Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-08-26
Ported from the following upstream stable releases:
v6.18.41, v6.18.42, v6.18.43, v7.1.6, v7.1.7
from git://git.kernel.org/
platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue
worker
seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
KVM: x86/mmu: Fix use-after-free on vendor module reload
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
xprtrdma: Clear receive-side ownership pointers on release
Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
Input: ims-pcu - fix logic error in packet reset
fuse: fix writeback array overflow when max_pages is one
arm64: tegra: Remove fallback compatible for GPCDMA
arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
xfrm: fix stale skb->prev after async crypto steals a GSO segment
firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
IB/mad: Drop unmatched RMPP responses before reassembly
mtd: mtdswap: remove debugfs stats file on teardown
mtd: nand: mtk-ecc: stop on ECC idle timeouts
btrfs: reject free space cache with more entries than pages
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
btrfs: fallback to transaction csum tree on a commit root csum miss
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
xfrm: reject optional IPTFS templates in outbound policies
RDMA/cma: Fix hardware address comparison length in netevent callback
RDMA/irdma: Prevent rereg_mr for non-mem regions
RDMA/irdma: Remove redundant legacy_mode checks
RDMA/irdma: Prevent user-triggered null deref on QP create
RDMA/erdma: initialize ret for empty receive WR lists
RDMA/mana_ib: initialize err for empty send WR lists
RDMA/hns: Fix potential integer overflow in mhop hem cleanup
RDMA/siw: publish QP after initialization
mtd: fix double free and WARN_ON in add_mtd_device() error paths
selftests/alsa: Fix memory leak in find_controls error path
RDMA/irdma: Prevent overflows in memory contiguity checks
xfrm: clear mode callbacks after failed mode setup
xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
wifi: cfg80211: cancel sched scan results work on unregister
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
wifi: mac80211: fix fils_discovery double free on alloc failure
wifi: libertas: fix memory leak in helper_firmware_cb()
wifi: mac80211: defer link RX stats percpu free to RCU
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
wifi: nl80211: free RNR data on MBSSID mismatch
wifi: cfg80211: derive S1G beacon TSF from S1G fields
wifi: nl80211: validate nested MBSSID IE blobs
wifi: nl80211: constrain MBSSID TX link ID range
wifi: cfg80211: validate PMSR measurement type data
wifi: cfg80211: validate PMSR FTM preamble range
wifi: cfg80211: reject unsupported PMSR FTM location requests
wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
wifi: brcmfmac: initialize SDIO data work before cleanup
wifi: cfg80211: bound element ID read when checking non-inheritance
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
ASoC: amd: ps: disable MSI on resume in ACP PCI driver
ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check
ASoC: cs42l43: Correct report for forced microphone jack
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
scsi: core: wake eh reliably when using scsi_schedule_eh
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
ata: sata_dwc_460ex: use platform_get_irq()
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
accel/ivpu: Fix wrong register read in LNL failure diagnostics
ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
Bluetooth: qca: fix NVM tag length underflow in TLV parser
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
Bluetooth: hci_sync: extend conn_hash lookup critical sections
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
Bluetooth: hci_qca: Clear memdump state on invalid dump size
smb/client: handle overlapping allocated ranges in fallocate
drm/i915/gt: use correct selftest config symbol
can: raw: add locking for raw flags bitfield
powerpc/85xx: Add fsl,ifc to common device ids
powerpc/time: Prepare to stop elapsing in dynticks-idle
powerpc/vtime: Initialize starttime at boot for native accounting
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
drm/panthor: Check debugfs GEM lock initialization
s390/checksum: Fix csum_partial() without vector facility
riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
can: j1939: fix lockless local-destination check
drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves
drm/xe/wopcm: fix WOPCM size for LNL+
ksmbd: pin conn during async oplock break notification
ksmbd: validate compound request size before reading StructureSize2
drm/i915/wm: clear the plane ddb_y entries on plane disable
drm/i915/selftests: Fix GT PM sort comparators
accel/amdxdna: Fix use-after-free of mm_struct in job scheduler
tcp: fix TIME_WAIT socket reference leak on PSP policy failure
dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
net/sched: act_tunnel_key: Defer dst_release to RCU callback
sctp: fix auth_hmacs array size in struct sctp_cookie
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
usb: core: sysfs: add lock to bos_descriptors_read()
wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
usb: core: port: Deattach Type-C connector on component unbind
usb: musb: omap2430: Do not put borrowed of_node in probe
USB: storage: add NO_ATA_1X quirk for Longmai USB Key
usb: chipidea: fix usage_count leak when autosuspend_delay is negative
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
usb: gadget: printer: fix infinite loop in printer_read()
USB: gadget: snps-udc: fix device name leak on probe failure
USB: gadget: fsl-udc: fix device name leak on probe failure
USB: gadget: fsl-udc: fix dev_printk() device
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
USB: serial: ftdi_sio: add support for E+H FXA291
USB: serial: io_edgeport: cap received transmit credits
USB: serial: keyspan_pda: fix data loss on receive throttling
USB: serial: option: add TDTECH MT5710-CN
UBUNTU: SAUCE: Revert "usb: typec: ucsi: Detect and skip duplicate altmodes
from buggy firmware"
usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware
RISC-V: KVM: Serialize virtual interrupt pending state updates
Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
selftests/bpf: Adjust verifier_map_ptr for the map's excl field
selftests/bpf: Keep verifier_map_ptr exercising ops pointer access
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
watchdog: airoha: Prevent division by zero when clock frequency is zero
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
firewire: net: Fix fragmented datagram reassembly
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
wifi: carl9170: fix OOB read from off-by-two in TX status handler
wifi: carl9170: fix buffer overflow in rx_stream failover path
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
btrfs: free mapping node on duplicate reloc root insert
ASoC: tas2781: bound firmware description string parsing
ASoC: sun4i-codec: Set quirks.playback_only for H616 codec
ALSA: hda: cs35l41: validate and free ACPI mute object
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
ASoC: cs35l56: Don't use devres to unregister component
ASoC: cs35l56: Fix potential probe() deadlock
ASoC: cs35l56: Use complete_all() to signal init_completion
wifi: iwlwifi: mvm: validate SAR GEO response payload size
wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list
wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn
wifi: iwlwifi: mvm: fix read in wake packet notification handler
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
hwmon: (asus-ec-sensors) fix EC read intervals
hwmon: (asus-ec-sensors) add missed handle for ENOMEM
smb: client: validate DFS referral PathConsumed
ovpn: avoid putting unrelated P2P peer on socket release
selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()
ovpn: fix use after free in unlock_ovpn()
ovpn: use monotonic clock for peer keepalive timeouts
hwmon: occ: validate poll response sensor blocks
regulator: mt6358: use regmap helper to read fixed LDO calibration
Bluetooth: btusb: validate Realtek vendor event length
net: phy: marvell: fix return code
netlink: specs: rt-link: convert bridge port flag attributes to u8
net/packet: avoid fanout hook re-registration after unregister
bonding: fix devconf_all NULL dereference when IPv6 is disabled
rds: drop incoming messages that cross network namespace boundaries
gtp: parse extension headers before reading inner protocol
rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
dpaa2-switch: put MAC endpoint device on disconnect
net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
dpaa2-eth: put MAC endpoint device on disconnect
net: airoha: Fix DMA direction for NPU mailbox buffer
iommu/amd: Wait for completion instead of returning early in
iommu_completion_wait()
wifi: mac80211: tear down new links on vif update error path
nfp: Check resource mutex allocation
wan: wanxl: Only reset hardware after BAR mapping
vhost-net: fix TX stall when vhost owns virtio-net header
wifi: mwifiex: bound uAP association event IEs to the event buffer
iommu/amd: Bound the early ACPI HID map
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
wifi: mac80211: recalculate TIM when a station enters power save
pds_core: reject component parameter in legacy firmware update
arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
net: Call net_enable_timestamp() before failure in sk_clone().
