Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.211 upstream stable release
Ported from the following upstream stable releases:
v5.15.210
v5.15.210, v5.15.211
from git://git.kernel.org/
Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
net/sched: cls_fw: fix NULL dereference of "old" filters before change()
net: mctp: ensure our nlmsg responses are initialised
net/sched: sch_sfb: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
drm: Remove plane hsub/vsub alignment requirement for core helpers
dmaengine: idxd: Fix not releasing workqueue on .release()
net: cpsw_new: Fix potential unregister of netdev that has not been registered
yet
nfc: llcp: Fix use-after-free in llcp_sock_release()
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
xfrm: Check for underflow in xfrm_state_mtu
nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
netfilter: xt_cpu: prefer raw_smp_processor_id
netfilter: ebtables: fix OOB read in compat_mtw_from_user
tun: free page on short-frame rejection in tun_xdp_one()
net: netlink: fix sending unassigned nsid after assigned one
net: netlink: don't set nsid on local notifications
net/smc: Do not re-initialize smc hashtables
net/iucv: fix locking in .getsockopt
ipv4: free net->ipv4.sysctl_local_reserved_ports after
unregister_net_sysctl_table()
ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
ASoC: codecs: simple-mux: Fix enum control bounds check
Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
bonding: refuse to enslave CAN devices
ethtool: eeprom: add more safeties to EEPROM Netlink fallback
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
sctp: fix race between sctp_wait_for_connect and peeloff
batman-adv: v: stop OGMv2 on disabled interface
batman-adv: tvlv: abort OGM send on tvlv append failure
batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
batman-adv: tvlv: reject oversized TVLV packets
batman-adv: iv: recover OGM scheduling after forward packet error
selftests: forwarding: lib: Add helpers for checksum handling
batman-adv: tp_meter: directly shut down timer on cleanup
batman-adv: tt: fix TOCTOU race for reported vlans
batman-adv: tt: avoid empty VLAN responses
batman-adv: bla: avoid double decrement of bla.num_requests
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
drm/i915/psr: Read Intel DPCD workaround register
drm/dp: Add eDP 1.5 bit definition
drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
Revert "RDMA/rxe: Fix double free in rxe_srq_from_init"
RDMA/rxe: Fix double free in rxe_srq_from_init
phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table
phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
usb: typec: ucsi: ccg: reject firmware images without a ':' record header
usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
usb: typec: altmodes/displayport: validate count before reading Status Update
VDO
usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
USB: serial: safe_serial: fix memory corruption with small endpoint
Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
Bluetooth: btusb: Allow firmware re-download when version matches
hpfs: fix a crash if hpfs_map_dnode_bitmap fails
ipc: limit next_id allocation to the valid ID range
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
Bluetooth: HIDP: fix missing length checks in hidp_input_report()
parport: Fix race between port and client registration
iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
iio: dac: max5821: fix return value check in powerdown sync
iio: dac: ad5686: fix input raw value check
wireguard: send: append trailer after expanding head
iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
iio: gyro: itg3200: fix i2c read into the wrong stack location
iio: ssp_sensors: cancel delayed work_refresh on remove
iio: temperature: tsys01: fix broken PROM checksum validation
iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
iio: light: cm3323: fix reg_conf not being initialized correctly
iio: buffer: hw-consumer: fix use-after-free in error path
USB: serial: omninet: fix memory corruption with small endpoint
usb: cdns3: gadget: fix request skipping after clearing halt
usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the
runtime PM usage counter across bind/unbind cycles
usb: dwc2: Fix use after free in debug code
Input: elan_i2c - validate firmware size before use
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
macsec: fix replay protection at XPN lower-PN wrap
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
ipv6: exthdrs: refresh nh after handling HAO option
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
ipv6: validate extension header length before copying to cmsg
xfrm: input: hold netns during deferred transport reinjection
ip6: vti: Use ip6_tnl.net in vti6_changelink().
HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
nfc: hci: fix out-of-bounds read in HCP header parsing
xfrm: route MIGRATE notifications to caller's netns
xfrm: ah: use skb_to_full_sk in async output callbacks
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
direction check
ASoC: qcom: q6asm-dai: close stream only when running
ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
xfrm: esp: restore combined single-frag length gate
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
tty: serial: pch_uart: add check for dma_alloc_coherent()
usb: chipidea: core: convert ci_role_switch to local variable
usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
usb: storage: Add quirks for PNY Elite Portable SSD
usbip: vudc: Fix use after free bug in vudc_remove due to race condition
usb: usbtmc: check URB actual_length for interrupt-IN notifications
usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
USB: serial: option: add MeiG SRM813Q
USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
USB: serial: belkin_sa: validate interrupt status length
USB: serial: cypress_m8: validate interrupt packet headers
USB: serial: keyspan: fix missing indat transfer sanity check
USB: serial: mxuport: fix memory corruption with small endpoint
USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
usb: gadget: net2280: Fix double free in probe error path
usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
usb: gadget: f_fs: copy only received bytes on short ep0 read
thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
drm/hyperv: validate VMBus packet size in receive callback
serial: sh-sci: fix memory region release in error path
serial: zs: Fix swapped RI/DSR modem line transition counting
serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
serial: dz: Fix bootconsole message clobbering at chip reset
serial: zs: Fix bootconsole handover lockup
serial: zs: Switch to using channel reset
USB: serial: cypress_m8: fix memory corruption with small endpoint
HID: core: Add printk_ratelimited variants to hid_warn() etc
HID: pass the buffer size to hid_report_raw_event
HID: core: Fix size_t specifier in hid_report_raw_event()
USB: serial: digi_acceleport: fix memory corruption with small endpoints
xhci: tegra: Fix ghost USB device on dual-role port unplug
serial: dz: Fix bootconsole handover lockup
usb: core: Fix SuperSpeed root hub wMaxPacketSize
bpf: Free reuseport cBPF prog after RCU grace period.
