fix crash when enabling pass-through port
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2024-57977
- memcg: fix soft lockup in the OOM process
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21712
- md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
* CVE-2024-58093
- PCI/ASPM: Fix link state exit during switch upstream function removal
* [SRU]Request E825-C driver into latest LTS of Ubuntu OS 24.04
(LP: #2114785)
- ice: add support for 3k signing DDP sections for E825C
- ice: Add helper function ice_is_generic_mac
- ice: introduce new E825C devices family
* [UBUNTU 22.04] kernel: Fix z17 elf platform recognition (LP: #2114450)
- s390: Add z17 elf platform
* [UBUNTU 24.04] Kernel: Add CPUMF extended counter set for z17
(LP: #2114258)
- s390/cpumf: Update CPU Measurement facility extended counter set support
* Noble update: upstream stable patchset 2025-06-29 (LP: #2115616)
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: fix hang in nfsd4_shutdown_callback
- pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware
- HID: multitouch: Add NULL check in mt_input_configured
- HID: hid-thrustmaster: fix stack-out-of-bounds read in
usb_check_int_endpoints()
- spi: sn-f-ospi: Fix division by zero
- ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
- ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
- vrf: use RCU protection in l3mdev_l3_out()
- vxlan: check vxlan_vnigroup_init() return value
- LoongArch: Fix idle VS timer enqueue
- LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
- team: better TEAM_OPTION_TYPE_STRING validation
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- cgroup: Remove steal time from usage_usec
- drm/i915/selftests: avoid using uninitialized context
- gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
- gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
- gpio: bcm-kona: Add missing newline to dev_err format string
- drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
- xen/swiotlb: relax alignment requirements
- x86/xen: allow larger contiguous memory regions in PV guests
- block: cleanup and fix batch completion adding conditions
- gpiolib: Fix crash on error in gpiochip_get_ngpios()
- tools: fix annoying "mkdir -p ..." logs when building tools in parallel
- RDMA/efa: Reset device on probe failure
- fbdev: omap: use threaded IRQ for LCD DMA
- soc/tegra: fuse: Update Tegra234 nvmem keepout list
- media: cxd2841er: fix 64-bit division on gcc-9
- media: i2c: ds90ub913: Add error handling to ub913_hw_init()
- media: i2c: ds90ub953: Add error handling for i2c reads/writes
- media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
- media: uvcvideo: Add new quirk definition for the Sonix Technology Co.
292a camera
- media: uvcvideo: Add Kurokesu C1 PRO camera
- media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
- PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
- PCI: switchtec: Add Microchip PCI100X device IDs
- scsi: ufs: bsg: Set bsg_queue to NULL after removal
- rtla/timerlat_hist: Abort event processing on second signal
- rtla/timerlat_top: Abort event processing on second signal
- vfio/pci: Enable iowrite64 and ioread64 for vfio pci
- NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
- Grab mm lock before grabbing pt lock
- selftests: gpio: gpio-sim: Fix missing chip disablements
- ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V
- x86/mm/tlb: Only trim the mm_cpumask once a second
- orangefs: fix a oob in orangefs_debug_write
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
- batman-adv: fix panic during interface removal
- batman-adv: Ignore neighbor throughput metrics in error case
- batman-adv: Drop unmanaged ELP metric worker
- drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
- KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-
kernel
- KVM: nSVM: Enter guest mode before initializing nested NPT MMU
- perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
- usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI
bind retries
- usb: dwc3: Fix timeout issue during controller enter/exit from halt
state
- usb: roles: set switch registered flag early on
- usb: gadget: udc: renesas_usb3: Fix compiler warning
- usb: dwc2: gadget: remove of_node reference upon udc_stop
- USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
- usb: core: fix pipe creation for get_bMaxPacketSize0
- USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
- USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
- usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
- USB: hub: Ignore non-compliant devices with too many configs or
interfaces
- USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
- usb: cdc-acm: Check control transfer buffer size before access
- usb: cdc-acm: Fix handling of oversized fragments
- USB: serial: option: add MeiG Smart SLM828
- USB: serial: option: add Telit Cinterion FN990B compositions
- USB: serial: option: fix Telit Cinterion FN990A name
- USB: serial: option: drop MeiG Smart defines
- can: ctucanfd: handle skb allocation failure
- can: c_can: fix unbalanced runtime PM disable in error path
- can: j1939: j1939_sk_send_loop(): fix unable to send messages with data
length zero
- can: etas_es58x: fix potential NULL pointer dereference on udev->serial
- alpha: make stack 16-byte aligned (most cases)
- wifi: ath12k: fix handling of 6 GHz rules
- kbuild: userprogs: fix bitsize and target detection on clang
- efi: Avoid cold plugged memory for placing the kernel
- cgroup: fix race between fork and cgroup.kill
- serial: port: Assign ->iotype correctly when ->iobase is set
- serial: port: Always update ->iotype in __uart_read_properties()
- serial: 8250: Fix fifo underflow on flush
- alpha: align stack for page fault and user unaligned trap handlers
- gpiolib: acpi: Add a quirk for Acer Nitro ANV14
- gpio: stmpe: Check return value of stmpe_reg_read in
stmpe_gpio_irq_sync_unlock
- partitions: mac: fix handling of bogus partition table
- regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator
- regmap-irq: Add missing kfree()
- arm64: Handle .ARM.attributes section in linker scripts
- mmc: mtk-sd: Fix register settings for hs400(es) mode
- igc: Set buffer type for empty frames in igc_init_empty_frame
- mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()
- btrfs: fix hole expansion when writing at an offset beyond EOF
- clocksource: Use pr_info() for "Checking clocksource synchronization"
message
- clocksource: Use migrate_disable() to avoid calling get_random_u32() in
atomic context
- ipv4: add RCU protection to ip4_dst_hoplimit()
- net: add dev_net_rcu() helper
- ipv4: use RCU protection in ipv4_default_advmss()
- ipv4: use RCU protection in rt_is_expired()
- ipv4: use RCU protection in inet_select_addr()
- net: ipv4: Cache pmtu for all packet paths if multipath enabled
- ipv4: use RCU protection in __ip_rt_update_pmtu()
- ipv4: icmp: convert to dev_net_rcu()
- flow_dissector: use RCU protection to fetch dev_net()
- ipv6: use RCU protection in ip6_default_advmss()
- ipv6: icmp: convert to dev_net_rcu()
- HID: hid-steam: Add Deck IMU support
- HID: hid-steam: Make sure rumble work is canceled on removal
- HID: hid-steam: Move hidraw input (un)registering to work
- ndisc: use RCU protection in ndisc_alloc_skb()
- neighbour: delete redundant judgment statements
- neighbour: use RCU protection in __neigh_notify()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- ndisc: extend RCU protection in ndisc_send_skb()
- ipv6: mcast: extend RCU protection in igmp6_send()
- ipv6: mcast: add RCU protection to mld_newpack()
- drm/tidss: Fix issue in irq handling causing irq-flood issue
- drm/tidss: Clear the interrupt status for interrupts being disabled
- drm/rcar-du: dsi: Fix PHY lock bit check
- drm/v3d: Stop active perfmon if it is being destroyed
- netdevsim: print human readable IP address
- selftests: rtnetlink: update netdevsim ipsec output format
- md/md-bitmap: factor behind write counters out from
bitmap_{start/end}write()
- md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
- md/md-bitmap: move bitmap_{start, end}write to md upper layer
- mm: gup: fix infinite loop within __get_longterm_locked
- alpha: replace hardcoded stack offsets with autogenerated ones
- HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context
- io_uring/kbuf: reallocate buf lists on upgrade
- x86/i8253: Disable PIT timer 0 when not in use
- pinctrl: cy8c95x0: Rename PWMSEL to SELPWM
- pinctrl: pinconf-generic: print hex value
- pinctrl: pinconf-generic: Print unsigned value if a format is registered
- idpf: fix handling rsc packet with a single segment
- idpf: call set_real_num_queues in idpf_open
- igc: Fix HW RX timestamp when passed by ZC XDP
- LoongArch: KVM: Fix typo issue about GCFG feature detection
- workqueue: Put the pwq after detaching the rescuer from the pool
- perf/x86/intel: Clean up PEBS-via-PT on hybrid
- drm/xe/client: bo->client does not need bos_lock
- io_uring/waitid: don't abuse io_tw_state
- drm: Fix DSC BPP increment decoding
- i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming
- i3c: mipi-i3c-hci: Add support for MIPI I3C HCI on PCI bus
- [Config] updateconfigs for MIPI_I3C_HCI_PCI
- serial: 8250_pci: Resolve WCH vendor ID ambiguity
- serial: 8250_pci: Share WCH IDs with parport_serial driver
- fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
- kbuild: suppress stdout from merge_config for silent builds
- KVM: x86: Load DR6 with guest value only before entering .vcpu_run()
loop
- perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
- USB: gadget: core: create sysfs link between udc and gadget
- usb: gadget: core: flush gadget workqueue after device removal
- include: net: add static inline dst_dev_overhead() to dst.h
- net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue
- net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
- net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
- net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
- scsi: ufs: core: Introduce ufshcd_has_pending_tasks()
- scsi: ufs: core: Prepare to introduce a new clock_gating lock
- scsi: ufs: core: Introduce a new clock_gating lock
- scsi: ufs: Fix toggling of clk_gating.state when clock gating is not
allowed
- ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
- drm/tidss: Fix race condition while handling interrupt registers
- drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
- wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
- net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
- scsi: ufs: core: Ensure clk_gating.lock is used only after
initialization
- serial: 8250_dma: terminate correct DMA in tx_dma_flush()
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
- HID: hid-steam: Fix use-after-free when detaching device
- block: change blk_mq_add_to_batch() third argument type to bool
- nvme: move error logging from nvme_end_req() to __nvme_end_req()
- Upstream stable to v6.6.79, v6.12.16
* Noble update: upstream stable patchset 2025-06-17 (LP: #2114849)
- ice: Add check for devm_kzalloc()
- io_uring/rw: commit provided buffer state on async
- mptcp: pm: only set fullmesh for subflow endp
- selftests: mptcp: join: fix AF_INET6 variable
- xfs: don't lose solo dquot update transactions
- Upstream stable to v6.6.78, v6.12.15
* [Regression Updates] "PCI: Explicitly put devices into D0 when
initializing" breaks pci-pass-through in QEMU/KVM (LP: #2117494)
- PCI/PM: Set up runtime PM even for devices without PCI PM
* CVE-2025-38083
- net_sched: prio: fix a race in prio_tune()
* CVE-2025-37797
- net_sched: hfsc: Fix a UAF vulnerability in class handling
-- Stefan Bader <stefan.bader@canonical.com> Fri, 25 Jul 2025 09:52:09 +0200
linux-hwe-6.8 (6.8.0-70.70~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-70.70~22.04.1 -proposed tracker (LP: #2116643)
* Packaging resync (LP: #1786013)
- [Packaging] debian.hwe-6.8/dkms-versions -- update from kernel-versions
(main/2025.07.14)
[ Ubuntu: 6.8.0-70.70 ]
* noble/linux: 6.8.0-70.70 -proposed tracker (LP: #2116645)
* Packaging resync (LP: #1786013)
- [Packaging] update annotations scripts
- [Packaging] debian.master/dkms-versions -- update from kernel-versions
(main/2025.07.14)
* NVMe namespace ID mismatch on repeated map/unmap (LP: #2115209)
- nvme: requeue namespace scan on missed AENs
- nvme: re-read ANA log page after ns scan completes
- nvme: fixup scan failure for non-ANA multipath controllers
* integrated I219-LM network adapter appears to be running too fast, causing
synchronization issues when using the I219-LM PTP feature (LP: #2116072)
- e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
* intel_rapl: support ARL-H hardware (LP: #2115652)
- powercap: intel_rapl_msr: Add PL4 support for ArrowLake-H
* Ubuntu 24.04+ arm64: screen resolution fixed to 1024x768 with last kernel
update (LP: #2115068)
- [Config] Replace FB_HYPERV with DRM_HYPERV
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212)
- arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings
- xfs: assert a valid limit in xfs_rtfind_forw
- xfs: validate inumber in xfs_iget
- xfs: fix a sloppy memory handling bug in xfs_iroot_realloc
- xfs: fix a typo
- xfs: skip background cowblock trims on inodes open for write
- xfs: don't free cowblocks from under dirty pagecache on unshare
- xfs: merge xfs_attr_leaf_try_add into xfs_attr_leaf_addname
- xfs: return bool from xfs_attr3_leaf_add
- xfs: distinguish extra split from real ENOSPC from xfs_attr3_leaf_split
- xfs: distinguish extra split from real ENOSPC from
xfs_attr_node_try_addname
- xfs: fold xfs_bmap_alloc_userdata into xfs_bmapi_allocate
- xfs: don't ifdef around the exact minlen allocations
- xfs: call xfs_bmap_exact_minlen_extent_alloc from xfs_bmap_btalloc
- xfs: support lowmode allocations in xfs_bmap_exact_minlen_extent_alloc
- xfs: Use try_cmpxchg() in xlog_cil_insert_pcp_aggregate()
- xfs: Remove empty declartion in header file
- xfs: pass the exact range to initialize to xfs_initialize_perag
- xfs: update the file system geometry after recoverying superblock
buffers
- xfs: error out when a superblock buffer update reduces the agcount
- xfs: don't use __GFP_RETRY_MAYFAIL in xfs_initialize_perag
- xfs: update the pag for the last AG at recovery time
- xfs: Reduce unnecessary searches when searching for the best extents
- xfs: streamline xfs_filestream_pick_ag
- xfs: Check for delayed allocations before setting extsize
- md/md-bitmap: replace md_bitmap_status() with a new helper
md_bitmap_get_stats()
- md/md-cluster: fix spares warnings for __le64
- md/md-bitmap: add 'sync_size' into struct md_bitmap_stats
- mm: update mark_victim tracepoints fields
- cpufreq: dt-platdev: add missing MODULE_DESCRIPTION() macro
- cpufreq: fix using cpufreq-dt as module
- Bluetooth: qca: Support downloading board id specific NVM for WCN7850
- Bluetooth: qca: Update firmware-name to support board specific nvm
- Bluetooth: qca: Fix poor RF performance for WCN6855
- Input: serio - define serio_pause_rx guard to pause and resume serio
ports
- ASoC: renesas: rz-ssi: Add a check for negative sample_space
- ASoC: rockchip: i2s-tdm: fix shift config for SND_SOC_DAIFMT_DSP_[AB]
- powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
- powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
- ALSA: seq: Drop UMP events when no UMP-conversion is set
- ibmvnic: Return error code on TX scrq flush fail
- ibmvnic: Introduce send sub-crq direct
- ibmvnic: Add stat for tx direct vs tx batched
- vsock/bpf: Warn on socket without transport
- tcp: adjust rcvq_space after updating scaling ratio
- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
- flow_dissector: Fix handling of mixed port and port-range keys
- flow_dissector: Fix port range key handling in BPF conversion
- net: Add non-RCU dev_getbyhwaddr() helper
- arp: switch to dev_getbyhwaddr() in arp_req_set_public()
- net: axienet: Set mac_managed_pm
- bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
- strparser: Add read_sock callback
- bpf: Fix wrong copied_seq calculation
- bpf: Disable non stream socket for strparser
- power: supply: da9150-fg: fix potential overflow
- nouveau/svm: fix missing folio unlock + put after
make_device_exclusive_range()
- drm/msm: Avoid rounding up to one jiffy
- nvme/ioctl: add missing space in err message
- bpf: skip non exist keys in generic_map_lookup_batch
- drm/nouveau/pmu: Fix gp10b firmware guard
- drm/msm/dpu: Disable dither in phys encoder cleanup
- drm/i915: Make sure all planes in use by the joiner have their crtc
included
- drm/i915/dp: Fix error handling during 128b/132b link training
- soc: loongson: loongson2_guts: Add check for devm_kstrdup()
- lib/iov_iter: fix import_iovec_ubuf iovec management
- ASoC: fsl_micfil: Enable default case in micfil_set_quality()
- ALSA: hda: Add error check for snd_ctl_rename_id() in
snd_hda_create_dig_out_ctls()
- ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
- ASoC: SOF: pcm: Clear the susbstream pointer to NULL on close
- acct: block access to kernel internal filesystems
- mm,madvise,hugetlb: check for 0-length range after end address
adjustment
- mtd: rawnand: cadence: fix error code in cadence_nand_init()
- mtd: rawnand: cadence: use dma_map_resource for sdma address
- mtd: rawnand: cadence: fix incorrect device in dma_unmap_single
- EDAC/qcom: Correct interrupt enable register configuration
- ftrace: Correct preemption accounting for function tracing.
