[ubuntu/jammy-proposed] linux-hwe-6.8 6.8.0-100.100~22.04.1 (Accepted)
Andy Whitcroft
apw at canonical.com
Tue Jan 20 06:11:21 UTC 2026
linux-hwe-6.8 (6.8.0-100.100~22.04.1) jammy; urgency=medium
* jammy/linux-hwe-6.8: 6.8.0-100.100~22.04.1 -proposed tracker (LP: #2137899)
* Packaging resync (LP: #1786013)
- [Packaging] hwe-6.8: Remove dwarfdump from Build-Depends
- [Packaging] debian.hwe-6.8/dkms-versions -- update from kernel-versions
(main/2026.01.12)
[ Ubuntu: 6.8.0-100.100 ]
* noble/linux: 6.8.0-100.100 -proposed tracker (LP: #2138307)
* Turbo boost stuck disabled on Clevo PD5x_7xSNC_SND_SNE (LP: #2122531)
- cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes
* [noble] write-sealed memfd mappings fail to map read-only (LP: #2138244)
- SAUCE: Fix read-only mapping of write-sealed pages
[ Ubuntu: 6.8.0-98.98 ]
* noble/linux: 6.8.0-98.98 -proposed tracker (LP: #2137901)
* Packaging resync (LP: #1786013)
- [Packaging] debian.master/dkms-versions -- update from kernel-versions
(main/2026.01.12)
* ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)
- SAUCE increase socat timeout in gre_gso.sh
* TPM timeouts occur on some Infineon TPMs (LP: #2137528)
- tpm: Make chip->{status,cancel,req_canceled} opt
- tpm: Check for completion after timeout
* power: intel_pstate: Fix unchecked MSR (LP: #2130244)
- cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722)
- selftests/futex: futex_waitv wouldblock test should fail
- drm/i915/dg2: wait for HuC load completion before running selftests
- drm/i915: Disable RPG during live selftest
- objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret()
- octeontx2-pf: qos: fix VF root node parent queue index
- tc: Ensure we have enough buffer space when sending filter netlink
notifications
- net: ethtool: Don't call .cleanup_data when prepare_data fails
- drm/tests: modeset: Fix drm_display_mode memory leak
- drm/tests: helpers: Add atomic helpers
- drm/tests: Add helper to create mock plane
- drm/tests: Add helper to create mock crtc
- drm/tests: helpers: Add helper for drm_display_mode_from_cea_vic()
- drm/tests: helpers: Fix compiler warning
- drm/tests: helpers: Create kunit helper to destroy a drm_display_mode
- drm/tests: cmdline: Fix drm_display_mode memory leak
- drm/tests: modes: Fix drm_display_mode memory leak
- drm/tests: probe-helper: Fix drm_display_mode memory leak
- ata: sata_sx4: Add error handling in pdc20621_i2c_read()
- nvmet-fcloop: swap list_add_tail arguments
- net_sched: sch_sfq: use a temporary work area for validating
configuration
- Revert "net_sched: sch_sfq: move the limit validation"
- net_sched: sch_sfq: move the limit validation
- ipv6: Align behavior across nexthops during path selection
- nft_set_pipapo: fix incorrect avx2 match of 5th field octet
- fs: consistently deref the files table with rcu_dereference_raw()
- umount: Allow superblock owners to force umount
- x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW
- x86/ia32: Leave NULL selector values 0~3 unchanged
- x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD
when running in a virtual machine
- perf: arm_pmu: Don't disable counter in armpmu_add()
- arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
- xen/mcelog: Add __nonstring annotations for unterminated strings
- zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work
around compiler segfault
- ASoC: SOF: topology: Use krealloc_array() to replace krealloc()
- HID: pidff: Convert infinite length from Linux API to PID standard
- HID: pidff: Do not send effect envelope if it's empty
- HID: pidff: Add MISSING_DELAY quirk and its detection
- HID: pidff: Add MISSING_PBO quirk and its detection
- HID: pidff: Add PERMISSIVE_CONTROL quirk
- HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol
- HID: pidff: Add FIX_WHEEL_DIRECTION quirk
- HID: Add hid-universal-pidff driver and supported device ids
- [Config] enable hid-universal-pidff driver
- HID: pidff: Add PERIODIC_SINE_ONLY quirk
- ALSA: hda: intel: Fix Optimus when GPU has no sound
- ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist
- ASoC: fsl_audmix: register card device depends on 'dais' property