USB: serial: mct_u232: fix memory corruption with small endpoint
compiler-clang.h: Add __diag infrastructure for clang
Disable -Wattribute-alias for clang-23 and newer
i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
ipv6: mcast: Fix use-after-free when processing MLD queries
tee: optee: prevent use-after-free when the client exits before the supplicant
netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
ipvs: clear the svc scheduler ptr early on edit
netfilter: synproxy: add mutex to guard hook reference counting
netfilter: conntrack_irc: fix possible out-of-bounds read
netfilter: bridge: make ebt_snat ARP rewrite writable
dm cache policy smq: check allocation under invalidate lock
net/sched: act_api: use RCU with deferred freeing for action lifecycle
6lowpan: fix off-by-one in multicast context address compression
drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
pcnet32: stop holding device spin lock during napi_complete_done
net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
net: lan743x: permit VLAN-tagged packets up to configured MTU
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
Bluetooth: MGMT: validate advertising TLV before type checks
Bluetooth: RFCOMM: validate skb length in MCC handlers
Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension
handling
Bluetooth: bnep: reject short frames before parsing
Bluetooth: fix memory leak in error path of hci_alloc_dev()
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
sctp: purge outqueue on stale COOKIE-ECHO handling
signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
time: Fix off-by-one in settimeofday() usec validation
ext4: validate p_idx bounds in ext4_ext_correct_indexes
fs/ntfs3: Return error for inconsistent extended attributes
nfsd: don't ignore the return code of svc_proc_register()
tap: free page on error paths in tap_get_user_xdp()
tun: free page on build_skb failure in tun_xdp_one()
KVM: arm64: Remove VPIPT I-cache handling
arm64: tlb: Allow XZR argument to TLBI ops
arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
netlabel: validate unlabeled address and mask attribute lengths
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
ipv6: sit: reload inner IPv6 header after GSO offloads
net: openvswitch: fix possible kfree_skb of ERR_PTR
sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
net: guard timestamp cmsgs to real error queue skbs
net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
rds: mark snapshot pages dirty in rds_info_getsockopt()
netfilter: x_tables: avoid leaking percpu counter pointers
netfilter: nf_log: validate MAC header was set before dumping it
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
net: mvpp2: sync RX data at the hardware packet offset
net: mvpp2: limit XDP frame size to the RX buffer
net: mvpp2: Add metadata support for xdp mode
net: mvpp2: refill RX buffers before XDP or skb use
net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
drm/vc4: fix krealloc() memory leak
netfilter: nft_tunnel: fix use-after-free on object destroy
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
drm/i915/gem: Fix phys BO pread/pwrite with offset
xfrm: espintcp: do not reuse an in-progress partial send
USB: serial: io_ti: fix heap overflow in get_manuf_info()
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
USB: serial: option: add usb-id for Dell Wireless DW5826e-m
USB: serial: kl5kusb105: fix bulk-out buffer overflow
ALSA: timer: Fix UAF at snd_timer_user_params()
drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
RDMA/srp: bound SRP_RSP sense copy by the received length
ARM: socfpga: Fix OF node refcount leak in SMP setup
ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
mptcp: fix retransmission loop when csum is enabled
mptcp: sockopt: check timestamping ret value
vsock/vmci: fix sk_ack_backlog leak on failed handshake
bnxt_en: Fix NULL pointer dereference
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
pidfd: refuse access to tasks that have started exiting harder
fuse: reject fuse_notify() pagecache ops on directories
i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
i2c: tegra: Fix NOIRQ suspend/resume
Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
ipc/shm: serialize orphan cleanup with shm_nattch updates
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
misc: fastrpc: fix DMA address corruption due to find_vma misuse
net: bonding: fix NULL pointer dereference in bond_do_ioctl()
net: mv643xx: fix OF node refcount
net: rds: clear i_sends on setup unwind
mmc: core: Fix host controller programming for fixed driver type
mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
mmc: sdhci: add signal voltage switch in sdhci_resume_host
sctp: diag: reject stale associations in dump_one path
sctp: stream: fully roll back denied add-stream state
thunderbolt: Reject zero-length property entries in validator
thunderbolt: Bound root directory content to block size
thunderbolt: Clamp XDomain response data copy to allocation size
thunderbolt: Limit XDomain response copy to actual frame size
slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
drm/amd/display: Use krealloc_array() in dal_vector_reserve()
fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
mm/damon/ops-common: call folio_test_lru() after folio_get()
io_uring/poll: fix signed comparison in io_poll_get_ownership()
Revert "net/tcp-md5: Fix MAC comparison to be constant-time"
net/tcp-md5: Fix MAC comparison to be constant-time
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
smb: server: fix active_num_conn leak on transport allocation failure
smb: server: fix max_connections off-by-one in tcp accept path
smb: client: require a full NFS mode SID before reading mode bits
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
ksmbd: require minimum ACE size in smb_check_perm_dacl()
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID
wifi: rtw88: check for PCI upstream bridge existence
thermal: core: Fix thermal zone governor cleanup issues
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
ALSA: aoa: Use guard() for mutex locks
ALSA: aoa: i2sbus: clear stale prepared state
media: rc: ttusbir: respect DMA coherency rules
ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
erofs: fix the out-of-bounds nameoff handling for trailing dirents
media: rc: igorplugusb: heed coherency rules
sched: Use u64 for bandwidth ratio calculations
ALSA: core: Fix potential data race at fasync handling
net: qrtr: ns: Limit the maximum number of lookups
net: qrtr: ns: Change servers radix tree to xarray
net: qrtr: ns: Free the node during ctrl_cmd_bye()
net: mctp: fix don't require received header reserved bits to be zero
net: qrtr: ns: Limit the total number of nodes
net: bridge: use a stable FDB dst snapshot in RCU readers
fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
randomize_kstack: Maintain kstack_offset per task
mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
mtd: spi-nor: sst: Fix write enable before AAI sequence
udf: fix partition descriptor append bookkeeping
hfsplus: fix uninit-value by validating catalog record size
hfsplus: fix held lock freed on hfsplus_fill_super()
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
can: ucan: fix typos in comments
