Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-08
Ported from the following upstream stable releases:
v6.6.132, v6.6.133, v6.12.81
from git://git.kernel.org/
Revert "rust: pin-init: internal: init: document load-bearing fact of field
accessors"
arm64/scs: Fix handling of advance_loc4
HID: logitech-hidpp: Enable MX Master 4 over bluetooth
wifi: mac80211: check tdls flag in ieee80211_tdls_oper
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
atm: lec: fix use-after-free in sock_def_readable()
btrfs: don't take device_list_mutex when querying zone info
tg3: replace placeholder MAC address with device property
objtool: Fix Clang jump table detection
HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation
failure
HID: multitouch: Check to ensure report responses match the request
btrfs: reserve enough transaction items for qgroup ioctls
i2c: tegra: Don't mark devices with pins as IRQ safe
btrfs: reject root items with drop_progress and zero drop_level
spi: geni-qcom: Check DMA interrupts early in ISR
dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
property warning
wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session
crypto: caam - fix DMA corruption on long hmac keys
crypto: caam - fix overflow on long hmac keys
crypto: af-alg - fix NULL pointer dereference in scatterwalk
net: fec: fix the PTP periodic output sysfs interface
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to
zero to prevent an info-leak
net/ipv6: ioam6: prevent schema length wraparound in trace fill
tg3: Fix race for querying speed/duplex
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
bridge: br_nd_send: linearize skb before parsing ND options
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
net: enetc: check whether the RSS algorithm is Toeplitz
ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
ipv6: prevent possible UaF in addrconf_permanent_addr()
net: introduce mangleid_features
net: use skb_header_pointer() for TCPv4 GSO frag_off check
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to
prevent an info-leak
NFC: pn533: bound the UART receive buffer
net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
bpf: Fix regsafe() for pointers to packet
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
netfilter: flowtable: strictly check for maximum number of actions
netfilter: nfnetlink_log: account for netlink header size
netfilter: x_tables: ensure names are nul-terminated
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
netfilter: nf_conntrack_helper: pass helper to expect cleanup
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
netfilter: nf_conntrack_expect: honor expectation helper field
netfilter: nf_conntrack_expect: use expect->helper
netfilter: nf_conntrack_expect: store netns and zone in expectation
netfilter: ctnetlink: ignore explicit helper on new expectations
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for
NFPROTO_ARP
netfilter: nf_tables: reject immediate NF_QUEUE verdict
Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
Bluetooth: SCO: fix race conditions in sco_sock_connect()
Bluetooth: MGMT: validate LTK enc_size on load
Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
Bluetooth: MGMT: validate mesh send advertising payload length
rds: ib: reject FRMR registration before IB connection is established
bpf: sockmap: Fix use-after-free of sk->sk_socket in
sk_psock_verdict_data_ready().
net/sched: sch_netem: fix out-of-bounds access in packet corruption
net: macb: fix clk handling on PCI glue driver removal
net: macb: properly unregister fixed rate clocks
net/mlx5: lag: Check for LAG device before creating debugfs
net/mlx5: Avoid "No data available" when FW version queries fail
net/mlx5: Fix switchdev mode rollback in case of failure
net/x25: Fix potential double free of skb
net/x25: Fix overflow when accumulating packets
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
net: hsr: fix VLAN add unwind on slave errors
ipv6: avoid overflows in ip6_datagram_send_ctl()
bpf: reject direct access to nullable PTR_TO_BUF pointers
iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
accel/qaic: Handle DBC deactivation if the owner went away
hwmon: (pxe1610) Check return value of page-select write in probe
hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
dt-bindings: gpio: fix microchip #interrupt-cells
hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
hwmon: (occ) Fix missing newline in occ_show_extended()
mips: ralink: update CPU clock index
sched/fair: Fix zero_vruntime tracking fix
riscv: kgdb: fix several debug register assignment bugs
drm/ioc32: stop speculation on the drm_compat_ioctl path
wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
wifi: iwlwifi: mvm: fix potential out-of-bounds read in