- media: uvcvideo: Add quirk for Actions UVC05
- mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves
- ALSA: usb-audio: Fix CME quirk for UF series keyboards
- ASoC: amd: Add DMI quirk for ACP6X mic support
- ASoC: amd: yc: update quirk data for new Lenovo model
- f2fs: don't retry IO for corrupted data scenario
- scsi: target: spc: Fix RSOC parameter data header size
- net: usb: asix_devices: add FiberGecko DeviceID
- fs/jfs: cast inactags to s64 to prevent potential overflow
- ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
- net: sfp: add quirk for 2.5G OEM BX SFP
- ahci: add PCI ID for Marvell 88SE9215 SATA Controller
- ext4: protect ext4_release_dquot against freezing
- Revert "f2fs: rebuild nat_bits during umount"
- cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk
- wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
- tracing: fix return value in __ftrace_event_enable_disable for
TRACE_REG_UNREGISTER
- Bluetooth: hci_uart: fix race during initialization
- Bluetooth: qca: simplify WCN399x NVM loading
- drm: allow encoder mode_set even when connectors change for crtc
- drm/amd/display: Update Cursor request mode to the beginning prefetch
always
- drm/amd/display: add workaround flag to link to force FFE preset
- drm: panel-orientation-quirks: Add support for AYANEO 2S
- drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB
- drm: panel-orientation-quirks: Add quirk for AYA NEO Slide
- drm: panel-orientation-quirks: Add new quirk for GPD Win 2
- drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel)
- drm/bridge: panel: forbid initializing a panel with unknown connector
type
- drivers: base: devres: Allow to release group on device release
- drm/amdkfd: clamp queue size to minimum
- drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
- drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data
- drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
- drm/amdgpu: grab an additional reference on the gang fence v2
- tracing: probe-events: Add comments about entry data storing code
- ktest: Fix Test Failures Due to Missing LOG_FILE Directories
- tpm, tpm_tis: Workaround failed command reception on Infineon devices
- pwm: rcar: Improve register calculation
- pwm: fsl-ftm: Handle clk_get_rate() returning 0
- bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
- ext4: don't treat fhandle lookup of ea_inode as FS corruption
- dt-bindings: media: st,stmipid02: correct lane-polarities maxItems
- media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
- media: i2c: adv748x: Fix test pattern selection mask
- media: vim2m: print device name after registering device
- media: siano: Fix error handling in smsdvb_module_init()
- xenfs/xensyms: respect hypervisor's "next" indication
- arm64: cputype: Add MIDR_CORTEX_A76AE
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe
list
- spi: cadence-qspi: Fix probe on AM62A LP SK
- tpm, tpm_tis: Fix timeout handling when waiting for TPM status
- media: streamzap: prevent processing IR data on URB failure
- media: visl: Fix ERANGE error when setting enum controls
- media: platform: stm32: Add check for clk_enable()
- media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
- media: i2c: ccs: Set the device's runtime PM status correctly in remove
- media: i2c: ccs: Set the device's runtime PM status correctly in probe
- media: i2c: ov7251: Set enable GPIO low in probe
- media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
- media: i2c: imx219: Rectify runtime PM handling in probe and remove
- mptcp: sockopt: fix getting IPV6_V6ONLY
- mtd: Add check for devm_kcalloc()
- net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320
family
- mtd: Replace kcalloc() with devm_kcalloc()
- clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init
wakeup
- wifi: mt76: Add check for devm_kstrdup()
- wifi: mac80211: fix integer overflow in hwmp_route_info_get()
- io_uring/kbuf: reject zero sized provided buffers
- ASoC: q6apm: add q6apm_get_hw_pointer helper
- ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment.
- ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns.
- ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
- f2fs: fix to avoid atomicity corruption of atomic file
- vdpa/mlx5: Fix oversized null mkey longer than 32bit
- udf: Fix inode_getblk() return value
- smb311 client: fix missing tcon check when mounting with linux/posix
extensions
- i3c: master: svc: Use readsb helper for reading MDB
- leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs
- leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs
- mailbox: tegra-hsp: Define dimensioning masks in SoC data
- locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
- lib: scatterlist: fix sg_split_phys to preserve original scatterlist
offsets
- mptcp: only inc MPJoinAckHMacFailure for HMAC failures
- mtd: rawnand: Add status chack in r852_ready()
- arm64: mm: Correct the update of max_pfn
- arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
- btrfs: fix non-empty delayed iputs list on unmount due to compressed
write workers
- btrfs: zoned: fix zone activation with missing devices
- btrfs: zoned: fix zone finishing with missing devices
- iommufd: Fix uninitialized rc in iommufd_access_rw()
- sparc/mm: disable preemption in lazy mmu mode
- sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes
- mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
- mm: make page_mapped_in_vma() hugetlb walk aware
- mm: fix lazy mmu docs and usage
- mm/mremap: correctly handle partial mremap() of VMA starting at 0
- mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
- mm/userfaultfd: fix release hang over concurrent GUP
- mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
- mm/hugetlb: move hugetlb_sysctl_init() to the __init section
- x86/xen: fix balloon target initialization for PVH dom0
- tracing: Do not add length to print format in synthetic events
- thermal/drivers/rockchip: Add missing rk3328 mapping entry
- cifs: fix integer overflow in match_server()
- clk: qcom: clk-branch: Fix invert halt status bit check for votable
clocks
- clk: qcom: gdsc: Release pm subdomains in reverse add order
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
- clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
- crypto: ccp - Fix check for the primary ASP device
- dm-ebs: fix prefetch-vs-suspend race
- dm-integrity: set ti->error on memory allocation failure
- dm-verity: fix prefetch-vs-suspend race
- dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg'
- dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg'
- gpio: tegra186: fix resource handling in ACPI probe path
- gpio: zynq: Fix wakeup source leaks on device unbind
- gve: handle overflow when reporting TX consumed descriptors
- KVM: x86: Explicitly zero-initialize on-stack CPUID unions
- ntb: use 64-bit arithmetic for the MSI doorbell mask
- of/irq: Fix device node refcount leakage in API of_irq_parse_one()
- of/irq: Fix device node refcount leakage in API of_irq_parse_raw()
- of/irq: Fix device node refcount leakages in of_irq_count()
- of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
- of/irq: Fix device node refcount leakages in of_irq_init()
- PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
- PCI: Fix reference leak in pci_alloc_child_bus()
- phy: freescale: imx8m-pcie: assert phy reset and perst in power off
- pinctrl: qcom: Clear latched interrupt status when changing IRQ type
- selftests: mptcp: close fd_in before returning in main_loop
- selftests: mptcp: fix incorrect fd checks in main_loop
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected()
lists
- ACPI: platform-profile: Fix CFI violation when accessing sysfs files
- iommufd: Fail replace if device has not been attached
- x86/e820: Fix handling of subpage regions when calculating nosave ranges
in e820__register_nosave_regions()
- media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef
noinline
- Bluetooth: hci_uart: Fix another race during initialization
- scsi: hisi_sas: Enable force phy when SATA disk directly connected
- wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
- scsi: iscsi: Fix missing scsi_host_put() in error path
- md/raid10: fix missing discard IO accounting
- md/md-bitmap: fix stats collection for external bitmaps
- ASoC: dwc: always enable/disable i2s irqs
- ovl: remove unused forward declaration
- RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
- RDMA/hns: Fix wrong maximum DMA segment size
- ASoC: cs42l43: Reset clamp override on jack removal
- Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid
address
- Bluetooth: l2cap: Check encryption key size on incoming connection
- Revert "wifi: mac80211: Update skb's control block key in
ieee80211_tx_dequeue()"
- igc: increase wait time before retrying PTM
- igc: move ktime snapshot into PTM retry loop
- igc: handle the IGC_PTP_ENABLED flag correctly
- igc: cleanup PTP module if probe fails
- igc: add lock preventing multiple simultaneous PTM transactions
- test suite: use %zu to print size_t
- pds_core: fix memory leak in pdsc_debugfs_add_qcq()
- net: ethernet: ti: am65-cpsw-nuss: rename phy_node -> port_np
- net: ethernet: ti: am65-cpsw: fix port_np reference counting
- ata: libata-sata: Save all fields from sense data descriptor
- netlink: specs: rt-link: add an attr layer around alt-ifname
- netlink: specs: rt-link: adjust mctp attribute naming
- net: b53: enable BPDU reception for management port
- net: bridge: switchdev: do not notify new brentries as changed
