[ubuntu/jammy-security] linux-nvidia-tegra 5.15.0-1049.49 (Accepted)
Andy Whitcroft
apw at canonical.com
Wed Dec 3 09:45:36 UTC 2025
linux-nvidia-tegra (5.15.0-1049.49) jammy; urgency=medium
* jammy/linux-nvidia-tegra: 5.15.0-1049.49 -proposed tracker (LP: #2127542)
[ Ubuntu-realtime: 5.15.0-1096.105 ]
* jammy/linux-realtime: 5.15.0-1096.105 -proposed tracker (LP: #2127546)
* Jammy real-time patch set update: v5.15.193-rt89 (LP: #2130278)
- rcu/tree: Protect rcu_rdp_is_offloaded() invocations on RT
- sched: Introduce migratable()
- arm64: mm: Make arch_faults_on_old_pte() check for migratability
- printk: rename printk cpulock API and always disable interrupts
- console: add write_atomic interface
- kdb: only use atomic consoles for output mirroring
- serial: 8250: implement write_atomic
- printk: relocate printk_delay()
- printk: call boot_delay_msec() in printk_delay()
- printk: use seqcount_latch for console_seq
- printk: introduce kernel sync mode
- printk: move console printing to kthreads
- printk: add console handover
- printk: add pr_flush()
- printk: Enhance the condition check of msleep in pr_flush()
- sched: Switch wait_task_inactive to HRTIMER_MODE_REL_HARD
- kthread: Move prio/affinite change into the newly created thread
- genirq: Move prio assignment into the newly created thread
- genirq: Disable irqfixup/poll on PREEMPT_RT.
- efi: Allow efi=runtime
- mm: Disable zsmalloc on PREEMPT_RT
- net/core: disable NET_RX_BUSY_POLL on PREEMPT_RT
- samples/kfifo: Rename read_lock/write_lock
- crypto: testmgr - Only disable migration in
crypto_disable_simd_for_test()
- mm: Allow only SLUB on PREEMPT_RT
- mm: page_alloc: Use migrate_disable() in drain_local_pages_wq()
- mm/scatterlist: Replace the !preemptible warning in sg_miter_stop()
- mm: Disable NUMA_BALANCING_DEFAULT_ENABLED and TRANSPARENT_HUGEPAGE on
PREEMPT_RT
- x86/softirq: Disable softirq stacks on PREEMPT_RT
- Documentation/kcov: Include types.h in the example.
- Documentation/kcov: Define `ip' in the example.
- kcov: Allocate per-CPU memory on the relevant node.
- kcov: Avoid enable+disable interrupts if !in_task().
- kcov: Replace local_irq_save() with a local_lock_t.
- gen_stats: Add instead Set the value in __gnet_stats_copy_basic().
- gen_stats: Add gnet_stats_add_queue().
- mq, mqprio: Use gnet_stats_add_queue().
- gen_stats: Move remaining users to gnet_stats_add_queue().
- u64_stats: Introduce u64_stats_set()
- net: sched: Protect Qdisc::bstats with u64_stats
- net: sched: Use _bstats_update/set() instead of raw writes
- net: sched: Merge Qdisc::bstats and Qdisc::cpu_bstats data types
- net: sched: Remove Qdisc::running sequence counter
- net: sched: Allow statistics reads from softirq.
- net: sched: fix logic error in qdisc_run_begin()
- net: sched: remove one pair of atomic operations
- net: stats: Read the statistics in ___gnet_stats_copy_basic() instead of
adding.
- net: sched: gred: dynamically allocate tc_gred_qopt_offload
- sched/rt: Annotate the RT balancing logic irqwork as IRQ_WORK_HARD_IRQ
- irq_work: Allow irq_work_sync() to sleep if irq_work() no IRQ support.
- irq_work: Handle some irq_work in a per-CPU thread on PREEMPT_RT
- irq_work: Also rcuwait for !IRQ_WORK_HARD_IRQ on PREEMPT_RT
- irq_poll: Use raise_softirq_irqoff() in cpu_dead notifier
- smp: Wake ksoftirqd on PREEMPT_RT instead do_softirq().
- fs/namespace: Boost the mount_lock.lock owner instead of spinning on
PREEMPT_RT.
- fscache: Use only one fscache_object_cong_wait.
- sched: Clean up the might_sleep() underscore zoo
- sched: Make cond_resched_*lock() variants consistent vs. might_sleep()
- sched: Remove preempt_offset argument from __might_sleep()
- sched: Cleanup might_sleep() printks
- sched: Make might_sleep() output less confusing
- sched: Make RCU nest depth distinct in __might_resched()
- sched: Make cond_resched_lock() variants RT aware
- locking/rt: Take RCU nesting into account for __might_resched()
- sched: Limit the number of task migrations per batch on RT
- sched: Disable TTWU_QUEUE on RT
- sched: Move kprobes cleanup out of finish_task_switch()
- sched: Delay task stack freeing on RT
- sched: Move mmdrop to RCU on RT
- cgroup: use irqsave in cgroup_rstat_flush_locked()
- mm: workingset: replace IRQ-off check with a lockdep assert.
- jump-label: disable if stop_machine() is used
- locking: Remove rt_rwlock_is_contended()
- lockdep/selftests: Avoid using local_lock_{acquire|release}().
- sched: Trigger warning if ->migration_disabled counter underflows.
- rtmutex: Add a special case for ww-mutex handling.
- rtmutex: Add rt_mutex_lock_nest_lock() and rt_mutex_lock_killable().
- lockdep: Make it RT aware
- lockdep/selftests: Add rtmutex to the last column
- lockdep/selftests: Unbalanced migrate_disable() & rcu_read_lock()
- lockdep/selftests: Skip the softirq related tests on PREEMPT_RT
- lockdep/selftests: Adapt ww-tests for PREEMPT_RT
- locking: Allow to include asm/spinlock_types.h from
linux/spinlock_types_raw.h
- sched: Make preempt_enable_no_resched() behave like preempt_enable() on
PREEMPT_RT
- kernel/sched: add {put|get}_cpu_light()
- block/mq: do not invoke preempt_disable()
- md: raid5: Make raid5_percpu handling RT aware
- scsi/fcoe: Make RT aware.