- ftrace: Do not add duplicate entries in subops manager ops
- arm64: dts: rockchip: change eth phy mode to rgmii-id for orangepi r1
plus lts
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit
- KVM: x86: Get vcpu->arch.apic_base directly and drop kvm_get_apic_base()
- KVM: x86: Inline kvm_get_apic_mode() in lapic.h
- KVM: Introduce vcpu->wants_to_run
- KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
- drm/amd/display: Refactoring if and endif statements to enable DC_LOGGER
- arm64: dts: mt8183: add dpi node to mt8183
- arm64: dts: mt8183: Add port node to dpi node
- arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface
- arm64: dts: mediatek: mt8183: Disable DPI display output by default
- arm64: dts: mediatek: mt8183-pumpkin: add HDMI support
- arm64: dts: mediatek: mt8183: Disable DSI display output by default
- accel/ivpu: Limit FW version string length
- accel/ivpu: Add coredump support
- accel/ivpu: Add FW state dump on TDR
- accel/ivpu: Fix error handling in recovery/reset
- ASoC: SOF: topology: dynamically allocate and store DAI widget->private
- ASoC: SOF: topology: Parse DAI type token for dspless mode
- ASoC: imx-audmix: remove cpu_mclk which is from cpu dai device
- vsock/virtio: fix variables initialization during resuming
- drm/msm/dpu: skip watchdog timer programming through TOP on >= SM8450
- drm/msm/dpu: Don't leak bits_per_component into random DSC_ENC fields
- drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG0 updated from driver side
- drm/msm/dsi/phy: Protect PHY_CMN_CLK_CFG1 against clock driver
- drm/msm/dsi/phy: Do not overwite PHY_CMN_CLK_CFG1 when choosing bitclk
source
- nvme: tcp: Fix compilation warning with W=1
- nvme-tcp: fix connect failure on receiving partial ICResp PDU
- drm: panel: jd9365da-h3: fix reset signal polarity
- io_uring/rw: forbid multishot async reads
- arm64: dts: rockchip: Fix broken tsadc pinctrl names for rk3588
- arm64: dts: rockchip: Move uart5 pin configuration to px30 ringneck SoM
- arm64: dts: rockchip: Disable DMA for uart5 on px30-ringneck
- s390/boot: Fix ESSA detection
- xfs: fix online repair probing when CONFIG_XFS_ONLINE_REPAIR=n
- smb: client: fix chmod(2) regression with ATTR_READONLY
- tracing: Fix using ret variable in tracing_set_tracer()
- selftests/mm: build with -O2
- Upstream stable to v6.6.80, v6.12.17
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21861
- mm/migrate_device: don't add folio to be freed to LRU in
migrate_device_finalize()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21868
- net: allow small head cache usage with large MAX_SKB_FRAGS values
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21869
- powerpc/code-patching: Disable KASAN report during patching via
temporary mm
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21870
- ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21844
- smb: client: Add check for next_buffer in receive_encrypted_standard()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21846
- acct: perform last write from workqueue
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21847
- ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21848
- nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21862
- drop_monitor: fix incorrect initialization order
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21871
- tee: optee: Fix supplicant wait loop
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21863
- io_uring: prevent opcode speculation
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2024-58088
- bpf: Fix deadlock when freeing cgroup storage
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21853
- bpf: avoid holding freeze_mutex during mmap operation
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21867
- bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21864
- tcp: drop secpath at the same time as we currently drop dst
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21854
- sockmap, vsock: For connectible sockets allow only connected
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21855
- ibmvnic: Don't reference skb after sending to VIOS
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21856
- s390/ism: add release function for struct device
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21857
- net/sched: cls_api: fix error handling causing NULL dereference
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21858
- geneve: Fix use-after-free in geneve_find_dev().
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21866
- powerpc/code-patching: Fix KASAN hit by not flagging text patching area
as VM_ALLOC
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21859
- USB: gadget: f_midi: f_midi_complete to call queue_work
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21746
- Input: synaptics - fix crash when enabling pass-through port
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2024-57977
- memcg: fix soft lockup in the OOM process
* Noble update: upstream stable patchset 2025-07-09 (LP: #2116212) //
CVE-2025-21712
- md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
* CVE-2025-37797
- net_sched: hfsc: Fix a UAF vulnerability in class handling
* CVE-2024-58093
- PCI/ASPM: Fix link state exit during switch upstream function removal
* [SRU]Request E825-C driver into latest LTS of Ubuntu OS 24.04
(LP: #2114785)
- ice: add support for 3k signing DDP sections for E825C
- ice: Add helper function ice_is_generic_mac
- ice: introduce new E825C devices family
* [UBUNTU 22.04] kernel: Fix z17 elf platform recognition (LP: #2114450)
- s390: Add z17 elf platform
* [UBUNTU 24.04] Kernel: Add CPUMF extended counter set for z17
(LP: #2114258)
- s390/cpumf: Update CPU Measurement facility extended counter set support
* Noble update: upstream stable patchset 2025-06-29 (LP: #2115616)
- nfsd: clear acl_access/acl_default after releasing them
- NFSD: fix hang in nfsd4_shutdown_callback
- pinctrl: cy8c95x0: Respect IRQ trigger settings from firmware
- HID: multitouch: Add NULL check in mt_input_configured
- HID: hid-thrustmaster: fix stack-out-of-bounds read in
usb_check_int_endpoints()
- spi: sn-f-ospi: Fix division by zero
- ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
- ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
- vrf: use RCU protection in l3mdev_l3_out()
- vxlan: check vxlan_vnigroup_init() return value
- LoongArch: Fix idle VS timer enqueue
- LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
- team: better TEAM_OPTION_TYPE_STRING validation
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
- cgroup: Remove steal time from usage_usec
- drm/i915/selftests: avoid using uninitialized context
- gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
- gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
- gpio: bcm-kona: Add missing newline to dev_err format string
- drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
- xen/swiotlb: relax alignment requirements
- x86/xen: allow larger contiguous memory regions in PV guests
- block: cleanup and fix batch completion adding conditions
- gpiolib: Fix crash on error in gpiochip_get_ngpios()
- tools: fix annoying "mkdir -p ..." logs when building tools in parallel
- RDMA/efa: Reset device on probe failure
- fbdev: omap: use threaded IRQ for LCD DMA
- soc/tegra: fuse: Update Tegra234 nvmem keepout list
- media: cxd2841er: fix 64-bit division on gcc-9
- media: i2c: ds90ub913: Add error handling to ub913_hw_init()
- media: i2c: ds90ub953: Add error handling for i2c reads/writes
- media: uvcvideo: Implement dual stream quirk to fix loss of usb packets
- media: uvcvideo: Add new quirk definition for the Sonix Technology Co.
292a camera
- media: uvcvideo: Add Kurokesu C1 PRO camera
- media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
- PCI/DPC: Quirk PIO log size for Intel Raptor Lake-P
- PCI: switchtec: Add Microchip PCI100X device IDs
- scsi: ufs: bsg: Set bsg_queue to NULL after removal
- rtla/timerlat_hist: Abort event processing on second signal
- rtla/timerlat_top: Abort event processing on second signal
- vfio/pci: Enable iowrite64 and ioread64 for vfio pci
- NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
- Grab mm lock before grabbing pt lock
- selftests: gpio: gpio-sim: Fix missing chip disablements
- ACPI: x86: Add skip i2c clients quirk for Vexia EDU ATLA 10 tablet 5V
- x86/mm/tlb: Only trim the mm_cpumask once a second
- orangefs: fix a oob in orangefs_debug_write
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
- batman-adv: fix panic during interface removal
- batman-adv: Ignore neighbor throughput metrics in error case
- batman-adv: Drop unmanaged ELP metric worker
- drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
- KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-
kernel
- KVM: nSVM: Enter guest mode before initializing nested NPT MMU
- perf/x86/intel: Ensure LBRs are disabled when a CPU is starting
- usb: gadget: f_midi: Fixing wMaxPacketSize exceeded issue during MIDI
bind retries
- usb: dwc3: Fix timeout issue during controller enter/exit from halt
state
- usb: roles: set switch registered flag early on
- usb: gadget: udc: renesas_usb3: Fix compiler warning
- usb: dwc2: gadget: remove of_node reference upon udc_stop
- USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
- usb: core: fix pipe creation for get_bMaxPacketSize0
- USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
- USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
- usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
- USB: hub: Ignore non-compliant devices with too many configs or
interfaces
- USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
- usb: cdc-acm: Check control transfer buffer size before access
- usb: cdc-acm: Fix handling of oversized fragments
- USB: serial: option: add MeiG Smart SLM828
- USB: serial: option: add Telit Cinterion FN990B compositions
- USB: serial: option: fix Telit Cinterion FN990A name
- USB: serial: option: drop MeiG Smart defines
- can: ctucanfd: handle skb allocation failure
- can: c_can: fix unbalanced runtime PM disable in error path
- can: j1939: j1939_sk_send_loop(): fix unable to send messages with data
length zero
- can: etas_es58x: fix potential NULL pointer dereference on udev->serial
- alpha: make stack 16-byte aligned (most cases)
- wifi: ath12k: fix handling of 6 GHz rules
- kbuild: userprogs: fix bitsize and target detection on clang
- efi: Avoid cold plugged memory for placing the kernel
- cgroup: fix race between fork and cgroup.kill
- serial: port: Assign ->iotype correctly when ->iobase is set
- serial: port: Always update ->iotype in __uart_read_properties()
- serial: 8250: Fix fifo underflow on flush
- alpha: align stack for page fault and user unaligned trap handlers
- gpiolib: acpi: Add a quirk for Acer Nitro ANV14
- gpio: stmpe: Check return value of stmpe_reg_read in
stmpe_gpio_irq_sync_unlock
- partitions: mac: fix handling of bogus partition table
- regulator: qcom_smd: Add l2, l5 sub-node to mp5496 regulator
- regmap-irq: Add missing kfree()
- arm64: Handle .ARM.attributes section in linker scripts
- mmc: mtk-sd: Fix register settings for hs400(es) mode
- igc: Set buffer type for empty frames in igc_init_empty_frame
- mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()
- btrfs: fix hole expansion when writing at an offset beyond EOF
- clocksource: Use pr_info() for "Checking clocksource synchronization"
message
- clocksource: Use migrate_disable() to avoid calling get_random_u32() in
atomic context
- ipv4: add RCU protection to ip4_dst_hoplimit()
- net: add dev_net_rcu() helper
- ipv4: use RCU protection in ipv4_default_advmss()
- ipv4: use RCU protection in rt_is_expired()
- ipv4: use RCU protection in inet_select_addr()
- net: ipv4: Cache pmtu for all packet paths if multipath enabled
- ipv4: use RCU protection in __ip_rt_update_pmtu()
- ipv4: icmp: convert to dev_net_rcu()
- flow_dissector: use RCU protection to fetch dev_net()
- ipv6: use RCU protection in ip6_default_advmss()
- ipv6: icmp: convert to dev_net_rcu()
- HID: hid-steam: Add Deck IMU support
- HID: hid-steam: Make sure rumble work is canceled on removal
- HID: hid-steam: Move hidraw input (un)registering to work
- ndisc: use RCU protection in ndisc_alloc_skb()
- neighbour: delete redundant judgment statements
- neighbour: use RCU protection in __neigh_notify()
- arp: use RCU protection in arp_xmit()
- openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
- ndisc: extend RCU protection in ndisc_send_skb()
- ipv6: mcast: extend RCU protection in igmp6_send()
- ipv6: mcast: add RCU protection to mld_newpack()
- drm/tidss: Fix issue in irq handling causing irq-flood issue
- drm/tidss: Clear the interrupt status for interrupts being disabled
- drm/rcar-du: dsi: Fix PHY lock bit check
- drm/v3d: Stop active perfmon if it is being destroyed
- netdevsim: print human readable IP address
- selftests: rtnetlink: update netdevsim ipsec output format
- md/md-bitmap: factor behind write counters out from
bitmap_{start/end}write()
- md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
- md/md-bitmap: move bitmap_{start, end}write to md upper layer
- mm: gup: fix infinite loop within __get_longterm_locked
- alpha: replace hardcoded stack offsets with autogenerated ones
- HID: hid-steam: Don't use cancel_delayed_work_sync in IRQ context
- io_uring/kbuf: reallocate buf lists on upgrade
- x86/i8253: Disable PIT timer 0 when not in use
- pinctrl: cy8c95x0: Rename PWMSEL to SELPWM
- pinctrl: pinconf-generic: print hex value
- pinctrl: pinconf-generic: Print unsigned value if a format is registered
- idpf: fix handling rsc packet with a single segment
- idpf: call set_real_num_queues in idpf_open
- igc: Fix HW RX timestamp when passed by ZC XDP
- LoongArch: KVM: Fix typo issue about GCFG feature detection
- workqueue: Put the pwq after detaching the rescuer from the pool
- perf/x86/intel: Clean up PEBS-via-PT on hybrid
- drm/xe/client: bo->client does not need bos_lock
- io_uring/waitid: don't abuse io_tw_state
- drm: Fix DSC BPP increment decoding
- i3c: mipi-i3c-hci: Add Intel specific quirk to ring resuming
- i3c: mipi-i3c-hci: Add support for MIPI I3C HCI on PCI bus
- [Config] updateconfigs for MIPI_I3C_HCI_PCI
- serial: 8250_pci: Resolve WCH vendor ID ambiguity
- serial: 8250_pci: Share WCH IDs with parport_serial driver
- fs/ntfs3: Unify inode corruption marking with _ntfs_bad_inode()
- kbuild: suppress stdout from merge_config for silent builds
- KVM: x86: Load DR6 with guest value only before entering .vcpu_run()
loop
- perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
- USB: gadget: core: create sysfs link between udc and gadget
- usb: gadget: core: flush gadget workqueue after device removal
- include: net: add static inline dst_dev_overhead() to dst.h
- net: ipv6: ioam6_iptunnel: mitigate 2-realloc issue
- net: ipv6: seg6_iptunnel: mitigate 2-realloc issue
- net: ipv6: rpl_iptunnel: mitigate 2-realloc issue
- net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
- scsi: ufs: core: Introduce ufshcd_has_pending_tasks()
- scsi: ufs: core: Prepare to introduce a new clock_gating lock
- scsi: ufs: core: Introduce a new clock_gating lock
- scsi: ufs: Fix toggling of clk_gating.state when clock gating is not
allowed
- ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
- drm/tidss: Fix race condition while handling interrupt registers
- drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
- wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
- net: ipv6: fix dst refleaks in rpl, seg6 and ioam6 lwtunnels
- scsi: ufs: core: Ensure clk_gating.lock is used only after
initialization
- serial: 8250_dma: terminate correct DMA in tx_dma_flush()
- x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
- HID: hid-steam: Fix use-after-free when detaching device
- block: change blk_mq_add_to_batch() third argument type to bool
- nvme: move error logging from nvme_end_req() to __nvme_end_req()
- Upstream stable to v6.6.79, v6.12.16
* Noble update: upstream stable patchset 2025-06-17 (LP: #2114849)
- ice: Add check for devm_kzalloc()
- io_uring/rw: commit provided buffer state on async
- mptcp: pm: only set fullmesh for subflow endp
- selftests: mptcp: join: fix AF_INET6 variable
- xfs: don't lose solo dquot update transactions
- Upstream stable to v6.6.78, v6.12.15
* CVE-2025-38083
- net_sched: prio: fix a race in prio_tune()
-- Stefan Bader <stefan.bader@canonical.com> Thu, 17 Jul 2025 14:48:53 +0200
linux-hwe-6.8 (6.8.0-65.68~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-65.68~22.04.1 -proposed tracker (LP: #2116397)
[ Ubuntu: 6.8.0-65.68 ]
* noble/linux: 6.8.0-65.68 -proposed tracker (LP: #2116399)
* CVE-2025-38083
- net_sched: prio: fix a race in prio_tune()
* CVE-2025-37797
- net_sched: hfsc: Fix a UAF vulnerability in class handling
-- Stefan Bader <stefan.bader@canonical.com> Tue, 15 Jul 2025 18:33:52 +0200
linux-hwe-6.8 (6.8.0-64.67~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-64.67~22.04.1 -proposed tracker (LP: #2114666)
[ Ubuntu: 6.8.0-64.67 ]
* noble/linux: 6.8.0-64.67 -proposed tracker (LP: #2114668)
* Unexpected system reboot at loading GUI session on some AMD platforms
(LP: #2112462)
- drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush
- drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush
- drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
- drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush
* [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
(LP: #2114174)
- s390/pci: rename lock member in struct zpci_dev
- s390/pci: introduce lock to synchronize state of zpci_dev's
- s390/pci: remove hotplug slot when releasing the device
- s390/pci: Remove redundant bus removal and disable from
zpci_release_device()
- s390/pci: Prevent self deletion in disable_slot()
- s390/pci: Allow re-add of a reserved but not yet removed device
- s390/pci: Serialize device addition and removal
* [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
(LP: #2114174) // CVE-2025-37946
- s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has
child VFs
* [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
(LP: #2114174) // CVE-2025-37974
- s390/pci: Fix missing check for zpci_create_device() error return
* [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
(LP: #2114174) // CVE-2024-56699
- s390/pci: Fix potential double remove of hotplug slot
* System will restart while resuming with SATA HDD or nvme installed with
password set (LP: #2110090)
- PCI: Explicitly put devices into D0 when initializing
* Noble update: upstream stable patchset 2025-06-12 (LP: #2114239)
- btrfs: fix assertion failure when splitting ordered extent after
transaction abort
- btrfs: fix use-after-free when attempting to join an aborted transaction
- arm64/mm: Ensure adequate HUGE_MAX_HSTATE
- exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
- s390/stackleak: Use exrl instead of ex in __stackleak_poison()
- btrfs: fix data race when accessing the inode's disk_i_size at
btrfs_drop_extents()
- btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error
handling
- sched: Don't try to catch up excess steal time.