- net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del()
fails
- ptp: ocp: fix start time alignment in ptp_ocp_signal_set
- net: ti: icss-iep: Add pwidth configuration for perout signal
- net: ti: icss-iep: Add phase offset configuration for perout signal
- net: ethernet: mtk_eth_soc: correct the max weight of the queue limit
for 100Mbps
- net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings
- riscv: Properly export reserved regions in /proc/iomem
- kunit: qemu_configs: SH: Respect kunit cmdline
- riscv: KGDB: Do not inline arch_kgdb_breakpoint()
- riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
- cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
- writeback: fix false warning in inode_to_wb()
- ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
- ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
- asus-laptop: Fix an uninitialized variable
- nfs: add missing selections of CONFIG_CRC32
- nfsd: decrease sc_count directly if fail to queue dl_recall
- i2c: atr: Fix wrong include
- ftrace: fix incorrect hash size in register_ftrace_direct()
- Bluetooth: l2cap: Process valid commands in too long frame
- Bluetooth: vhci: Avoid needless snprintf() calls
- btrfs: correctly escape subvol in btrfs_show_options()
- crypto: caam/qi - Fix drv_ctx refcount bug
- Revert "UBUNTU: SAUCE: fs: hfs/hfsplus: add key_len boundary check to
hfs_bnode_read_key"
- hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
- loop: properly send KOBJ_CHANGED uevent for disk device
- loop: LOOP_SET_FD: send uevents for partitions
- mm/gup: fix wrongly calculated returned value in
fault_in_safe_writeable()
- mm: fix filemap_get_folios_contig returning batches of identical folios
- mm: fix apply_to_existing_page_range()
- ksmbd: Prevent integer overflow in calculation of deadtime
- Revert "smb: client: fix TCP timers deadlock after rmmod"
- riscv: Avoid fortify warning in syscall_get_arguments()
- selftests/mm: generate a temporary mountpoint for cgroup filesystem
- smb3 client: fix open hardlink on deferred close file error
- string: Add load_unaligned_zeropad() code path to sized_strscpy()
- tracing: Fix filter string testing
- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any
unreleased standalone Zen5 microcode patches
- x86/cpu/amd: Fix workaround for erratum 1054
- x86/boot/sev: Avoid shared GHCB page for early memory acceptance
- scsi: megaraid_sas: Block zero-length ATA VPD inquiry
- scsi: ufs: exynos: Ensure consistent phy reference counts
- perf/x86/intel: Allow to update user space GPRs from PEBS records
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
- drm/repaper: fix integer overflows in repeat functions
- drm/msm/a6xx: Fix stale rpmh votes from GPU
- drm/amd: Handle being compiled without SI or CIK support better
- drm/amdgpu/dma_buf: fix page_link check
- drm/sti: remove duplicate object names
- drm/i915/gvt: fix unterminated-string-initialization warning
- io_uring/net: fix accept multishot handling
- cpufreq: Reference count policy in cpufreq_update_limits()
- kbuild: Add '-fno-builtin-wcslen'
- mptcp: sockopt: fix getting freebind & transparent
- misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
- efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32
- x86/xen: move xen_reserve_extra_memory()
- x86/xen: fix memblock_reserve() usage on PVH
- x86/split_lock: Fix the delayed detection logic
- LoongArch: Eliminate superfluous get_numa_distances_cnt()
- Revert "usb: typec: fix potential array underflow in
ucsi_ccg_sync_control()"
- usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
- usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
- landlock: Add the errata interface
- nvmet-fc: Remove unused functions
- xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
- sign-file,extract-cert: move common SSL helper functions to a header
- sign-file,extract-cert: avoid using deprecated ERR_get_error_line()
- sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
- MIPS: dec: Declare which_prom() as static
- MIPS: cevt-ds1287: Add missing ds1287.h include
- MIPS: ds1287: Match ds1287_set_base_clock() function types
- drm/tests: Build KMS helpers when DRM_KUNIT_TEST_HELPERS is enabled
- ASoC: Intel: adl: add 2xrt1316 audio configuration
- cgroup/cpuset: Fix incorrect isolated_cpus update in
update_parent_effective_cpumask()
- cgroup/cpuset: Correct invalid remote parition prs
- cgroup/cpuset: Fix error handling in remote_partition_disable()
- cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in
update_cpumasks_hier()"
- cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call
per operation
- cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set
- cgroup/cpuset: Fix race between newly created partition and dying one
- gpiolib: of: Fix the choice for Ingenic NAND quirk
- ublk: refactor recovery configuration flag helpers
- net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
- iommu/exynos: Fix suspend/resume with IDENTITY domain
- perf/dwc_pcie: fix some unreleased resources
- Flush console log from kernel_power_off()
- ASoC: amd: ps: use macro for ACP6.3 pci revision id
- media: s5p-mfc: Corrected NV12M/NV21M plane-sizes
- wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues
- wifi: ath11k: fix memory leak in ath11k_xxx_remove()
- wifi: mac80211: ensure sdata->work is canceled before initialized.