iwl_mvm_nd_match_info_handler()
USB: serial: option: add MeiG Smart SRM825WN
ALSA: caiaq: fix stack out-of-bounds read in init_card
ALSA: ctxfi: Fix missing SPDIFI1 index handling
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
Bluetooth: SMP: force responder MITM requirements before building the pairing
response
Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
ksmbd: fix OOB write in QUERY_INFO for compound requests
MIPS: SiByte: Bring back cache initialisation
MIPS: Fix the GCC version check for `__multi3' workaround
hwmon: (occ) Fix division by zero in occ_show_power_1()
mips: mm: Allocate tlb_vpn array atomically
iio: adc: ti-adc161s626: fix buffer read on big-endian
iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
drm/ast: dp501: Fix initialization of SCU2C
drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode
drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP
drm/amdgpu/pm: drop SMU driver if version not matched messages
USB: serial: io_edgeport: add support for Blackbox IC135A
USB: serial: option: add support for Rolling Wireless RW135R-GL
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
Input: synaptics-rmi4 - fix a locking bug in an error path
Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
Input: bcm5974 - recover from failed mode switch
Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
Input: xpad - add support for Razer Wolverine V3 Pro
iio: adc: aspeed: clear reference voltage bits before configuring vref
iio: accel: fix ADXL355 temperature signature value
iio: dac: ad5770r: fix error return in ad5770r_read_raw()
iio: light: vcnl4035: fix scan buffer on big-endian
iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
iio: gyro: mpu3050: Fix incorrect free_irq() variable
iio: gyro: mpu3050: Fix irq resource leak
iio: gyro: mpu3050: Move iio_device_register() to correct location
iio: gyro: mpu3050: Fix out-of-sequence free_irq()
usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
usb: ulpi: fix double free in ulpi_register_interface() error path
usb: usbtmc: Flush anchored URBs in usbtmc_release
usb: ehci-brcm: fix sleep during atomic
usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
usb: cdns3: gadget: fix state inconsistency on gadget init failure
bridge: br_nd_send: validate ND option lengths
cdc-acm: new quirk for EPSON HMD
comedi: dt2815: add hardware detection to prevent crash
comedi: Reinit dev->spinlock between attachments to low-level drivers
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
comedi: me_daq: Fix potential overrun of firmware buffer
comedi: me4000: Fix potential overrun of firmware buffer
firmware: microchip: fail auto-update probe if no flash found
dt-bindings: connector: add pd-disable dependency
nvmem: imx: assign nvmem_cell_info::raw_len
netfilter: ipset: drop logically empty buckets in mtype_del
counter: rz-mtu3-cnt: prevent counter from being toggled multiple times
counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
vxlan: validate ND option lengths in vxlan_na_create
net: ftgmac100: fix ring allocation unwind on open failure
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
gpio: mxc: map Both Edge pad wakeup to Rising Edge
thermal: core: Fix thermal zone device registration error path
misc: fastrpc: possible double-free of cctx->remote_heap
thunderbolt: Fix property read in nhi_wake_supported()
USB: dummy-hcd: Fix locking/synchronization error
USB: dummy-hcd: Fix interrupt synchronization error
usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial
transfer
usb: typec: ucsi: validate connector number in ucsi_notify_common()
ice: Fix memory leak in ice_set_ringparam()
btrfs: fix the qgroup data free range for inline data extents
btrfs: do not free data reservation in fallback from inline due to -ENOSPC
usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
usb: gadget: uvc: fix NULL pointer dereference during unbind race
usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
usb: gadget: f_rndis: Protect RNDIS options with mutex
usb: gadget: f_ecm: Fix net_device lifecycle with device_move
usb: gadget: f_eem: Fix net_device lifecycle with device_move
usb: gadget: f_subset: Fix net_device lifecycle with device_move
usb: gadget: f_rndis: Fix net_device lifecycle with device_move
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
usb: gadget: f_uac1_legacy: validate control request size
wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
spi: cadence-qspi: Fix exec_mem_op error handling
net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
net: mana: fix use-after-free in add_adev() error path
scsi: target: tcm_loop: Drain commands in target_reset handler
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
ext4: publish jinode after initialization