net: txgbe: fix FDIR filter leak on remove
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
pds_core: fix deadlock between reset thread and remove
pds_core: fix use-after-free on workqueue during remove
pds_core: yield the CPU while waiting for the adminq to drain
pds_core: order completion reads after the ownership check
pds_core: fix auxiliary device add/del races
pds_core: check for workqueue allocation failure
sctp: validate stream count in sctp_process_strreset_inreq()
net: mctp i3c: clean up notifier and buses if driver register fails
tls: device: push pending open record on splice EOF
selftests: af_unix: add USER_NS config
selftests: openvswitch: add config file
selftests: ovpn: add IPV6 and VETH configs
selftests: ovpn: increase timeout
selftests: drv-net: increase timeout
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
nexthop: initialize extack in nh_res_bucket_migrate()
tipc: fix infinite loop in __tipc_nl_compat_dumpit
ppp: don't store tx skb in the fastpath
ppp: annotate concurrent dev->stats accesses
wifi: mt76: mt7925: guard link STA in decap offload
wifi: mt76: mt7915: guard HE capability lookups
wifi: mt76: connac: fix possible NULL-pointer deref in
mt76_connac_mcu_uni_bss_he_tlv()
wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
wifi: mt76: mt7925: fix crash in reset link replay
wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
ovl: fix trusted xattr escape prefix matching
drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
ovl: check access to copy_file_range source with src mounter creds
amt: re-read skb header pointers after every pull
amt: make the head writable before rewriting the L2 header
net: bridge: vlan: fix vlan range dumps starting with pvid
net: hsr: fix memory leak on slave unregistration by removing synced VLANs
net: dpaa: fix mode setting
sctp: auth: verify auth requirement when auth_chunk is NULL
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
drm/xe/i2c: Allow per domain unique id
drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
iomap: correct the range of a partial dirty clear
tipc: fix u16 MTU truncation in media and bearer MTU validation
drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem
bpf: tcp: fix double sock release on batch realloc
net: stmmac: xgmac: fix l4 filter port overwrite on register update
net: stmmac: fix l3l4 filter rejecting unsupported offload requests
net: stmmac: reset residual action in L3L4 filters on delete
net: stmmac: enable the MAC on link up for all supported speeds
net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
octeontx2-vf: set TC flower flag on MCAM entry allocation
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
ppp: annotate data races in ppp_generic
hinic: remove unused ethtool RSS user configuration buffers
net: qrtr: restrict socket creation to the initial network namespace
raw: annotate lockless match fields in raw_v4_match()
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
net/mlx5e: Report zero bandwidth for non-ETS traffic classes
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
octeontx2-pf: tc: fix egress ratelimiting
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
ice: fix LAG recipe to profile association
ice: prevent tstamp ring allocation for non-PF VSI types
ipv6: Change allocation flags to match rcu_read_lock section requirements
rds: tcp: unregister sysctl before tearing down listen socket
ptp: netc: explicitly clear TMR_OFF during initialization
mctp: check register_netdevice_notifier() error in mctp_device_init()
net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()
drm/tidss: Fix missing drm_bridge_add() call
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()
drm/imagination: Count paired job fence as dependency in prepare_job()
drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
drm/imagination: Fit paired fragment job in the correct CCCB
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0
(v2)
drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
drm/sysfb: Do not page-align visible size of the framebuffer
drm/sysfb: Avoid truncating maximum stride
drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
drm/nouveau: fix reversed error cleanup order in ucopy functions
drm/sysfb: Avoid possible truncation with calculating visible size
drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
drm/displayid: fix Tiled Display Topology ID size
drm/i915/gem: Add missing nospec on parallel submit slot
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
drm/radeon: fix r100_copy_blit for large BOs
drm/xe: Return error on non-migratable faults requiring devmem
drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
drm/xe: Hold a dma-buf reference for imported BOs
drm/imagination: Fix double call to drm_sched_entity_fini()
drm/imagination: Fix user array stride in pvr_set_uobj_array()
drm/imagination: fix error checking of pvr_vm_context_lookup()
drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
drm/amdkfd: Use kvcalloc to allocate arrays
drm/amdkfd: Check bounds in allocate_event_notification_slot
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks
prev_sink reference
drm/virtio: bound EDID block reads to the response buffer
drm/i915/hdcp: require monotonically increasing seq_num_v
drm/i915/hdcp: check streams[] bounds before overflow
drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
drm/i915: Return NULL on error in active_instance
drm/i915/bios: range check LFP Data Block panel_type2
drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
drm/i915/gem: Do not leak siblings[] on proto context error
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
drm/i915/mst: limit DP MST ESI service loop
drm/amd/pm: fix smu14 power limit range calculation
drm/gfx10: Program DB_RING_CONTROL
drm/virtio: Don't detach GEM from a non-created context
drm/ttm: Account for NULL and handle pages in ttm_pool_backup
drm/panthor: return error on truncated firmware
drm/amdgpu: Release VFCT ACPI table reference
drm/amdgpu: Fix VFCT bus number matching with soft filter
drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
drm/amd/display: set new_stream to NULL after release
drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
drm/amd/display: dce100: skip non-DP stream encoders for DP MST
drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
drm/amd/display: Fix flip-done timeouts on mode1 reset
drm/vc4: Shut down BO cache timer before teardown
drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
drm/vmwgfx: Validate vmw_surface_metadata::array_size
drm/vc4: Prevent shader BO mappings from becoming writable
drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
drm/v3d: Reach the GMP through the hub registers on V3D 7.x
media: airspy: Return queued buffers on start_streaming() failure
media: amlogic-c3: Add validations for ae and awb config
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
media: cec: seco: unregister adapter on IR probe failure
media: cedrus: clean up media device on probe failure
media: cedrus: Fix missing cleanup in error path
media: cedrus: skip invalid H.264 reference list entries
media: chips-media: wave5: Move src_buf Removal to finish_encode
media: cx231xx: fix devres lifetime
media: cx23885: add ioremap return check and cleanup
media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
media: imx219: Fix maximum frame length in lines
media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping
ranges
media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ
media: marvell-cam: fix missing pci_disable_device() on remove
media: meson: vdec: Fix memory leak in error path of vdec_open
media: msi2500: Return queued buffers on start_streaming() failure
media: nuvoton: npcm-video: fix error handling in npcm_video_init()
media: nuvoton: npcm-video: fix memory leaks in probe and remove
media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path
media: nxp: imx8-isi: Fix potential out-of-bounds issues
media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
media: pci: dm1105: Free allocated workqueue
media: pwc: Drain fill_buf on start_streaming() failure
media: pwc: Return queued buffers on start_streaming() failure
media: qcom: camss: Fix RDI streaming for CSID 680
media: qcom: camss: Fix RDI streaming for CSID GEN2
media: qcom: camss: Fix RDI streaming for CSID GEN3
media: radio-si476x: Unregister v4l2_device on probe failure
media: rtl2832: fix use-after-free in rtl2832_remove()
media: rtl2832_sdr: Return queued buffers on start_streaming() failure
media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used
media: saa7134: Fix a possible memory leak in saa7134_video_init1
media: stm32-dcmipp: Return queued buffers on start_streaming() failure
media: stm32: dcmi: unregister notifier on probe failure
media: sun4i-csi: Return queued buffers on start_streaming() failure
media: synopsys: hdmirx: Fix HPD lane hold time
media: tegra-video: vi: fix invalid u32 return value in format lookup
media: ti: vpe: unwind v4l2 device registration on probe error
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
media: v4l2-ctrls: validate HEVC active reference counts
media: v4l2-fwnode: Fix subdev owner overwritten in
v4l2_async_register_subdev_sensor()
media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
media: vb2: use ssize_t for vb2_read/vb2_write
media: verisilicon: Export only needed pixels formats
media: vidtv: fix reference leak on failed device registration
media: vimc: fix reference leak on failed device registration
media: vivid: add vivid_update_reduced_fps()
media: vivid: check for vb2_is_busy() when toggling caps
media: vivid: fix cleanup bugs in vivid_init()
media: vpif_capture: fix OF node reference imbalance
ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
ALSA: seq: close a re-opened queue timer in the destructor
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
ALSA: timer: drain a slave's callback before its master detaches it
ALSA: timer: don't re-enter an instance callback that is still running
wifi: ath6kl: fix OOB access from firmware ADDBA window size
wifi: ath6kl: fix use-after-free in aggr_reset_state()
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
wifi: wilc1000: validate assoc response length before subtracting header
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
wifi: brcmfmac: make release_scratchbuffers idempotent
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
staging: rtl8723bs: fix inverted HT40 secondary channel offset
Bluetooth: hci_sync: Protect UUID list traversal
Bluetooth: RFCOMM: Fix session UAF in set_termios