- mm/vmalloc: Another preempt disable region which sucks
- net: Remove preemption disabling in netif_rx()
- sunrpc: Make svc_xprt_do_enqueue() use get_cpu_light()
- softirq: Check preemption after reenabling interrupts
- mm/memcontrol: Disable on PREEMPT_RT
- signal: Revert ptrace preempt magic
- ptrace: fix ptrace vs tasklist_lock race
- fs/dcache: use swait_queue instead of waitqueue
- fs/dcache: disable preemption on i_dir_seq's write side
- rcu: Delay RCU-selftests
- net/core: use local_bh_disable() in netif_rx_ni()
- net: Use skbufhead with raw lock
- net: Dequeue in dev_cpu_dead() without the lock
- net: dev: always take qdisc's busylock in __dev_xmit_skb()
- panic: skip get_random_bytes for RT_FULL in init_oops_id
- x86: stackprotector: Avoid random pool on rt
- drm/i915: Don't disable interrupts and pretend a lock as been acquired
in __timeline_mark_lock().
- drm/i915: Use preempt_disable/enable_rt() where recommended
- drm/i915: Don't disable interrupts on PREEMPT_RT during atomic updates
- drm/i915: Don't check for atomic context on PREEMPT_RT
- drm/i915: Disable tracing points on PREEMPT_RT
- drm/i915: skip DRM_I915_LOW_LEVEL_TRACEPOINTS with NOTRACE
- drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +
spin_lock()
- drm/i915: Drop the irqs_disabled() check
- signal/x86: Delay calling signals in atomic
- x86: kvm Require const tsc for RT
- x86: Allow to enable RT
- x86: Enable RT also on 32bit
- genirq: update irq_set_irqchip_state documentation
- ASoC: mediatek: mt8195: Remove unsued irqs_lock.
- smack: Guard smack_ipv6_lock definition within a
SMACK_IPV6_PORT_LABELING block
- virt: acrn: Remove unsued acrn_irqfds_mutex.
- tpm_tis: fix stall after iowrite*()s
- mm/zsmalloc: Replace bit spinlock and get_cpu_var() usage.
- drivers/block/zram: Replace bit spinlocks with rtmutex for -rt
- leds: trigger: Disable CPU trigger on PREEMPT_RT
- generic/softirq: Disable softirq stacks on PREEMPT_RT
- */softirq: Disable softirq stacks on PREEMPT_RT
- sched: Add support for lazy preemption
- x86/entry: Use should_resched() in idtentry_exit_cond_resched()
- x86: Support for lazy preemption
- entry: Fix the preempt lazy fallout
- arm: Add support for lazy preemption
- powerpc: Add support for lazy preemption
- arch/arm64: Add lazy preempt support
- ARM: enable irq in translation/section permission fault handlers
- KVM: arm/arm64: downgrade preempt_disable()d region to migrate_disable()
- arm64/sve: Delay freeing memory in fpsimd_flush_thread()
- arm64/sve: Make kernel FPU protection RT friendly
- arm64: signal: Use ARCH_RT_DELAYS_SIGNAL_SEND.
- tty/serial/omap: Make the locking RT aware
- tty/serial/pl011: Make the locking work on RT
- ARM: Allow to enable RT
- ARM64: Allow to enable RT
- powerpc: traps: Use PREEMPT_RT
- powerpc/pseries/iommu: Use a locallock instead local_irq_save()
- powerpc/kvm: Disable in-kernel MPIC emulation for PREEMPT_RT
- powerpc/stackprotector: work around stack-guard init from atomic
- POWERPC: Allow to enable RT
- sysfs: Add /sys/kernel/realtime entry
- genirq: Provide generic_handle_irq_safe().
- i2c: core: Use generic_handle_irq_safe() in
i2c_handle_smbus_host_notify().
- i2c: cht-wc: Use generic_handle_irq_safe().
- misc: hi6421-spmi-pmic: Use generic_handle_irq_safe().
- mfd: ezx-pcap: Use generic_handle_irq_safe().
- net: usb: lan78xx: Use generic_handle_irq_safe().
- staging: greybus: gpio: Use generic_handle_irq_safe().
- mm/memcg: Revert ("mm/memcg: optimize user context object stock access")
- mm/memcg: Disable threshold event handlers on PREEMPT_RT
- mm/memcg: Protect per-CPU counter by disabling preemption on PREEMPT_RT
where needed.
- mm/memcg: Opencode the inner part of obj_cgroup_uncharge_pages() in
drain_obj_stock()
- mm/memcg: Protect memcg_stock with a local_lock_t
- mm/memcg: Disable migration instead of preemption in drain_all_stock().
- mm/memcg: Add missing counter index which are not update in interrupt.
- mm/memcg: Add a comment regarding the release `obj'.
- mm/memcg: Only perform the debug checks on !PREEMPT_RT
- io-mapping: don't disable preempt on RT in io_mapping_map_atomic_wc().
- locking/rwbase: Mitigate indefinite writer starvation
- Revert "softirq: Let ksoftirqd do its job"
- debugobject: Ensure pool refill (again)
- debugobjects,locking: Annotate debug_object_fill_pool() wait type
violation
- sched: avoid false lockdep splat in put_task_struct()
- mm/page_alloc: Use write_seqlock_irqsave() instead write_seqlock() +
local_irq_save().
- bpf: Remove in_atomic() from bpf_link_put().
- drm/i915: Do not disable preemption for resets
- netfilter: nft_counter: Use u64_stats_t for statistic.