s390/perf_cpum_sf: Convert to use try_cmpxchg128()
s390/cpum_sf: Cap sampling rate to prevent lsctl exception
MPTCP: fix lock class name family in pm_nl_create_listen_socket
x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
drm/amd/amdgpu: decouple ASPM with pcie dpm
drm/amd/amdgpu: disable ASPM in some situations
drm/amd/display: Disable fastboot on DCE 6 too
drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
drm/amd/display: Disable scaling on DCE6 for now
drm/amd: Disable ASPM on SI
drm/amd/display: Correct logic check error for fastboot
bpf: Improve bounds when s64 crosses sign boundary
selftests/bpf: Test cross-sign 64bits range refinement
selftests/bpf: Test invariants on JSLT crossing sign
bpf: Add third round of bounds deduction
selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary
arm64/scs: Fix potential sign extension issue of advance_loc4
usb: ulpi: fix memory leak on ulpi_register() error paths
UBUNTU: Upstream stable to v6.6.132, v6.6.133, v6.12.81
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-08
+
+ Ported from the following upstream stable releases:
+ v6.6.132, v6.6.133, v6.12.81
+
from git://git.kernel.org/
+
+ Revert "rust: pin-init: internal: init: document load-bearing fact of field
accessors"
+ arm64/scs: Fix handling of advance_loc4
+ HID: logitech-hidpp: Enable MX Master 4 over bluetooth
+ wifi: mac80211: check tdls flag in ieee80211_tdls_oper
+ HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
+ atm: lec: fix use-after-free in sock_def_readable()
+ btrfs: don't take device_list_mutex when querying zone info
+ tg3: replace placeholder MAC address with device property
+ objtool: Fix Clang jump table detection
+ HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation
failure
+ HID: multitouch: Check to ensure report responses match the request
+ btrfs: reserve enough transaction items for qgroup ioctls
+ i2c: tegra: Don't mark devices with pins as IRQ safe
+ btrfs: reject root items with drop_progress and zero drop_level
+ spi: geni-qcom: Check DMA interrupts early in ISR
+ dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
property warning
+ wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session
+ crypto: caam - fix DMA corruption on long hmac keys
+ crypto: caam - fix overflow on long hmac keys
+ crypto: af-alg - fix NULL pointer dereference in scatterwalk
+ net: fec: fix the PTP periodic output sysfs interface
+ net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
+ net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to
zero to prevent an info-leak
+ net/ipv6: ioam6: prevent schema length wraparound in trace fill
+ tg3: Fix race for querying speed/duplex
+ ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
+ ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
+ bridge: br_nd_send: linearize skb before parsing ND options
+ net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
+ net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
+ net: enetc: check whether the RSS algorithm is Toeplitz
+ ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
+ ipv6: prevent possible UaF in addrconf_permanent_addr()
+ net: introduce mangleid_features
+ net: use skb_header_pointer() for TCPv4 GSO frag_off check
+ net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to
prevent an info-leak
+ NFC: pn533: bound the UART receive buffer
+ net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
+ bpf: Fix regsafe() for pointers to packet
+ net: ipv6: flowlabel: defer exclusive option free until RCU teardown
+ netfilter: flowtable: strictly check for maximum number of actions
+ netfilter: nfnetlink_log: account for netlink header size
+ netfilter: x_tables: ensure names are nul-terminated
+ netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
+ netfilter: nf_conntrack_helper: pass helper to expect cleanup
+ netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
+ netfilter: nf_conntrack_expect: honor expectation helper field
+ netfilter: nf_conntrack_expect: use expect->helper
+ netfilter: nf_conntrack_expect: store netns and zone in expectation
+ netfilter: ctnetlink: ignore explicit helper on new expectations
+ netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for
NFPROTO_ARP
+ netfilter: nf_tables: reject immediate NF_QUEUE verdict
+ Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
+ Bluetooth: SCO: fix race conditions in sco_sock_connect()
+ Bluetooth: MGMT: validate LTK enc_size on load
+ Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
+ Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
+ Bluetooth: MGMT: validate mesh send advertising payload length
+ rds: ib: reject FRMR registration before IB connection is established
+ bpf: sockmap: Fix use-after-free of sk->sk_socket in
sk_psock_verdict_data_ready().