can: ucan: fix devres lifetime
erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
ceph: only d_add() negative dentries when they are unhashed
ALSA: aloop: Fix peer runtime UAF during format-change stop
printk: add print_hex_dump_devel()
crypto: caam - guard HMAC key hex dumps in hash_digest_key
tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
smb: client: validate the whole DACL before rewriting it in cifsacl
usb: typec: tcpm: reset internal port states on soft reset AMS
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
usb: dwc3: Move GUID programming after PHY initialization
net: ipv4: stop checking crypto_ahash_alignmask
net: ipv6: stop checking crypto_ahash_alignmask
xfrm: ah: account for ESN high bits in async callbacks
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
spi: syncuacer: fix controller deregistration
spi: sun4i: fix controller deregistration
spi: spi-ti-qspi: Convert to platform remove callback returning void
spi: ti-qspi: fix controller deregistration
spi: zynq-qspi: fix controller deregistration
spi: sun6i: fix controller deregistration
spi: tegra114: fix controller deregistration
spi: tegra20-sflash: fix controller deregistration
spi: uniphier: fix controller deregistration
mm/hugetlb_cma: round up per_node before logging it
fbcon: Avoid OOB font access if console rotation fails
spi: topcliff-pch: Convert to platform remove callback returning void
spi: topcliff-pch: fix controller deregistration
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
info-leak
tracing/probes: Limit size of event probe to 3K
pmdomain: core: Fix detach procedure for virtual devices in genpd
Revert "smb: client: validate dacloffset before building DACL pointers"
smb: client: validate dacloffset before building DACL pointers
btrfs: fix missing last_unlink_trans update when removing a directory
smb: client: Use FullSessionKey for AES-256 encryption key derivation
mptcp: pm: prio: skip closed subflows
mptcp: pm: ADD_ADDR rtx: fix potential data-race
mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
f2fs: fix incorrect file address mapping when inline inode is unwritten
f2fs: fix false alarm of lockdep on cp_global_sem lock
spi: st-ssc4: fix controller deregistration
spi: lantiq-ssc: fix controller deregistration
genetlink: Use internal flags for multicast groups
smb: client: require net admin for CIFS SWN netlink
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
Bluetooth: hci_qca: Convert timeout from jiffies to ms
Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2
Bluetooth: MGMT: validate Add Extended Advertising Data length
qed: Use the bitmap API to simplify some functions
qed: fix double free in qed_cxt_tables_alloc()
Bluetooth: Consolidate code around sk_alloc into a helper function
Bluetooth: Init sk_peer_* on bt_sock_alloc
Bluetooth: serialize accept_q access
net: hsr: defer node table free until after RCU readers
ice: fix VF queue configuration with low MTU values
ipv6/addrconf: annotate data-races around devconf fields (II)
ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
use less confusing names for iov_iter direction initializers
mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
selftests: mptcp: drop nanoseconds width specifier
mptcp: do not drop partial packets
octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
octeontx2-pf: avoid double free of pool->stack on AQ init failure
spi: qup: switch to use modern name
spi: qup: fix error pointer deref after DMA setup failure
arm64: tlb: Flush walk cache when unsharing PMD tables
phy: tegra: xusb: Disable trk clk when not in use
phy: tegra: xusb: Fix per-pad high-speed termination calibration
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
iio: gyro: adis16260: fix division by zero in write_raw
iio: chemical: scd30: Use guard(mutex) to allow early returns
iio: chemical: scd30: fix division by zero in write_raw
iio: dac: ad5686: fix ref bit initialization for single-channel parts
usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition
failure
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
serial: samsung_tty: Use port lock wrappers
tty: serial: samsung: use u32 for register interactions
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
usb: dwc3: xilinx: fix error handling in zynqmp init error paths
usb: gadget: f_hid: tidy error handling in hidg_alloc
usb: gadget: f_hid: fix device reference leak in hidg_alloc()
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7
drm/hyperv: validate resolution_count and fix WIN8 fallback
serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt
serial: altera_jtaguart: handle uart_add_one_port() failures
tty: serial: qcom-geni-serial: remove unused symbols
tty: serial: qcom-geni-serial: align #define values
serial: qcom-geni: fix UART_RX_PAR_EN bit position
scsi: target: iscsi: Fix CRC overread and double-free in
iscsit_handle_text_cmd()
netfilter: nft_fib: fix stale stack leak via the OIFNAME register
hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
RDMA/umem: fix kernel-doc warnings
RDMA: Move DMA block iterator logic into dedicated files
RDMA/umem: Fix truncation for block sizes >= 4G
mm/huge_memory: update file PMD counter before folio_put()
ipvs: skip ipv6 extension headers for csum checks
blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before
init
batman-adv: stop tp_meter sessions during mesh teardown
batman-adv: tp_meter: fix tp_num leak on kmalloc failure
Revert "net/ipv6: ioam6: prevent schema length wraparound in trace fill"
net/ipv6: ioam6: prevent schema length wraparound in trace fill
ksmbd: Compare MACs in constant time
Revert "nfsd: fix heap overflow in NFSv4.0 LOCK replay cache"
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
selinux: enable genfscon labeling for securityfs
arm64: cputype: Add NVIDIA Olympus definitions
arm64: cputype: Add C1-Ultra definitions
arm64: cputype: Add C1-Premium definitions
arm64: errata: Mitigate TLBI errata on various Arm CPUs
arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
UBUNTU: [Config] Set CONFIG_ARM64_ERRATUM_4118414=y
mptcp: close TOCTOU race while computing rcv_wnd
fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter
Revert "apparmor: validate DFA start states are in bounds in unpack_pdb"
apparmor: validate DFA start states are in bounds in unpack_pdb
apparmor: validate default DFA states are in bounds
media: rc: ttusbir: fix inverted error logic
batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
media: rc: igorplugusb: fix control request setup packet
Bluetooth: MGMT: Fix backward compatibility with userspace
ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
batman-adv: tp_meter: fix race condition in send error reporting
batman-adv: tp_meter: avoid role confusion in tp_list
netfilter: require Ethernet MAC header before using eth_hdr()
Linux 5.15.210
UBUNTU: Upstream stable to v5.15.210
fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
net/sched: act_pedit: check static offsets a priori
net/sched: act_pedit: rate limit datapath messages
net/sched: fix pedit partial COW leading to page cache corruption
net/sched: act_pedit: free pedit keys on bail from offset check
drm/amd/display: Bound VBIOS record-chain walk loops
ip6_vti: set netns_immutable on the fallback device.