- printk: ignore consoles without write() callback
* Miscellaneous upstream changes
- Realtime patchset v5.15-rt89
[ Ubuntu: 5.15.0-163.173 ]
* jammy/linux: 5.15.0-163.173 -proposed tracker (LP: #2127867)
* Add pvpanic kernel modules to linux-modules (LP: #2126659)
- [Packaging] Add pvpanic kernel modules to linux-modules
* Ubuntu 24.04.2: error in audit_log_object_context keep printing in the
kernel and console (LP: #2123815)
- SAUCE: fix: apparmor4.0.0 [26/90]: LSM stacking v39: Audit: Add record
for multiple object contexts
* Hung task when heavily accessing kernfs files (LP: #2125142)
- kernfs: switch global kernfs_rwsem lock to per-fs lock
- kernfs: dont take i_lock on inode attr read
- kernfs: move struct kernfs_root out of the public view.
- kernfs: Introduce separate rwsem to protect inode attributes.
- kernfs: Use a per-fs rwsem to protect per-fs list of kernfs_super_info.
- kernfs: change kernfs_rename_lock into a read-write lock.
- kernfs: prevent early freeing of root node
- kernfs: remove redundant kernfs_rwsem declaration.
- kernfs: fix NULL dereferencing in kernfs_remove
- kernfs: fix potential NULL dereference in __kernfs_remove
- kernfs: fix missing kernfs_iattr_rwsem locking
* ensure mptcp keepalives are honored when set (LP: #2125444)
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
* UBUNTU: fan: fail to check kmalloc() return could cause a NULL pointer
dereference (LP: #2125053)
- SAUCE: fan: vxlan: check memory allocation for map
* Jammy update: v5.15.193 upstream stable release (LP: #2127112)
- [Config] enable CONFIG_MITIGATION_VMSCAPE
- Linux 5.15.193
* Jammy update: v5.15.192 upstream stable release (LP: #2126782)
- bpf: Add cookie object to bpf maps
- bpf: Move cgroup iterator helpers to bpf.h
- bpf: Move bpf map owner out of common struct
- bpf: Fix oob access in cgroup local storage
- drm/amd/display: Don't warn when missing DCE encoder caps
- fs: writeback: fix use-after-free in __mark_inode_dirty()
- tee: fix NULL pointer dereference in tee_shm_put
- arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
- wifi: cfg80211: fix use-after-free in cmp_bss()
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
after confirm
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
- xirc2ps_cs: fix register access when enabling FullDuplex
- mISDN: Fix memory leak in dsp_hwec_enable()
- icmp: fix icmp_ndo_send address translation for reply direction
- i40e: Fix potential invalid access when MAC list is empty
- net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
- wifi: cw1200: cap SSID length in cw1200_do_join()
- wifi: libertas: cap SSID len in lbs_associate()
- net: thunder_bgx: add a missing of_node_put
- net: thunder_bgx: decrement cleanup index before use
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
- ax25: properly unshare skbs in ax25_kiss_rcv()
- net: atm: fix memory leak in atm_register_sysfs when device_register
fail
- ppp: fix memory leak in pad_compress_skb
- ptp: Add generic PTP is_sync() function
- net: phy: mscc: Fix memory leak when using one step timestamping
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
arch_sync_kernel_mappings()
- mm: move page table sync declarations to linux/pgtable.h
- wifi: mwifiex: Initialize the chan_stats array to zero
- drm/amdgpu: drop hw access in non-DC audio fini
- scsi: lpfc: Fix buffer free/clear order in deferred receive path
- batman-adv: fix OOB read/write in network-coding decode
- e1000e: fix heap overflow in e1000_set_eeprom
- mm/khugepaged: fix ->anon_vma race
- cpufreq/sched: Explicitly synchronize limits_changed flag handling
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
- spi: tegra114: Remove unnecessary NULL-pointer checks
- spi: tegra114: Don't fail set_cs_timing when delays are zero
- iio: chemical: pms7003: use aligned_s64 for timestamp
- iio: light: opt3001: fix deadlock due to concurrent flag access
- gpio: pca953x: fix IRQ storm on system wake up
- dma-buf: insert memory barrier before updating num_fences
- dmaengine: mediatek: Fix a possible deadlock error in
mtk_cqdma_tx_status()
- net: dsa: microchip: update tag_ksz masks for KSZ9477 family
- net: dsa: microchip: linearize skb for tail-tagging switches
- vmxnet3: update MTU after device quiesce
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
- randstruct: gcc-plugin: Remove bogus void member
- randstruct: gcc-plugin: Fix attribute addition
- mm/slub: avoid accessing metadata when pointer is invalid in
object_err()
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
- pcmcia: Add error handling for add_interval() in do_validate_mem()
- spi: spi-fsl-lpspi: Fix transmissions when using CONT
- spi: spi-fsl-lpspi: Set correct chip-select polarity bit
- spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
- drm/bridge: ti-sn65dsi86: fix REFCLK setting
- perf bpf-event: Fix use-after-free in synthesis
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
- spi: tegra114: Use value to check for invalid delays
- dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
- Linux 5.15.192
* Jammy update: v5.15.191 upstream stable release (LP: #2125626)
- pinctrl: STMFX: add missing HAS_IOMEM dependency
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
- scsi: core: sysfs: Correct sysfs attributes access rights
- ASoC: codecs: tx-macro: correct tx_macro_component_drv name
- nfs: fold nfs_page_group_lock_subrequests into
nfs_lock_and_join_requests
- NFS: Fix a race when updating an existing write
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
- net: ipv4: fix regression in local-broadcast routes
- powerpc/kvm: Fix ifdef to remove build warning
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
- net: dlink: fix multicast stats being counted incorrectly
- phy: mscc: Fix when PTP clock is register and unregister
- net/mlx5e: Update and set Xon/Xoff upon MTU set
- net/mlx5e: Update and set Xon/Xoff upon port speed set
- net/mlx5e: Set local Xoff after FW update
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
- sctp: initialize more fields in sctp_v6_from_sk()
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
- KVM: x86: use array_index_nospec with indices that come from guest
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
- HID: wacom: Add a new Art Pen 2
- HID: hid-ntrig: fix unable to handle page fault in
ntrig_report_version()
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
- drm/nouveau/disp: Always accept linear modifier
- HID: mcp2221: Don't set bus speed on every transfer
- HID: mcp2221: Handle reads greater than 60 bytes
- xfs: do not propagate ENODATA disk errors into xattr code
- Linux 5.15.191