- locking/ww_mutex/test: Use swap() macro
- lockdep: Fix upper limit for LOCKDEP_*_BITS configs
- x86/amd_nb: Restrict init function to AMD-based systems
- drm/virtio: New fence for every plane update
- drm: Add panel backlight quirks
- drm: panel-backlight-quirks: Add Framework 13 matte panel
- drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
- nvkm/gsp: correctly advance the read pointer of GSP message queue
- nvkm: correctly calculate the available space of the GSP cmdq buffer
- drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
- drm/amd/display: Overwriting dualDPP UBF values before usage
- printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
- drm/connector: add mutex to protect ELD from concurrent access
- drm/bridge: anx7625: use eld_mutex to protect access to connector->eld
- drm/bridge: ite-it66121: use eld_mutex to protect access to
connector->eld
- drm/amd/display: use eld_mutex to protect access to connector->eld
- drm/exynos: hdmi: use eld_mutex to protect access to connector->eld
- drm/radeon: use eld_mutex to protect access to connector->eld
- drm/sti: hdmi: use eld_mutex to protect access to connector->eld
- drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
- drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
- drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
- drm/amdkfd: Queue interrupt work to different CPU
- drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
- drm/bridge: it6505: fix HDCP Bstatus check
- drm/bridge: it6505: fix HDCP encryption when R0 ready
- drm/bridge: it6505: fix HDCP CTS compare V matching
- drm/bridge: it6505: fix HDCP V match check is not performed correctly
- drm/bridge: it6505: fix HDCP CTS KSV list wait timer
- safesetid: check size of policy writes
- drm/amd/display: Increase sanitizer frame larger than limit when compile
testing with clang
- drm/amd/display: Limit Scaling Ratio on DCN3.01
- wifi: rtw89: add crystal_cap check to avoid setting as overflow value
- tun: fix group permission check
- mmc: core: Respect quirk_max_rate for non-UHS SDIO card
- mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
- tomoyo: don't emit warning in tomoyo_write_control()
- mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
- wifi: rtw88: add __packed attribute to efuse layout struct
- clk: qcom: Make GCC_8150 depend on QCOM_GDSC
- HID: multitouch: Add quirk for Hantick 5288 touchpad
- HID: Wacom: Add PCI Wacom device support
- net/mlx5: use do_aux_work for PHC overflow checks
- wifi: brcmfmac: Check the return value of
of_property_read_string_index()
- wifi: iwlwifi: pcie: Add support for new device ids
- wifi: iwlwifi: avoid memory leak
- i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
- APEI: GHES: Have GHES honor the panic= setting
- Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
- Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
- Bluetooth: MGMT: Fix slab-use-after-free Read in
mgmt_remove_adv_monitor_sync
- net: wwan: iosm: Fix hibernation by re-binding the driver around it
- mmc: sdhci-msm: Correctly set the load for the regulator
- octeon_ep: update tx/rx stats locally for persistence
- tipc: re-order conditions in tipc_crypto_key_rcv()
- selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
- x86/kexec: Allocate PGD for x86_64 transition page tables separately
- iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
- iommu/arm-smmu-v3: Clean up more on probe failure
- platform/x86: int3472: Check for adev == NULL
- platform/x86: acer-wmi: Add support for Acer PH14-51
- ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
- platform/x86: acer-wmi: Add support for Acer Predator PH16-72
- ASoC: amd: Add ACPI dependency to fix build error
- Input: allocate keycode for phone linking
- platform/x86: acer-wmi: add support for Acer Nitro AN515-58
- platform/x86: acer-wmi: Ignore AC events
- xfs: report realtime block quota limits on realtime directories
- xfs: don't over-report free space or inodes in statvfs
- tty: xilinx_uartps: split sysrq handling
- tty: vt: pass proper pointers from tioclinux()
- tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
- tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
- platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
- nvme: handle connectivity loss in nvme_set_queue_count
- firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
- gpu: drm_dp_cec: fix broken CEC adapter properties check
- ice: put Rx buffers after being done with current frame
- ice: gather page_count()'s of each frag right before XDP prog call
- ice: stop storing XDP verdict within ice_rx_buf
- nvme-fc: use ctrl state getter
- net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
- vmxnet3: Fix tx queue race condition with XDP
- tg3: Disable tg3 PCIe AER on system reboot
- udp: gso: do not drop small packets when PMTU reduces
- rxrpc: Fix the rxrpc_connection attend queue handling
- gpio: pca953x: Improve interrupt support
- net: atlantic: fix warning during hot unplug
- net: rose: lock the socket in rose_bind()
- ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
- tun: revert fix group permission check
- net: sched: Fix truncation of offloaded action statistics
- rxrpc: Fix call state set to not include the SERVER_SECURING state
- cpufreq: s3c64xx: Fix compilation warning
- leds: lp8860: Write full EEPROM, not only half of it
- ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
- drm/modeset: Handle tiled displays in pan_display_atomic.
- drm/client: Handle tiled displays better
- smb: client: fix order of arguments of tracepoints
- smb: client: change lease epoch type from unsigned int to __u16
- s390/futex: Fix FUTEX_OP_ANDN implementation
- arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented
- m68k: vga: Fix I/O defines
- fs/proc: do_task_stat: Fix ESP not readable during coredump
- binfmt_flat: Fix integer overflow bug on 32 bit systems
- accel/ivpu: Fix Qemu crash when running in passthrough
- arm64/kvm: Configure HYP TCR.PS/DS based on host stage1
- arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
- KVM: arm64: timer: Always evaluate the need for a soft timer
- drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
- arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
- remoteproc: omap: Handle ARM dma_iommu_mapping
- KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
- KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
- ksmbd: fix integer overflows on 32 bit systems
- drm/amd/display: Optimize cursor position updates
- drm/amd/pm: Mark MM activity as unsupported
- drm/amdkfd: only flush the validate MES contex
- drm/i915/guc: Debug print LRC state entries only if the context is
pinned
- drm/i915: Fix page cleanup on DMA remap failure
- drm/komeda: Add check for komeda_get_layer_fourcc_list()
- drm/i915/dp: Iterate DSC BPP from high to low on all platforms
- drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
- drm/amd/display: Fix seamless boot sequence
- Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
- clk: sunxi-ng: a100: enable MMC clock reparenting
- clk: mmp2: call pm_genpd_init() only after genpd.name is set
- media: i2c: ds90ub960: Fix UB9702 refclk register access
- clk: qcom: clk-alpha-pll: fix alpha mode configuration
- clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
- clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during gdsc_disable()
- clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
- clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
- clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
- clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
- clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
- clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe
- clk: mediatek: mt2701-bdp: add missing dummy clk
- clk: mediatek: mt2701-img: add missing dummy clk
- clk: mediatek: mt2701-mm: add missing dummy clk
- blk-cgroup: Fix class @block_class's subsystem refcount leakage
- efi: libstub: Use '-std=gnu11' to fix build with GCC 15
- perf bench: Fix undefined behavior in cmpworker()
- scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
- of: Correct child specifier used as input of the 2nd nexus node
- of: Fix of_find_node_opts_by_path() handling of alias+path+options
- Input: bbnsm_pwrkey - add remove hook
- HID: hid-sensor-hub: don't use stale platform-data on remove
- ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
- atomic64: Use arch_spin_locks instead of raw_spin_locks
- wifi: rtlwifi: rtl8821ae: Fix media status report
- wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
- wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
- wifi: rtw88: sdio: Fix disconnection after beacon loss
- wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
- usb: gadget: f_tcm: Translate error to sense
- usb: gadget: f_tcm: Decrement command ref count on cleanup
- usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
- usb: gadget: f_tcm: Don't prepare BOT write request twice
- usbnet: ipheth: fix possible overflow in DPE length check
- usbnet: ipheth: use static NDP16 location in URB
- usbnet: ipheth: check that DPE points past NCM header
- usbnet: ipheth: refactor NCM datagram loop
- usbnet: ipheth: break up NCM header size computation
- usbnet: ipheth: fix DPE OoB read
- usbnet: ipheth: document scope of NCM implementation
- ASoC: acp: Support microphone from Lenovo Go S
- soc: qcom: socinfo: Avoid out of bounds read of serial number
- serial: sh-sci: Drop __initdata macro for port_cfg
- serial: sh-sci: Do not probe the serial port if its slot in sci_ports[]
is in use
- MIPS: Loongson64: remove ROM Size unit in boardinfo
- LoongArch: Extend the maximum number of watchpoints
- powerpc/pseries/eeh: Fix get PE state translation
- dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
- dm-crypt: track tag_offset in convert_context
- mips/math-emu: fix emulation of the prefx instruction
- MIPS: pci-legacy: Override pci_address_to_pio
- block: don't revert iter for -EIOCBQUEUED
- firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available()
- ALSA: hda/realtek: Enable headset mic on Positivo C6400
- ALSA: hda: Fix headset detection failure due to unstable sort
- ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model
- ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
- arm64: tegra: Fix Tegra234 PCIe interrupt-map
- PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
- PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
- PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
- scsi: st: Don't set pos_unknown just after device recognition
- scsi: qla2xxx: Move FCE Trace buffer allocation to user control
- scsi: ufs: qcom: Fix crypto key eviction
- scsi: ufs: core: Fix use-after free in init error and remove paths
- scsi: storvsc: Set correct data length for sending SCSI command without
payload
- scsi: core: Do not retry I/Os during depopulation
- kbuild: Move -Wenum-enum-conversion to W=2
- rust: init: use explicit ABI to clean warning in future compilers
- x86/boot: Use '-std=gnu11' to fix build with GCC 15
- ubi: Add a check for ubi_num
- ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
- ARM: dts: ti/omap: gta04: fix pm issues caused by spi module
- arm64: dts: qcom: sm6115: Fix MPSS memory length
- arm64: dts: qcom: sm6115: Fix CDSP memory length
- arm64: dts: qcom: sm6115: Fix ADSP memory base and length
- arm64: dts: qcom: sm6350: Fix ADSP memory length
- arm64: dts: qcom: sm6350: Fix MPSS memory length
- arm64: dts: qcom: sm6350: Fix uart1 interconnect path
- arm64: dts: qcom: sm6375: Fix ADSP memory length
- arm64: dts: qcom: sm6375: Fix CDSP memory base and length
- arm64: dts: qcom: sm6375: Fix MPSS memory base and length
- arm64: dts: qcom: sm8350: Fix ADSP memory base and length
- arm64: dts: qcom: sm8350: Fix CDSP memory base and length
- arm64: dts: qcom: sm8350: Fix MPSS memory length
- arm64: dts: qcom: sm8450: Fix CDSP memory length
- arm64: dts: qcom: sm8450: Fix MPSS memory length
- arm64: dts: qcom: sm8550: Fix CDSP memory length
- arm64: dts: qcom: sm8550: Fix MPSS memory length
- arm64: dts: qcom: sm8450: add missing qcom,non-secure-domain property
- arm64: dts: qcom: sm8450: Fix ADSP memory base and length
- arm64: dts: qcom: sm8550: add missing qcom,non-secure-domain property
- arm64: dts: qcom: sm8550: Add dma-coherent property
- arm64: dts: qcom: sm8550: Fix ADSP memory base and length
- arm64: dts: qcom: sm8650: Fix CDSP memory length
- arm64: dts: qcom: sm8650: Fix MPSS memory length
- arm64: dts: qcom: sm8550: correct MDSS interconnects
- arm64: dts: qcom: sm8650: correct MDSS interconnects
- crypto: qce - fix priority to be less than ARMv8 CE
- arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
- arm64: tegra: Disable Tegra234 sce-fabric node
- parisc: Temporarily disable jump label support
- pwm: microchip-core: fix incorrect comparison with max period
- xfs: Propagate errors from xfs_reflink_cancel_cow_range in
xfs_dax_write_iomap_end
- xfs: Add error handling for xfs_reflink_cancel_cow_range
- ACPI: PRM: Remove unnecessary strict handler address checks
- tpm: Change to kvalloc() in eventlog/acpi.c
- rv: Reset per-task monitors also for idle tasks
- hrtimers: Force migrate away hrtimers queued after
CPUHP_AP_HRTIMERS_DYING
- kfence: skip __GFP_THISNODE allocations on NUMA systems
- media: ccs: Clean up parsed CCS static data on parse failure
- mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
- iio: light: as73211: fix channel handling in only-color triggered buffer
- soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
- soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
- soc: qcom: smem_state: fix missing of_node_put in error path
- media: mmp: Bring back registration of the device
- media: mc: fix endpoint iteration
- media: nuvoton: Fix an error check in npcm_video_ece_init()
- media: imx296: Add standby delay during probe
- media: ov5640: fix get_light_freq on auto
- media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
- media: ccs: Fix CCS static data parsing for large block sizes
- media: ccs: Fix cleanup order in ccs_probe()
- media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
- media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
- media: i2c: ds90ub960: Fix UB9702 VC map
- media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
- media: uvcvideo: Fix crash during unbind if gpio unit is in use
- media: uvcvideo: Fix event flags in uvc_ctrl_send_events
- media: uvcvideo: Support partial control reads
- media: uvcvideo: Remove redundant NULL assignment
- media: uvcvideo: Refactor iterators
- media: uvcvideo: Only save async fh if success
- media: uvcvideo: Remove dangling pointers
- mm: kmemleak: fix upper boundary check for physical address objects
- mm/compaction: fix UBSAN shift-out-of-bounds warning
- ata: libata-sff: Ensure that we cannot write outside the allocated
buffer
- crypto: qce - fix goto jump in error path
- crypto: qce - unregister previously registered algos in error path
- nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
- nvmem: core: improve range check for nvmem_cell_write()
- nvmem: imx-ocotp-ele: simplify read beyond device check
- nvmem: imx-ocotp-ele: fix MAC address byte order
- nvmem: imx-ocotp-ele: fix reading from non zero offset
- nvmem: imx-ocotp-ele: set word length to 1
- io_uring: fix multishots with selected buffers
- io_uring/net: don't retry connect operation on EPOLLERR
- selftests: mptcp: connect: -f: no reconnect
- pnfs/flexfiles: retry getting layout segment for reads
- ocfs2: fix incorrect CPU endianness conversion causing mount failure
- ocfs2: handle a symlink read error correctly
- nilfs2: fix possible int overflows in nilfs_fiemap()
- nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
- NFSD: Encode COMPOUND operation status on page boundaries
- mailbox: tegra-hsp: Clear mailbox before using message
- NFC: nci: Add bounds checking in nci_hci_create_pipe()
- irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
- mtd: onenand: Fix uninitialized retlen in do_otp_read()
- misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
- char: misc: deallocate static minor in error path
- misc: fastrpc: Deregister device nodes properly in error scenarios
