Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-10
Ported from the following upstream stable releases:
v6.6.136, v6.12.83, v6.12.84
from git://git.kernel.org/
RDMA/irdma: Fix double free related to rereg_user_mr
ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()
ALSA: asihpi: avoid write overflow check warning
ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
ASoC: SOF: topology: reject invalid vendor array size in token parser
can: mcp251x: add error handling for power enable in open and resume
btrfs: tracepoints: get correct superblock from dentry in event
btrfs_sync_file()
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
ALSA: hda/realtek: add quirk for Framework F111:000F
wifi: wl1251: validate packet IDs before indexing tx_frames
ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)
platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
HID: roccat: fix use-after-free in roccat_report_event
ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
wifi: brcmfmac: validate bsscfg indices in IF events
ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching
arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency
PCI: hv: Set default NUMA node to 0 for devices without affinity info
drm/vc4: Release runtime PM reference after binding V3D
drm/vc4: Fix memory leak of BO array in hang state
drm/vc4: Fix a memory leak in hang state error path
drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
eventpoll: defer struct eventpoll free to RCU grace period
net: sched: act_csum: validate nested VLAN headers
net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
nfc: s3fwrn5: allocate rx skb before consuming bytes
net: stmmac: Fix PTP ref clock for Tegra234
dt-bindings: net: Fix Tegra234 MGBE PTP clock
tracing/probe: reject non-closed empty immediate strings
ixgbevf: add missing negotiate_features op to Hyper-V ops table
e1000: check return value of e1000_read_eeprom
xsk: tighten UMEM headroom validation to account for tailroom and min frame
xsk: respect tailroom for ZC setups
xsk: fix XDP_UMEM_SG_FLAG issues
xsk: validate MTU against usable frame size on bind
xfrm: Wait for RCU readers during policy netns exit
xfrm_user: fix info leak in build_mapping()
selftests: net: bridge_vlan_mcast: wait for h1 before querier check
ipvs: fix NULL deref in ip_vs_add_service error path
netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
netfilter: xt_multiport: validate range encoding in checkentry
netfilter: ip6t_eui64: reject invalid MAC header for all packets
net: txgbe: leave space for null terminators on property_entry
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
net: ipa: fix event ring index not programmed for IPA v5.0+
l2tp: Drop large packets with UDP encap
gpio: tegra: fix irq_release_resources calling enable instead of disable
perf/x86/intel/uncore: Skip discovery table for offline dies
netfilter: conntrack: add missing netlink policy validations
ALSA: usb-audio: Improve Focusrite sample rate filtering
nfc: llcp: add missing return after LLCP_CLOSED checks
can: raw: fix ro->uniq use-after-free in raw_rcv()
i2c: s3c24xx: check the size of the SMBUS message before using it
staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
HID: alps: fix NULL pointer dereference in alps_raw_event()
HID: core: clamp report_size in s32ton() to avoid undefined shift
net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
drm/vc4: platform_get_irq_byname() returns an int
ALSA: fireworks: bound device-supplied status before string array lookup
fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
ksmbd: validate EaNameLength in smb2_get_ea()
ksmbd: require 3 sub-authorities before reading sub_auth[2]
ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
usbip: validate number_of_packets in usbip_pack_ret_submit()
usb: storage: Expand range of matched versions for VL817 quirks entry
USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
usb: port: add delay after usb_hub_set_port_power()
fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
scripts: generate_rust_analyzer.py: avoid FD leak
wifi: rtw88: fix device leak on probe failure
staging: sm750fb: fix division by zero in ps_to_hz()
USB: serial: option: add Telit Cinterion FN990A MBIM composition
Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race
ALSA: ctxfi: Limit PTP to a single page
dcache: Limit the minimal number of bucket to two
media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
ocfs2: fix possible deadlock between unlink and dio_end_io_write
ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
ocfs2: handle invalid dinode in ocfs2_group_extend
KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
KVM: nVMX: Fold requested virtual interrupt check into has_nested_events()
net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
checkpatch: add support for Assisted-by tag