* Jammy update: v5.15.190 upstream stable release (LP: #2122364)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
- USB: serial: option: add Foxconn T99W640
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
- usb: gadget: configfs: Fix OOB read on empty string write
- i2c: stm32: fix the device used for the DMA map
- thunderbolt: Fix bit masking in tb_dp_port_set_hops()
- Input: xpad - set correct controller type for Acer NGR200
- pch_uart: Fix dma_sync_sg_for_device() nents value
- HID: core: ensure the allocated report buffer can contain the reserved
report ID
- HID: core: ensure __hid_request reserves the report ID as the first byte
- HID: core: do not bypass hid_hw_raw_request
- tracing: Add down_write(trace_event_sem) when adding trace event
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
pep_sock_accept()
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
- af_packet: fix soft lockup issue caused by tpacket_snd()
- dmaengine: nbpfaxi: Fix memory corruption in probe()
- isofs: Verify inode mode when loading from disk
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
- mmc: bcm2835: Fix dma_unmap_sg() nents value
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
Positivo models
- mmc: sdhci_am654: Workaround for Errata i2312
- pmdomain: governor: Consider CPU latency tolerance from
pm_domain_cpu_gov
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
- iio: adc: max1363: Reorder mode_list[] entries
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler
- comedi: pcl812: Fix bit shift out of bounds
- comedi: aio_iiro_16: Fix bit shift out of bounds
- comedi: das16m1: Fix bit shift out of bounds
- comedi: das6402: Fix bit shift out of bounds
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
- comedi: Fix some signed shift left operations
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
- comedi: Fix initialization of data for instructions that write to
subdevice
- bpf: Reject %p% format string in bprintf-like helpers
- net: emaclite: Fix missing pointer increment in aligned_read()
- rpl: Fix use-after-free in rpl_do_srh_inline().
- pinctrl: mediatek: moore: check if pin_desc is valid before use
- smb: client: fix use-after-free in cifs_oplock_break
- nvme: fix misaccounting of nvme-mpath inflight I/O
- selftests: udpgro: report error when receive failed
- selftests: net: increase inter-packet timeout in udpgro.sh
- hwmon: (corsair-cpro) Validate the size of the received input buffer
- usb: net: sierra: check for no status endpoint
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
- Bluetooth: SMP: If an unallowed command is received consider it a
failure
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
- lib: bitmap: Introduce node-aware alloc API
- net/mlx5e: Add support to klm_umr_wqe
- net/mlx5: Correctly set gso_size when LRO is used
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
runtime
- net: bridge: Do not offload IGMP/MLD messages
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
- sched: Change nr_uninterruptible type to unsigned long
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the
right userns
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
pm
- usb: hub: Fix flushing of delayed work used for post resume purposes
- usb: musb: Add and use inline functions musb_{get,set}_state
- usb: musb: fix gadget state on disconnect
- usb: dwc3: qcom: Don't leave BCR asserted
- ASoC: fsl_sai: Force a software reset when starting in consumer mode
- mm/vmalloc: leave lazy MMU mode on PTE mapping error
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be
changed
- platform/x86: think-lmi: Fix kobject cleanup
- bpf, sockmap: Fix panic when calling skb_linearize
- x86: Fix get_wchan() to support the ORC unwinder
- sched: Add wrapper for get_wchan() to keep task blocked
- x86: Fix __get_wchan() for !STACKTRACE
- x86: Pin task-stack in __get_wchan()
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
- regulator: core: fix NULL dereference on unbind due to stale coupling
data
- RDMA/core: Rate limit GID cache warning messages
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
- regmap: fix potential memory leak of regmap_bus
- i40e: Add rx_missed_errors for buffer exhaustion
- i40e: report VF tx_dropped with tx_errors instead of tx_discards
- net: appletalk: Fix use-after-free in AARP proxy probe
- net: hns3: fix concurrent setting vlan filter issue
- net: hns3: disable interrupt when ptp init failed
- net: hns3: fixed vf get max channels bug
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among
boots
- i2c: qup: jump out of the loop in case of timeout
- i2c: virtio: Avoid hang by using interruptible completion wait
- bus: fsl-mc: Fix potential double device reference in
fsl_mc_get_endpoint()
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
- e1000e: ignore uninitialized checksum word on tgp
- gve: Fix stuck TX queue for DQ queue format
- nilfs2: reject invalid file types when reading inodes
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
- usb: typec: tcpm: allow to use sink in accessory mode
- usb: typec: tcpm: allow switching to mode accessory to mux properly
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode()
- jfs: reject on-disk inodes of an unsupported type
- comedi: comedi_test: Fix possible deletion of uninitialized timers
- ALSA: hda: Add missing NVIDIA HDA codec IDs
- usb: chipidea: add USB PHY event
- usb: phy: mxs: disconnect line when USB charger is attached
- ethernet: intel: fix building with large NR_CPUS
- ASoC: Intel: fix SND_SOC_SOF dependencies
- fs_context: fix parameter name in infofc() macro
- hfsplus: remove mutex_lock check in hfsplus_free_extents
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value
- selftests: Fix errno checking in syscall_user_dispatch test
- ARM: dts: vfxxx: Correctly use two tuples for timer address
- usb: misc: apple-mfi-fastcharge: Make power supply names unique
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
- vmci: Prevent the dispatching of uninitialized payloads
- pps: fix poll support
- Revert "vmci: Prevent the dispatching of uninitialized payloads"
- usb: early: xhci-dbc: Fix early_ioremap leak
- arm: dts: ti: omap: Fixup pinheader typo
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
- PM / devfreq: Check governor before using governor->name
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
- cpufreq: Initialize cpufreq-based frequency-invariance later
- cpufreq: Init policy->rwsem before it may be possibly used
- samples: mei: Fix building on musl libc
- staging: nvec: Fix incorrect null termination of battery manufacturer