exec: fix unsigned loop counter wrap in transfer_args_to_stack()
binfmt_misc: set have_execfd only once the interpreter is opened
platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
rust_binder: only print failure if error has source
rust: time: fix as_micros_ceil() to round correctly for negative Delta
rust: allow `clippy::unwrap_or_default` globally
objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
LoongArch: Fix address space mismatch in kexec command line lookup
LoongArch: Fix oops during single-step debugging
LoongArch: Move jump_label_init() before parse_early_param()
LoongArch: Retrieve CPU package ID from PPTT when available
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
rhashtable: clear stale iter->p on table restart
firmware: stratix10-svc: fix memory leaks and list corruption bugs
x86/boot/compressed: Disable jump tables
comedi: comedi_parport: deal with premature interrupt
uio_hv_generic: Bind to FCopy device by default
serial: sc16is7xx: implement gpio get_direction() callback
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
platforms
selftests: ntsync: correct CONFIG_NTSYNC name
mei: bus: access mei_device under device_lock on cleanup
intel_th: fix MSC output device reference leak
misc: nsm: only unlock nsm_dev on post-lock error paths
misc: nsm: pin the module while the device is open
tracing: Fix context switch counter truncation
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
tracing: Fix resource leak on mmiotrace trace_pipe close
tracing: Fix union collision of module and refcnt for dynamic events
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
tracing/probes: Avoid temporary buffer truncation in
trace_probe_match_command_args()
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
arm64: make huge_ptep_get handled unaligned addresses
mptcp: decrement subflows counter on failed passive join
mptcp: only set DATA_FIN when a mapping is present
mptcp: pm: userspace: fix use-after-free in get_local_id
afs: Fix afs_edit_dir_remove() to get, not find, block 0
mm/kmemleak: fix checksum computation for per-cpu objects
mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
sctp: don't free the ASCONF's own transport in DEL-IP processing
sctp: avoid auth_enable sysctl UAF during netns teardown
sctp: close UDP tunnel sockets during netns teardown
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
ceph: fix refcount leak in ceph_readdir()
ceph: fix writeback_count leak in write_folio_nounlock()
libceph: bound get_version reply decode to front len
libceph: Fix multiplication overflow in decode_new_up_state_weight()
libceph: guard missing CRUSH type name lookup
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
libceph: Reject monmaps advertising zero monitors
libceph: reject zero bucket types in crush_decode
libceph: remove debugfs files before client teardown
amt: fix use-after-free in AMT delayed works
ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
binfmt_elf_fdpic: only honour the first PT_INTERP
fs/super: fix emergency thaw double-unlock of s_umount
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
fscrypt: Add missing superblock check in find_or_insert_direct_key()
ftrace: Add global mutex to serialize trace_parser access
io_uring/rw: fix missing ERESTARTSYS conversion in read paths
iomap: fix out-of-bounds bitmap_set() with zero-length range
iommu/vt-d: Disallow SVA if page walk is not coherent
net: stmmac: intel: skip SerDes reconfig when rate is unchanged
phonet: pep: fix use-after-free in pep_get_sb()
vxlan: require CAP_NET_ADMIN in the device netns for changelink
net: slip: serialize receive against buffer reallocation
geneve: require CAP_NET_ADMIN in the device netns for changelink
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
net/iucv: fix use-after-free of a severed iucv_path
net/mlx5e: Use sender devcom for MPV master-up
net/x25: fix use-after-free in x25_kill_by_neigh()
net: gro: fix double aggregation of flush-marked skbs
net: hip04: fix RX buffer leak on build_skb failure
net: pcs: xpcs: fix SGMII state reading
proc: Fix broken error paths for namespace links
s390/ptff: Export ptff_function_mask[]
ptp: ptp_s390: Add missing facility check
ice: fix PTP Call Trace during PTP release
super: fix emergency thaw deadlock on frozen block devices
rbd: Reset positive result codes to zero in object map update path
smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target
ksmbd: defer destroy_previous_session() until after NTLM authentication
gve: fix Rx queue stall on alloc failure
ice: reject out-of-range ptype in ice_parser_profile_init
ice: use READ_ONCE() to access cached PHC time
ila: reload IPv6 header after pskb_may_pull in checksum adjust
mac802154: hold an interface reference across the scan worker
mac802154: llsec: reject frames shorter than the authentication tag
mctp: serial: handle zero-length frames to prevent rx buffer overflow
openvswitch: fix GSO userspace truncation underflow
ovpn: fix peer refcount leak in TCP error paths
ovpn: hold peer before scheduling keepalive work
pppoe: reload header pointer after dev_hard_header()
rtase: Workaround for TX hang caused by hardware packet parsing
tcp: initialize standalone TCP-AO response padding
tcp: challenge ACK for non-exact RST in SYN-RECEIVED
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
vsock/virtio: collapse receive queue under memory pressure
vxlan: mdb: Fix source list corruption on a failed replace
watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
drm/amd/pm: fix amdgpu_pm_info power display units
drm/amd/pm: make pp_features read-only when scpm is enabled
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx8: drop unecessary BUG_ON()
drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
drm/amdgpu/soc24: reset dGPU if suspend got aborted
drm/amdgpu/vce: fix integer overflow in image size
drm/amdgpu/vcn4: avoid rereading IB param length
drm/dp_mst: Handle torn-down topology gracefully in
drm_dp_mst_topology_queue_probe()
drm/amdgpu: fix division by zero with invalid uvd dimensions
drm/amdgpu: fix resource leak on ACP reset timeout
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
drm/amd/pm: fix smu13 power limit range calculation
drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
ublk: wait on ublk_dev_ready() instead of ub->completion
net: qrtr: ns: Raise node count limit to 512
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
ksmbd: bound DACL dedup walk to copied ACEs
ksmbd: validate ACE size against SID sub-authorities
fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
audit: widen ino fields to u64
audit: use 'unsigned int' instead of 'unsigned'
audit: fix recursive locking deadlock in audit_dupe_exe()
fuse-uring: fix race between registration and connection abortion
xfs: don't replace the wrong part of the cow fork
netfilter: nf_tables: remove register tracking infrastructure
drm: drop lib from header search path.
SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
UBUNTU: SAUCE: Revert "mm/sparse-vmemmap: fix vmemmap accounting underflow"
mm/sparse-vmemmap: fix vmemmap accounting underflow
mmc: vub300: rename probe error labels
net: mana: Optimize irq affinity for low vcpu configs
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
pmdomain: imx93-blk-ctrl: convert to devm_* only
mm/damon/core: validate ranges in damon_set_regions()
mm/damon/core: disallow overlapping input ranges for damon_set_regions()
rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
rust: device: avoid trailing ; in printing macros
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after
hotplug
sched_ext: Skip ops.set_weight() for disabled tasks
sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs()
reset: spacemit: k3: fix USB2 ahb reset
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
wifi: cfg80211: reject empty PMSR peer lists
ASoC: amd: acp: Fix linker error with SDCA quirks
UBUNTU: [Config] Adjust config SND_SOC_ACPI_AMD_SDCA_QUIRKS
wifi: cfg80211: use wiphy work for socket owner autodisconnect
sched_ext: Enable tick for finite slices on nohz_full
bpf: Fix UAF in sock clone early bailouts
Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
Bluetooth: mgmt: Translate HCI reason in Device Disconnected event
riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE
spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled
drm/xe: Assign queue name in time for drm_sched_init
drm/xe/guc: Keep scheduler timeline name alive
drm/xe: add WQ_PERCPU to alloc_workqueue users
drm/xe/guc: Hold device ref until queue teardown completes
bnxt_en: Handle partially initialized auxiliary devices
selftests: netconsole: only restore MAC when it changed on resume
drm/amd/display: fix NULL ptr deref in ISM delayed work
drm/amd/display: Fix ISM teardown crash from NULL dc dereference
drm/amd/display: Fix ISM dc_lock deadlock during suspend
wifi: ath10k: fix skb leak on incomplete msdu during rx pop
wifi: ath12k: Fix low MLO RX throughput on WCN7850
iommu/amd: Fix IRQ unsafe locking in gdom allocation
iommu/amd: Fix nested domain leak
arm_mpam: Fix software reset values of MPAMCFG_PRI
arm_mpam: Fix MPAMCFG_MBW_PBM register setting
arm_mpam: guard MBWU state before adding it to garbage
hwmon: Drop unused i2c driver_data
hwmon: Use named initializers for arrays of i2c_device_data
hwmon: (pmbus/max34440): add support adpm12250
hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers
drm/i915/backlight: Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD
backlight
selftests/net: Fix tun IPv6 test addresses to avoid 6to4 range
bpf: Reject redirect helpers without a bpf_net_context
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
geneve: fix hint header definition wrt endianness
geneve: ensure the skb is writable before fixing its headers
tipc: serialize udp bearer replicast list updates
net: txgbe: fix heap overflow when reading module EEPROM
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
accel: ethosu: Fix element size accounting for cmd stream validation
accel: ethosu: Handle U85 internal chaining buffer
selftests: drv-net: convert so_txtime to drv-net
cifs: prevent readdir from changing file size due to stale directory metadata
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
wifi: mt76: fix airoha_npu dependency tracking
UBUNTU: [Config] Fix config dependencies for MT76_NPU
drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T
drm/vc4: hvs/v3d: Fix null dereference in unbind
iomap: fix incorrect did_zero setting in iomap_zero_iter()
mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().