- misc: fastrpc: Fix registered buffer page address
- misc: fastrpc: Fix copy buffer page size
- net/ncsi: wait for the last response to Deselect Package before
configuring channel
- net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
- maple_tree: simplify split calculation
- scripts/gdb: fix aarch64 userspace detection in get_current_task
- tracing/osnoise: Fix resetting of tracepoints
- rtla/osnoise: Distinguish missing workload option
- rtla: Add trace_instance_stop
- rtla/timerlat_hist: Stop timerlat tracer on signal
- rtla/timerlat_top: Stop timerlat tracer on signal
- pinctrl: samsung: fix fwnode refcount cleanup if
platform_get_irq_optional() fails
- ptp: Ensure info->enable callback is always set
- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
- rtc: zynqmp: Fix optional clock name property
- MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
- xfs: avoid nested calls to __xfs_trans_commit
- xfs: don't lose solo superblock counter update transactions
- spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC
families
- spi: atmel-qspi: Memory barriers after memory-mapped I/O
- btrfs: avoid monopolizing a core when activating a swap file
- mptcp: prevent excessive coalescing on receive
- Revert "drm/amd/display: Fix green screen issue after suspend"
- statmount: let unset strings be empty
- arm64: dts: rockchip: add reset-names for combphy on rk3568
- ocfs2: check dir i_size in ocfs2_find_entry
- Upstream stable to v6.6.77, v6.12.14
* kvmppc_set_passthru_irq_hv: Could not assign IRQ map traces are seen when
pci device is attached to kvm guest when "xive=off" is set (LP: #2109951)
- KVM: PPC: Book3S HV: Fix IRQ map warnings with XICS on pSeries KVM Guest
* Latitude 5450 is experiencing packet loss on Ethernet in Ubuntu 22.04
(LP: #2106558)
- e1000e: change k1 configuration on MTP and later platforms
* cpufreq amd-pstate: cpuinfo_max_freq reports incorrect value
(LP: #2109609)
- SAUCE: Revert "Revert "cpufreq: amd-pstate: Fix the inconsistency in max
frequency units""
* Backport pci=config_acs parameter with fix commit (LP: #2100340)
- PCI: Extend ACS configurability
- PCI: Fix pci_enable_acs() support for the ACS quirks
- PCI/ACS: Fix 'pci=config_acs=' parameter
* [UBUNTU 24.04] s390/pci: Fix zpci_bus_is_isolated_vf() for non-VF
(LP: #2111599)
- s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs
* nvme/tcp hangs IO on arm (LP: #2106381)
- nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch
* CVE-2025-37750
- smb: client: fix UAF in decryption with multichannel
* CVE-2025-40364
- io_uring: fix io_req_prep_async with provided buffers
* CVE-2024-49887
- f2fs: fix to handle segment allocation failure correctly
- f2fs: fix to don't panic system for no free segment fault injection
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953)
- powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active
- dlm: fix srcu_read_lock() return type to int
- afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
- afs: Fix directory format encoding struct
- afs: Fix cleanup of immediately failed async calls
- fs: fix proc_handler for sysctl_nr_open
- block: retry call probe after request_module in blk_request_module
- pstore/blk: trivial typo fixes
- nvme: Add error check for xa_store in nvme_get_effects_log
- selftests/powerpc: Fix argument order to timer_sub()
- nvme: Add error path for xa_store in nvme_init_effects
- partitions: ldm: remove the initial kernel-doc notation
- select: Fix unbalanced user_access_end()
- nvme: fix bogus kzalloc() return check in nvme_init_effects_log()
- afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
- perf/core: Save raw sample data conditionally based on sample type
- sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
- x86/cpu: Enable SD_ASYM_PACKING for PKG domain on AMD
- x86/topology: Use x86_sched_itmt_flags for PKG domain unconditionally
- drm/msm/dp: set safe_to_exit_level before printing it
- drm/etnaviv: Fix page property being used for non writecombine buffers
- drm/amd/pm: Fix an error handling path in
vega10_enable_se_edc_force_stall_config()
- drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset
- drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
- drm/rockchip: vop2: Fix the windows switch between different layers
- drm/rockchip: vop2: Check linear format for Cluster windows on rk3566/8
- drm/rockchip: vop2: include rockchip_drm_drv.h
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8150
- drm/msm/dpu: link DSPP_2/_3 blocks on SC8180X
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8250
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8350
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8550
- drm/msm: Check return value of of_dma_configure()
- drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
- drm/amdgpu: tear down ttm range manager for doorbell in
amdgpu_ttm_fini()
- genirq: Make handle_enforce_irqctx() unconditionally available
- wifi: ath11k: Fix unexpected return buffer manager error for
WCN6750/WCN6855
- wifi: rtlwifi: do not complete firmware loading needlessly
- wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last
step
- wifi: rtlwifi: wait for firmware loading before releasing memory
- wifi: rtlwifi: fix init_sw_vars leak when probe fails
- wifi: rtlwifi: usb: fix workqueue leak when probe fails
- net_sched: sch_sfq: annotate data-races around q->perturb_period
- net_sched: sch_sfq: handle bigger packets
- spi: zynq-qspi: Add check for clk_enable()
- dt-bindings: mmc: controller: clarify the address-cells description
- of: remove internal arguments from of_property_for_each_u32()
- clk: fix an OF node reference leak in of_clk_get_parent_name()
- dt-bindings: leds: class-multicolor: Fix path to color definitions
- wifi: rtlwifi: destroy workqueue at rtl_deinit_core
- wifi: rtlwifi: pci: wait for firmware loading before releasing memory
- HID: multitouch: fix support for Goodix PID 0x01e9
- regulator: dt-bindings: mt6315: Drop regulator-compatible property
- wifi: brcmfmac: add missing header include for brcmf_dbg
- ACPI: fan: cleanup resources in the error path of .probe()
- cpupower: fix TSC MHz calculation
- dt-bindings: mfd: bd71815: Fix rsense and typos
- leds: netxbig: Fix an OF node reference leak in
netxbig_leds_get_of_pdata()
- inetpeer: remove create argument of inet_getpeer_v[46]()
- inetpeer: remove create argument of inet_getpeer()
- inetpeer: update inetpeer timestamp in inet_getpeer()
- inetpeer: do not get a refcount in inet_getpeer()
- pwm: stm32-lp: Add check for clk_enable()
- cpufreq: schedutil: Fix superfluous updates caused by need_freq_update
- gpio: pca953x: log an error when failing to get the reset GPIO
- cpufreq: qcom: Fix qcom_cpufreq_hw_recalc_rate() to query LUT if LMh IRQ
is not available
- cpufreq: qcom: Implement clk_ops::determine_rate() for qcom_cpufreq*
clocks
- clk: imx8mp: Fix clkout1/2 support
- dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI
- clk: sunxi-ng: a64: drop redundant CLK_PLL_VIDEO0_2X and CLK_PLL_MIPI
- clk: sunxi-ng: a64: stop force-selecting PLL-MIPI as TCON0 parent
- regulator: of: Implement the unwind path of of_regulator_match()
- OPP: OF: Fix an OF node leak in _opp_add_static_v2()
- ipmi: ssif_bmc: Fix new request loss when bmc ready for a response
- wifi: ath12k: fix tx power, max reg power update to firmware
- clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
- HID: fix generic desktop D-Pad controls
- leds: cht-wcove: Use devm_led_classdev_register() to avoid memory leak
- mfd: syscon: Remove extern from function prototypes
- mfd: syscon: Add of_syscon_register_regmap() API
- mfd: syscon: Use scoped variables with memory allocators to simplify
error paths
- mfd: syscon: Fix race in device_node_get_regmap()
- samples/landlock: Fix possible NULL dereference in parse_path()
- wifi: wlcore: fix unbalanced pm_runtime calls
- wifi: mt76: mt7915: Fix mesh scan on MT7916 DBDC
- wifi: mac80211: fix tid removal during mesh forwarding
- wifi: mac80211: Fix common size calculation for ML element
- net/smc: fix data error when recvmsg with MSG_PEEK flag
- wifi: mt76: mt76u_vendor_request: Do not print error messages when
-EPROTO
- wifi: mt76: mt7921: fix using incorrect group cipher after
disconnection.
- wifi: mt76: mt7915: fix overflows seen when writing limit attributes
- wifi: mt76: mt7996: fix rx filter setting for bfee functionality
- wifi: mt76: mt7915: firmware restart on devices with a second pcie link
- wifi: mt76: connac: move mt7615_mcu_del_wtbl_all to connac
- wifi: mt76: mt7915: improve hardware restart reliability
- wifi: mt76: mt7915: fix omac index assignment after hardware reset
- wifi: mt76: mt7915: fix register mapping
- wifi: mt76: mt7996: fix register mapping
- wifi: mt76: mt7996: add max mpdu len capability
- wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU
- wifi: mt76: mt7996: fix HE Phy capability
- wifi: mt76: mt7996: fix incorrect indexing of MIB FW event
- wifi: mt76: mt7996: fix ldpc setting
- cpufreq: ACPI: Fix max-frequency computation
- selftests: timers: clocksource-switch: Adapt progress to kselftest
framework
- selftests: harness: fix printing of mismatch values in __EXPECT()
- wifi: cfg80211: adjust allocation of colocated AP data
- inet: ipmr: fix data-races
- clk: analogbits: Fix incorrect calculation of vco rate delta
- pwm: stm32: Add check for clk_enable()
- selftests/landlock: Fix error message
- net/mlxfw: Drop hard coded max FW flash image size
- octeon_ep: remove firmware stats fetch in ndo_get_stats64
- netfilter: nf_tables: fix set size with rbtree backend
- netfilter: nft_flow_offload: update tcp state flags under lock
- tcp_cubic: fix incorrect HyStart round start detection
- libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is
missing
- tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
- libbpf: Fix segfault due to libelf functions not setting errno
- ASoC: sun4i-spdif: Add clock multiplier settings
- selftests/bpf: Fix fill_link_info selftest on powerpc
- crypto: caam - use JobR's space to access page 0 regs
- perf header: Fix one memory leakage in process_bpf_btf()
- perf header: Fix one memory leakage in process_bpf_prog_info()
- perf bpf: Fix two memory leakages when calling
perf_env__insert_bpf_prog_info()
- ASoC: renesas: rz-ssi: Use only the proper amount of dividers
- perf expr: Initialize is_test value in expr__ctx_new()
- ktest.pl: Remove unused declarations in run_bisect_test function
- crypto: hisilicon/sec2 - fix for aead icv error
- crypto: hisilicon/sec2 - fix for aead invalid authsize
- crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
- ALSA: seq: remove redundant 'tristate' for SND_SEQ_UMP_CLIENT
- ALSA: seq: Make dependency on UMP clearer
- padata: fix sysfs store callback check
- perf top: Don't complain about lack of vmlinux when not resolving some
kernel samples
- perf machine: Don't ignore _etext when not a text symbol
- perf namespaces: Introduce nsinfo__set_in_pidns()
- perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool
- ASoC: Intel: avs: Prefix SKL/APL-specific members
- ASoC: Intel: avs: Abstract IPC handling
- ASoC: Intel: avs: Do not readq() u32 registers
- ASoC: Intel: avs: Fix theoretical infinite loop
- perf report: Fix misleading help message about --demangle
- pinctrl: stm32: Add check for clk_enable()
- pinctrl: amd: Take suspend type into consideration which pins are non-
wake
- bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
- ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire
A115-31 laptop
- perf lock: Fix parse_lock_type which only retrieve one lock flag
- padata: add pd get/put refcnt helper
- cifs: Use cifs_autodisable_serverino() for disabling
CIFS_MOUNT_SERVER_INUM in readdir.c
- soc: atmel: fix device_node release in atmel_soc_device_init()
- ARM: at91: pm: change BU Power Switch to automatic mode
- arm64: dts: mediatek: mt8186: Move wakeup to MTU3 to get working suspend
- arm64: dts: mt8183: set DMIC one-wire mode on Damu
- arm64: dts: mediatek: mt8516: fix GICv2 range
- arm64: dts: mediatek: mt8516: fix wdt irq type
- arm64: dts: mediatek: mt8516: add i2c clock-div property
- arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A
- ARM: dts: stm32: Fix IPCC EXTI declaration on stm32mp151
- RDMA/mlx4: Avoid false error about access to uninitialized gids array
- arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
- arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property
- arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible property
- arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible property
- arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property
- arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
- arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
- ARM: dts: aspeed: yosemite4: correct the compatible string of adm1272
- ARM: dts: aspeed: yosemite4: Add required properties for IOE on fan
boards
- ARM: dts: aspeed: yosemite4: correct the compatible string for max31790
- arm: dts: socfpga: use reset-name "stmmaceth-ocp" instead of "ahb"
- RDMA/rxe: Improve newline in printing messages
- RDMA/rxe: Fix mismatched max_msg_sz
- arm64: dts: mediatek: mt8183: kenzo: Support second source touchscreen
- arm64: dts: mediatek: mt8183: willow: Support second source touchscreen
- RDMA/srp: Fix error handling in srp_add_port
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie1
- ARM: dts: stm32: Deduplicate serial aliases and chosen node for
STM32MP15xx DHCOM SoM
- ARM: dts: stm32: Swap USART3 and UART8 alias on STM32MP15xx DHCOM SoM
- arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage
settings
- arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
- arm64: dts: qcom: move common parts for sa8775p-ride variants into a
.dtsi
- arm64: dts: qcom: sa8775p: Update sleep_clk frequency
- arm64: dts: qcom: msm8996: Fix up USB3 interrupts
- arm64: dts: qcom: msm8994: Describe USB interrupts
- arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
- arm64: dts: qcom: msm8916: correct sleep clock frequency
- arm64: dts: qcom: msm8939: correct sleep clock frequency
- arm64: dts: qcom: msm8994: correct sleep clock frequency
- arm64: dts: qcom: qcs404: correct sleep clock frequency
- arm64: dts: qcom: q[dr]u1000: correct sleep clock frequency
- arm64: dts: qcom: qrb4210-rb2: correct sleep clock frequency
- arm64: dts: qcom: sc7280: correct sleep clock frequency
- arm64: dts: qcom: sdx75: correct sleep clock frequency
- arm64: dts: qcom: sm4450: correct sleep clock frequency
- arm64: dts: qcom: sm6125: correct sleep clock frequency
- arm64: dts: qcom: sm6375: correct sleep clock frequency
- arm64: dts: qcom: sm8250: correct sleep clock frequency
- arm64: dts: qcom: sm8350: correct sleep clock frequency
- arm64: dts: qcom: sm8450: correct sleep clock frequency
- ARM: dts: microchip: sama5d27_wlsom1_ek: Add no-1-8-v property to sdmmc0
node
- arm64: dts: ti: k3-am62: Remove duplicate GICR reg
- arm64: dts: ti: k3-am62a: Remove duplicate GICR reg
- arm64: dts: allwinner: a64: explicitly assign clock parent for TCON0
- RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error
- ARM: omap1: Fix up the Retu IRQ on Nokia 770
- arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: Convert mezzanine
riser to dtso
- arm64: dts: qcom: sdm845-db845c-navigation-mezzanine: remove disabled
ov7251 camera
- arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply
- arm64: dts: qcom: sc7180-*: Remove thermal zone polling delays
- arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
- arm64: dts: qcom: sc7180: change labels to lower-case
- arm64: dts: qcom: sc7180: fix psci power domain node names
- arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280
properties
- arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes
- dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
- arm64: dts: mediatek: add per-SoC compatibles for keypad nodes
- arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts
- arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts
- ARM: dts: mediatek: mt7623: fix IR nodename
- fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
- arm64: tegra: Fix DMA ID for SPI2
- i3c: dw: Add hot-join support.