- selftests/tracing: Fix false failure of subsystem event test
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
- bpf, sockmap: Fix psock incorrectly pointing to sk
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
- caif: reduce stack size, again
- wifi: rtl818x: Kill URBs before clearing tx status queue
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
- iwlwifi: Add missing check for alloc_ordered_workqueue
- wifi: ath11k: clear initialized flag for deinit-ed srng lists
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
- net/mlx5: Check device memory pointer before usage
- m68k: Don't unregister boot console needlessly
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
- netfilter: nf_tables: adjust lockdep assertions handling
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
- um: rtc: Avoid shadowing err in uml_rtc_start()
- net/sched: Restrict conditions for adding duplicating netems to qdisc
tree
- net_sched: act_ctinfo: use atomic64_t for three counters
- xen/gntdev: remove struct gntdev_copy_batch from stack
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
- mwl8k: Add missing check after DMA map
- wifi: mac80211: Don't call fq_flow_idx() for management frames
- wifi: mac80211: Check 802.11 encaps offloading in
ieee80211_tx_h_select_key()
- Reapply "wifi: mac80211: Update skb's control block key in
ieee80211_tx_dequeue()"
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P
IE
- can: kvaser_pciefd: Store device channel index
- can: kvaser_usb: Assign netdev.dev_port based on device channel index
- netfilter: xt_nfacct: don't assume acct name is null-terminated
- selftests: rtnetlink.sh: remove esp4_offload after test
- vrf: Drop existing dst reference in vrf_ip6_input_dst
- PCI: rockchip-host: Fix "Unexpected Completion" log message
- crypto: marvell/cesa - Fix engine load inaccuracy
- mtd: fix possible integer overflow in erase_xfer()
- clk: davinci: Add NULL check in davinci_lpsc_clk_register()
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
- clk: xilinx: vcu: unregister pll_post only if registered correctly
- power: supply: cpcap-charger: Fix null check for
power_supply_get_by_name
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if
pci_epc_get_next_free_bar() fails
- pinctrl: sunxi: Fix memory leak on krealloc failure
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
- perf sched: Fix memory leaks for evsel->priv in timehist
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko
- RDMA/hns: Fix -Wframe-larger-than issue
- kernel: trace: preemptirq_delay_test: use offstack cpu mask
- perf tests bp_account: Fix leaked file descriptor
- clk: sunxi-ng: v3s: Fix de clock definition
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
- scsi: mvsas: Fix dma_unmap_sg() nents value
- scsi: isci: Fix dma_unmap_sg() nents value
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
- hwrng: mtk - handle devm_pm_runtime_enable errors
- crypto: keembay - Fix dma_unmap_sg() nents value
- crypto: img-hash - Fix dma_unmap_sg() nents value
- soundwire: stream: restore params when prepare ports fail
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem
attribute
- fs/orangefs: Allow 2 more characters in do_c_string()
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
- dmaengine: nbpfaxi: Add missing check after DMA map
- sh: Do not use hyphen in exported variable name
- crypto: qat - fix seq_file position update in adf_ring_next()
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
- jfs: fix metapage reference count leak in dbAllocCtl
- mtd: rawnand: atmel: Fix dma_mapping_error() address
- mtd: rawnand: rockchip: Add missing check after DMA map
- mtd: rawnand: atmel: set pmecc data setup time
- vhost-scsi: Fix log flooding with target does not exist errors
- bpf: Check flow_dissector ctx accesses are aligned
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2
- module: Restore the moduleparam prefix length check
- ucount: fix atomic_long_inc_below() argument type
- rtc: ds1307: fix incorrect maximum clock rate handling
- rtc: hym8563: fix incorrect maximum clock rate handling
- rtc: pcf85063: fix incorrect maximum clock rate handling
- rtc: pcf8563: fix incorrect maximum clock rate handling
- rtc: rv3028: fix incorrect maximum clock rate handling
- f2fs: fix KMSAN uninit-value in extent_info usage
- f2fs: doc: fix wrong quota mount option description
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
- f2fs: fix to avoid panic in f2fs_evict_inode
- f2fs: fix to avoid out-of-boundary access in devs.path
- scsi: mpt3sas: Fix a fw_event memory leak
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime
resume
- kconfig: qconf: fix ConfigList::updateListAllforAll()
- PCI: pnv_php: Clean up allocated IRQs on unplug
- PCI: pnv_php: Work around switches with broken presence detection
- powerpc/eeh: Export eeh_unfreeze_pe()
- powerpc/eeh: Rely on dev->link_active_reporting
- powerpc/eeh: Make EEH driver device hotplug safe
- PCI: pnv_php: Fix surprise plug detection and recovery
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
- NFSv4.2: another fix for listxattr
- XArray: Add calls to might_alloc()
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
- netpoll: prevent hanging NAPI when netcons gets enabled
- phy: mscc: Fix parsing of unicast frames
- pptp: ensure minimal skb length in pptp_xmit()
- net/mlx5: Correctly set gso_segs when LRO is used
- ipv6: reject malicious packets in ipv6_gso_segment()
- net: drop UFO packets in udp_rcv_segment()
- benet: fix BUG when creating VFs
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
- smb: server: remove separate empty_recvmsg_queue
- smb: server: make sure we call ib_dma_unmap_single() only if we called
ib_dma_map_single already
- smb: server: let recv_done() consistently call
put_recvmsg/smb_direct_disconnect_rdma_connection
- smb: server: let recv_done() avoid touching data_transfer after
cleanup/move
- smb: client: let recv_done() cleanup before notifying the callers.
- pptp: fix pptp_xmit() error path
- perf/core: Don't leak AUX buffer refcount on allocation failure
- perf/core: Exit early on perf_mmap() fail
- perf/core: Prevent VMA split of buffer mappings
- selftests/perf_events: Add a mmap() correctness test
- USB: serial: option: add Foxconn T99W709
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
- net: usbnet: Fix the wrong netif_carrier_on() call
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
- usb: gadget : fix use-after-free in composite_dev_cleanup()
- io_uring: don't use int for ABI
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors
- gpio: virtio: Fix config space reading.