LoongArch: BPF: Zero-extend signed ALU32 div/mod results
idpf: fix max_vport related crash on allocation error during init
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
bnge/bng_re: fix ring ID widths
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
drop_monitor: fix size calculations for 64-bit attributes
drop_monitor: perform u64_stats updates under IRQ-disabled section
pidfs: make pidfs_ino_lock static
LoongArch: BPF: Fix memory leak in bpf_jit_free()
tracing: Fix use-after-free freeing trigger private data
drm/exynos: fbdev: Remove offset into screen_buffer
drm/tegra: fbdev: Remove offset into framebuffer memory
drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable
drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15 APUs
bitmap: add test_zero_nbits()
drm/xe/guc: Fix buffer overflow in steered register list allocation
drm/xe: Add compact-PT and addr mask handling for page reclaim
drm/amd/display: Restore periodic detection for DCN35
drm/amdgpu: Fix context pstate override handling
drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
drm/amdkfd: Use exclusive bounds for SVM split alignment checks
drm/i915/mtl+: Enable PPS before PLL
drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG
drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
drm/xe/nvm: fix writable override for CRI
drm/amdgpu: Check for multiplication overflow in checkpoint stack size
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size
drm/amdkfd: free MQD managers on DQM init failures
drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x
drm/amd/display: use kvzalloc to allocate struct dc
drm/i915/vrr: require valid min/max vfreq for VRR
drm/amdgpu: add the doorbell index input for suspending userq
drm/i915/gt: Fix NULL deref on sched_engine alloc failure
drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset
drm/amdgpu/userq: fix indefinite fence wait during GPU reset
drm/amd: Create a device link between APU display and XHCI devices
drm/pagemap: Clear driver-provided PFNs from migration PFN array
mm: add gpu active/reclaim per-node stat counters (v2)
drm/ttm: use gpu mm stats to track gpu memory allocations. (v4)
drm/ttm: Fix GPU MM stats during pool shrinking
drm/ttm/pool: back up at native page order
drm/gpusvm: Zero HMM PFNs before scanning ranges
media: dw9719: Add back the I²C device id table
media: mali-c55: Add missing of_reserved_mem_device_release()
media: mali-c55: Disable pm_runtime on probe error
media: mali-c55: Fix possible ERR_PTR in enable_streams
media: mali-c55: Power-off the peripheral in remove()
media: qcom: camss: Fix RDI streaming for CSID 340
media: rzv2h-ivc: Wait for frame end in stop_streaming
media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete()
media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()
media: ti: vpe: Fix the error code of devm_request_irq()
media: uapi: rkisp: Correct name version enum
wifi: mt76: restrict NPU/PPE active checks to MMIO devices
wifi: brcmfmac: drain bus_reset work on device removal
wifi: ath12k: fix NULL pointer dereference in rhash table destroy
LoongArch: Fix build errors due to wrong instructions for 32BIT
LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT
firmware: stratix10-svc: fix teardown order in remove to prevent race
firmware: stratix10-svc: handle NO_RESPONSE in async poll
tracing: Delay module ref count for "enable_event" trigger
tracing: perf: Fix stale head for perf syscall tracing
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
mptcp: fix stale skb->sk reference on subflow close
selftests: mptcp: userspace_pm: fix undefined variable port
userfaultfd: prevent registration of special VMAs
m68k: avoid -Wunused-but-set-parameter in clear_user_page()
mm/memory-failure: trace: change memory_failure_event to ras subsystem
mm/page_vma_mapped: fix device-private PMD handling
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
libceph: fix two unsafe bare decodes in decode_lockers()
mm/slub: fix lost local objects when bulk remote free batch fills
mm/slab: fix a memory leak due to bootstrapping sheaves twice
net/sched: serialize qdisc_rtab_list against concurrent get/put
ksmbd: validate minimum PDU size for transform requests
drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
drm/amdgpu: rework userq fence driver alloc/destroy
drm/amdgpu: rework userq fence signal processing
drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq
drm/amdgpu/mes11: set doorbell offset for suspending userq
drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
drm/amdgpu: Fix kernel panic during driver load failure
selftests: drv-net: add missing kconfig for psp.py
mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths
mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
selftests: drv-net: cope with slow env in so_txtime.py test
selftests: drv-net: so_txtime: relax variance bounds
cifs: fix time_last_write stamp placement in setattr/truncate paths
cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
x86/bugs: Make Safe-RET robust against interrupt injection
UBUNTU: Upstream stable to v6.18.41, v6.18.42, v6.18.43, v7.1.6, v7.1.7
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Resolute)
Importance: Medium
Assignee: Alice C. Munduruca (cremfuelled)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Also affects: linux (Ubuntu Resolute)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Resolute)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Resolute)
Status: New => In Progress
** Changed in: linux (Ubuntu Resolute)
Assignee: (unassigned) => Alice C. Munduruca (cremfuelled)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2026-08-26
+
+ Ported from the following upstream stable releases:
+ v6.18.41, v6.18.42, v6.18.43, v7.1.6, v7.1.7
+
from git://git.kernel.org/
+
+ platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug
+ selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs
+ drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue
worker
+ seqlock: Allow UBSAN_ALIGNMENT to fail optimizing
+ KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
+ KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
+ KVM: nVMX: Hide shadow VMCS right after VMCLEAR
+ KVM: x86/mmu: Fix use-after-free on vendor module reload
+ gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
+ crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
+ xprtrdma: Clear receive-side ownership pointers on release
+ Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()
+ Input: ims-pcu - fix logic error in packet reset
+ fuse: fix writeback array overflow when max_pages is one
+ arm64: tegra: Remove fallback compatible for GPCDMA
+ arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
+ xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
+ xfrm: fix stale skb->prev after async crypto steals a GSO segment
+ firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
+ IB/mad: Drop unmatched RMPP responses before reassembly
+ mtd: mtdswap: remove debugfs stats file on teardown
+ mtd: nand: mtk-ecc: stop on ECC idle timeouts
+ btrfs: reject free space cache with more entries than pages
+ btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
+ btrfs: fallback to transaction csum tree on a commit root csum miss
+ firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
+ sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
+ xfrm: reject optional IPTFS templates in outbound policies
+ RDMA/cma: Fix hardware address comparison length in netevent callback
+ RDMA/irdma: Prevent rereg_mr for non-mem regions
+ RDMA/irdma: Remove redundant legacy_mode checks
+ RDMA/irdma: Prevent user-triggered null deref on QP create
+ RDMA/erdma: initialize ret for empty receive WR lists
+ RDMA/mana_ib: initialize err for empty send WR lists
+ RDMA/hns: Fix potential integer overflow in mhop hem cleanup
+ RDMA/siw: publish QP after initialization
+ mtd: fix double free and WARN_ON in add_mtd_device() error paths
+ selftests/alsa: Fix memory leak in find_controls error path
+ RDMA/irdma: Prevent overflows in memory contiguity checks
+ xfrm: clear mode callbacks after failed mode setup
+ xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
+ xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
+ xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
+ wifi: cfg80211: cancel sched scan results work on unregister
+ wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
+ wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
+ wifi: mac80211_hwsim: clamp virtio RX length before skb_put
+ wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
+ wifi: mac80211: fix fils_discovery double free on alloc failure
+ wifi: libertas: fix memory leak in helper_firmware_cb()
+ wifi: mac80211: defer link RX stats percpu free to RCU
+ wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
+ wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
+ wifi: nl80211: free RNR data on MBSSID mismatch
+ wifi: cfg80211: derive S1G beacon TSF from S1G fields
+ wifi: nl80211: validate nested MBSSID IE blobs
+ wifi: nl80211: constrain MBSSID TX link ID range
+ wifi: cfg80211: validate PMSR measurement type data