- RDMA/mlx5: Fix indirect mkey ODP page count
- of: reserved-memory: Do not make kmemleak ignore freed address
- efi: sysfb_efi: fix W=1 warnings when EFI is not set
- spi: omap2-mcspi: Correctly handle devm_clk_get_optional() errors
- media: rc: iguanair: handle timeouts
- media: lmedm04: Handle errors for lme2510_int_read
- PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
- media: marvell: Add check for clk_enable()
- media: i2c: imx290: Register 0x3011 varies between imx327 and imx290
- media: i2c: imx412: Add missing newline to prints
- media: i2c: ov9282: Correct the exposure offset
- media: mipi-csis: Add check for clk_enable()
- media: camif-core: Add check for clk_enable()
- media: uvcvideo: Propagate buf->error to userspace
- mtd: rawnand: brcmnand: fix status read of brcmnand_waitfunc
- mtd: hyperbus: hbmc-am654: fix an OF node reference leak
- media: nxp: imx8-isi: fix v4l2-compliance test errors
- watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe()
- staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
- media: dvb-usb-v2: af9035: fix ISO C90 compilation error on
af9035_i2c_master_xfer
- PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
- PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
- scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
- scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
- ocfs2: mark dquot as inactive if failed to start trans while releasing
dquot
- module: Extend the preempt disabled section in
dereference_symbol_descriptor().
- serial: 8250: Adjust the timeout for FIFO mode
- NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
- NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
- tools/bootconfig: Fix the wrong format specifier
- xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
- dmaengine: ti: edma: fix OF node reference leaks in edma_driver
- rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr()
- regulator: core: Add missing newline character
- gpio: mxc: remove dead code after switch to DT-only
- net: fec: implement TSO descriptor cleanup
- PM: hibernate: Add error handling for syscore_suspend()
- iavf: allow changing VLAN state without calling PF
- net: netdevsim: try to close UDP port harness races
- ptp: Properly handle compat ioctls
- net: stmmac: Limit the number of MTL queues to hardware capability
- net: stmmac: Limit FIFO size by hardware capability
- perf trace: Fix runtime error of index out of bounds
- Bluetooth: btnxpuart: Fix glitches seen in dual A2DP streaming
- vsock: Allow retrying on connect() failure
- bgmac: reduce max frame size to support just MTU 1500
- net: sh_eth: Fix missing rtnl lock in suspend/resume path
- genksyms: fix memory leak when the same symbol is added from source
- genksyms: fix memory leak when the same symbol is read from *.symref
file
- RISC-V: Mark riscv_v_init() as __init
- ASoC: rockchip: i2s_tdm: Re-add the set_sysclk callback
- io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock()
- cifs: Fix getting and setting SACLs over SMB1
- kconfig: fix file name in warnings when loading KCONFIG_DEFCONFIG_LIST
- kconfig: fix memory leak in sym_warn_unmet_dep()
- hexagon: fix using plain integer as NULL pointer warning in cmpxchg
- hexagon: Fix unbalanced spinlock in die()
- f2fs: Introduce linear search for dentries
- Revert "SUNRPC: Reduce thread wake-up rate when receiving large RPC
messages"
- kbuild: switch from lz4c to lz4 for compression
- selftests/rseq: Fix handling of glibc without rseq support
- ktest.pl: Check kernelrelease return in get_version
- ALSA: usb-audio: Add delay quirk for iBasso DC07 Pro
- usb: gadget: f_tcm: Fix Get/SetInterface return value
- usb: dwc3-am62: Fix an OF node leak in phy_syscon_pll_refclk()
- usb: dwc3: core: Defer the probe until USB power supply ready
- usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to
PD_T_SENDER_RESPONSE
- usb: typec: tcpci: Prevent Sink disconnection before vPpsShutdown in SPR
PPS
- btrfs: output the reason for open_ctree() failure
- s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
- LoongArch: Change 8 to 14 for LOONGARCH_MAX_{BRP,WRP}
- block: copy back bounce buffer to user-space correctly in case of split
- nvme-tcp: Fix I/O queue cpu spreading for multiple controllers
- sched/fair: Untangle NEXT_BUDDY and pick_next_task()
- sched: Fix race between yield_to() and try_to_wake_up()
- drm/v3d: Fix performance counter source settings on V3D 7.x
- drm/rockchip: vop2: fix rk3588 dp+dsi maxclk verification
- drm/rockchip: vop2: Set AXI id for rk3588
- drm/rockchip: vop2: Setup delay cycle for Esmart2/3
- drm/rockchip: vop2: Add check for 32 bpp format for rk3588
- drm/msm/dpu: provide DSPP and correct LM config for SDM670
- drm/msm/dpu: link DSPP_2/_3 blocks on SM8650
- drm/msm: don't clean up priv->kms prematurely
- drm/msm/mdp4: correct LCDC regulator name
- wifi: rtlwifi: rtl8821ae: phy: restore removed code to fix infinite loop
- selftests/bpf: Actuate tx_metadata_len in xdp_hw_metadata
- selftests: ktap_helpers: Fix uninitialized variable
- inet: constify inet_sk_bound_dev_eq() net parameter
- inet: constify 'struct net' parameter of various lookup helpers
- udp: constify 'struct net' parameter of socket lookups
- inet6: constify 'struct net' parameter of various lookup helpers
- ipv6: udp: constify 'struct net' parameter of socket lookups
- dt-bindings: clock: imx93: Drop IMX93_CLK_END macro definition
- dt-bindings: clock: Add i.MX91 clock support
- dt-bindings: clock: imx93: Add SPDIF IPG clk
- clk: imx93: Move IMX93_CLK_END macro to clk driver
- clk: imx: add i.MX91 clk
- clk: imx93: Add IMX93_CLK_SPDIF_IPG clock
- arm64: dts: imx93: Use IMX93_CLK_SPDIF_IPG as SPDIF IPG clock
- clk: imx: Apply some clks only for i.MX93
- wifi: rtw89: mcc: consider time limits not divisible by 1024
- wifi: iwlwifi: cleanup uefi variables loading
- wifi: iwlwifi: fw: read STEP table from correct UEFI var
- wifi: mt76: mt7996: fix overflows seen when writing limit attributes
- wifi: mt76: mt7996: fix definition of tx descriptor
- Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
- platform/mellanox: mlxbf-pmc: incorrect type in assignment
- platform/x86: x86-android-tablets: make platform data be static
- crypto: api - Fix boot-up self-test race
- pinctrl: nomadik: Add check for clk_enable()
- rhashtable: Fix potential deadlock by moving schedule_work outside lock
- crypto: iaa - Fix IAA disabling that occurs when sync_mode is set to
'async'
- perf maps: Fix display of kernel symbols
- perf MANIFEST: Add arch/*/include/uapi/asm/bpf_perf_event.h to the perf
tarball
- ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers
- tools: Sync if_xdp.h uapi tooling header
- rhashtable: Fix rhashtable_try_insert test
- ARM: dts: imx7-tqma7: add missing vs-supply for LM75A (rev. 01xxx)
- arm64: dts: renesas: rzg3s-smarc: Fix the debug serial alias
- arm64: dts: mediatek: mt8395-genio-1200-evk: Drop regulator-compatible
property
- arm64: dts: qcom: sm8550: correct sleep clock frequency
- arm64: dts: qcom: sm8650: correct sleep clock frequency
- arm64: dts: qcom: x1e80100: correct sleep clock frequency
- ARM: dts: microchip: sama5d29_curiosity: Add no-1-8-v property to sdmmc0
node
- RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
- [Config] updateconfigs for INFINIBAND_HNS
- RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event
- iommu: iommufd: fix WARNING in iommufd_device_unbind
- remoteproc: mtk_scp: Only populate devices for SCP cores
- PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset()
- PCI: dwc: Always stop link in the dw_pcie_suspend_noirq
- PCI: microchip: Add support for using either Root Port 1 or 2
- PCI: microchip: Set inbound address translation for coherent or non-
coherent mode
- erofs: get rid of erofs_{find,insert}_workgroup
- erofs: move erofs_workgroup operations into zdata.c
- erofs: sunset `struct erofs_workgroup`
- erofs: fix potential return value overflow of z_erofs_shrink_scan()
- tty: mips_ejtag_fdc: fix one more u8 warning
- xfrm: Add support for per cpu xfrm state handling.
- xfrm: Cache used outbound xfrm states at the policy.
- xfrm: Add an inbound percpu state cache.
- xfrm: Don't disable preemption while looking up cache state.
- idpf: add read memory barrier when checking descriptor done bit
- net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
- tools: ynl: c: correct reverse decode of empty attrs
- selftests: mptcp: extend CFLAGS to keep options from environment
- selftests: net/{lib,openvswitch}: extend CFLAGS to keep options from
environment
- net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts
in
- ethtool: Fix set RXNFC command with symmetric RSS hash
- tools/power turbostat: Fix forked child affinity regression
- md: add a new callback pers->bitmap_sector()
- md/raid5: implement pers->bitmap_sector()
- xfs: check for dead buffers in xfs_buf_find_insert
- xfs: don't shut down the filesystem for media failures beyond end of log
- usb: dwc3: Skip resume if pm_runtime_set_active() fails
- clk: qcom: gcc-x1e80100: Do not turn off usb_2 controller GDSC
- xfrm: Add error handling when nla_put_u32() returns an error
- xfrm: Fix acquire state insertion.
- ethtool: Fix access to uninitialized fields in set RXNFC command
- ASoC: da7213: Initialize the mutex
- drm/amd/display: Add hubp cache reset when powergating
- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
- ethtool: ntuple: fix rss + ring_cookie check
- Upstream stable to v6.6.76, v6.12.13
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57975
- btrfs: do proper folio cleanup when run_delalloc_nocow() failed
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21714
- RDMA/mlx5: Fix implicit ODP use after free
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21801
- net: ravb: Fix missing rtnl lock in suspend/resume path
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21809
- rxrpc, afs: Fix peer hash locking vs RCU callback
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58057
- idpf: convert workqueues to unbound
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57953
- rtc: tps6594: Fix integer overflow on 32bit systems
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57982
- xfrm: state: fix out-of-bounds read during lookup
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21721
- nilfs2: handle errors that nilfs_prepare_chunk() may return
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21722
- nilfs2: do not force clear folio if buffer is referenced
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21798
- firewire: test: Fix potential null dereference in firewire kunit test
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21723
- scsi: mpi3mr: Fix possible crash when setting up bsg fails
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21724
- iommufd/iova_bitmap: Fix shift-out-of-bounds in
iova_bitmap_offset_to_index()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21825
- bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57990
- wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57974
- udp: Deal with race between UDP socket address change and rehash
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57994
- ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57999
- powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58054
- staging: media: max96712: fix kernel oops when removing module
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58055
- usb: gadget: f_tcm: Don't free command immediately
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57979
- pps: Fix a use-after-free
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57980
- media: uvcvideo: Fix double free in error path
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58056
- remoteproc: core: Fix ida_free call while not allocated
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21705
- mptcp: handle fastopen disconnect correctly
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21707
- mptcp: consolidate suboption status
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57981
- usb: xhci: Fix NULL pointer dereference on certain command aborts
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21708
- net: usb: rtl8150: enable basic endpoint checking
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21826
- netfilter: nf_tables: reject mismatching sum of field_len with set key
length
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21808
- net: xdp: Disallow attaching device-bound programs in generic mode
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21710
- tcp: correct handling of extreme memory squeeze
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21715
- net: davicom: fix UAF in dm9000_drv_remove
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21716
- vxlan: Fix uninit-value in vxlan_vnifilter_dump()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21718
- net: rose: fix timer races against user threads
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21719
- ipmr: do not call mr_mfc_uses_dev() for unres entries
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21802
- net: hns3: fix oops when unload drivers paralleling
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58058
- ubifs: skip dumping tnc tree when zroot is null
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58069
- rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21720
- xfrm: delete intermediate secpath entry in packet offload mode
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21803
- LoongArch: Fix warnings during S3 suspend
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21810
- driver core: class: Fix wild pointer dereferences in API
class_dev_iter_next()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21811
- nilfs2: protect access to buffers with no active references
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21804
- PCI: rcar-ep: Fix incorrect variable used when calling
devm_request_mem_region()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21829
- RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57984
- i3c: dw: Fix use-after-free in dw_i3c_master driver due to race
condition
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58034
- memory: tegra20-emc: fix an OF node reference bug in
tegra_emc_find_node_by_ram_code()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57973
- rdma/cxgb4: Prevent potential integer overflow on 32bit
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21725
- smb: client: fix oops due to unset link speed
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21726
- padata: avoid UAF for reorder_work
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21727
- padata: fix UAF in padata_reorder
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21728
- bpf: Send signals asynchronously if !preemptible
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58070
- bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21711
- net/rose: prevent integer overflows in rose_setsockopt()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21799
- net: ethernet: ti: am65-cpsw: fix freeing IRQ in
am65_cpsw_nuss_remove_tx_chns()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21806
- net: let net.core.dev_weight always be non-zero
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21830
- landlock: Handle weird files
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21828
- wifi: mac80211: don't flush non-uploaded STAs
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58061
- wifi: mac80211: prohibit deactivating all links
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57993
- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding
endpoint check
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58071
- team: prevent adding a device which is already a team device lower
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58063
- wifi: rtlwifi: fix memory leaks and invalid access at probe error path
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58072
- wifi: rtlwifi: remove unused check_buddy_priv
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58053
- rxrpc: Fix handling of received connection abort
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57996
- net_sched: sch_sfq: don't allow 1 packet limit
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57997
- wifi: wcn36xx: fix channel survey memory allocation size
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58051
- ipmi: ipmb: Add check devm_kasprintf() returned value
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58068
- OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57998
- OPP: add index check to assert to avoid buffer overflow in _read_freq()
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-58052
- drm/amdgpu: Fix potential NULL pointer dereference in
atomctrl_get_smc_sclk_range_table
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2024-57986
- HID: core: Fix assumption that Resolution Multipliers must be in Logical
Collections
* Noble update: upstream stable patchset 2025-05-29 (LP: #2111953) //
CVE-2025-21731
- nbd: don't allow reconnect after disconnect
* CVE-2025-37798
- sch_htb: make htb_qlen_notify() idempotent
- sch_htb: make htb_deactivate() idempotent
- sch_drr: make drr_qlen_notify() idempotent
- sch_hfsc: make hfsc_qlen_notify() idempotent
- sch_qfq: make qfq_qlen_notify() idempotent
- sch_ets: make est_qlen_notify() idempotent
- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
* CVE-2025-37997
- netfilter: ipset: fix region locking in hash types
* CVE-2025-22088
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
* CVE-2025-37890
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child
qdisc
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
* raid1: Fix NULL pointer dereference in process_checks() (LP: #2112519)
- md/raid1: Add check for missing source disk in process_checks()