- net: gianfar: fix device leak when querying time stamp info
- net: dpaa: fix device leak when querying time stamp info
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op
- sunvdc: Balance device refcount in vdc_port_mpgroup_check
- fs: Prevent file descriptor table allocations exceeding INT_MAX
- eventpoll: Fix semi-unbounded recursion
- Documentation: ACPI: Fix parent device references
- ACPI: processor: perflib: Fix initial _PPC limit application
- ACPI: processor: perflib: Move problematic pr->performance check
- udp: also consider secpath when evaluating ipsec use for checksumming
- netfilter: ctnetlink: fix refcount leak on table dump
- sctp: linearize cloned gso packets in sctp_rcv
- intel_idle: Allow loading ACPI tables for any family
- cpuidle: governors: menu: Avoid using invalid recent intervals data
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
- hfs: fix slab-out-of-bounds in hfs_bnode_read()
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
- arm64: Handle KCOV __init vs inline mismatches
- smb/server: avoid deadlock when linking with ReplaceIfExists
- udf: Verify partition map count
- drbd: add missing kref_get in handle_write_conflicts
- hfs: fix not erasing deleted b-tree node issue
- better lockdep annotations for simple_recursive_removal()
- ata: libata-sata: Disallow changing LPM state if not supported
- fs/ntfs3: Add sanity check for file name
- fs/ntfs3: correctly create symlink for relative path
- ext2: Handle fiemap on empty files to prevent EINVAL
- securityfs: don't pin dentries twice, once is enough...
- usb: xhci: print xhci->xhc_state when queue_command failed
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit
time_t
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
- usb: xhci: Avoid showing warnings for dying controller
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
- usb: xhci: Avoid showing errors during surprise removal
- gpio: wcd934x: check the return value of regmap_update_bits()
- cpufreq: Exit governor when failed to start old governor
- ARM: rockchip: fix kernel hang during smp initialization
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in
set_freq_store()
- EDAC/synopsys: Clear the ECC counters on init
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
successed
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when
required
- tools/nolibc: define time_t in terms of __kernel_old_time_t
- gpio: tps65912: check the return value of regmap_update_bits()
- ARM: tegra: Use I/O memcpy to write to IRAM
- selftests: tracing: Use mutex_unlock for testing glob filter
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads
- PM: sleep: console: Fix the black screen issue
- ACPI: processor: fix acpi_object initialization
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
- pps: clients: gpio: fix interrupt handling order in remove path
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
- x86/bugs: Avoid warning when overriding return thunk
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
- usb: core: usb_submit_urb: downgrade type check
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
- ASoC: codecs: rt5640: Retry DEVICE_ID verification
- xen/netfront: Fix TX response spurious interrupts
- ktest.pl: Prevent recursion of default variable options
- wifi: cfg80211: reject HTC bit for management frames
- s390/time: Use monotonic clock in get_cycles()
- be2net: Use correct byte order and format string for TCP seq and ack_seq
- et131x: Add missing check after DMA map
- net: ag71xx: Add missing check after DMA map
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable
- arm64: Mark kernel as tainted on SAE and SError panic
- rcu: Protect ->defer_qs_iw_pending from data race
- net: mctp: Prevent duplicate binds
- wifi: cfg80211: Fix interface type validation
- net: ipv4: fix incorrect MTU in broadcast routes
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
- sched/deadline: Fix accounting after global limits change
- wifi: iwlwifi: mvm: fix scan request validation
- s390/stp: Remove udelay from stp_sync_clock()
- wifi: mac80211: don't complete management TX on SAE commit
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
- ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in
__ipv6_dev_mc_inc().
- drm/msm: use trylock for debugfs
- net: thunderbolt: Fix the parameter passing of
tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
- net: atlantic: add set_power to fw_ops for atl2 to fix wol
- net: fec: allow disable coalescing
- drm/amd/display: Separate set_gsl from set_gsl_source_select
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
- drm/amd/display: Fix 'failed to blank crtc!'
- wifi: rtlwifi: fix possible skb memory leak in
`_rtl_pci_rx_interrupt()`.
- netmem: fix skb_frag_address_safe with unreadable skbs
- wifi: iwlegacy: Check rate_idx range after addition
- dpaa_eth: don't use fixed_phy_change_carrier
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to
manual
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
- gve: Return error for unknown admin queue command
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
- wifi: rtlwifi: fix possible skb memory leak in
_rtl_pci_init_one_rxdesc()
- net: ncsi: Fix buffer overflow in fetching version id
- drm/ttm: Should to return the evict error
- uapi: in6: restore visibility of most IPv6 socket options
- drm/ttm: Respect the shrinker core free target
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
- vhost: fail early when __vhost_add_used() fails
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race
condition
- cifs: Fix calling CIFSFindFirst() for root path without msearch
- crypto: hisilicon/hpre - fix dma unmap sequence
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
- scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is
allocated
- fs/orangefs: use snprintf() instead of sprintf()
- watchdog: dw_wdt: Fix default timeout
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
- watchdog: iTCO_wdt: Report error if timeout configuration fails
- scsi: bfa: Double-free fix
- jfs: truncate good inode pages when hard link is 0
- jfs: Regular file corruption check
- jfs: upper bound check of tree index in dbAllocAG
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ
control
- leds: leds-lp50xx: Handle reg to get correct multi_index
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