+ wifi: cfg80211: validate PMSR FTM preamble range
+ wifi: cfg80211: reject unsupported PMSR FTM location requests
+ wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
+ wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
+ wifi: brcmfmac: initialize SDIO data work before cleanup
+ wifi: cfg80211: bound element ID read when checking non-inheritance
+ firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
+ firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
+ ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop
+ ASoC: amd: ps: disable MSI on resume in ACP PCI driver
+ ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()
+ ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check
+ ASoC: cs42l43: Correct report for forced microphone jack
+ ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup
+ firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
+ cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq
+ ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
+ ipv4: fib: free fib_alias with kfree_rcu() on insert error path
+ net/iucv: take a reference on the socket found in afiucv_hs_rcv()
+ udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
+ scsi: core: wake eh reliably when using scsi_schedule_eh
+ ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is
registered
+ ata: sata_dwc_460ex: use platform_get_irq()
+ ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
+ ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
+ accel/ivpu: Fix wrong register read in LNL failure diagnostics
+ ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC
+ Bluetooth: qca: fix NVM tag length underflow in TLV parser
+ Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
+ Bluetooth: hci_sync: extend conn_hash lookup critical sections
+ Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
+ Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
+ Bluetooth: hci_qca: Clear memdump state on invalid dump size
+ smb/client: handle overlapping allocated ranges in fallocate
+ drm/i915/gt: use correct selftest config symbol
+ can: raw: add locking for raw flags bitfield
+ powerpc/85xx: Add fsl,ifc to common device ids
+ powerpc/time: Prepare to stop elapsing in dynticks-idle
+ powerpc/vtime: Initialize starttime at boot for native accounting
+ bpf, sockmap: Reject unhashed UDP sockets on sockmap update
+ drm/panthor: Check debugfs GEM lock initialization
+ s390/checksum: Fix csum_partial() without vector facility
+ riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
+ can: j1939: fix lockless local-destination check
+ drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves
+ drm/xe/wopcm: fix WOPCM size for LNL+
+ ksmbd: pin conn during async oplock break notification
+ ksmbd: validate compound request size before reading StructureSize2
+ drm/i915/wm: clear the plane ddb_y entries on plane disable
+ drm/i915/selftests: Fix GT PM sort comparators
+ accel/amdxdna: Fix use-after-free of mm_struct in job scheduler
+ tcp: fix TIME_WAIT socket reference leak on PSP policy failure
+ dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
+ net/sched: act_tunnel_key: Defer dst_release to RCU callback
+ sctp: fix auth_hmacs array size in struct sctp_cookie
+ mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
+ usb: core: sysfs: add lock to bos_descriptors_read()
+ wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()
+ usb: core: port: Deattach Type-C connector on component unbind
+ usb: musb: omap2430: Do not put borrowed of_node in probe
+ USB: storage: add NO_ATA_1X quirk for Longmai USB Key
+ usb: chipidea: fix usage_count leak when autosuspend_delay is negative
+ usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
+ usb: gadget: f_midi: cancel pending IN work before freeing the midi object
+ usb: gadget: printer: fix infinite loop in printer_read()
+ USB: gadget: snps-udc: fix device name leak on probe failure
+ USB: gadget: fsl-udc: fix device name leak on probe failure
+ USB: gadget: fsl-udc: fix dev_printk() device
+ usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
+ usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
+ usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer
+ USB: serial: ftdi_sio: add support for E+H FXA291
+ USB: serial: io_edgeport: cap received transmit credits
+ USB: serial: keyspan_pda: fix data loss on receive throttling
+ USB: serial: option: add TDTECH MT5710-CN
+ UBUNTU: SAUCE: Revert "usb: typec: ucsi: Detect and skip duplicate altmodes
from buggy firmware"
+ usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
+ wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware
+ RISC-V: KVM: Serialize virtual interrupt pending state updates
+ Revert "drm/amd/display: Add missing kdoc for ALLM parameters"
+ usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits
+ selftests/bpf: Adjust verifier_map_ptr for the map's excl field
+ selftests/bpf: Keep verifier_map_ptr exercising ops pointer access
+ wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware
request
+ wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
+ hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop
+ hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop
+ hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
+ hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop
+ hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop
+ watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
+ watchdog: airoha: Prevent division by zero when clock frequency is zero
+ wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()
+ wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
+ wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET
+ firewire: net: Fix fragmented datagram reassembly
+ wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
+ wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
+ wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
+ wifi: carl9170: fix OOB read from off-by-two in TX status handler
+ wifi: carl9170: fix buffer overflow in rx_stream failover path
+ btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
+ btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
+ btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
+ btrfs: free mapping node on duplicate reloc root insert
+ ASoC: tas2781: bound firmware description string parsing
+ ASoC: sun4i-codec: Set quirks.playback_only for H616 codec
+ ALSA: hda: cs35l41: validate and free ACPI mute object
+ ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
+ ASoC: cs35l56: Don't use devres to unregister component
+ ASoC: cs35l56: Fix potential probe() deadlock
+ ASoC: cs35l56: Use complete_all() to signal init_completion
+ wifi: iwlwifi: mvm: validate SAR GEO response payload size
+ wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list
+ wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn
+ wifi: iwlwifi: mvm: fix read in wake packet notification handler
+ usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
+ drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
+ hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
+ hwmon: (asus-ec-sensors) fix EC read intervals
+ hwmon: (asus-ec-sensors) add missed handle for ENOMEM
+ smb: client: validate DFS referral PathConsumed
+ ovpn: avoid putting unrelated P2P peer on socket release
+ selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()
+ ovpn: fix use after free in unlock_ovpn()
+ ovpn: use monotonic clock for peer keepalive timeouts
+ hwmon: occ: validate poll response sensor blocks
+ regulator: mt6358: use regmap helper to read fixed LDO calibration
+ Bluetooth: btusb: validate Realtek vendor event length
+ net: phy: marvell: fix return code
+ netlink: specs: rt-link: convert bridge port flag attributes to u8
+ net/packet: avoid fanout hook re-registration after unregister
+ bonding: fix devconf_all NULL dereference when IPv6 is disabled
+ rds: drop incoming messages that cross network namespace boundaries
+ gtp: parse extension headers before reading inner protocol
+ rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()
+ dpaa2-switch: put MAC endpoint device on disconnect
+ net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
+ dpaa2-eth: put MAC endpoint device on disconnect
+ net: airoha: Fix DMA direction for NPU mailbox buffer
+ iommu/amd: Wait for completion instead of returning early in
iommu_completion_wait()
+ wifi: mac80211: tear down new links on vif update error path
+ nfp: Check resource mutex allocation
+ wan: wanxl: Only reset hardware after BAR mapping
+ vhost-net: fix TX stall when vhost owns virtio-net header
+ wifi: mwifiex: bound uAP association event IEs to the event buffer
+ iommu/amd: Bound the early ACPI HID map
+ iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
+ wifi: mac80211: recalculate TIM when a station enters power save
+ pds_core: reject component parameter in legacy firmware update
+ arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()
+ amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
+ soreuseport: Clear sk_reuseport_cb before failure in sk_clone().
+ net: Call net_enable_timestamp() before failure in sk_clone().