* Packaging resync (LP: #1786013)
- [Packaging] update variants
- [Packaging] update annotations scripts
-- Stefan Bader <stefan.bader@canonical.com> Mon, 23 Jun 2025 16:03:43 +0200
linux-hwe-6.8 (6.8.0-63.66~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-63.66~22.04.1 -proposed tracker (LP: #2114339)
* Packaging resync (LP: #1786013)
- [Packaging] update variants
[ Ubuntu: 6.8.0-63.66 ]
* noble/linux: 6.8.0-63.66 -proposed tracker (LP: #2114341)
* Packaging resync (LP: #1786013)
- [Packaging] update variants
- [Packaging] update annotations scripts
* CVE-2025-37798
- sch_htb: make htb_qlen_notify() idempotent
- sch_htb: make htb_deactivate() idempotent
- sch_drr: make drr_qlen_notify() idempotent
- sch_hfsc: make hfsc_qlen_notify() idempotent
- sch_qfq: make qfq_qlen_notify() idempotent
- sch_ets: make est_qlen_notify() idempotent
- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
* CVE-2025-37997
- netfilter: ipset: fix region locking in hash types
* CVE-2025-22088
- RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
* CVE-2025-37890
- net_sched: hfsc: Fix a UAF vulnerability in class with netem as child
qdisc
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
- net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
* raid1: Fix NULL pointer dereference in process_checks() (LP: #2112519)
- md/raid1: Add check for missing source disk in process_checks()
-- Stefan Bader <stefan.bader@canonical.com> Fri, 20 Jun 2025 11:07:01 +0200
linux-hwe-6.8 (6.8.0-62.65~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-62.65~22.04.1 -proposed tracker (LP: #2110736)
[ Ubuntu: 6.8.0-62.65 ]
* noble/linux: 6.8.0-62.65 -proposed tracker (LP: #2110737)
* Rotate the Canonical Livepatch key (LP: #2111244)
- [Config] Prepare for Canonical Livepatch key rotation
* KVM bug causes Firecracker crash when it runs the vCPU for the first time
(LP: #2109859)
- vhost: return task creation error instead of NULL
- kvm: retry nx_huge_page_recovery_thread creation
* CVE-2025-2312 cifs.upcall could access incorrect kerberos credentials cache
(LP: #2099914) // CVE-2025-2312
- CIFS: New mount option for cifs.upcall namespace resolution
* Noble update: upstream stable patchset 2025-04-29 (LP: #2109640)
- ASoC: wm8994: Add depends on MFD core
- ASoC: samsung: Add missing selects for MFD_WM8994
- seccomp: Stub for !CONFIG_SECCOMP
- scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
- of/unittest: Add test that of_address_to_resource() fails on non-
translatable address
- irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
- hwmon: (drivetemp) Set scsi command timeout to 10s
- ASoC: samsung: Add missing depends on I2C
- ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf()
- Revert "libfs: fix infinite directory reads for offset dir"
- libfs: Replace simple_offset end-of-directory detection
- Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
- ALSA: usb-audio: Add delay quirk for USB Audio Device
- Input: xpad - add support for Nacon Pro Compact
- Input: atkbd - map F23 key to support default copilot shortcut
- Input: xpad - add unofficial Xbox 360 wireless receiver clone
- Input: xpad - add QH Electronics VID/PID
- Input: xpad - improve name of 8BitDo controller 2dc8:3106
- Input: xpad - add support for Nacon Evol-X Xbox One Controller
- Input: xpad - add support for wooting two he (arm)
- ASoC: codecs: es8316: Fix HW rate calculation for 48Mhz MCLK
- ASoC: cs42l43: Add codec force suspend/resume ops
- ALSA: hda/realtek: Fix volume adjustment issue on Lenovo ThinkBook 16P Gen5
- libfs: Return ENOSPC when the directory offset range is exhausted
- Revert "libfs: Add simple_offset_empty()"
- libfs: Use d_children list to iterate simple_offset directories
- wifi: rtl8xxxu: add more missing rtl8192cu USB IDs
- HID: wacom: Initialize brightness of LED trigger
- Upstream stable to v6.6.75, v6.12.12
* Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
CVE-2025-21689
- USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
* Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
CVE-2025-21690
- scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
* Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
CVE-2025-21691
- cachestat: fix page cache statistics permission checking
* Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
CVE-2025-21692
- net: sched: fix ets qdisc OOB Indexing
* Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
CVE-2025-21699
- gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
* Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
CVE-2024-50157
- RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
* rtw89: Support hardware rfkill (LP: #2077384)
- wifi: rtw89: add support for hardware rfkill
* Introduce configfs-based interface for gpio-aggregator (LP: #2103496)
- gpio: introduce utilities for synchronous fake device creation
- bitmap: Define a cleanup function for bitmaps
- gpio: aggregator: simplify aggr_parse() with scoped bitmap
- gpio: aggregator: protect driver attr handlers against module unload
- gpio: aggregator: reorder functions to prepare for configfs introduction
- gpio: aggregator: unify function naming
- gpio: aggregator: add gpio_aggregator_{alloc, free}()
- gpio: aggregator: introduce basic configfs interface
- [Config] Enable DEV_SYNC_PROBE as module
- SAUCE: gpio: aggregator: Fix error code in gpio_aggregator_activate()
- gpio: aggregator: rename 'name' to 'key' in gpio_aggregator_parse()
- gpio: aggregator: expose aggregator created via legacy sysfs to configfs
- SAUCE: gpio: aggregator: fix "_sysfs" prefix check in
gpio_aggregator_make_group()
- SAUCE: gpio: aggregator: Fix gpio_aggregator_line_alloc() checking
- SAUCE: gpio: aggregator: Return an error if there are no GPIOs in
gpio_aggregator_parse()
- SAUCE: gpio: aggregator: Fix leak in gpio_aggregator_parse()
- gpio: aggregator: cancel deferred probe for devices created via configfs
- Documentation: gpio: document configfs interface for gpio-aggregator
- selftests: gpio: add test cases for gpio-aggregator
- SAUCE: selftests: gpio: gpio-aggregator: add a test case for _sysfs prefix
reservation
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449)
- net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
- net: add exit_batch_rtnl() method
- gtp: use exit_batch_rtnl() method
- gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
- gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
- nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
- net: xilinx: axienet: Fix IRQ coalescing packet count overflow
- net/mlx5: Fix RDMA TX steering prio
- net/mlx5e: Rely on reqid in IPsec tunnel mode
- net/mlx5e: Always start IPsec sequence number from 1
- drm/vmwgfx: Add new keep_resv BO param
- drm/v3d: Assign job pointer to NULL before signaling the fence
- soc: ti: pruss: Fix pruss APIs
- hwmon: (tmp513) Fix division of negative numbers
- i2c: mux: demux-pinctrl: check initial mux selection, too
- i2c: rcar: fix NACK handling when being a target
- hfs: Sanity check the root record
- fs: fix missing declaration of init_files
- kheaders: Ignore silly-rename files
- cachefiles: Parse the "secctx" immediately
- scsi: ufs: core: Honor runtime/system PM levels if set by host controller
drivers
- selftests: tc-testing: reduce rshift value
- ACPI: resource: acpi_dev_irq_override(): Check DMI match last
- poll_wait: add mb() to fix theoretical race between waitqueue_active() and
.poll()
- RDMA/bnxt_re: Fix to export port num to ib_query_qp
- nvmet: propagate npwg topology
- ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
- i2c: atr: Fix client detach
- mptcp: be sure to send ack when mptcp-level window re-opens
- mptcp: fix spurious wake-up on under memory pressure
- selftests: mptcp: avoid spurious errors on disconnect
- net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
- vsock/virtio: cancel close work in the destructor
- vsock: reset socket state when de-assigning the transport
- nouveau/fence: handle cross device fences properly
- irqchip: Plug a OF node reference leak in platform_irqchip_probe()
- irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
- drm/i915/fb: Relax clear color alignment to 64 bytes
- drm/amdgpu: always sync the GFX pipe on ctx switch
- ocfs2: fix deadlock in ocfs2_get_system_file_inode
- nfsd: add list_head nf_gc to struct nfsd_file
- x86/xen: fix SLS mitigation in xen_hypercall_iret()
- efi/zboot: Limit compression options to GZIP and ZSTD
- [Config] updateconfigs for HAVE_KERNEL_(LZ4|LZMA|LZO|XZ)
- net: ravb: Fix max TX frame size for RZ/V2M
- net/mlx5: SF, Fix add port error handling
- drm/vmwgfx: Unreserve BO on error
- i2c: testunit: on errors, repeat NACK until STOP
- hwmon: (ltc2991) Fix mixed signed/unsigned in DIV_ROUND_CLOSEST
- fs/qnx6: Fix building with GCC 15
- gpio: sim: lock up configfs that an instantiated device depends on
- gpio: sim: lock hog configfs items if present
- platform/x86: ISST: Add Clearwater Forest to support list
- drm/nouveau/disp: Fix missing backlight control on Macbook 5,1
- net/ncsi: fix locking in Get MAC Address handling
- drm/amd/display: Do not elevate mem_type change to full update
- drm/xe: Mark ComputeCS read mode as UC on iGPU
- drm/amdgpu/smu13: update powersave optimizations
- drm/amdgpu: fix fw attestation for MP0_14_0_{2/3}
- drm/amdgpu: disable gfxoff with the compute workload on gfx12
- drm/amd/display: Fix PSR-SU not support but still call the
amdgpu_dm_psr_enable
- Upstream stable to v6.6.73, v6.6.74, v6.12.11
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21672
- afs: Fix merge preference rule failure condition
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21682
- eth: bnxt: always recalculate features after XDP clearing, fix null-deref
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2024-53124
- net: fix data-races around sk->sk_forward_alloc
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2024-57924
- fs: relax assertions on failure to encode file handles
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2024-57951
- hrtimers: Handle CPU state correctly on hotplug
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2024-57949
- irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21668
- pmdomain: imx8mp-blk-ctrl: add missing loop break condition
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21684
- gpio: xilinx: Convert gpio_lock to raw spinlock
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21694
- fs/proc: fix softlockup in __read_vmcore (part 2)
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21665
- filemap: avoid truncating 64-bit offset to 32 bits
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21666
- vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21669
- vsock/virtio: discard packets if the transport changes
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21670
- vsock/bpf: return early if transport is not assigned
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21667
- iomap: avoid avoid truncating 64-bit offset to 32 bits
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2024-57948
- mac802154: check local interfaces before deleting sdata list
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21673
- smb: client: fix double free of TCP_Server_Info::hostname
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21697
- drm/v3d: Ensure job pointer is set to NULL after job completion
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21674
- net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21675
- net/mlx5: Clear port select structure when fail to create
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21676
- net: fec: handle page_pool_dev_alloc_pages error
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21678
- gtp: Destroy device along with udp socket's netns dismantle.
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21680
- pktgen: Avoid out-of-bounds access in get_imix_entries
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21681
- openvswitch: fix lockup on tx to unregistering netdev with carrier
* Noble update: upstream stable patchset 2025-04-16 (LP: #2107449) //
CVE-2025-21683
- bpf: Fix bpf_sk_select_reuseport() memory leak
* Packaging resync (LP: #1786013)
- [Packaging] update annotations scripts
-- Stefan Bader <stefan.bader@canonical.com> Fri, 23 May 2025 11:48:00 +0200
linux-hwe-6.8 (6.8.0-60.63~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-60.63~22.04.1 -proposed tracker (LP: #2107137)
* Packaging resync (LP: #1786013)
- [Packaging] debian.hwe-6.8/dkms-versions -- update from kernel-versions
(main/2025.04.14)
[ Ubuntu: 6.8.0-60.63 ]
* noble/linux: 6.8.0-60.63 -proposed tracker (LP: #2107138)
* Packaging resync (LP: #1786013)
- [Packaging] debian.master/dkms-versions -- update from kernel-versions
(main/2025.04.14)
* Missing upstream commits for LP: #2102181 (LP: #2107336)
- libperf cpumap: Add any, empty and min helpers
- libperf cpumap: Ensure empty cpumap is NULL from alloc
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770)
- memblock: use numa_valid_node() helper to check for invalid node ID
- jbd2: increase IO priority for writing revoke records
- jbd2: flush filesystem device before updating tail sequence
- dm array: fix unreleased btree blocks on closing a faulty array cursor
- dm array: fix cursor index when skipping across block boundaries
- exfat: fix the infinite loop in __exfat_free_cluster()
- erofs: fix PSI memstall accounting
- ASoC: rt722: add delay time to wait for the calibration procedure
- ASoC: mediatek: disable buffer pre-allocation
- selftests/alsa: Fix circular dependency involving global-timer
- ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
- net: 802: LLC+SNAP OID:PID lookup on start of skb data
- tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
- tcp/dccp: allow a connection when sk_max_ack_backlog is zero
- net: libwx: fix firmware mailbox abnormal return
- pds_core: limit loop over fw name list
- bnxt_en: Fix possible memory leak when hwrm_req_replace fails
- cxgb4: Avoid removal of uninserted tid
- ice: fix incorrect PHY settings for 100 GB/s
- igc: return early when failing to read EECD register
- tls: Fix tls_sw_sendmsg error handling
- eth: gve: use appropriate helper to set xdp_features
- Bluetooth: hci_sync: Fix not setting Random Address when required
- Bluetooth: MGMT: Fix Add Device to responding before completing
- Bluetooth: btnxpuart: Fix driver sending truncated data
- tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
- riscv: Fix early ftrace nop patching
- memblock tests: fix implicit declaration of function 'numa_valid_node'
- iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
- netfilter: nf_tables: imbalance in flowtable binding
- drm/mediatek: stop selecting foreign drivers
- [Config] updateconfigs for MTK_SMI
- drm/mediatek: Fix YCbCr422 color format issue for DP
- drm/mediatek: Fix mode valid issue for dp
- drm/mediatek: Add return value check when reading DPCD
- cpuidle: riscv-sbi: fix device node release in early exit of
for_each_possible_cpu
- scsi: ufs: qcom: Power off the PHY if it was already powered on in
ufs_qcom_power_up_sequence()
- dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
- ksmbd: Implement new SMB3 POSIX type
- thermal: of: fix OF node leak in of_thermal_zone_find()
- smb: client: sync the root session and superblock context passwords before
automounting
- ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
- ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
- drm/amd/display: increase MAX_SURFACES to the value supported by hw
- io_uring/timeout: fix multishot updates
- dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
- USB: serial: option: add MeiG Smart SRM815
- USB: serial: option: add Neoway N723-EA support
- staging: iio: ad9834: Correct phase range check
- staging: iio: ad9832: Correct phase range check
- usb-storage: Add max sectors quirk for Nokia 208
- USB: serial: cp210x: add Phoenix Contact UPS Device
- usb: dwc3: gadget: fix writing NYET threshold
- misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set
config
- tty: serial: 8250: Fix another runtime PM usage counter underflow
- usb: dwc3-am62: Disable autosuspend during remove
- USB: usblp: return error when setting unsupported protocol
- USB: core: Disable LPM only for non-suspended ports
- usb: fix reference leak in usb_new_device()
- usb: gadget: midi2: Reverse-select at the right place
- usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in
the error path of .probe()
- usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
- usb: typec: tcpm/tcpci_maxim: fix error code in
max_contaminant_read_resistance_kohm()
- usb: gadget: configfs: Ignore trailing LF for user strings to cdev
- iio: gyro: fxas21002c: Fix missing data update in trigger handler
- iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
- iio: inkern: call iio_device_put() only on mapped devices
- iio: adc: ad7124: Disable all channels at probe time
- riscv: kprobes: Fix incorrect address calculation
- ARM: dts: imxrt1050: Fix clocks for mmc
- arm64: dts: rockchip: add hevc power domain clock to rk3328
- pmdomain: imx: gpcv2: Simplify with scoped for each OF child loop
- pmdomain: imx: gpcv2: fix an OF node reference leak in imx_gpcv2_probe()
- workqueue: Add rcu lock check at the end of work item execution
- workqueue: Update lock debugging code
- mm/hugetlb: enforce that PMD PT sharing has split PMD PT locks
- riscv: Fix text patching when IPI are used
- drm/mediatek: Only touch DISP_REG_OVL_PITCH_MSB if AFBC is supported
- ovl: pass realinode to ovl_encode_real_fh() instead of realdentry
- net: don't dump Tx and uninitialized NAPIs
- ice: fix max values for dpll pin phase adjust
- net: hns3: fixed reset failure issues caused by the incorrect reset type
- net: hns3: fix missing features due to dev->features configuration too early
- net: hns3: Resolved the issue that the debugfs query result is inconsistent.