- can: flexcan: Add quirk to handle separate interrupt lines for mailboxes
- can: flexcan: add NXP S32G2/S32G3 SoC support
- Bluetooth: btusb: Add 2 HWIDs for MT7922
- Bluetooth: Add quirk for broken READ_VOICE_SETTING
- Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE
- drm/debugfs: fix printk format for bridge index
- drm/amd/display: stop DML2 from removing pipes based on planes
- drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds
- PCI: Add Rockchip Vendor ID
- HID: pidff: Clamp PERIODIC effect period to device's logical range
- HID: pidff: Stop all effects before enabling actuators
- HID: pidff: Completely rework and fix pidff_reset function
- HID: pidff: Simplify pidff_upload_effect function
- HID: pidff: Define values used in pidff_find_special_fields
- HID: pidff: Rescale time values to match field units
- HID: pidff: Factor out code for setting gain
- HID: pidff: Move all hid-pidff definitions to a dedicated header
- HID: pidff: Simplify pidff_rescale_signed
- HID: pidff: Use macros instead of hardcoded min/max values for shorts
- HID: pidff: Factor out pool report fetch and remove excess declaration
- HID: hid-universal-pidff: Add Asetek wheelbases support
- HID: pidff: Comment and code style update
- HID: pidff: Support device error response from PID_BLOCK_LOAD
- HID: pidff: Remove redundant call to pidff_find_special_keys
- HID: pidff: Rename two functions to align them with naming convention
- HID: pidff: Clamp effect playback LOOP_COUNT value
- HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff
- HID: pidff: Fix 90 degrees direction name North -> East
- HID: pidff: Fix set_device_control()
- media: mgb4: Fix CMT registers update logic
- media: mgb4: Fix switched CMT frequency range "magic values" sets
- media: rockchip: rga: fix rga offset lookup
- media: v4l: Add a helper for setting up link-frequencies control
- media: v4l2-common.h: kerneldoc: correctly format return values
- media: imx219: Adjust PLL settings based on the number of MIPI lanes
- media: nuvoton: Fix reference handling of ece_node
- media: nuvoton: Fix reference handling of ece_pdev
- media: i2c: imx319: Rectify runtime PM handling probe and remove
- media: i2c: imx214: Rectify probe error handling related to runtime PM
- media: chips-media: wave5: Fix gray color on screen
- media: chips-media: wave5: Fix a hang after seeking
- wifi: mt76: mt7925: ensure wow pattern command align fw format
- wifi: mt76: mt7925: fix country count limitation for CLC
- ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx
- accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal()
- ima: limit the number of open-writers integrity violations
- arm64: dts: exynos: gs101: disable pinctrl_gsacore node
- btrfs: tests: fix chunk map leak after failure to add it to the tree
- mm/damon/ops: have damon_get_folio return folio even for tail pages
- CIFS: Propagate min offload along with other parameters from primary to
secondary channels.