+ net: txgbe: fix FDIR filter leak on remove
+ sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
+ pds_core: fix deadlock between reset thread and remove
+ pds_core: fix use-after-free on workqueue during remove
+ pds_core: yield the CPU while waiting for the adminq to drain
+ pds_core: order completion reads after the ownership check
+ pds_core: fix auxiliary device add/del races
+ pds_core: check for workqueue allocation failure
+ sctp: validate stream count in sctp_process_strreset_inreq()
+ net: mctp i3c: clean up notifier and buses if driver register fails
+ tls: device: push pending open record on splice EOF
+ selftests: af_unix: add USER_NS config
+ selftests: openvswitch: add config file
+ selftests: ovpn: add IPV6 and VETH configs
+ selftests: ovpn: increase timeout
+ selftests: drv-net: increase timeout
+ gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
+ nexthop: initialize extack in nh_res_bucket_migrate()
+ tipc: fix infinite loop in __tipc_nl_compat_dumpit
+ ppp: don't store tx skb in the fastpath
+ ppp: annotate concurrent dev->stats accesses
+ wifi: mt76: mt7925: guard link STA in decap offload
+ wifi: mt76: mt7915: guard HE capability lookups
+ wifi: mt76: connac: fix possible NULL-pointer deref in
mt76_connac_mcu_uni_bss_he_tlv()
+ wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
+ wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
+ wifi: mt76: mt7925: fix crash in reset link replay
+ wifi: mt76: mt7996: fix possible NULL-pointer deref in
mt7996_mcu_sta_bfer_eht()
+ wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
+ ovl: fix trusted xattr escape prefix matching
+ drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
+ ovl: check access to copy_file_range source with src mounter creds
+ amt: re-read skb header pointers after every pull
+ amt: make the head writable before rewriting the L2 header
+ net: bridge: vlan: fix vlan range dumps starting with pvid
+ net: hsr: fix memory leak on slave unregistration by removing synced VLANs
+ net: dpaa: fix mode setting
+ sctp: auth: verify auth requirement when auth_chunk is NULL
+ vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
+ drm/xe/i2c: Allow per domain unique id
+ drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
+ iomap: correct the range of a partial dirty clear
+ tipc: fix u16 MTU truncation in media and bearer MTU validation
+ drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem
+ bpf: tcp: fix double sock release on batch realloc
+ net: stmmac: xgmac: fix l4 filter port overwrite on register update
+ net: stmmac: fix l3l4 filter rejecting unsupported offload requests
+ net: stmmac: reset residual action in L3L4 filters on delete
+ net: stmmac: enable the MAC on link up for all supported speeds
+ net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM
+ octeontx2-vf: set TC flower flag on MCAM entry allocation
+ ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup
+ ppp: annotate data races in ppp_generic
+ hinic: remove unused ethtool RSS user configuration buffers
+ net: qrtr: restrict socket creation to the initial network namespace
+ raw: annotate lockless match fields in raw_v4_match()
+ net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
+ net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule
+ net/mlx5e: Report zero bandwidth for non-ETS traffic classes
+ net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation
+ octeontx2-pf: tc: fix egress ratelimiting
+ net: ipv6: fix dif and sdif mismatch in raw6_icmp_error
+ ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV
+ ice: fix LAG recipe to profile association
+ ice: prevent tstamp ring allocation for non-PF VSI types
+ ipv6: Change allocation flags to match rcu_read_lock section requirements
+ rds: tcp: unregister sysctl before tearing down listen socket
+ ptp: netc: explicitly clear TMR_OFF during initialization
+ mctp: check register_netdevice_notifier() error in mctp_device_init()
+ net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
+ bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
+ drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay
+ drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()
+ drm/tidss: Fix missing drm_bridge_add() call
+ drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
+ drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()
+ drm/imagination: Count paired job fence as dependency in prepare_job()
+ drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()
+ drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
+ drm/dp/mst: fix buffer overflows in sideband chunk accumulation
+ drm/imagination: Fit paired fragment job in the correct CCCB
+ drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
+ drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
+ drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0
(v2)
+ drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
+ drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
+ drm/sysfb: Do not page-align visible size of the framebuffer
+ drm/sysfb: Avoid truncating maximum stride
+ drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2
+ drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
+ drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
+ drm/nouveau: fix reversed error cleanup order in ucopy functions
+ drm/sysfb: Avoid possible truncation with calculating visible size
+ drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
+ drm/displayid: fix Tiled Display Topology ID size
+ drm/i915/gem: Add missing nospec on parallel submit slot
+ drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
+ drm/radeon: fix r100_copy_blit for large BOs
+ drm/xe: Return error on non-migratable faults requiring devmem
+ drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
+ drm/xe: Hold a dma-buf reference for imported BOs
+ drm/imagination: Fix double call to drm_sched_entity_fini()
+ drm/imagination: Fix user array stride in pvr_set_uobj_array()
+ drm/imagination: fix error checking of pvr_vm_context_lookup()
+ drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM
+ drm/amdkfd: Use kvcalloc to allocate arrays
+ drm/amdkfd: Check bounds in allocate_event_notification_slot
+ drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
+ drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
+ drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips
+ drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks
prev_sink reference
+ drm/virtio: bound EDID block reads to the response buffer
+ drm/i915/hdcp: require monotonically increasing seq_num_v
+ drm/i915/hdcp: check streams[] bounds before overflow
+ drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
+ drm/i915: Return NULL on error in active_instance
+ drm/i915/bios: range check LFP Data Block panel_type2
+ drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
+ drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
+ drm/i915/gem: Do not leak siblings[] on proto context error
+ drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
+ drm/i915/mst: limit DP MST ESI service loop
+ drm/amd/pm: fix smu14 power limit range calculation
+ drm/gfx10: Program DB_RING_CONTROL
+ drm/virtio: Don't detach GEM from a non-created context
+ drm/ttm: Account for NULL and handle pages in ttm_pool_backup
+ drm/panthor: return error on truncated firmware
+ drm/amdgpu: Release VFCT ACPI table reference
+ drm/amdgpu: Fix VFCT bus number matching with soft filter
+ drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
+ drm/amd/display: set new_stream to NULL after release
+ drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
+ drm/amd/display: dce100: skip non-DP stream encoders for DP MST
+ drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
+ drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
+ drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
+ drm/amd/display: Fix flip-done timeouts on mode1 reset
+ drm/vc4: Shut down BO cache timer before teardown
+ drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
+ drm/vmwgfx: Validate vmw_surface_metadata::array_size
+ drm/vc4: Prevent shader BO mappings from becoming writable
+ drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict
+ drm/v3d: Reach the GMP through the hub registers on V3D 7.x
+ media: airspy: Return queued buffers on start_streaming() failure
+ media: amlogic-c3: Add validations for ae and awb config
+ media: aspeed: fix missing of_reserved_mem_device_release() on probe failure
+ media: cec: seco: unregister adapter on IR probe failure
+ media: cedrus: clean up media device on probe failure
+ media: cedrus: Fix missing cleanup in error path
+ media: cedrus: skip invalid H.264 reference list entries
+ media: chips-media: wave5: Move src_buf Removal to finish_encode
+ media: cx231xx: fix devres lifetime
+ media: cx23885: add ioremap return check and cleanup
+ media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
+ media: imx219: Fix maximum frame length in lines
+ media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping
ranges
+ media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ
+ media: marvell-cam: fix missing pci_disable_device() on remove
+ media: meson: vdec: Fix memory leak in error path of vdec_open
+ media: msi2500: Return queued buffers on start_streaming() failure
+ media: nuvoton: npcm-video: fix error handling in npcm_video_init()
+ media: nuvoton: npcm-video: fix memory leaks in probe and remove
+ media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe
+ media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure
+ media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error
path
+ media: nxp: imx8-isi: Fix potential out-of-bounds issues
+ media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding
+ media: pci: dm1105: Free allocated workqueue
+ media: pwc: Drain fill_buf on start_streaming() failure
+ media: pwc: Return queued buffers on start_streaming() failure
+ media: qcom: camss: Fix RDI streaming for CSID 680
+ media: qcom: camss: Fix RDI streaming for CSID GEN2
+ media: qcom: camss: Fix RDI streaming for CSID GEN3
+ media: radio-si476x: Unregister v4l2_device on probe failure