- net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
- mctp i3c: fix MCTP I3C driver multi-thread issue
- drm/mediatek: Move mtk_crtc_finish_page_flip() to ddp_cmdq_cb()
- drm/mediatek: Add support for 180-degree rotation in the display driver
- drm/mediatek: mtk_dsi: Add registers to pdata to fix MT8186/MT8188
- platform/x86: intel/pmc: Fix ioremap() of bad address
- riscv: module: remove relocation_head rel_entry member allocation
- cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains
- fs: kill MNT_ONRB
- gpio: loongson: Fix Loongson-2K2000 ACPI GPIO register offset
- drm/amd/pm: fix BUG: scheduling while atomic
- drm/amdkfd: wq_release signals dma_fence only when available
- drm/amd/display: fix divide error in DM plane scale calcs
- drm/amd/display: fix page fault due to max surface definition mismatch
- serial: stm32: use port lock wrappers for break control
- usb: host: xhci-plat: set skip_phy_initialization if software node has
XHCI_SKIP_PHY_INIT property
- iio: imu: inv_icm42600: add register caching in the regmap
- iio: imu: inv_icm42600: fix spi burst write not supported
- Upstream stable to v6.6.71, v6.6.72, v6.12.10
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21659
- netdev: prevent accessing NAPI instances from another namespace
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21634
- cgroup/cpuset: remove kernfs active break
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21635
- rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21643
- netfs: Fix kernel async DIO
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21649
- net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21650
- net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21651
- net: hns3: don't auto enable misc vector
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21654
- ovl: support encoding fid from inode with no alias
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57883
- mm: hugetlb: independent PMD page table shared count
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57888
- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from
!WQ_MEM_RECLAIM worker
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21631
- block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21656
- hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21655
- io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57904
- iio: adc: at91: call input_free_device() on allocated iio_dev
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57906
- iio: adc: ti-ads8688: fix information leak in triggered buffer
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57907
- iio: adc: rockchip_saradc: fix information leak in triggered buffer
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57908
- iio: imu: kmx61: fix information leak in triggered buffer
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57910
- iio: light: vcnl4035: fix information leak in triggered buffer
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57911
- iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered
buffer
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57912
- iio: pressure: zpa2326: fix information leak in triggered buffer
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57913
- usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21632
- x86/fpu: Ensure shadow stack is active before "getting" registers
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57916
- misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57917
- topology: Keep the cpumask unchanged when printing cpumap
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57939
- riscv: Fix sleeping in invalid context in die()
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21636
- sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21637
- sctp: sysctl: udp_port: avoid using current->nsproxy
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21638
- sctp: sysctl: auth_enable: avoid using current->nsproxy
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21639
- sctp: sysctl: rto_min/max: avoid using current->nsproxy
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21640
- sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21642
- mptcp: sysctl: sched: avoid using current->nsproxy
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21664
- dm thin: make get_first_thin use rcu-safe list first function
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57945
- riscv: mm: Fix the out of bound issue of vmemmap address
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21660
- ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21645
- platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled
it
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21646
- afs: Fix the maximum cell name length
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57925
- ksmbd: fix a missing return value check bug
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57926
- drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind
returns err
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21662
- net/mlx5: Fix variable not being completed when function returns
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21663
- net: stmmac: dwmac-tegra: Read iommu stream id from device tree
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21647
- sched: sch_cake: add bounds checks to host bulk flow fairness counts
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21648
- netfilter: conntrack: clamp maximum hashtable size to INT_MAX
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21652
- ipvlan: Fix use-after-free in ipvlan_get_iflink().
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21658
- btrfs: avoid NULL pointer dereference if no valid extent tree
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2025-21653
- net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-47736
- erofs: handle overlapped pclusters out of crafted images properly
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57940
- exfat: fix the infinite loop in exfat_readdir()
* Noble update: upstream stable patchset 2025-04-10 (LP: #2106770) //
CVE-2024-57929
- dm array: fix releasing a faulty array block twice in dm_array_cursor_end
* intel_idle: add Granite Rapids Xeon (D) support (LP: #2106638)
- intel_idle: add Granite Rapids Xeon support
- intel_idle: add Granite Rapids Xeon D support
* [SRU] Enable speaker/mic mute LEDs on Lenovo ideapad and thinkbook
(LP: #2106449)
- ALSA: hda: Support for Ideapad hotkey mute LEDs
- platform/x86:lenovo-wmi-hotkey-utilities.c: Support for mic and audio mute
LEDs
- [Config] Enable Lenovo wmi hotkey driver
* Backport "PCI: Wait for device readiness with Configuration RRS" to N/O
(LP: #2106251)
- PCI: Wait for device readiness with Configuration RRS
- PCI: Avoid FLR for Mediatek MT7922 WiFi
* Enable OOB P-state control for Intel Sierra Forest/Granite Rapids
(LP: #2106275)
- cpufreq: intel_pstate: Support Granite Rapids and Sierra Forest OOB mode
* mptcp BUG 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
(LP: #2101120)
- mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
* CVE-2025-21971
- net_sched: Prevent creation of classes with TC_H_ROOT
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632)
- smb/client: rename cifs_ntsd to smb_ntsd
- smb/client: rename cifs_sid to smb_sid
- smb/client: rename cifs_acl to smb_acl
- smb/client: rename cifs_ace to smb_ace
- fs/smb/client: implement chmod() for SMB3 POSIX Extensions
- smb: client: stop flooding dmesg in smb2_calc_signature()
- media: uvcvideo: Force UVC version to 1.0a for 0408:4033
- Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925
- watchdog: rzg2l_wdt: Remove reset de-assert from probe
- watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset
- watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler
- ALSA: ump: Use guard() for locking
- ALSA: ump: Don't open legacy substream for an inactive group
- scsi: mpi3mr: Use ida to manage mrioc ID
- scsi: mpi3mr: Start controller indexing from 0
- ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11
- ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A
- x86/ptrace: Cleanup the definition of the pt_regs structure
- x86/ptrace: Add FRED additional information to the pt_regs structure
- Bluetooth: btusb: add callback function in btusb suspend/resume
- Bluetooth: btusb: mediatek: add callback function in btusb_disconnect
- platform/x86: mlx-platform: call pci_dev_put() to balance the refcount
- mmc: sdhci-msm: fix crypto key eviction
- tracing: Handle old buffer mappings for event strings and functions
- tracing: Fix trace_check_vprintf() when tp_printk is used
- tracing: Check "%s" dereference via the field and not the TP_printk format
- RDMA/bnxt_re: Allow MSN table capability check
- RDMA/bnxt_re: Remove always true dattr validity check
- RDMA/mlx5: Enforce same type port association for multiport RoCE
- RDMA/bnxt_re: Avoid initializing the software queue for user queues
- RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters
- nvme-pci: 512 byte aligned dma pool segment quirk
- RDMA/bnxt_re: Fix the check for 9060 condition
- RDMA/bnxt_re: Add check for path mtu in modify_qp
- RDMA/bnxt_re: Fix reporting hw_ver in query_device
- RDMA/bnxt_re: Fix max_qp_wrs reported
- RDMA/bnxt_re: Add support for Variable WQE in Genp7 adapters
- RDMA/bnxt_re: Disable use of reserved wqes
- RDMA/bnxt_re: Add send queue size check for variable wqe
- RDMA/bnxt_re: Fix MSN table size for variable wqe mode
- drm/bridge: adv7511_audio: Update Audio InfoFrame properly
- net: dsa: microchip: Fix KSZ9477 set_ageing_time function
- net: dsa: microchip: Fix LAN937X set_ageing_time function
- RDMA/hns: Refactor mtr find
- RDMA/hns: Remove unused parameters and variables
- RDMA/hns: Fix mapping error of zero-hop WQE buffer
- RDMA/hns: Fix warning storm caused by invalid input in IO path
- RDMA/hns: Fix missing flush CQE for DWQE
- ip_tunnel: annotate data-races around t->parms.link
- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev()
- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit()
- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit()
- net: Fix netns for ip_tunnel_init_flow()
- net/mlx5: DR, select MSIX vector 0 for completion queue creation
- net/mlx5e: macsec: Maintain TX SA from encoding_sa
- drm/i915/dg1: Fix power gate sequence.
- net: llc: reset skb->transport_header
- ALSA: usb-audio: US16x08: Initialize array before use
- eth: bcmsysport: fix call balance of priv->clk handling routines
- net: mv643xx_eth: fix an OF node reference leak
- net: sfc: Correct key_len for efx_tc_ct_zone_ht_params
- net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init()
- net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init
- wifi: mac80211: wake the queues in case of failure in resume
- ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers
- ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model
- sound: usb: enable DSD output for ddHiFi TC44C
- sound: usb: format: don't warn that raw DSD is unsupported
- bpf: fix potential error return
- ksmbd: retry iterate_dir in smb2_query_dir
- smb: client: destroy cfid_put_wq on module exit
- net: usb: qmi_wwan: add Telit FE910C04 compositions
- irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
- ARC: build: Try to guess GCC variant of cross compiler
- RDMA/bnxt_re: Fix the max WQE size for static WQE support
- modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
- modpost: fix the missed iteration for the max bit in do_input()
- ALSA: seq: Check UMP support for midi_version change
- ALSA hda/realtek: Add quirk for Framework F111:000C
- kcov: mark in_softirq_really() as __always_inline
- scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
- sky2: Add device ID 11ab:4373 for Marvell 88E8075
- drm: adv7511: Drop dsi single lane support
- dt-bindings: display: adi,adv7533: Drop single lane support
- fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit
- mm/readahead: fix large folio support in async readahead
- mptcp: fix recvbuffer adjust on sleeping rcvmsg
- mptcp: don't always assume copied data in mptcp_cleanup_rbuf()
- RDMA/bnxt_re: Fix max SGEs for the Work Request
- scsi: hisi_sas: Remove redundant checks for automatic debugfs dump
- platform/x86: hp-wmi: Add thermal profile support for 8BAD boards
- platform/x86: hp-wmi: Fix platform profile option switch bug on Omen and
Victus laptops
- platform/x86: hp-wmi: Fix implementation of the platform_profile_omen_get
function
- platform/x86: hp-wmi: mark 8A15 board for timed OMEN thermal profile
- RDMA/core: Fix ENODEV error for iWARP test over vlan
- net: phy: micrel: Dynamically control external clock of KSZ PHY
- netdev-genl: avoid empty messages in napi get
- net: stmmac: restructure the error path of stmmac_probe_config_dt()
- net/mlx5e: Fix netif state handling
- net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only
- drm/i915/cx0_phy: Fix C10 pll programming sequence
- RDMA/bnxt_re: Fix error recovery sequence
- btrfs: allow swap activation to be interruptible
- perf/x86/intel: Add Arrow Lake U support
- ALSA: hda: cs35l56: Remove calls to
cs35l56_force_sync_asp1_registers_from_cache()
- ALSA: hda/realtek - Add support for ASUS Zen AIO 27 Z272SD_A272SD audio
- spi: spi-cadence-qspi: Disable STIG mode for Altera SoCFPGA.
- ARC: build: disallow invalid PAE40 + 4K page config
- bpf: refactor bpf_helper_changes_pkt_data to use helper number
- bpf: consider that tail calls invalidate packet pointers
- maple_tree: reload mas before the second call for mas_empty_area
- io_uring/rw: fix downgraded mshot read
- wifi: iwlwifi: mvm: Fix __counted_by usage in cfg80211_wowlan_nd_*
- net: ethernet: ti: am65-cpsw: default to round-robin for host port receive
- gve: process XSK TX descriptors as part of RX NAPI
- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
- mm: reinstate ability to map write-sealed memfd mappings read-only
- Upstream stable to v6.6.70, v6.12.9
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57898
- wifi: cfg80211: clear link ID from bitmap during link delete after clean up
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57882
- mptcp: fix TCP options overflow.
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57884
- mm: vmscan: account for free pages to prevent infinite Loop in
throttle_direct_reclaim()
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57885
- mm/kmemleak: fix sleeping function called from invalid context at print
message
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57932
- gve: guard XDP xmit NDO on existence of xdp queues
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57933
- gve: guard XSK operations on the existence of queues
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57887
- drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57938
- net/sctp: Prevent autoclose integer overflow in sctp_association_init()
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57889
- pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57890
- RDMA/uverbs: Prevent integer overflow issue
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57892
- ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57893
- ALSA: seq: oss: Fix races at processing SysEx messages
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57895
- ksmbd: set ATTR_CTIME flags when setting mtime
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57896
- btrfs: flush delalloc workers queue before stopping cleaner kthread during
unmount
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57897
- drm/amdkfd: Correct the migration DMA map direction
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57899
- wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57900
- ila: serialize calls to nf_register_net_hooks()
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57901
- af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57902
- af_packet: fix vlan_get_tci() vs MSG_PEEK
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57903
- net: restrict SO_REUSEPORT to inet sockets
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-36476
- RDMA/rtrs: Ensure 'ib_sge list' is accessible
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-39282
- net: wwan: t7xx: Fix FSM command timeout issue
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57801
- net/mlx5e: Skip restore TC rules for vport rep without loaded flag
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57802
- netrom: check buffer length before accessing it
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57841
- net: fix memory leak in tcp_conn_request()
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-57931
- selinux: ignore unknown extended permissions
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-56761
- x86/fred: Clear WFE in missing-ENDBRANCH #CPs
* Noble update: upstream stable patchset 2025-04-09 (LP: #2106632) //
CVE-2024-53179
- smb: client: fix use-after-free of signing key
* uprobe-related panics during profiling (LP: #2104210)
- uprobes: Fix race in uprobe_free_utask
* ubuntu_bpf failed to build on Noble / Oracular (LP: #2069407)
- selftests/bpf: Fix compilation failure when CONFIG_NET_FOU!=y
* nfsd hangs and never recovers after NFS4ERR_DELAY and a connection loss
(LP: #2103564)
- NFSD: Reset cb_seq_status after NFS4ERR_DELAY
* thermal: Fix temperature readings on intel hardware (LP: #2103427)
- thermal: intel: intel_tcc: Add model checks for temperature registers
- thermal: intel: intel_tcc_cooling: Use a model-specific bitmask for TCC
offset
- hwmon: (coretemp) Extend the bitmask to read temperature to 0xff
* [SRU] Fix Lenovo M70/90 gen6 micmute key and led (LP: #2101811)
- ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform
- ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869)
- ceph: allocate sparse_ext map only for sparse reads
- mm/vmstat: fix a W=1 clang compiler warning
- tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress()
- tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
- bpf: Check negative offsets in __bpf_skb_min_len()
- mtd: diskonchip: Cast an operand to prevent potential overflow
- mtd: rawnand: arasan: Fix double assertion of chip-select
- mtd: rawnand: arasan: Fix missing de-registration of NAND
- phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP
- phy: core: Fix an OF node refcount leakage in _of_phy_get()
- phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
- phy: core: Fix that API devm_phy_put() fails to release the phy
- phy: core: Fix that API devm_of_phy_provider_unregister() fails to
unregister the phy provider
- phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
- phy: usb: Toggle the PHY power during init
- phy: rockchip: naneng-combphy: fix phy reset
- dmaengine: mv_xor: fix child node refcount handling in early exit
- dmaengine: dw: Select only supported masters for ACPI devices
- dmaengine: tegra: Return correct DMA status when paused
- dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()
- dmaengine: apple-admac: Avoid accessing registers in probe
- stddef: make __struct_group() UAPI C++-friendly
- tracing/kprobe: Make trace_kprobe's module callback called after jump_label
update
- watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
- watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
- scsi: qla1280: Fix hw revision numbering for ISP1020/1040
- udf: Skip parent dir link count update if corrupted
- ALSA: hda/conexant: fix Z60MR100 startup pop issue
- ALSA: sh: Use standard helper for buffer accesses
- smb: server: Fix building with GCC 15
- regmap: Use correct format specifier for logging range errors
- LoongArch: Fix reserving screen info memory for above-4G firmware
- LoongArch: BPF: Adjust the parameter of emit_jirl()
- platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
- spi: intel: Add Panther Lake SPI controller support
- scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load
time
- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN
as an error
- spi: omap2-mcspi: Fix the IS_ERR() bug for devm_clk_get_optional_enabled()
- blk-mq: register cpuhp callback after hctx is added to xarray table
- blk-mq: move cpuhp callback registering out of q->sysfs_lock