- RDMA/core: reduce stack using in nldev_stat_get_doit()
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport
structure
- scsi: mpt3sas: Correctly handle ATA device errors
- pinctrl: stm32: Manage irq affinity settings
- media: tc358743: Check I2C succeeded during probe
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
- media: tc358743: Increase FIFO trigger level to 374
- media: usb: hdpvr: disable zero-length read messages
- media: dvb-frontends: dib7090p: fix null-ptr-deref in
dib7090p_rw_on_apb()
- media: dvb-frontends: w7090p: fix null-ptr-deref in
w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
- media: uvcvideo: Fix bandwidth issue for Alcor camera
- crypto: octeontx2 - add timeout for load_fvc completion poll
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized
use
- i3c: add missing include to internal header
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
- i3c: don't fail if GETHDRCAP is unsupported
- dm-mpath: don't print the "loaded" message if registering fails
- i2c: Force DLL0945 touchpad i2c freq to 100khz
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
- kconfig: nconf: Ensure null termination where strncpy is used
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
- scsi: target: core: Generate correct identifiers for PR OUT transport
IDs
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
- kconfig: gconf: fix potential memory leak in renderer_edited()
- kconfig: lxdialog: fix 'space' to (de)select options
- ipmi: Fix strcpy source and destination the same
- net: phy: smsc: add proper reset flags for LAN8710A
- block: avoid possible overflow for chunk_sectors check in
blk_stack_limits()
- pNFS: Fix stripe mapping in block/scsi layout
- pNFS: Fix disk addr range check in block/scsi layout
- pNFS: Handle RPC size limit for layoutcommits
- pNFS: Fix uninited ptr deref in block/scsi layout
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
- scsi: lpfc: Remove redundant assignment to avoid memory leak
- ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe()
- ASoC: soc-dai.h: merge DAI call back functions into ops
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits
- ext4: fix largest free orders lists corruption on mb_optimize_scan
switch
- usb: core: config: Prevent OOB read in SS endpoint companion parsing
- misc: rtsx: usb: Ensure mmc child device is active when card is present
- comedi: fix race between polling and detaching
- thunderbolt: Fix copy+paste error in match_service_id()
- cdc-acm: fix race between initial clearing halt and open
- btrfs: fix log tree replay failure due to file with 0 links and extents
- btrfs: do not allow relocation of partially dropped subvolumes
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
- parisc: Makefile: fix a typo in palo.conf
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
- media: uvcvideo: Do not mark valid metadata as invalid
- HID: magicmouse: avoid setting up battery timer when not needed
- serial: 8250: fix panic due to PSLVERR
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
- m68k: Fix lost column on framebuffer debug console
- usb: atm: cxacru: Merge cxacru_upload_firmware() into
cxacru_heavy_init()
- usb: gadget: udc: renesas_usb3: fix device leak at unbind
- usb: dwc3: meson-g12a: fix device leaks at unbind
- bus: mhi: host: Fix endianness of BHI vector table
- vt: keyboard: Don't process Unicode characters in K_OFF mode
- vt: defkeymap: Map keycodes above 127 to K_HOLE
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
- Revert "vgacon: Add check for vc_origin address range in
vgacon_scroll()"
- ext4: check fast symlink for ea_inode correctly
- ext4: fix fsmap end of range reporting with bigalloc
- ext4: fix reserved gdt blocks handling in fsmap
- ext4: don't try to clear the orphan_present feature block device is r/o
- ext4: use kmalloc_array() for array space allocation
- ext4: fix hole length calculation overflow in non-extent inodes
- scsi: mpi3mr: Fix race between config read submit and interrupt
completion
- ata: libata-scsi: Fix ata_to_sense_error() status handling
- zynq_fpga: use sgtable-based scatterlist wrappers
- wifi: brcmsmac: Remove const from tbl_ptr parameter in
wlc_lcnphy_common_read_table()
- wifi: ath11k: fix source ring-buffer corruption
- pwm: imx-tpm: Reset counter if CMOD is 0
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
- mtd: rawnand: fsmc: Add missing check after DMA map
- PCI: endpoint: Fix configfs group list head handling
- PCI: endpoint: Fix configfs group removal on driver teardown
- jbd2: prevent softlockup in jbd2_log_do_checkpoint()
- soc/tegra: pmc: Ensure power-domains are in a known state
- media: gspca: Add bounds checking to firmware parser
- media: hi556: correct the test pattern configuration
- media: imx: fix a potential memory leak in
imx_media_csc_scaler_device_init()
- media: v4l2-ctrls: Don't reset handler's error in
v4l2_ctrl_handler_free()
- media: usbtv: Lock resolution while streaming
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
- media: ov2659: Fix memory leaks in ov2659_probe()
- media: venus: Add a check for packet size after reading from shared
memory
- media: venus: hfi: explicitly release IRQ during teardown
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240
- drm/amd: Restore cached power limit during resume
- drm/amd/display: Don't overwrite dce60_clk_mgr
- net, hsr: reject HSR frame if skb can't hold tag
- ipv6: sr: Fix MAC comparison to be constant-time
- mptcp: drop skb if MPTCP skb extension allocation fails
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
- mm: drop the assumption that VM_SHARED always implies writable
- mm: update memfd seal write check to include F_SEAL_WRITE
- mm: reinstate ability to map write-sealed memfd mappings read-only
- selftests/memfd: add test for mapping write-sealed memfd read-only
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
- drm/sched: Remove optimization that causes hang when killing dependent
jobs
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
- f2fs: fix to do sanity check on ino and xnid
- iio: hid-sensor-prox: Restore lost scale assignments
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation
- x86/mce/amd: Add default names for MCA banks and blocks
- usb: hub: avoid warm port reset during USB3 disconnect
- usb: hub: Don't try to recover devices lost during warm reset.