drm/v3d: Store the active job inside the queue's state
drm/v3d: Skip CSD when it has zeroed workgroups
batman-adv: tt: reject oversized local TVLV buffers
batman-adv: tt: prevent TVLV entry number overflow
iio: light: bh1780: fix PM runtime leak on error path
vfio/iommu_type1: replace kfree with kvfree
RDMA/bnxt_re: zero shared page before exposing to userspace
i2c: stub: Reject I2C block transfers with invalid length
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
agp/amd64: Fix broken error propagation in agp_amd64_probe()
xhci: fix memory leak regression when freeing xhci vdev devices depth first
af_unix: Reject SIOCATMARK on non-stream sockets
regulator: core: fix locking in regulator_resolve_supply() error path
vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
virtiofs: fix UAF on submount umount
Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"
Revert "ptp: add testptp mask test"
KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported
batman-adv: tp_meter: keep unacked list in ascending ordered
batman-adv: tp_meter: initialize dup_acks explicitly
batman-adv: tp_meter: initialize dec_cwnd explicitly
batman-adv: tp_meter: avoid window underflow
batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
batman-adv: tp_meter: fix fast recovery precondition
batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
batman-adv: tp_meter: add only finished tp_vars to lists
batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
batman-adv: prevent ELP transmission interval underflow
batman-adv: tp_meter: initialize last_recv_time during init
batman-adv: ensure bcast is writable before modifying TTL
batman-adv: fix (m|b)cast csum after decrementing TTL
batman-adv: frag: ensure fragment is writable before modifying TTL
batman-adv: frag: avoid underflow of TTL
batman-adv: v: prevent OGM aggregation on disabled hardif
batman-adv: tp_meter: restrict number of unacked list entries
batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
batman-adv: tp_meter: prevent parallel modifications of last_recv
batman-adv: tp_meter: handle overlapping packets
batman-adv: tt: don't merge change entries with different VIDs
batman-adv: tt: track roam count per VID
batman-adv: dat: prevent false sharing between VLANs
batman-adv: tvlv: enforce 2-byte alignment
batman-adv: tvlv: avoid race of cifsnotfound handler state
ring-buffer: Remove ring_buffer_read_prepare_sync()
ntfs3: reject direct userspace writes to reserved $LX* xattrs
ext4: add bounds check for inline data length in ext4_read_inline_page
crypto: af_alg - Set merge to zero early in af_alg_sendmsg
mac802154: llsec: add skb_cow_data() before in-place crypto
KEYS: fix overflow in keyctl_pkey_params_get_2()
keys: Pin request_key_auth payload in instantiate paths
wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
wifi: ath11k: fix warning when unbinding
wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
bpf: use kvfree() for replaced sysctl write buffer
MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
exfat: fix potential use-after-free in exfat_find_dir_entry()
hdlc_ppp: sync per-proto timers before freeing hdlc state
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
pNFS: Fix use-after-free in pnfs_update_layout()
irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
fpga: region: fix use-after-free in child_regions_with_firmware()
ocfs2: reject oversized group bitmap descriptors
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
power: reset: linkstation-poweroff: fix use-after-free in the
linkstation_poweroff_init()
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
NFSD: Fix SECINFO_NO_NAME decode error cleanup
nfsd: fix posix_acl leak on SETACL decode failure
nfsd: check get_user() return when reading princhashlen
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
mptcp: fix missing wakeups in edge scenarios
hv: utils: handle and propagate errors in kvp_register
misc: fastrpc: Add dma_mask to fastrpc_channel_ctx
misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
phonet: Pass ifindex to fill_addr().
phonet: Pass net and ifindex to phonet_address_notify().
net: phonet: free phonet_device after RCU grace period
fuse: re-lock request before replacing page cache folio
ksmbd: reject non-VALID session in compound request branch
Documentation: ioctl-number: Extend "Include File" column width
crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()
crypto: qat - Return pointer directly in adf_ctl_alloc_resources
crypto: qat - remove unused character device and IOCTLs
dlm: prevent NPD when writing a positive value to event_done
Linux 5.15.211
UBUNTU: Upstream stable to v5.15.210, v5.15.211
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Jammy)
Importance: Medium
Assignee: Vinicius Peixoto (vpeixoto)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Jammy)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Jammy)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Jammy)
Status: New => In Progress
** Changed in: linux (Ubuntu Jammy)
Assignee: (unassigned) => Vinicius Peixoto (vpeixoto)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
v5.15.211 upstream stable release
+
+ Ported from the following upstream stable releases:
+ v5.15.210
+ v5.15.210, v5.15.211
+
from git://git.kernel.org/
-
+ Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
+ net/sched: cls_fw: fix NULL dereference of "old" filters before change()
+ net: mctp: ensure our nlmsg responses are initialised
+ net/sched: sch_sfb: Replace direct dequeue call with peek and
qdisc_dequeue_peeked
+ drm: Remove plane hsub/vsub alignment requirement for core helpers
+ dmaengine: idxd: Fix not releasing workqueue on .release()
+ net: cpsw_new: Fix potential unregister of netdev that has not been
registered yet
+ nfc: llcp: Fix use-after-free in llcp_sock_release()
+ nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
+ xfrm: Check for underflow in xfrm_state_mtu
+ nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
+ netfilter: synproxy: refresh tcphdr after skb_ensure_writable
+ netfilter: xt_cpu: prefer raw_smp_processor_id
+ netfilter: ebtables: fix OOB read in compat_mtw_from_user
+ tun: free page on short-frame rejection in tun_xdp_one()
+ net: netlink: fix sending unassigned nsid after assigned one
+ net: netlink: don't set nsid on local notifications
+ net/smc: Do not re-initialize smc hashtables
+ net/iucv: fix locking in .getsockopt
+ ipv4: free net->ipv4.sysctl_local_reserved_ports after
unregister_net_sysctl_table()
+ ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
+ tunnels: load network headers after skb_cow() in
iptunnel_pmtud_build_icmp[v6]()
+ vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
+ tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
+ ASoC: codecs: simple-mux: Fix enum control bounds check
+ Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
+ bonding: refuse to enslave CAN devices
+ ethtool: eeprom: add more safeties to EEPROM Netlink fallback
+ ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
+ Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
+ Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
+ gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
+ sctp: fix race between sctp_wait_for_connect and peeloff
+ batman-adv: v: stop OGMv2 on disabled interface
+ batman-adv: tvlv: abort OGM send on tvlv append failure
+ batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
+ batman-adv: tvlv: reject oversized TVLV packets
+ batman-adv: iv: recover OGM scheduling after forward packet error
+ selftests: forwarding: lib: Add helpers for checksum handling
+ batman-adv: tp_meter: directly shut down timer on cleanup
+ batman-adv: tt: fix TOCTOU race for reported vlans
+ batman-adv: tt: avoid empty VLAN responses
+ batman-adv: bla: avoid double decrement of bla.num_requests
+ wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
+ drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
+ drm/i915/psr: Read Intel DPCD workaround register
+ drm/dp: Add eDP 1.5 bit definition
+ drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
+ Revert "RDMA/rxe: Fix double free in rxe_srq_from_init"
+ RDMA/rxe: Fix double free in rxe_srq_from_init
+ phy: mscc: Use PHY_ID_MATCH_VENDOR to minimize PHY ID table
+ phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X
+ smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
+ iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
+ usb: typec: ucsi: ccg: reject firmware images without a ':' record header
+ usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
+ usb: typec: altmodes/displayport: validate count before reading Status Update
VDO
+ usb: typec: wcove: don't write past struct pd_message in
wcove_read_rx_buffer()
+ USB: serial: safe_serial: fix memory corruption with small endpoint
+ Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
+ Bluetooth: btusb: Allow firmware re-download when version matches
+ hpfs: fix a crash if hpfs_map_dnode_bitmap fails
+ ipc: limit next_id allocation to the valid ID range
+ Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
+ Bluetooth: HIDP: fix missing length checks in hidp_input_report()
+ parport: Fix race between port and client registration
+ iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
+ iio: dac: max5821: fix return value check in powerdown sync
+ iio: dac: ad5686: fix input raw value check
+ wireguard: send: append trailer after expanding head
+ iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
+ iio: gyro: itg3200: fix i2c read into the wrong stack location
+ iio: ssp_sensors: cancel delayed work_refresh on remove
+ iio: temperature: tsys01: fix broken PROM checksum validation
+ iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
+ iio: light: cm3323: fix reg_conf not being initialized correctly
+ iio: buffer: hw-consumer: fix use-after-free in error path
+ USB: serial: omninet: fix memory corruption with small endpoint
+ usb: cdns3: gadget: fix request skipping after clearing halt
+ usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks
the runtime PM usage counter across bind/unbind cycles
+ usb: dwc2: Fix use after free in debug code
+ Input: elan_i2c - validate firmware size before use
+ bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
+ macsec: fix replay protection at XPN lower-PN wrap
+ ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
+ ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
+ ipv6: exthdrs: refresh nh after handling HAO option
+ ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
+ ipv6: validate extension header length before copying to cmsg
+ xfrm: input: hold netns during deferred transport reinjection
+ ip6: vti: Use ip6_tnl.net in vti6_changelink().
+ HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
+ iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
+ nfc: hci: fix out-of-bounds read in HCP header parsing
+ xfrm: route MIGRATE notifications to caller's netns
+ xfrm: ah: use skb_to_full_sk in async output callbacks
+ netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
direction check
+ ASoC: qcom: q6asm-dai: close stream only when running
+ ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks
+ xfrm: esp: restore combined single-frag length gate
+ Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
+ Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
+ comedi: comedi_test: fix check for valid scan_begin_src in
waveform_ai_cmdtest()
+ comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()
+ tty: serial: pch_uart: add check for dma_alloc_coherent()
+ usb: chipidea: core: convert ci_role_switch to local variable
+ usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
+ USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers
+ usb: storage: Add quirks for PNY Elite Portable SSD
+ usbip: vudc: Fix use after free bug in vudc_remove due to race condition
+ usb: usbtmc: check URB actual_length for interrupt-IN notifications
+ usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
+ USB: serial: option: add MeiG SRM813Q
+ USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
+ USB: serial: belkin_sa: validate interrupt status length
+ USB: serial: cypress_m8: validate interrupt packet headers
+ USB: serial: keyspan: fix missing indat transfer sanity check
+ USB: serial: mxuport: fix memory corruption with small endpoint
+ USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
+ usb: gadget: net2280: Fix double free in probe error path
+ usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
+ usb: gadget: f_fs: copy only received bytes on short ep0 read
+ thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
+ thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
+ scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
+ scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
+ drm/hyperv: validate VMBus packet size in receive callback
+ serial: sh-sci: fix memory region release in error path
+ serial: zs: Fix swapped RI/DSR modem line transition counting
+ serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
+ serial: dz: Fix bootconsole message clobbering at chip reset
+ serial: zs: Fix bootconsole handover lockup
+ serial: zs: Switch to using channel reset
+ USB: serial: cypress_m8: fix memory corruption with small endpoint
+ HID: core: Add printk_ratelimited variants to hid_warn() etc
+ HID: pass the buffer size to hid_report_raw_event
+ HID: core: Fix size_t specifier in hid_report_raw_event()
+ USB: serial: digi_acceleport: fix memory corruption with small endpoints
+ xhci: tegra: Fix ghost USB device on dual-role port unplug
+ serial: dz: Fix bootconsole handover lockup
+ usb: core: Fix SuperSpeed root hub wMaxPacketSize
+ bpf: Free reuseport cBPF prog after RCU grace period.
+ USB: serial: mct_u232: fix memory corruption with small endpoint
+ compiler-clang.h: Add __diag infrastructure for clang
+ Disable -Wattribute-alias for clang-23 and newer
+ i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
+ ipv6: mcast: Fix use-after-free when processing MLD queries
+ tee: optee: prevent use-after-free when the client exits before the supplicant
+ netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
+ ipvs: clear the svc scheduler ptr early on edit
+ netfilter: synproxy: add mutex to guard hook reference counting
+ netfilter: conntrack_irc: fix possible out-of-bounds read
+ netfilter: bridge: make ebt_snat ARP rewrite writable
+ dm cache policy smq: check allocation under invalidate lock
+ net/sched: act_api: use RCU with deferred freeing for action lifecycle
+ 6lowpan: fix off-by-one in multicast context address compression
+ drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
+ pcnet32: stop holding device spin lock during napi_complete_done
+ net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
+ net: lan743x: permit VLAN-tagged packets up to configured MTU
+ Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
+ Bluetooth: MGMT: validate advertising TLV before type checks
+ Bluetooth: RFCOMM: validate skb length in MCC handlers
+ Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension
handling
+ Bluetooth: bnep: reject short frames before parsing
+ Bluetooth: fix memory leak in error path of hci_alloc_dev()
+ ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
+ ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
+ net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
+ sctp: purge outqueue on stale COOKIE-ECHO handling
+ signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
+ time: Fix off-by-one in settimeofday() usec validation
+ ext4: validate p_idx bounds in ext4_ext_correct_indexes
+ fs/ntfs3: Return error for inconsistent extended attributes
+ nfsd: don't ignore the return code of svc_proc_register()
+ tap: free page on error paths in tap_get_user_xdp()
+ tun: free page on build_skb failure in tun_xdp_one()
+ KVM: arm64: Remove VPIPT I-cache handling
+ arm64: tlb: Allow XZR argument to TLBI ops
+ arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI
+ xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
+ netlabel: validate unlabeled address and mask attribute lengths
+ net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
+ ipv6: sit: reload inner IPv6 header after GSO offloads
+ net: openvswitch: fix possible kfree_skb of ERR_PTR
+ sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
+ net: guard timestamp cmsgs to real error queue skbs
+ net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
completion
+ ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
+ rds: mark snapshot pages dirty in rds_info_getsockopt()
+ netfilter: x_tables: avoid leaking percpu counter pointers
+ netfilter: nf_log: validate MAC header was set before dumping it
+ netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
+ net: mvpp2: sync RX data at the hardware packet offset
+ net: mvpp2: limit XDP frame size to the RX buffer
+ net: mvpp2: Add metadata support for xdp mode
+ net: mvpp2: refill RX buffers before XDP or skb use
+ net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
+ drm/vc4: fix krealloc() memory leak
+ netfilter: nft_tunnel: fix use-after-free on object destroy
+ Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
+ drm/i915/gem: Fix phys BO pread/pwrite with offset
+ xfrm: espintcp: do not reuse an in-progress partial send
+ USB: serial: io_ti: fix heap overflow in get_manuf_info()
+ USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
+ USB: serial: option: add usb-id for Dell Wireless DW5826e-m
+ USB: serial: kl5kusb105: fix bulk-out buffer overflow
+ ALSA: timer: Fix UAF at snd_timer_user_params()
+ drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
+ RDMA/srp: bound SRP_RSP sense copy by the received length
+ ARM: socfpga: Fix OF node refcount leak in SMP setup
+ ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
+ mptcp: fix retransmission loop when csum is enabled
+ mptcp: sockopt: check timestamping ret value
+ vsock/vmci: fix sk_ack_backlog leak on failed handshake
+ bnxt_en: Fix NULL pointer dereference
+ IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
+ pidfd: refuse access to tasks that have started exiting harder
+ fuse: reject fuse_notify() pagecache ops on directories
+ i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
+ i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
+ i2c: tegra: Fix NOIRQ suspend/resume
+ Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
+ Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
+ ipc/shm: serialize orphan cleanup with shm_nattch updates
+ misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