+ net/sched: sch_netem: fix out-of-bounds access in packet corruption
+ net: macb: fix clk handling on PCI glue driver removal
+ net: macb: properly unregister fixed rate clocks
+ net/mlx5: lag: Check for LAG device before creating debugfs
+ net/mlx5: Avoid "No data available" when FW version queries fail
+ net/mlx5: Fix switchdev mode rollback in case of failure
+ net/x25: Fix potential double free of skb
+ net/x25: Fix overflow when accumulating packets
+ net/sched: cls_fw: fix NULL pointer dereference on shared blocks
+ net/sched: cls_flow: fix NULL pointer dereference on shared blocks
+ net: hsr: fix VLAN add unwind on slave errors
+ ipv6: avoid overflows in ip6_datagram_send_ctl()
+ bpf: reject direct access to nullable PTR_TO_BUF pointers
+ iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+ accel/qaic: Handle DBC deactivation if the owner went away
+ hwmon: (pxe1610) Check return value of page-select write in probe
+ hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
+ dt-bindings: gpio: fix microchip #interrupt-cells
+ hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
+ hwmon: (occ) Fix missing newline in occ_show_extended()
+ mips: ralink: update CPU clock index
+ sched/fair: Fix zero_vruntime tracking fix
+ riscv: kgdb: fix several debug register assignment bugs
+ drm/ioc32: stop speculation on the drm_compat_ioctl path
+ wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
+ wifi: iwlwifi: mvm: fix potential out-of-bounds read in
iwl_mvm_nd_match_info_handler()
+ USB: serial: option: add MeiG Smart SRM825WN
+ ALSA: caiaq: fix stack out-of-bounds read in init_card
+ ALSA: ctxfi: Fix missing SPDIFI1 index handling
+ Bluetooth: SMP: derive legacy responder STK authentication from MITM state
+ Bluetooth: SMP: force responder MITM requirements before building the pairing
response
+ Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
+ ksmbd: fix OOB write in QUERY_INFO for compound requests
+ MIPS: SiByte: Bring back cache initialisation
+ MIPS: Fix the GCC version check for `__multi3' workaround
+ hwmon: (occ) Fix division by zero in occ_show_power_1()
+ mips: mm: Allocate tlb_vpn array atomically
+ iio: adc: ti-adc161s626: fix buffer read on big-endian
+ iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
+ drm/ast: dp501: Fix initialization of SCU2C
+ drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode
+ drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP
+ drm/amdgpu/pm: drop SMU driver if version not matched messages
+ USB: serial: io_edgeport: add support for Blackbox IC135A
+ USB: serial: option: add support for Rolling Wireless RW135R-GL
+ USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
+ Input: synaptics-rmi4 - fix a locking bug in an error path
+ Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
+ Input: bcm5974 - recover from failed mode switch
+ Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
+ Input: xpad - add support for Razer Wolverine V3 Pro
+ iio: adc: aspeed: clear reference voltage bits before configuring vref
+ iio: accel: fix ADXL355 temperature signature value
+ iio: dac: ad5770r: fix error return in ad5770r_read_raw()
+ iio: light: vcnl4035: fix scan buffer on big-endian
+ iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
+ iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
+ iio: gyro: mpu3050: Fix incorrect free_irq() variable
+ iio: gyro: mpu3050: Fix irq resource leak
+ iio: gyro: mpu3050: Move iio_device_register() to correct location
+ iio: gyro: mpu3050: Fix out-of-sequence free_irq()
+ usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
+ usb: ulpi: fix double free in ulpi_register_interface() error path
+ usb: usbtmc: Flush anchored URBs in usbtmc_release
+ usb: ehci-brcm: fix sleep during atomic
+ usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
+ usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
+ usb: cdns3: gadget: fix state inconsistency on gadget init failure
+ bridge: br_nd_send: validate ND option lengths
+ cdc-acm: new quirk for EPSON HMD