- x86/fpu: Delay instruction pointer fixup until after warning
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
- smb: server: Fix extension string in ksmbd_extract_shortname()
- hv_netvsc: Fix panic during namespace deletion with VF
- usb: typec: fusb302: cache PD RX state
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
- block: Make REQ_OP_ZONE_FINISH a write operation
- net: enetc: fix device and OF node leak at probe
- NFS: Create an nfs4_server_set_init_caps() function
- NFS: Fix the setting of capabilities when automounting a new filesystem
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
- usb: musb: omap2430: Convert to platform remove callback returning void
- usb: musb: omap2430: fix device leak at unbind
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
- bus: mhi: host: Detect events pointing to unexpected TREs
- usb: dwc3: imx8mp: fix device leak at unbind
- platform/chrome: cros_ec: Make cros_ec_unregister() return void
- platform/chrome: cros_ec: Use per-device lockdep key
- platform/chrome: cros_ec: remove unneeded label and if-condition
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
- net/sched: sch_ets: properly init all active DRR list handles
- net_sched: sch_ets: implement lockless ets_dump()
- net/sched: ets: use old 'nbands' while purging unused classes
- KVM: VMX: Flush shadow VMCS on emergency reboot
- btrfs: populate otime when logging an inode item
- sch_htb: make htb_deactivate() idempotent
- ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
- kbuild: userprogs: use correct linker when mixing clang and GNU ld
- selftests: mptcp: make sendfile selftest work
- selftests: mptcp: connect: also cover alt modes
- selftests: mptcp: connect: also cover checksum
- selftests: mptcp: add missing join check
- mptcp: fix error mibs accounting
- mptcp: introduce MAPPING_BAD_CSUM
- selftests: mptcp: Initialize variables to quiet gcc 12 warnings
- mptcp: drop unused sk in mptcp_push_release
- mptcp: do not queue data on closed subflows
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like
host controllers
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels
- KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix
- memstick: Fix deadlock by moving removing flag earlier
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for
consistency
- squashfs: fix memory leak in squashfs_fill_super
- mm/debug_vm_pgtable: clear page table entries at destroy_args()
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and
EliteBook 830 G6
- drm/amd/display: Avoid a NULL pointer dereference
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
- drm/amd/display: Find first CRTC and its line time in
dce110_fill_display_configs
- drm/amd/display: Fill display clock and vblank time in
dce110_fill_display_configs
- fs/buffer: fix use-after-free when call bh_read() helper
- use uniform permission checks for all mount propagation changes
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
- ftrace: Also allocate and copy hash for reading of filter files
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
- iio: proximity: isl29501: fix buffered read on big-endian systems
- most: core: Drop device reference after usage in get_channel()
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash
Drive
- comedi: Make insn_rw_emulate_bits() do insn->n samples
- comedi: pcl726: Prevent invalid irq number
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and
do_insnlist_ioctl()
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
test
- usb: renesas-xhci: Fix External ROM access timeouts
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
- usb: storage: realtek_cr: Use correct byte order for bcs->Residue
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts
- drm/amd/display: Don't overclock DCE 6 by 15%
- mptcp: disable add_addr retransmission when timeout is 0
- f2fs: fix to avoid out-of-boundary access in dnode page
- media: camss: Convert to platform remove callback returning void
- media: qcom: camss: cleanup media device allocated resource on error
path
- media: venus: Add support for SSR trigger using fault injection
- media: venus: protect against spurious interrupts during probe
- locking/barriers, kcsan: Support generic instrumentation
- asm-generic: Add memory barrier dma_mb()
- wifi: ath11k: fix dest ring-buffer corruption when ring is full
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header
- iio: adc: ad_sigma_delta: change to buffer predisable
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
- pwm: mediatek: Implement .apply() callback
- pwm: mediatek: Handle hardware enable and clock enable separately
- pwm: mediatek: Fix duty and period setting
- selftests: mptcp: pm: check flush doesn't reset limits
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again
- usb: xhci: Fix slot_id resource race conflict
- iio: imu: inv_icm42600: change invalid data error to -EBUSY
- tracing: Remove unneeded goto out logic
- tracing: Limit access to parser->buffer when trace_get_user failed
- iio: light: as73211: Ensure buffer holes are zeroed
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
- mm/page_alloc: detect allocation forbidden by cpuset and bail out early
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on
cpusets_insane_config_key
- RDMA/bnxt_re: Fix to initialize the PBL array
- net: bridge: fix soft lockup in br_multicast_query_expired()
- scsi: qla4xxx: Prevent a potential error pointer dereference
- iommu/amd: Avoid stack buffer overflow from kernel cmdline
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug
- ALSA: usb-audio: Fix size validation in convert_chmap_v3()
- drm/amd/display: Add null pointer check in
mod_hdcp_hdcp1_create_session()
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
- ppp: fix race conditions in ppp_fill_forward_path
- net: phy: Use netif_rx().
- phy: mscc: Fix timestamping for vsc8584
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
- igc: fix disabling L1.2 PCI-E link substate on I226 on init
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in
htb_activate
- bonding: update LACP activity flag after setting lacp_active
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs
- s390/hypfs: Enable limited access during lockdown
- netfilter: nf_reject: don't leak dst refcount for loopback packets
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters
- alloc_fdtable(): change calling conventions.
- Linux 5.15.190
* UBUNTU: SAUCE: Revert "sch_htb: make htb_deactivate() idempotent"
(LP: #2127864)
- SAUCE: Revert "sch_htb: make htb_deactivate() idempotent"
* Jammy update: v5.15.190 upstream stable release (LP: #2122364) //
CVE-2024-50047 fix.
- smb: client: fix use-after-free in crypt_message when using async crypto
* CVE-2024-50061
- i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master
Driver Due to Race Condition
* CVE-2023-53074
- drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini
* CVE-2025-38678
- netfilter: nf_tables: reject duplicate device on updates
* CVE-2024-53068
- firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()
* VMSCAPE CVE-2025-40300 (LP: #2124105) // CVE-2025-40300
- Documentation/hw-vuln: Add VMSCAPE documentation
- x86/vmscape: Enumerate VMSCAPE bug
- x86/vmscape: Add conditional IBPB mitigation
- x86/vmscape: Enable the mitigation
- x86/bugs: Move cpu_bugs_smt_update() down
- x86/vmscape: Warn when STIBP is disabled with SMT
- x86/vmscape: Add old Intel CPUs to affected list
* VMSCAPE CVE-2025-40300 (LP: #2124105)
- [Config] Enable MITIGATION_VMSCAPE config
Date: 2025-11-04 10:57:12.998982+00:00
Changed-By: Noah Wager <noah.wager at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux-nvidia-tegra/5.15.0-1049.49
-------------- next part --------------
Sorry, changesfile not available.
More information about the jammy-changes
mailing list