KVM: x86: Use scratch field in MMIO fragment to hold small write values
ASoC: qcom: q6apm: move component registration to unmanaged version
mm/kasan: fix double free for kasan pXds
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
media: vidtv: fix nfeeds state corruption on start_streaming failure
media: mediatek: vcodec: fix use-after-free in encoder release path
media: em28xx: fix use-after-free in em28xx_v4l2_open()
ALSA: 6fire: fix use-after-free on disconnect
bcache: fix cached_dev.sb_bio use-after-free and crash
media: as102: fix to not free memory after the device is registered in
as102_usb_probe()
nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
media: vidtv: fix pass-by-value structs causing MSAN warnings
media: hackrf: fix to not free memory after the device is registered in
hackrf_probe()
Revert "perf unwind-libdw: Fix invalid reference counts"
PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
ipv6: add NULL checks for idev in SRv6 paths
wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
scripts: generate_rust_analyzer.py: define scripts
KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
rxrpc: Fix key quota calculation for multitoken keys
ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
ocfs2: validate inline data i_size during inode read
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"
scripts/dtc: Remove unused dts_version in dtc-lexer.l
fs/ntfs3: validate rec->used in journal-replay file record check
f2fs: fix to avoid memory leak in f2fs_rename()
fuse: reject oversized dirents in page cache
fuse: Check for large folio with SPLICE_F_MOVE
fuse: quiet down complaints in fuse_conn_limit_write
smb: server: fix active_num_conn leak on transport allocation failure
smb: server: fix max_connections off-by-one in tcp accept path
smb: client: require a full NFS mode SID before reading mode bits
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
ALSA: caiaq: take a reference on the USB device in create_card()
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
crypto: testmgr - Hide ENOENT errors
crypto: testmgr - Hide ENOENT errors better
crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
Bluetooth: hci_sync: annotate data-races around hdev->req_status
platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC
drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
arm64: dts: qcom: hamoa/x1: fix idle exit latency
HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
xfrm: account XFRMA_IF_ID in aevent size calculation
net: increase IP_TUNNEL_RECURSION_LIMIT to 5
netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT
allocation
netfilter: nfnetlink_queue: make hash table per queue
crypto: af_alg - limit RX SG extraction by receive buffer budget
thermal: core: Mark thermal zones as exiting before unregistration
thermal: core: Address thermal zone removal races with resume
usb: gadget: f_hid: don't call cdev_init while cdev in use
kernel: be more careful about dup_mmap() failures and uprobe registering
KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
x86-64: rename misleadingly named '__copy_user_nocache()' function
hwmon: (powerz) Fix use-after-free on USB disconnect
PCI: Fix placement of pci_save_state() in pci_bus_add_device()
mm/userfaultfd: fix hugetlb fault mutex hash calculation
ima: verify if the segment size has changed
ima: do not copy measurement list to kdump kernel
ksmbd: require minimum ACE size in smb_check_perm_dacl()
ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
UBUNTU: Upstream stable to v6.6.136, v6.12.83, v6.12.84
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Noble)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Noble)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Noble)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Noble)
Status: New => In Progress
** Changed in: linux (Ubuntu Noble)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-06-10
+
+ Ported from the following upstream stable releases:
+ v6.6.136, v6.12.83, v6.12.84
+
from git://git.kernel.org/
+
+ RDMA/irdma: Fix double free related to rereg_user_mr
+ ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
+ ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
+ ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
+ media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl()
+ ALSA: asihpi: avoid write overflow check warning
+ ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
+ ASoC: SOF: topology: reject invalid vendor array size in token parser
+ can: mcp251x: add error handling for power enable in open and resume
+ btrfs: tracepoints: get correct superblock from dentry in event
btrfs_sync_file()
+ ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
+ netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
+ ALSA: hda/realtek: add quirk for Framework F111:000F
+ wifi: wl1251: validate packet IDs before indexing tx_frames
+ ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
+ ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
+ fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
+ ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
+ pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)
+ platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
+ HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
+ ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
+ HID: roccat: fix use-after-free in roccat_report_event
+ ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
+ wifi: brcmfmac: validate bsscfg indices in IF events
+ ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
+ soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching
+ arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency
+ PCI: hv: Set default NUMA node to 0 for devices without affinity info
+ drm/vc4: Release runtime PM reference after binding V3D
+ drm/vc4: Fix memory leak of BO array in hang state
+ drm/vc4: Fix a memory leak in hang state error path
+ drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
+ eventpoll: defer struct eventpoll free to RCU grace period
+ net: sched: act_csum: validate nested VLAN headers
+ net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
+ ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
+ nfc: s3fwrn5: allocate rx skb before consuming bytes
+ net: stmmac: Fix PTP ref clock for Tegra234
+ dt-bindings: net: Fix Tegra234 MGBE PTP clock
+ tracing/probe: reject non-closed empty immediate strings
+ ixgbevf: add missing negotiate_features op to Hyper-V ops table
+ e1000: check return value of e1000_read_eeprom
+ xsk: tighten UMEM headroom validation to account for tailroom and min frame
+ xsk: respect tailroom for ZC setups
+ xsk: fix XDP_UMEM_SG_FLAG issues
+ xsk: validate MTU against usable frame size on bind
+ xfrm: Wait for RCU readers during policy netns exit
+ xfrm_user: fix info leak in build_mapping()
+ selftests: net: bridge_vlan_mcast: wait for h1 before querier check
+ ipvs: fix NULL deref in ip_vs_add_service error path
+ netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
+ netfilter: xt_multiport: validate range encoding in checkentry
+ netfilter: ip6t_eui64: reject invalid MAC header for all packets
+ net: txgbe: leave space for null terminators on property_entry
+ af_unix: read UNIX_DIAG_VFS data under unix_state_lock
+ net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
+ net: ipa: fix event ring index not programmed for IPA v5.0+
+ l2tp: Drop large packets with UDP encap
+ gpio: tegra: fix irq_release_resources calling enable instead of disable
+ perf/x86/intel/uncore: Skip discovery table for offline dies
+ netfilter: conntrack: add missing netlink policy validations
+ ALSA: usb-audio: Improve Focusrite sample rate filtering
+ nfc: llcp: add missing return after LLCP_CLOSED checks
+ can: raw: fix ro->uniq use-after-free in raw_rcv()
+ i2c: s3c24xx: check the size of the SMBUS message before using it
+ staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
+ HID: alps: fix NULL pointer dereference in alps_raw_event()
+ HID: core: clamp report_size in s32ton() to avoid undefined shift
+ net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
+ NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
+ drm/vc4: platform_get_irq_byname() returns an int
+ ALSA: fireworks: bound device-supplied status before string array lookup
+ fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
+ usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
+ usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
+ usb: gadget: renesas_usb3: validate endpoint index in standard request
handlers
+ ksmbd: validate EaNameLength in smb2_get_ea()
+ ksmbd: require 3 sub-authorities before reading sub_auth[2]
+ ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
+ usbip: validate number_of_packets in usbip_pack_ret_submit()
+ usb: storage: Expand range of matched versions for VL817 quirks entry
+ USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
+ usb: port: add delay after usb_hub_set_port_power()
+ fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
+ scripts: generate_rust_analyzer.py: avoid FD leak
+ wifi: rtw88: fix device leak on probe failure
+ staging: sm750fb: fix division by zero in ps_to_hz()
+ USB: serial: option: add Telit Cinterion FN990A MBIM composition
+ Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race
+ ALSA: ctxfi: Limit PTP to a single page
+ dcache: Limit the minimal number of bucket to two
+ media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
+ ocfs2: fix possible deadlock between unlink and dio_end_io_write
+ ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
+ ocfs2: handle invalid dinode in ocfs2_group_extend
+ KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
+ KVM: nVMX: Fold requested virtual interrupt check into has_nested_events()