+ comedi: dt2815: add hardware detection to prevent crash
+ comedi: Reinit dev->spinlock between attachments to low-level drivers
+ comedi: ni_atmio16d: Fix invalid clean-up after failed attach
+ comedi: me_daq: Fix potential overrun of firmware buffer
+ comedi: me4000: Fix potential overrun of firmware buffer
+ firmware: microchip: fail auto-update probe if no flash found
+ dt-bindings: connector: add pd-disable dependency
+ nvmem: imx: assign nvmem_cell_info::raw_len
+ netfilter: ipset: drop logically empty buckets in mtype_del
+ counter: rz-mtu3-cnt: prevent counter from being toggled multiple times
+ counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
+ vxlan: validate ND option lengths in vxlan_na_create
+ net: ftgmac100: fix ring allocation unwind on open failure
+ cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
+ gpio: mxc: map Both Edge pad wakeup to Rising Edge
+ thermal: core: Fix thermal zone device registration error path
+ misc: fastrpc: possible double-free of cctx->remote_heap
+ thunderbolt: Fix property read in nhi_wake_supported()
+ USB: dummy-hcd: Fix locking/synchronization error
+ USB: dummy-hcd: Fix interrupt synchronization error
+ usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial
transfer
+ usb: typec: ucsi: validate connector number in ucsi_notify_common()
+ ice: Fix memory leak in ice_set_ringparam()
+ btrfs: fix the qgroup data free range for inline data extents
+ btrfs: do not free data reservation in fallback from inline due to -ENOSPC
+ usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
+ usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
+ usb: gadget: uvc: fix NULL pointer dereference during unbind race
+ usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
+ usb: gadget: f_rndis: Protect RNDIS options with mutex
+ usb: gadget: f_ecm: Fix net_device lifecycle with device_move
+ usb: gadget: f_eem: Fix net_device lifecycle with device_move
+ usb: gadget: f_subset: Fix net_device lifecycle with device_move
+ usb: gadget: f_rndis: Fix net_device lifecycle with device_move
+ usb: gadget: f_hid: move list and spinlock inits from bind to alloc
+ usb: gadget: f_uac1_legacy: validate control request size
+ wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
+ spi: cadence-qspi: Fix exec_mem_op error handling
+ net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
+ net: mana: fix use-after-free in add_adev() error path
+ scsi: target: tcm_loop: Drain commands in target_reset handler
+ mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
+ drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
+ ext4: publish jinode after initialization
+ s390/perf_cpum_sf: Convert to use try_cmpxchg128()
+ s390/cpum_sf: Cap sampling rate to prevent lsctl exception
+ MPTCP: fix lock class name family in pm_nl_create_listen_socket
+ x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
+ drm/amd/amdgpu: decouple ASPM with pcie dpm
+ drm/amd/amdgpu: disable ASPM in some situations
+ drm/amd/display: Disable fastboot on DCE 6 too
+ drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
+ drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
+ drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
+ drm/amd/display: Disable scaling on DCE6 for now
+ drm/amd: Disable ASPM on SI
+ drm/amd/display: Correct logic check error for fastboot
+ bpf: Improve bounds when s64 crosses sign boundary
+ selftests/bpf: Test cross-sign 64bits range refinement
+ selftests/bpf: Test invariants on JSLT crossing sign
+ bpf: Add third round of bounds deduction
+ selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary
+ arm64/scs: Fix potential sign extension issue of advance_loc4
+ usb: ulpi: fix memory leak on ulpi_register() error paths
+ UBUNTU: Upstream stable to v6.6.132, v6.6.133, v6.12.81
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2155958
Title:
Noble update: upstream stable patchset 2026-06-08
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2155958/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