- dm-integrity: fix non-constant-time tag verification
- landlock: Move code to ease future backports
- landlock: Add erratum for TCP fix
- misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq'
error
- net: mana: Switch to page pool for jumbo frames
- PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4
- pinctrl: samsung: add support for eint_fltcon_offset
- s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues
- thermal/drivers/mediatek/lvts_thermal: Allow early empty sensor slots
- thermal/drivers/mediatek/lvts_thermal: Fix wrong lvts_ctrl index
- thermal/drivers/mediatek/lvts: Disable monitor mode during suspend
- thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr
- libbpf: Prevent compiler warnings/errors
- Upstream stable to v6.6.88, v6.12.24
- SAUCE: Enable upstream config option "CONFIG_CPUSETS_V1"
* [SRU] ixgbe: Add support for E610 in Noble (LP: #2131265)
- ixgbe: Add support for E610 FW Admin Command Interface
- ixgbe: Add support for E610 device capabilities detection
- ixgbe: Add link management support for E610 device
- ixgbe: Add support for NVM handling in E610 device
- ixgbe: Add support for EEPROM dump in E610 device
- ixgbe: Add ixgbe_x540 multiple header inclusion protection
- ixgbe: Clean up the E610 link management related code
- ixgbe: Enable link management in E610 device
- ixgbe: fix media type detection for E610 device
- ixgbe: fix media cage present detection for E610 device
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586)
- io_uring: don't use int for ABI
- ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
- ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
- smb: client: remove redundant lstrp update in negotiate protocol
- gpio: virtio: Fix config space reading.
- gpio: mlxbf2: use platform_get_irq_optional()
- gpio: mlxbf3: use platform_get_irq_optional()
- netlink: avoid infinite retry looping in netlink_unicast()
- net: phy: micrel: fix KSZ8081/KSZ8091 cable test
- net: gianfar: fix device leak when querying time stamp info
- net: enetc: fix device and OF node leak at probe
- net: mtk_eth_soc: fix device leak at probe
- net: ti: icss-iep: fix device and OF node leaks at probe
- net: dpaa: fix device leak when querying time stamp info
- NFSD: detect mismatch of file handle and delegation stateid in OPEN op
- PCI: Extend isolated function probing to LoongArch
- LoongArch: BPF: Fix jump offset calculation in tailcall
- sunvdc: Balance device refcount in vdc_port_mpgroup_check
- Documentation: ACPI: Fix parent device references
- ACPI: processor: perflib: Fix initial _PPC limit application
- ACPI: processor: perflib: Move problematic pr->performance check
- smb: client: let send_done() cleanup before calling
smbd_disconnect_rdma_connection()
- smb: client: don't wait for info->send_pending == 0 on error
- KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
- KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer
exits
- KVM: VMX: Handle forced exit due to preemption timer in fastpath
- KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers
- KVM: VMX: Handle KVM-induced preemption timer exits in fastpath for L2
- KVM: x86: Fully defer to vendor code to decide how to force immediate
exit
- KVM: x86: Convert vcpu_run()'s immediate exit param into a generic
bitmap
- KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
- KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
- KVM: VMX: Extract checking of guest's DEBUGCTL into helper
- KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
- KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
- KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the
guest
- udp: also consider secpath when evaluating ipsec use for checksumming
- net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
- intel_idle: Allow loading ACPI tables for any family
- ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
- arm64: Handle KCOV __init vs inline mismatches
- nvme-pci: try function level reset on init failure
- udf: Verify partition map count
- hfs: fix not erasing deleted b-tree node issue
- better lockdep annotations for simple_recursive_removal()
- ata: libata-sata: Disallow changing LPM state if not supported
- fs/ntfs3: correctly create symlink for relative path
- ext2: Handle fiemap on empty files to prevent EINVAL
- fix locking in efi_secret_unlink()
- securityfs: don't pin dentries twice, once is enough...