+ misc: fastrpc: fix DMA address corruption due to find_vma misuse
+ net: bonding: fix NULL pointer dereference in bond_do_ioctl()
+ net: mv643xx: fix OF node refcount
+ net: rds: clear i_sends on setup unwind
+ mmc: core: Fix host controller programming for fixed driver type
+ mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
+ mmc: sdhci: add signal voltage switch in sdhci_resume_host
+ sctp: diag: reject stale associations in dump_one path
+ sctp: stream: fully roll back denied add-stream state
+ thunderbolt: Reject zero-length property entries in validator
+ thunderbolt: Bound root directory content to block size
+ thunderbolt: Clamp XDomain response data copy to allocation size
+ thunderbolt: Limit XDomain response copy to actual frame size
+ slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
+ drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
+ drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
+ drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
+ drm/amd/display: Use krealloc_array() in dal_vector_reserve()
+ fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
+ mm/damon/ops-common: call folio_test_lru() after folio_get()
+ io_uring/poll: fix signed comparison in io_poll_get_ownership()
+ Revert "net/tcp-md5: Fix MAC comparison to be constant-time"
+ net/tcp-md5: Fix MAC comparison to be constant-time
+ lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
+ f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
+ f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
+ smb: server: fix active_num_conn leak on transport allocation failure
+ smb: server: fix max_connections off-by-one in tcp accept path
+ smb: client: require a full NFS mode SID before reading mode bits
+ smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
+ ksmbd: require minimum ACE size in smb_check_perm_dacl()
+ net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
+ arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
+ rtw88: 8821ce: Disable PCIe ASPM L1 for 8821CE using chip ID
+ wifi: rtw88: check for PCI upstream bridge existence
+ thermal: core: Fix thermal zone governor cleanup issues
+ wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
+ ALSA: aoa: Use guard() for mutex locks
+ ALSA: aoa: i2sbus: clear stale prepared state
+ media: rc: ttusbir: respect DMA coherency rules
+ ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
+ erofs: fix the out-of-bounds nameoff handling for trailing dirents
+ media: rc: igorplugusb: heed coherency rules
+ sched: Use u64 for bandwidth ratio calculations
+ ALSA: core: Fix potential data race at fasync handling
+ net: qrtr: ns: Limit the maximum number of lookups
+ net: qrtr: ns: Change servers radix tree to xarray
+ net: qrtr: ns: Free the node during ctrl_cmd_bye()
+ net: mctp: fix don't require received header reserved bits to be zero
+ net: qrtr: ns: Limit the total number of nodes
+ net: bridge: use a stable FDB dst snapshot in RCU readers
+ fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
+ randomize_kstack: Maintain kstack_offset per task
+ mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
+ mtd: spi-nor: sst: Fix write enable before AAI sequence
+ udf: fix partition descriptor append bookkeeping
+ hfsplus: fix uninit-value by validating catalog record size
+ hfsplus: fix held lock freed on hfsplus_fill_super()
+ Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
+ can: ucan: fix typos in comments
+ can: ucan: fix devres lifetime
+ erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
+ ceph: only d_add() negative dentries when they are unhashed
+ ALSA: aloop: Fix peer runtime UAF during format-change stop
+ printk: add print_hex_dump_devel()
+ crypto: caam - guard HMAC key hex dumps in hash_digest_key
+ tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
+ smb: client: validate the whole DACL before rewriting it in cifsacl
+ usb: typec: tcpm: reset internal port states on soft reset AMS
+ wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
+ usb: dwc3: Move GUID programming after PHY initialization
+ net: ipv4: stop checking crypto_ahash_alignmask
+ net: ipv6: stop checking crypto_ahash_alignmask
+ xfrm: ah: account for ESN high bits in async callbacks
+ xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
+ spi: syncuacer: fix controller deregistration
+ spi: sun4i: fix controller deregistration
+ spi: spi-ti-qspi: Convert to platform remove callback returning void
+ spi: ti-qspi: fix controller deregistration
+ spi: zynq-qspi: fix controller deregistration
+ spi: sun6i: fix controller deregistration
+ spi: tegra114: fix controller deregistration
+ spi: tegra20-sflash: fix controller deregistration
+ spi: uniphier: fix controller deregistration
+ mm/hugetlb_cma: round up per_node before logging it
+ fbcon: Avoid OOB font access if console rotation fails
+ spi: topcliff-pch: Convert to platform remove callback returning void
+ spi: topcliff-pch: fix controller deregistration
+ btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
info-leak
+ tracing/probes: Limit size of event probe to 3K
+ pmdomain: core: Fix detach procedure for virtual devices in genpd
+ Revert "smb: client: validate dacloffset before building DACL pointers"
+ smb: client: validate dacloffset before building DACL pointers
+ btrfs: fix missing last_unlink_trans update when removing a directory
+ smb: client: Use FullSessionKey for AES-256 encryption key derivation
+ mptcp: pm: prio: skip closed subflows
+ mptcp: pm: ADD_ADDR rtx: fix potential data-race
+ mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
+ f2fs: fix incorrect file address mapping when inline inode is unwritten
+ f2fs: fix false alarm of lockdep on cp_global_sem lock
+ spi: st-ssc4: fix controller deregistration
+ spi: lantiq-ssc: fix controller deregistration
+ genetlink: Use internal flags for multicast groups
+ smb: client: require net admin for CIFS SWN netlink
+ Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
+ Bluetooth: hci_qca: Convert timeout from jiffies to ms
+ Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2
+ Bluetooth: MGMT: validate Add Extended Advertising Data length
+ qed: Use the bitmap API to simplify some functions
+ qed: fix double free in qed_cxt_tables_alloc()
+ Bluetooth: Consolidate code around sk_alloc into a helper function
+ Bluetooth: Init sk_peer_* on bt_sock_alloc
+ Bluetooth: serialize accept_q access
+ net: hsr: defer node table free until after RCU readers
+ ice: fix VF queue configuration with low MTU values
+ ipv6/addrconf: annotate data-races around devconf fields (II)
+ ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
+ use less confusing names for iov_iter direction initializers
+ mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient
+ selftests: mptcp: drop nanoseconds width specifier
+ mptcp: do not drop partial packets
+ octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
+ octeontx2-pf: avoid double free of pool->stack on AQ init failure
+ spi: qup: switch to use modern name
+ spi: qup: fix error pointer deref after DMA setup failure
+ arm64: tlb: Flush walk cache when unsharing PMD tables
+ phy: tegra: xusb: Disable trk clk when not in use
+ phy: tegra: xusb: Fix per-pad high-speed termination calibration
+ Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
+ iio: gyro: adis16260: fix division by zero in write_raw
+ iio: chemical: scd30: Use guard(mutex) to allow early returns
+ iio: chemical: scd30: fix division by zero in write_raw
+ iio: dac: ad5686: fix ref bit initialization for single-channel parts
+ usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition
failure
+ net: skbuff: fix missing zerocopy reference in pskb_carve helpers
+ serial: samsung_tty: Use port lock wrappers
+ tty: serial: samsung: use u32 for register interactions
+ tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
+ usb: dwc3: xilinx: fix error handling in zynqmp init error paths