+ net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
+ checkpatch: add support for Assisted-by tag
+ KVM: x86: Use scratch field in MMIO fragment to hold small write values
+ ASoC: qcom: q6apm: move component registration to unmanaged version
+ mm/kasan: fix double free for kasan pXds
+ mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
+ media: vidtv: fix nfeeds state corruption on start_streaming failure
+ media: mediatek: vcodec: fix use-after-free in encoder release path
+ media: em28xx: fix use-after-free in em28xx_v4l2_open()
+ ALSA: 6fire: fix use-after-free on disconnect
+ bcache: fix cached_dev.sb_bio use-after-free and crash
+ media: as102: fix to not free memory after the device is registered in
as102_usb_probe()
+ nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
+ media: vidtv: fix pass-by-value structs causing MSAN warnings
+ media: hackrf: fix to not free memory after the device is registered in
hackrf_probe()
+ Revert "perf unwind-libdw: Fix invalid reference counts"
+ PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
+ ipv6: add NULL checks for idev in SRv6 paths
+ wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
+ net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
+ PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
+ scripts: generate_rust_analyzer.py: define scripts
+ KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
+ rxrpc: Fix key quota calculation for multitoken keys
+ ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
+ ocfs2: validate inline data i_size during inode read
+ ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
+ Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"
+ scripts/dtc: Remove unused dts_version in dtc-lexer.l
+ fs/ntfs3: validate rec->used in journal-replay file record check
+ f2fs: fix to avoid memory leak in f2fs_rename()
+ fuse: reject oversized dirents in page cache
+ fuse: Check for large folio with SPLICE_F_MOVE
+ fuse: quiet down complaints in fuse_conn_limit_write
+ smb: server: fix active_num_conn leak on transport allocation failure
+ smb: server: fix max_connections off-by-one in tcp accept path
+ smb: client: require a full NFS mode SID before reading mode bits
+ smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
+ ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
+ ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
+ f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
+ ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
+ ALSA: caiaq: take a reference on the USB device in create_card()
+ net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
+ crypto: testmgr - Hide ENOENT errors
+ crypto: testmgr - Hide ENOENT errors better
+ crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
+ crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
+ crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
+ rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
+ Bluetooth: hci_sync: annotate data-races around hdev->req_status
+ platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC
+ drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
+ ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
+ ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
+ net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
+ arm64: dts: qcom: hamoa/x1: fix idle exit latency
+ HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
+ xfrm: account XFRMA_IF_ID in aevent size calculation
+ net: increase IP_TUNNEL_RECURSION_LIMIT to 5
+ netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT
allocation
+ netfilter: nfnetlink_queue: make hash table per queue
+ crypto: af_alg - limit RX SG extraction by receive buffer budget
+ thermal: core: Mark thermal zones as exiting before unregistration
+ thermal: core: Address thermal zone removal races with resume
+ usb: gadget: f_hid: don't call cdev_init while cdev in use
+ kernel: be more careful about dup_mmap() failures and uprobe registering
+ KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
+ x86-64: rename misleadingly named '__copy_user_nocache()' function
+ hwmon: (powerz) Fix use-after-free on USB disconnect
+ PCI: Fix placement of pci_save_state() in pci_bus_add_device()
+ mm/userfaultfd: fix hugetlb fault mutex hash calculation
+ ima: verify if the segment size has changed
+ ima: do not copy measurement list to kdump kernel
+ ksmbd: require minimum ACE size in smb_check_perm_dacl()
+ ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
+ ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
+ btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
+ UBUNTU: Upstream stable to v6.6.136, v6.12.83, v6.12.84
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2156373
Title:
Noble update: upstream stable patchset 2026-06-10
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2156373/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