+ media: rtl2832: fix use-after-free in rtl2832_remove()
+ media: rtl2832_sdr: Return queued buffers on start_streaming() failure
+ media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used
+ media: saa7134: Fix a possible memory leak in saa7134_video_init1
+ media: stm32-dcmipp: Return queued buffers on start_streaming() failure
+ media: stm32: dcmi: unregister notifier on probe failure
+ media: sun4i-csi: Return queued buffers on start_streaming() failure
+ media: synopsys: hdmirx: Fix HPD lane hold time
+ media: tegra-video: vi: fix invalid u32 return value in format lookup
+ media: ti: vpe: unwind v4l2 device registration on probe error
+ media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
+ media: v4l2-ctrls: validate HEVC active reference counts
+ media: v4l2-fwnode: Fix subdev owner overwritten in
v4l2_async_register_subdev_sensor()
+ media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely
+ media: vb2: use ssize_t for vb2_read/vb2_write
+ media: verisilicon: Export only needed pixels formats
+ media: vidtv: fix reference leak on failed device registration
+ media: vimc: fix reference leak on failed device registration
+ media: vivid: add vivid_update_reduced_fps()
+ media: vivid: check for vb2_is_busy() when toggling caps
+ media: vivid: fix cleanup bugs in vivid_init()
+ media: vpif_capture: fix OF node reference imbalance
+ ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
+ ALSA: seq: close a re-opened queue timer in the destructor
+ ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
+ ALSA: timer: drain a slave's callback before its master detaches it
+ ALSA: timer: don't re-enter an instance callback that is still running
+ wifi: ath6kl: fix OOB access from firmware ADDBA window size
+ wifi: ath6kl: fix use-after-free in aggr_reset_state()
+ wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
+ wifi: wilc1000: validate assoc response length before subtracting header
+ wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
+ wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
+ wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
+ wifi: brcmfmac: make release_scratchbuffers idempotent
+ wifi: brcmfmac: set F2 blocksize to 256 for BCM43752
+ wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()
+ staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
+ staging: rtl8723bs: fix inverted HT40 secondary channel offset
+ Bluetooth: hci_sync: Protect UUID list traversal
+ Bluetooth: RFCOMM: Fix session UAF in set_termios
+ exec: fix unsigned loop counter wrap in transfer_args_to_stack()
+ binfmt_misc: set have_execfd only once the interpreter is opened
+ platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
+ rust_binder: only print failure if error has source
+ rust: time: fix as_micros_ceil() to round correctly for negative Delta
+ rust: allow `clippy::unwrap_or_default` globally
+ objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
+ LoongArch: Fix address space mismatch in kexec command line lookup
+ LoongArch: Fix oops during single-step debugging
+ LoongArch: Move jump_label_init() before parse_early_param()
+ LoongArch: Retrieve CPU package ID from PPTT when available
+ cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
+ rhashtable: clear stale iter->p on table restart
+ firmware: stratix10-svc: fix memory leaks and list corruption bugs
+ x86/boot/compressed: Disable jump tables
+ comedi: comedi_parport: deal with premature interrupt
+ uio_hv_generic: Bind to FCopy device by default
+ serial: sc16is7xx: implement gpio get_direction() callback
+ serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR
platforms
+ selftests: ntsync: correct CONFIG_NTSYNC name
+ mei: bus: access mei_device under device_lock on cleanup
+ intel_th: fix MSC output device reference leak
+ misc: nsm: only unlock nsm_dev on post-lock error paths
+ misc: nsm: pin the module while the device is open
+ tracing: Fix context switch counter truncation
+ tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
+ tracing: Fix resource leak on mmiotrace trace_pipe close
+ tracing: Fix union collision of module and refcnt for dynamic events
+ tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
+ tracing/probes: Avoid temporary buffer truncation in
trace_probe_match_command_args()
+ tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
+ tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
+ arm64: make huge_ptep_get handled unaligned addresses
+ mptcp: decrement subflows counter on failed passive join
+ mptcp: only set DATA_FIN when a mapping is present
+ mptcp: pm: userspace: fix use-after-free in get_local_id
+ afs: Fix afs_edit_dir_remove() to get, not find, block 0
+ mm/kmemleak: fix checksum computation for per-cpu objects
+ mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
+ sctp: don't free the ASCONF's own transport in DEL-IP processing
+ sctp: avoid auth_enable sysctl UAF during netns teardown
+ sctp: close UDP tunnel sockets during netns teardown
+ ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
+ ceph: fix refcount leak in ceph_readdir()
+ ceph: fix writeback_count leak in write_folio_nounlock()
+ libceph: bound get_version reply decode to front len
+ libceph: Fix multiplication overflow in decode_new_up_state_weight()
+ libceph: guard missing CRUSH type name lookup
+ libceph: refresh auth->authorizer_buf{,_len} after authorizer update
+ libceph: Reject monmaps advertising zero monitors
+ libceph: reject zero bucket types in crush_decode
+ libceph: remove debugfs files before client teardown
+ amt: fix use-after-free in AMT delayed works
+ ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
+ ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
+ binfmt_elf_fdpic: only honour the first PT_INTERP
+ fs/super: fix emergency thaw double-unlock of s_umount
+ fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
+ fscrypt: Add missing superblock check in find_or_insert_direct_key()
+ ftrace: Add global mutex to serialize trace_parser access
+ io_uring/rw: fix missing ERESTARTSYS conversion in read paths
+ iomap: fix out-of-bounds bitmap_set() with zero-length range
+ iommu/vt-d: Disallow SVA if page walk is not coherent
+ net: stmmac: intel: skip SerDes reconfig when rate is unchanged
+ phonet: pep: fix use-after-free in pep_get_sb()
+ vxlan: require CAP_NET_ADMIN in the device netns for changelink
+ net: slip: serialize receive against buffer reallocation
+ geneve: require CAP_NET_ADMIN in the device netns for changelink
+ net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
+ net/iucv: fix use-after-free of a severed iucv_path
+ net/mlx5e: Use sender devcom for MPV master-up
+ net/x25: fix use-after-free in x25_kill_by_neigh()
+ net: gro: fix double aggregation of flush-marked skbs
+ net: hip04: fix RX buffer leak on build_skb failure
+ net: pcs: xpcs: fix SGMII state reading
+ proc: Fix broken error paths for namespace links
+ s390/ptff: Export ptff_function_mask[]
+ ptp: ptp_s390: Add missing facility check
+ ice: fix PTP Call Trace during PTP release
+ super: fix emergency thaw deadlock on frozen block devices
+ rbd: Reset positive result codes to zero in object map update path
+ smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink
target
+ ksmbd: defer destroy_previous_session() until after NTLM authentication
+ gve: fix Rx queue stall on alloc failure
+ ice: reject out-of-range ptype in ice_parser_profile_init
+ ice: use READ_ONCE() to access cached PHC time
+ ila: reload IPv6 header after pskb_may_pull in checksum adjust
+ mac802154: hold an interface reference across the scan worker
+ mac802154: llsec: reject frames shorter than the authentication tag
+ mctp: serial: handle zero-length frames to prevent rx buffer overflow
+ openvswitch: fix GSO userspace truncation underflow
+ ovpn: fix peer refcount leak in TCP error paths
+ ovpn: hold peer before scheduling keepalive work
+ pppoe: reload header pointer after dev_hard_header()
+ rtase: Workaround for TX hang caused by hardware packet parsing
+ tcp: initialize standalone TCP-AO response padding
+ tcp: challenge ACK for non-exact RST in SYN-RECEIVED
+ tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
+ vsock/virtio: collapse receive queue under memory pressure
+ vxlan: mdb: Fix source list corruption on a failed replace
+ watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
+ drm/amd/pm: fix amdgpu_pm_info power display units
+ drm/amd/pm: make pp_features read-only when scpm is enabled
+ drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/gfx8: drop unecessary BUG_ON()
+ drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
+ drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
+ drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
+ drm/amdgpu/soc24: reset dGPU if suspend got aborted
+ drm/amdgpu/vce: fix integer overflow in image size
+ drm/amdgpu/vcn4: avoid rereading IB param length
+ drm/dp_mst: Handle torn-down topology gracefully in
drm_dp_mst_topology_queue_probe()
+ drm/amdgpu: fix division by zero with invalid uvd dimensions
+ drm/amdgpu: fix resource leak on ACP reset timeout
+ drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
+ drm/amd/pm: fix smu13 power limit range calculation
+ drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
+ drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
+ ublk: wait on ublk_dev_ready() instead of ub->completion
+ net: qrtr: ns: Raise node count limit to 512
+ ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
+ ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
+ ksmbd: bound DACL dedup walk to copied ACEs
+ ksmbd: validate ACE size against SID sub-authorities
+ fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
+ drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
+ audit: widen ino fields to u64
+ audit: use 'unsigned int' instead of 'unsigned'
+ audit: fix recursive locking deadlock in audit_dupe_exe()
+ fuse-uring: fix race between registration and connection abortion
+ xfs: don't replace the wrong part of the cow fork
+ netfilter: nf_tables: remove register tracking infrastructure
+ drm: drop lib from header search path.
+ SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
+ SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
+ UBUNTU: SAUCE: Revert "mm/sparse-vmemmap: fix vmemmap accounting underflow"
+ mm/sparse-vmemmap: fix vmemmap accounting underflow
+ mmc: vub300: rename probe error labels
+ net: mana: Optimize irq affinity for low vcpu configs
+ bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
+ bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
+ pmdomain: imx93-blk-ctrl: convert to devm_* only
+ mm/damon/core: validate ranges in damon_set_regions()
+ mm/damon/core: disallow overlapping input ranges for damon_set_regions()
+ rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
+ rust: device: avoid trailing ; in printing macros
+ usb: gadget: f_tcm: synchronize delayed set_alt with teardown
+ KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after
hotplug
+ sched_ext: Skip ops.set_weight() for disabled tasks
+ sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs()
+ reset: spacemit: k3: fix USB2 ahb reset
+ xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
+ wifi: cfg80211: reject empty PMSR peer lists
+ ASoC: amd: acp: Fix linker error with SDCA quirks
+ UBUNTU: [Config] Adjust config SND_SOC_ACPI_AMD_SDCA_QUIRKS
+ wifi: cfg80211: use wiphy work for socket owner autodisconnect
+ sched_ext: Enable tick for finite slices on nohz_full
+ bpf: Fix UAF in sock clone early bailouts
+ Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
+ Bluetooth: mgmt: Translate HCI reason in Device Disconnected event
+ riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE
+ spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled
+ drm/xe: Assign queue name in time for drm_sched_init
+ drm/xe/guc: Keep scheduler timeline name alive
+ drm/xe: add WQ_PERCPU to alloc_workqueue users
+ drm/xe/guc: Hold device ref until queue teardown completes
+ bnxt_en: Handle partially initialized auxiliary devices
+ selftests: netconsole: only restore MAC when it changed on resume
+ drm/amd/display: fix NULL ptr deref in ISM delayed work
+ drm/amd/display: Fix ISM teardown crash from NULL dc dereference
+ drm/amd/display: Fix ISM dc_lock deadlock during suspend
+ wifi: ath10k: fix skb leak on incomplete msdu during rx pop
+ wifi: ath12k: Fix low MLO RX throughput on WCN7850
+ iommu/amd: Fix IRQ unsafe locking in gdom allocation
+ iommu/amd: Fix nested domain leak
+ arm_mpam: Fix software reset values of MPAMCFG_PRI
+ arm_mpam: Fix MPAMCFG_MBW_PBM register setting
+ arm_mpam: guard MBWU state before adding it to garbage
+ hwmon: Drop unused i2c driver_data
+ hwmon: Use named initializers for arrays of i2c_device_data
+ hwmon: (pmbus/max34440): add support adpm12250
+ hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers
+ drm/i915/backlight: Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD
backlight
+ selftests/net: Fix tun IPv6 test addresses to avoid 6to4 range
+ bpf: Reject redirect helpers without a bpf_net_context
+ net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
+ geneve: fix hint header definition wrt endianness
+ geneve: ensure the skb is writable before fixing its headers
+ tipc: serialize udp bearer replicast list updates
+ net: txgbe: fix heap overflow when reading module EEPROM
+ rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
+ accel: ethosu: Fix element size accounting for cmd stream validation
+ accel: ethosu: Handle U85 internal chaining buffer
+ selftests: drv-net: convert so_txtime to drv-net
+ cifs: prevent readdir from changing file size due to stale directory metadata
+ cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
+ wifi: mt76: fix airoha_npu dependency tracking
+ UBUNTU: [Config] Fix config dependencies for MT76_NPU
+ drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T
+ drm/vc4: hvs/v3d: Fix null dereference in unbind
+ iomap: fix incorrect did_zero setting in iomap_zero_iter()
+ mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().
+ LoongArch: BPF: Zero-extend signed ALU32 div/mod results
+ idpf: fix max_vport related crash on allocation error during init
+ tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
+ bnge/bng_re: fix ring ID widths
+ net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
+ drop_monitor: fix size calculations for 64-bit attributes
+ drop_monitor: perform u64_stats updates under IRQ-disabled section
+ pidfs: make pidfs_ino_lock static
+ LoongArch: BPF: Fix memory leak in bpf_jit_free()
+ tracing: Fix use-after-free freeing trigger private data
+ drm/exynos: fbdev: Remove offset into screen_buffer
+ drm/tegra: fbdev: Remove offset into framebuffer memory
+ drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable
+ drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15 APUs
+ bitmap: add test_zero_nbits()
+ drm/xe/guc: Fix buffer overflow in steered register list allocation
+ drm/xe: Add compact-PT and addr mask handling for page reclaim
+ drm/amd/display: Restore periodic detection for DCN35
+ drm/amdgpu: Fix context pstate override handling
+ drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
+ drm/amdkfd: Use exclusive bounds for SVM split alignment checks
+ drm/i915/mtl+: Enable PPS before PLL
+ drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
+ drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG
+ drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
+ drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
+ drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
+ drm/xe/nvm: fix writable override for CRI
+ drm/amdgpu: Check for multiplication overflow in checkpoint stack size
+ drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
+ drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size
+ drm/amdkfd: free MQD managers on DQM init failures
+ drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x
+ drm/amd/display: use kvzalloc to allocate struct dc
+ drm/i915/vrr: require valid min/max vfreq for VRR
+ drm/amdgpu: add the doorbell index input for suspending userq
+ drm/i915/gt: Fix NULL deref on sched_engine alloc failure
+ drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
+ drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset
+ drm/amdgpu/userq: fix indefinite fence wait during GPU reset
+ drm/amd: Create a device link between APU display and XHCI devices
+ drm/pagemap: Clear driver-provided PFNs from migration PFN array
+ mm: add gpu active/reclaim per-node stat counters (v2)
+ drm/ttm: use gpu mm stats to track gpu memory allocations. (v4)
+ drm/ttm: Fix GPU MM stats during pool shrinking
+ drm/ttm/pool: back up at native page order
+ drm/gpusvm: Zero HMM PFNs before scanning ranges
+ media: dw9719: Add back the I²C device id table
+ media: mali-c55: Add missing of_reserved_mem_device_release()
+ media: mali-c55: Disable pm_runtime on probe error
+ media: mali-c55: Fix possible ERR_PTR in enable_streams
+ media: mali-c55: Power-off the peripheral in remove()
+ media: qcom: camss: Fix RDI streaming for CSID 340
+ media: rzv2h-ivc: Wait for frame end in stop_streaming
+ media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete()
+ media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()
+ media: ti: vpe: Fix the error code of devm_request_irq()
+ media: uapi: rkisp: Correct name version enum
+ wifi: mt76: restrict NPU/PPE active checks to MMIO devices
+ wifi: brcmfmac: drain bus_reset work on device removal
+ wifi: ath12k: fix NULL pointer dereference in rhash table destroy
+ LoongArch: Fix build errors due to wrong instructions for 32BIT
+ LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT
+ firmware: stratix10-svc: fix teardown order in remove to prevent race
+ firmware: stratix10-svc: handle NO_RESPONSE in async poll
+ tracing: Delay module ref count for "enable_event" trigger
+ tracing: perf: Fix stale head for perf syscall tracing
+ arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
+ Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"
+ mptcp: fix stale skb->sk reference on subflow close
+ selftests: mptcp: userspace_pm: fix undefined variable port
+ userfaultfd: prevent registration of special VMAs
+ m68k: avoid -Wunused-but-set-parameter in clear_user_page()
+ mm/memory-failure: trace: change memory_failure_event to ras subsystem
+ mm/page_vma_mapped: fix device-private PMD handling
+ libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
+ libceph: fix two unsafe bare decodes in decode_lockers()
+ mm/slub: fix lost local objects when bulk remote free batch fills
+ mm/slab: fix a memory leak due to bootstrapping sheaves twice
+ net/sched: serialize qdisc_rtab_list against concurrent get/put
+ ksmbd: validate minimum PDU size for transform requests
+ drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()
+ drm/amdgpu: rework userq fence driver alloc/destroy
+ drm/amdgpu: rework userq fence signal processing
+ drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
+ drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq
+ drm/amdgpu/mes11: set doorbell offset for suspending userq
+ drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
+ drm/amdgpu: Fix kernel panic during driver load failure
+ selftests: drv-net: add missing kconfig for psp.py
+ mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths
+ mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization
+ selftests: drv-net: cope with slow env in so_txtime.py test
+ selftests: drv-net: so_txtime: relax variance bounds
+ cifs: fix time_last_write stamp placement in setattr/truncate paths
+ cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
+ x86/bugs: Make Safe-RET robust against interrupt injection
+ UBUNTU: Upstream stable to v6.18.41, v6.18.42, v6.18.43, v7.1.6, v7.1.7
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165189
Title:
Resolute update: upstream stable patchset 2026-08-26
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165189/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