- MIPS: Probe toolchain support of -msym32
- MIPS: mipsregs: Set proper ISA level for virt extensions
- freezer, sched: Report frozen tasks as 'D' instead of 'R'
- tracing: Constify string literal data member in struct trace_event_call
- io_uring/sqpoll: fix sqpoll error handling races
- i2c: microchip-core: actually use repeated sends
- i2c: imx: add imx7d compatible string for applying erratum ERR007805
- i2c: microchip-core: fix "ghost" detections
- btrfs: sysfs: fix direct super block member reads
- ALSA: sh: Fix wrong argument order for copy_from_iter()
- block: avoid to reuse `hctx` not removed from cpuhp callback list
- fork: avoid inappropriate uprobe access to invalid mm
- ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
- power: supply: bq24190: Fix BQ24296 Vbus regulator support
- udf: Verify inode link counts before performing rename
- ALSA: ump: Indicate the inactive group in legacy substream names
- ALSA: ump: Update legacy substream names upon FB info update
- scsi: mpi3mr: Synchronize access to ioctl data buffer
- scsi: mpi3mr: Handling of fault code for insufficient power
- objtool: Add bch2_trans_unlocked_error() to bcachefs noreturns
- dmaengine: loongson2-apb: Change GENMASK to GENMASK_ULL
- perf/x86/intel/ds: Add PEBS format 6
- btrfs: add and use helper to verify the calling task has locked the inode
- btrfs: fix race with memory mapped writes when activating swap file
- btrfs: fix swap file activation failure due to extents that used to be
shared
- ALSA: ump: Shut up truncated string warning
- Upstream stable to v6.6.69, v6.12.8
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-56758
- btrfs: check folio mapping after unlock in relocate_one_folio()
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-56759
- btrfs: fix use-after-free when COWing tree bock and tracing is enabled
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-57806
- btrfs: fix transaction atomicity bug when enabling simple quotas
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-57793
- virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-56764
- ublk: detach gendisk from ublk device if add_disk() fails
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-57804
- scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-57792
- power: supply: gpio-charger: Fix set charge current limits
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-56760
- PCI/MSI: Handle lack of irqdomain gracefully
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-56763
- tracing: Prevent bad count for tracing_cpumask_write
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-57946
- virtio-blk: don't keep queue frozen during system suspend
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-57807
- scsi: megaraid_sas: Fix for a potential deadlock
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-56767
- dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
* Noble update: upstream stable patchset 2025-03-22 (LP: #2103869) //
CVE-2024-56769
- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266)
- usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with
iommu enabled
- PCI: vmd: Create domain symlink before pci_bus_add_devices()
- PCI: Add ACS quirk for Broadcom BCM5760X NIC
- usb: cdns3-ti: Add workaround for Errata i2409
- MIPS: Loongson64: DTS: Fix msi node for ls7a
- ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP
- ASoC: Intel: sof_sdw: add quirk for Dell SKU 0B8C
- usb: cdns3: Add quirk flag to enable suspend residency
- platform/x86: p2sb: Make p2sb_get_devfn() return void
- p2sb: Factor out p2sb_read_from_cache()
- p2sb: Introduce the global flag p2sb_hidden_by_bios
- p2sb: Move P2SB hide and unhide code to p2sb_scan_and_cache()
- p2sb: Do not scan and remove the P2SB device when it is unhidden
- i2c: pnx: Fix timeout in wait functions
- xfs: fix the contact address for the sysfs ABI documentation
- xfs: verify buffer, inode, and dquot items every tx commit
- xfs: use consistent uid/gid when grabbing dquots for inodes
- xfs: declare xfs_file.c symbols in xfs_file.h
- xfs: create a new helper to return a file's allocation unit
- xfs: Fix xfs_flush_unmap_range() range for RT
- xfs: Fix xfs_prepare_shift() range for RT
- xfs: convert comma to semicolon
- xfs: fix file_path handling in tracepoints
- xfs: remove unused parameter in macro XFS_DQUOT_LOGRES
- xfs: attr forks require attr, not attr2
- xfs: conditionally allow FS_XFLAG_REALTIME changes if S_DAX is set
- xfs: Fix the owner setting issue for rmap query in xfs fsmap
- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
- xfs: take m_growlock when running growfsrt
- xfs: reset rootdir extent size hint after growfsrt
- tools: hv: change permissions of NetworkManager configuration file
- cxl/pci: Fix potential bogus return value upon successful probing
- cxl/region: Fix region creation for greater than x2 switches
- net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
- ionic: use ee->offset when returning sprom data
- net: renesas: rswitch: rework ts tags management
- net: hinic: Fix cleanup in create_rxqs/txqs()
- net: ethernet: bgmac-platform: fix an OF node reference leak
- ipvs: Fix clamp() of ip_vs_conn_tab on small memory systems
- netfilter: ipset: Fix for recursive locking warning
- selftests: openvswitch: fix tcpdump execution
- net: mdiobus: fix an OF node reference leak
- mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
- mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe()
- EDAC/amd64: Simplify ECC check on unified memory controllers
- chelsio/chtls: prevent potential integer overflow on 32bit
- i2c: riic: Always round-up when calculating bus period
- efivarfs: Fix error on non-existent file
- hexagon: Disable constant extender optimization for LLVM prior to 19.1.0
- USB: serial: option: add TCL IK512 MBIM & ECM
- USB: serial: option: add MeiG Smart SLM770A
- USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
- USB: serial: option: add MediaTek T7XX compositions
- USB: serial: option: add Telit FE910C04 rmnet compositions
- thunderbolt: Improve redrive mode handling
- drm/panel: novatek-nt35950: fix return value check in nt35950_probe()
- i915/guc: Reset engine utilization buffer before registration
- i915/guc: Ensure busyness counter increases motonically
- i915/guc: Accumulate active runtime on gt reset
- hwmon: (tmp513) Fix interpretation of values of Shunt Voltage and Limit
Registers
- hwmon: (tmp513) Fix Current Register value interpretation
- hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit
Registers
- zram: refuse to use zero sized block device as backing device
- zram: fix uninitialized ZRAM not releasing backing device
- zram: fix potential UAF of zram table
- vmalloc: fix accounting with i915
- btrfs: tree-checker: reject inline extent items with 0 ref count
- smb: client: fix TCP timers deadlock after rmmod
- tracing: Fix test_event_printk() to process entire print argument
- tracing: Add missing helper functions in event pointer dereference check
- tracing: Add "%s" check in test_event_printk()
- tracing: Have process_string() also allow arrays
- selftests/memfd: run sysctl tests when PID namespace support is enabled
- selftests/bpf: Use asm constraint "m" for LoongArch
- io_uring: Fix registered ring file refcount leak
- NFS/pnfs: Fix a live lock between recalled layouts and layoutget
- of/irq: Fix interrupt-map cell length check in of_irq_parse_imap_parent()
- of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
- nilfs2: fix buffer head leaks in calls to truncate_inode_pages()
- udmabuf: also check for F_SEAL_FUTURE_WRITE
- of: Fix error path in of_parse_phandle_with_args_map()
- of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
- ceph: validate snapdirname option length when mounting
- ceph: improve error handling and short/overflow-read logic in
__ceph_sync_read()
- ceph: fix memory leaks in __ceph_sync_read()
- epoll: Add synchronous wakeup support for ep_poll_callback
- io_uring/rw: avoid punting to io-wq directly
- drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update
- xfs: sb_spino_align is not verified
- xfs: fix sparse inode limits on runt AG
- xfs: fix sb_spino_align checks for large fsblock sizes
- xfs: fix zero byte checking in the superblock scrubber
- netdev: fix repeated netlink messages in queue dump
- team: Fix feature exposure when no ports are present
- can: m_can: fix missed interrupts with m_can_pci
- netdev-genl: avoid empty messages in queue dump
- KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden
- KVM: arm64: Fix set_id_regs selftest for ASIDBITS becoming unwritable
- net: mctp: handle skb cleanup on sock_queue failures
- xhci: retry Stop Endpoint on buggy NEC controllers
- usb: xhci: Limit Stop Endpoint retries
- usb: xhci: Avoid queuing redundant Stop Endpoint commands
- xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic
- thunderbolt: Add support for Intel Panther Lake-M/P
- thunderbolt: Don't display nvm_version unless upgrade supported
- drm/panel: st7701: Add prepare_prev_first flag to drm_panel
- drm/panel: synaptics-r63353: Fix regulator unbalance
- drm/amdgpu/nbio7.11: fix IP version check
- drm/amdgpu/nbio7.7: fix IP version check
- fgraph: Still initialize idle shadow stacks when starting
- x86/hyperv: Fix hv tsc page based sched_clock for hibernation
- ocfs2: fix the space leak in LA when releasing LA
- of: property: fw_devlink: Do not use interrupt-parent directly
- of: address: Preserve the flags portion on 1:1 dma-ranges mapping
- Upstream stable to v6.6.68, v6.12.7
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-56710
- ceph: fix memory leak in ceph_direct_read_write()
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-53685
- ceph: give up on paths longer than PATH_MAX
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-54193
- accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-54455
- accel/ivpu: Fix general protection fault in ivpu_bo_list()
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-53690
- nilfs2: prevent use of deleted inode
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-56709
- io_uring: check if iowq is killed before queuing
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-55881
- KVM: x86: Play nice with protected guests in complete_hypercall_exit()
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-55916
- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-56369
- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-56372
- net: tun: fix tun_napi_alloc_frags()
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-56715
- ionic: Fix netdev notifier unregister on failure
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-56716
- netdevsim: prevent bad user input in nsim_dev_health_break_write()
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-56717
- net: mscc: ocelot: fix incorrect IFH SRC_PORT field in
ocelot_ifh_set_basic()
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-57791
- net/smc: check return value of sock_recvmsg when draining clc data
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-47408
- net/smc: check smcd_v2_ext_offset when receiving proposal msg
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-49568
- net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-49571
- net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal
msg
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-56718
- net/smc: protect link down work from execute after lgr freed
* Noble update: upstream stable patchset 2025-03-14 (LP: #2102266) //
CVE-2024-41013
- xfs: don't walk off the end of a directory data block
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181)
- perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
- ksmbd: fix racy issue from session lookup and expire
- splice: do not checksum AF_UNIX sockets
- tcp: check space before adding MPTCP SYN options
- ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
- usb: host: max3421-hcd: Correctly abort a USB request.
- ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
- usb: dwc2: Fix HCD resume
- usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
- usb: dwc2: Fix HCD port connection race
- scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
- usb: gadget: midi2: Fix interpretation of is_midi1 bits
- usb: ehci-hcd: fix call balance of clocks handling routines
- usb: typec: anx7411: fix fwnode_handle reference leak
- usb: typec: anx7411: fix OF node reference leaks in
anx7411_typec_switch_probe()
- usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
- drm/i915: Fix memory leak by correcting cache object name in error handler
- xfs: update btree keys correctly when _insrec splits an inode root block
- xfs: don't drop errno values when we fail to ficlone the entire range
- xfs: return from xfs_symlink_verify early on V4 filesystems
- xfs: fix scrub tracepoints when inode-rooted btrees are involved
- xfs: only run precommits once per transaction object
- bpf: Check size for BTF-based ctx access of pointer members
- bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
- bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
- bpf, sockmap: Fix update element with same
- wifi: mac80211: init cnt before accessing elem in
ieee80211_copy_mbssid_beacon
- wifi: mac80211: clean up 'ret' in sta_link_apply_parameters()
- wifi: mac80211: fix station NSS capability initialization order
- batman-adv: Do not send uninitialized TT changes
- batman-adv: Remove uninitialized data in full table TT response
- batman-adv: Do not let TT changes list grows indefinitely
- wifi: cfg80211: sme: init n_channels before channels[] access
- selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
- selftests: mlxsw: sharedbuffer: Remove duplicate test cases
- selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
- ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
- net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
- net: mscc: ocelot: improve handling of TX timestamp for unknown skb
- net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-
safe
- net: mscc: ocelot: be resilient to loss of PTP packets during transmission
- net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
- spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
- net: sparx5: fix FDMA performance issue
- net: sparx5: fix the maximum frame length register
- ACPI: resource: Fix memory resource type union access
- cxgb4: use port number to set mac addr
- qca_spi: Fix clock speed for multiple QCA7000
- qca_spi: Make driver probing reliable
- ASoC: amd: yc: Fix the wrong return value
- Documentation: PM: Clarify pm_runtime_resume_and_get() return value
- net: renesas: rswitch: fix race window between tx start and complete
- net: renesas: rswitch: fix leaked pointer on error path
- net: renesas: rswitch: handle stop vs interrupt race
- net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
- netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
- bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
- team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
- ACPICA: events/evxfregn: don't release the ContextMutex that was never
acquired
- Bluetooth: iso: Fix recursive locking warning
- Bluetooth: SCO: Add support for 16 bits transparent voice setting
- net: renesas: rswitch: fix initial MPIC register setting
- net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
- blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
- kselftest/arm64: abi: fix SVCR detection
- KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
- selftests/bpf: remove use of __xlated()
- xen/netfront: fix crash when removing device
- x86: make get_cpu_vendor() accessible from Xen code
- objtool/x86: allow syscall instruction
- x86/static-call: provide a way to do very early static-call updates
- x86/xen: don't do PV iret hypercall through hypercall page
- x86/xen: add central hypercall functions
- x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
- x86/xen: add FRAME_END to xen_hypercall_hvm()
- x86/xen: use new hypercall functions instead of hypercall page
- x86/xen: remove hypercall page
- x86/static-call: fix 32-bit build
- x86/asm: Make serialize() always_inline
- x86/static-call: Remove early_boot_irqs_disabled check to fix Xen PVH dom0
- serial: sh-sci: Check if TX data was written to device in .tx_empty()
- gpio: ljca: Initialize num before accessing item in ljca_gpio_config
- ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
- drm/amdkfd: Use device based logging for errors
- drm/amdkfd: pause autosuspend when creating pdd
- drm/amdkfd: fixed page fault when enable MES shader debugger
- drm/i915/color: Stop using non-posted DSB writes for legacy LUT
- drm/amd/pm: Set SMU v13.0.7 default workload type
- xfs: return a 64-bit block count from xfs_btree_count_blocks
- perf machine: Initialize machine->env to address a segfault
- bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
- net: renesas: rswitch: fix possible early skb release
- Bluetooth: Improve setsockopt() handling of malformed user input
- libperf: evlist: Fix --cpu argument on hybrid platform
- selftests: netfilter: Stabilize rpath.sh
- net, team, bonding: Add netdev_base_features helper
- bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
- team: Fix initial vlan_feature set in __team_compute_features
- drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
- Upstream stable to v6.6.67, v6.12.6
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56652
- drm/xe/reg_sr: Remove register pool
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-54460
- Bluetooth: iso: Fix circular lock in iso_listen_bis
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-57879
- Bluetooth: iso: Always release hdev at the end of iso_listen_bis
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56656
- bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-53125
- bpf: sync_linked_regs() must preserve subreg_def
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56654
- Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56770
- net/sched: netem: account for backlog updates from child qdisc
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-54683
- netfilter: IDLETIMER: Fix for possible ABBA deadlock
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-55639
- net: renesas: rswitch: avoid use-after-put for a device tree node
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56657
- ALSA: control: Avoid WARN() for symlink errors
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56659
- net: lapb: increase LAPB_HEADER_LEN
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56660
- net/mlx5: DR, prevent potential error pointer dereference
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56662
- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56664
- bpf, sockmap: Fix race between element replace and close()
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56667
- drm/i915: Fix NULL pointer dereference in capture_engine
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56670
- usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to
accessing null pointer
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-53687
- riscv: Fix IPIs usage in kfence_protect_page()
* Noble update: upstream stable patchset 2025-03-13 (LP: #2102181) //
CVE-2024-56675
- bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
* Noble update: upstream stable patchset 2025-02-04 (LP: #2097393)
- selftests: net: Remove executable bits from library scripts
* CVE-2024-56653
- Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
-- Stefan Bader <stefan.bader@canonical.com> Tue, 22 Apr 2025 15:59:16 +0200
linux-hwe-6.8 (6.8.0-59.61~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-59.61~22.04.1 -proposed tracker (LP: #2107075)
[ Ubuntu: 6.8.0-59.61 ]
* noble/linux: 6.8.0-59.61 -proposed tracker (LP: #2107076)
* Packaging resync (LP: #1786013)
- [Packaging] update annotations scripts
* CVE-2024-56653
- Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
-- Stefan Bader <stefan.bader@canonical.com> Tue, 15 Apr 2025 15:08:08 +0200
# For older changelog entries, run 'apt-get changelog linux-hwe-6.8-headers-6.8.0-79'
Generated by dwww version 1.14 on Sat Sep 6 06:09:09 CEST 2025.