+ usb: gadget: f_hid: tidy error handling in hidg_alloc
+ usb: gadget: f_hid: fix device reference leak in hidg_alloc()
+ thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
+ scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
+ drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7
+ drm/hyperv: validate resolution_count and fix WIN8 fallback
+ serial: altera_jtaguart: Use platform_get_irq_optional() to get the interrupt
+ serial: altera_jtaguart: handle uart_add_one_port() failures
+ tty: serial: qcom-geni-serial: remove unused symbols
+ tty: serial: qcom-geni-serial: align #define values
+ serial: qcom-geni: fix UART_RX_PAR_EN bit position
+ scsi: target: iscsi: Fix CRC overread and double-free in
iscsit_handle_text_cmd()
+ netfilter: nft_fib: fix stale stack leak via the OIFNAME register
+ hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
+ RDMA/umem: fix kernel-doc warnings
+ RDMA: Move DMA block iterator logic into dedicated files
+ RDMA/umem: Fix truncation for block sizes >= 4G
+ mm/huge_memory: update file PMD counter before folio_put()
+ ipvs: skip ipv6 extension headers for csum checks
+ blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before
init
+ batman-adv: stop tp_meter sessions during mesh teardown
+ batman-adv: tp_meter: fix tp_num leak on kmalloc failure
+ Revert "net/ipv6: ioam6: prevent schema length wraparound in trace fill"
+ net/ipv6: ioam6: prevent schema length wraparound in trace fill
+ ksmbd: Compare MACs in constant time
+ Revert "nfsd: fix heap overflow in NFSv4.0 LOCK replay cache"
+ nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
+ ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
+ selinux: enable genfscon labeling for securityfs
+ arm64: cputype: Add NVIDIA Olympus definitions
+ arm64: cputype: Add C1-Ultra definitions
+ arm64: cputype: Add C1-Premium definitions
+ arm64: errata: Mitigate TLBI errata on various Arm CPUs
+ arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
+ arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
+ UBUNTU: [Config] Set CONFIG_ARM64_ERRATUM_4118414=y
+ mptcp: close TOCTOU race while computing rcv_wnd
+ fbdev: vt8500lcdfb: Fix dma_free_coherent() cpu_addr parameter
+ Revert "apparmor: validate DFA start states are in bounds in unpack_pdb"
+ apparmor: validate DFA start states are in bounds in unpack_pdb
+ apparmor: validate default DFA states are in bounds
+ media: rc: ttusbir: fix inverted error logic
+ batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
+ media: rc: igorplugusb: fix control request setup packet
+ Bluetooth: MGMT: Fix backward compatibility with userspace
+ ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
+ batman-adv: tp_meter: fix race condition in send error reporting
+ batman-adv: tp_meter: avoid role confusion in tp_list
+ netfilter: require Ethernet MAC header before using eth_hdr()
+ Linux 5.15.210
+ UBUNTU: Upstream stable to v5.15.210
+ fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
+ net/sched: act_pedit: check static offsets a priori
+ net/sched: act_pedit: rate limit datapath messages
+ net/sched: fix pedit partial COW leading to page cache corruption
+ net/sched: act_pedit: free pedit keys on bail from offset check
+ drm/amd/display: Bound VBIOS record-chain walk loops
+ ip6_vti: set netns_immutable on the fallback device.
+ drm/v3d: Store the active job inside the queue's state
+ drm/v3d: Skip CSD when it has zeroed workgroups
+ batman-adv: tt: reject oversized local TVLV buffers
+ batman-adv: tt: prevent TVLV entry number overflow
+ iio: light: bh1780: fix PM runtime leak on error path
+ vfio/iommu_type1: replace kfree with kvfree
+ RDMA/bnxt_re: zero shared page before exposing to userspace
+ i2c: stub: Reject I2C block transfers with invalid length
+ net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
+ agp/amd64: Fix broken error propagation in agp_amd64_probe()
+ xhci: fix memory leak regression when freeing xhci vdev devices depth first
+ af_unix: Reject SIOCATMARK on non-stream sockets
+ regulator: core: fix locking in regulator_resolve_supply() error path
+ vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
+ media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
+ virtiofs: fix UAF on submount umount
+ Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"
+ Revert "ptp: add testptp mask test"
+ KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
+ kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported
+ batman-adv: tp_meter: keep unacked list in ascending ordered
+ batman-adv: tp_meter: initialize dup_acks explicitly
+ batman-adv: tp_meter: initialize dec_cwnd explicitly
+ batman-adv: tp_meter: avoid window underflow
+ batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
+ batman-adv: tp_meter: fix fast recovery precondition
+ batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
+ batman-adv: tp_meter: add only finished tp_vars to lists
+ batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
+ batman-adv: prevent ELP transmission interval underflow
+ batman-adv: tp_meter: initialize last_recv_time during init
+ batman-adv: ensure bcast is writable before modifying TTL
+ batman-adv: fix (m|b)cast csum after decrementing TTL
+ batman-adv: frag: ensure fragment is writable before modifying TTL
+ batman-adv: frag: avoid underflow of TTL
+ batman-adv: v: prevent OGM aggregation on disabled hardif
+ batman-adv: tp_meter: restrict number of unacked list entries
+ batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
+ batman-adv: tp_meter: prevent parallel modifications of last_recv
+ batman-adv: tp_meter: handle overlapping packets
+ batman-adv: tt: don't merge change entries with different VIDs
+ batman-adv: tt: track roam count per VID
+ batman-adv: dat: prevent false sharing between VLANs
+ batman-adv: tvlv: enforce 2-byte alignment
+ batman-adv: tvlv: avoid race of cifsnotfound handler state
+ ring-buffer: Remove ring_buffer_read_prepare_sync()
+ ntfs3: reject direct userspace writes to reserved $LX* xattrs
+ ext4: add bounds check for inline data length in ext4_read_inline_page
+ crypto: af_alg - Set merge to zero early in af_alg_sendmsg
+ mac802154: llsec: add skb_cow_data() before in-place crypto
+ KEYS: fix overflow in keyctl_pkey_params_get_2()
+ keys: Pin request_key_auth payload in instantiate paths
+ wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
+ wifi: ath11k: fix warning when unbinding
+ wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
+ f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
+ bpf: use kvfree() for replaced sysctl write buffer
+ MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
+ exfat: fix potential use-after-free in exfat_find_dir_entry()
+ hdlc_ppp: sync per-proto timers before freeing hdlc state
+ tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
+ pNFS: Fix use-after-free in pnfs_update_layout()
+ irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on
remove
+ fpga: region: fix use-after-free in child_regions_with_firmware()
+ ocfs2: reject oversized group bitmap descriptors
+ KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
+ power: reset: linkstation-poweroff: fix use-after-free in the
linkstation_poweroff_init()
+ fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
+ fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
+ NFSD: Fix SECINFO_NO_NAME decode error cleanup
+ nfsd: fix posix_acl leak on SETACL decode failure
+ nfsd: check get_user() return when reading princhashlen
+ NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
+ mptcp: fix missing wakeups in edge scenarios
+ hv: utils: handle and propagate errors in kvp_register
+ misc: fastrpc: Add dma_mask to fastrpc_channel_ctx
+ misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
+ Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
+ phonet: Pass ifindex to fill_addr().
+ phonet: Pass net and ifindex to phonet_address_notify().
+ net: phonet: free phonet_device after RCU grace period
+ fuse: re-lock request before replacing page cache folio
+ ksmbd: reject non-VALID session in compound request branch
+ Documentation: ioctl-number: Extend "Include File" column width
+ crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()
+ crypto: qat - Return pointer directly in adf_ctl_alloc_resources
+ crypto: qat - remove unused character device and IOCTLs
+ dlm: prevent NPD when writing a positive value to event_done
Linux 5.15.211
- dlm: prevent NPD when writing a positive value to event_done
- crypto: qat - remove unused character device and IOCTLs
- crypto: qat - Return pointer directly in adf_ctl_alloc_resources
- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()
- Documentation: ioctl-number: Extend "Include File" column width
- ksmbd: reject non-VALID session in compound request branch
- fuse: re-lock request before replacing page cache folio
- net: phonet: free phonet_device after RCU grace period
- phonet: Pass net and ifindex to phonet_address_notify().
- phonet: Pass ifindex to fill_addr().
- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
- misc: fastrpc: Add dma_mask to fastrpc_channel_ctx
- hv: utils: handle and propagate errors in kvp_register
- mptcp: fix missing wakeups in edge scenarios
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
- nfsd: check get_user() return when reading princhashlen
- nfsd: fix posix_acl leak on SETACL decode failure
- NFSD: Fix SECINFO_NO_NAME decode error cleanup
- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
- fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
- power: reset: linkstation-poweroff: fix use-after-free in the
linkstation_poweroff_init()
- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
- ocfs2: reject oversized group bitmap descriptors
- fpga: region: fix use-after-free in child_regions_with_firmware()
- irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on
remove
- pNFS: Fix use-after-free in pnfs_update_layout()
- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
- hdlc_ppp: sync per-proto timers before freeing hdlc state
- exfat: fix potential use-after-free in exfat_find_dir_entry()
- MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
- bpf: use kvfree() for replaced sysctl write buffer
- f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
- wifi: ath11k: fix warning when unbinding
- wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
- keys: Pin request_key_auth payload in instantiate paths
- KEYS: fix overflow in keyctl_pkey_params_get_2()
- mac802154: llsec: add skb_cow_data() before in-place crypto
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg
- ext4: add bounds check for inline data length in ext4_read_inline_page
- ntfs3: reject direct userspace writes to reserved $LX* xattrs
- ring-buffer: Remove ring_buffer_read_prepare_sync()
- batman-adv: tvlv: avoid race of cifsnotfound handler state
- batman-adv: tvlv: enforce 2-byte alignment
- batman-adv: dat: prevent false sharing between VLANs
- batman-adv: tt: track roam count per VID
- batman-adv: tt: don't merge change entries with different VIDs
- batman-adv: tp_meter: handle overlapping packets
- batman-adv: tp_meter: prevent parallel modifications of last_recv
- batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
- batman-adv: tp_meter: restrict number of unacked list entries
- batman-adv: v: prevent OGM aggregation on disabled hardif
- batman-adv: frag: avoid underflow of TTL
- batman-adv: frag: ensure fragment is writable before modifying TTL
- batman-adv: fix (m|b)cast csum after decrementing TTL
- batman-adv: ensure bcast is writable before modifying TTL
- batman-adv: tp_meter: initialize last_recv_time during init
- batman-adv: prevent ELP transmission interval underflow
- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
- batman-adv: tp_meter: add only finished tp_vars to lists
- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
- batman-adv: tp_meter: fix fast recovery precondition
- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
- batman-adv: tp_meter: avoid window underflow
- batman-adv: tp_meter: initialize dec_cwnd explicitly
- batman-adv: tp_meter: initialize dup_acks explicitly
- batman-adv: tp_meter: keep unacked list in ascending ordered
- kselftest/arm64: signal: Skip SVE signal test if not enough VLs supported
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
- Revert "ptp: add testptp mask test"
- Revert "selftest/ptp: update ptp selftest to exercise the gettimex options"
- virtiofs: fix UAF on submount umount
- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
- regulator: core: fix locking in regulator_resolve_supply() error path
- af_unix: Reject SIOCATMARK on non-stream sockets
- xhci: fix memory leak regression when freeing xhci vdev devices depth first
- agp/amd64: Fix broken error propagation in agp_amd64_probe()
- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
- i2c: stub: Reject I2C block transfers with invalid length
- RDMA/bnxt_re: zero shared page before exposing to userspace
- vfio/iommu_type1: replace kfree with kvfree
- iio: light: bh1780: fix PM runtime leak on error path
- batman-adv: tt: prevent TVLV entry number overflow
- batman-adv: tt: reject oversized local TVLV buffers
- drm/v3d: Skip CSD when it has zeroed workgroups
- drm/v3d: Store the active job inside the queue's state
- ip6_vti: set netns_immutable on the fallback device.
- drm/amd/display: Bound VBIOS record-chain walk loops
- net/sched: act_pedit: free pedit keys on bail from offset check
- net/sched: fix pedit partial COW leading to page cache corruption
- net/sched: act_pedit: rate limit datapath messages
- net/sched: act_pedit: check static offsets a priori
- fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
+ UBUNTU: Upstream stable to v5.15.210, v5.15.211
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161176
Title:
Jammy update: v5.15.211 upstream stable release
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161176/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