- tracefs: Add d_delete to remove negative dentries
- usb: xhci: print xhci->xhc_state when queue_command failed
- platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
- cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
- selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit
time_t
- usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
- usb: xhci: Avoid showing warnings for dying controller
- usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
- usb: xhci: Avoid showing errors during surprise removal
- soc: qcom: rpmh-rsc: Add RSC version 4 support
- remoteproc: imx_rproc: skip clock enable when M-core is managed by the
SCU
- gpio: wcd934x: check the return value of regmap_update_bits()
- cpufreq: Exit governor when failed to start old governor
- PM / devfreq: governor: Replace sscanf() with kstrtoul() in
set_freq_store()
- EDAC/synopsys: Clear the ECC counters on init
- ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
successed
- thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when
required
- tools/nolibc: define time_t in terms of __kernel_old_time_t
- iio: adc: ad_sigma_delta: don't overallocate scan buffer
- gpio: tps65912: check the return value of regmap_update_bits()
- tools/build: Fix s390(x) cross-compilation with clang
- selftests: tracing: Use mutex_unlock for testing glob filter
- ACPI: PRM: Reduce unnecessary printing to avoid user confusion
- firmware: tegra: Fix IVC dependency problems
- PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
- thermal: sysfs: Return ENODATA instead of EAGAIN for reads
- PM: sleep: console: Fix the black screen issue
- ACPI: processor: fix acpi_object initialization
- mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
- pps: clients: gpio: fix interrupt handling order in remove path
- reset: brcmstb: Enable reset drivers for ARCH_BCM2835
- char: misc: Fix improper and inaccurate error code returned by
misc_init()
- mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
- mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
- ALSA: hda: Handle the jack polling always via a work
- ALSA: hda: Disable jack polling at shutdown
- x86/bugs: Avoid warning when overriding return thunk
- ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
- ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
- usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
- usb: core: usb_submit_urb: downgrade type check
- pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
- imx8m-blk-ctrl: set ISI panic write hurry level
- soc: qcom: mdt_loader: Actually use the e_phoff
- platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
- platform/chrome: cros_ec_typec: Defer probe on missing EC parent
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
- ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
- ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
- iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
- ASoC: codecs: rt5640: Retry DEVICE_ID verification
- ASoC: qcom: use drvdata instead of component to keep id
- powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
- Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
- xen/netfront: Fix TX response spurious interrupts
- net: usb: cdc-ncm: check for filtering capability
- ktest.pl: Prevent recursion of default variable options
- wifi: cfg80211: reject HTC bit for management frames
- s390/time: Use monotonic clock in get_cycles()
- be2net: Use correct byte order and format string for TCP seq and ack_seq
- wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
- et131x: Add missing check after DMA map
- net: ag71xx: Add missing check after DMA map
- net/mlx5e: Properly access RCU protected qdisc_sleeping variable
- arm64: Mark kernel as tainted on SAE and SError panic
- net: mctp: Prevent duplicate binds
- wifi: cfg80211: Fix interface type validation
- net: ipv4: fix incorrect MTU in broadcast routes
- net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
- net: phy: micrel: Add ksz9131_resume()
- perf/cxlpmu: Remove unintended newline from IRQ name format string
- wifi: iwlwifi: mvm: set gtk id also in older FWs
- um: Re-evaluate thread flags repeatedly
- wifi: iwlwifi: mvm: fix scan request validation
- s390/stp: Remove udelay from stp_sync_clock()
- sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
- wifi: mac80211: don't complete management TX on SAE commit
- (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
- ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in
__ipv6_dev_mc_inc().
- wifi: mac80211: fix rx link assignment for non-MLO stations
- drm/msm: use trylock for debugfs
- wifi: rtw89: Fix rtw89_mac_power_switch() for USB
- wifi: rtw89: Disable deep power saving for USB/SDIO
- wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
- kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
- net: thunderbolt: Enable end-to-end flow control also in transmit
- net: thunderbolt: Fix the parameter passing of
tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
- net: atlantic: add set_power to fw_ops for atl2 to fix wol
- net: fec: allow disable coalescing
- drm/amd/display: Separate set_gsl from set_gsl_source_select
- wifi: ath12k: Add memset and update default rate value in wmi tx
completion
- wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
- wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
- drm/amd/display: Fix 'failed to blank crtc!'
- wifi: mac80211: update radar_required in channel context after channel
switch
- wifi: rtlwifi: fix possible skb memory leak in
`_rtl_pci_rx_interrupt()`.
- wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
- powerpc: floppy: Add missing checks after DMA map
- netmem: fix skb_frag_address_safe with unreadable skbs
- wifi: iwlegacy: Check rate_idx range after addition
- neighbour: add support for NUD_PERMANENT proxy entries
- dpaa_eth: don't use fixed_phy_change_carrier
- drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to
manual
- net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
- net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
- gve: Return error for unknown admin queue command
- net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
- net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
- net: dsa: b53: prevent DIS_LEARNING access on BCM5325
- net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
- bpftool: Fix JSON writer resource leak in version command
- ptp: Use ratelimite for freerun error message
- wifi: rtlwifi: fix possible skb memory leak in
_rtl_pci_init_one_rxdesc()
- ionic: clean dbpage in de-init
- net: ncsi: Fix buffer overflow in fetching version id
- drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
- drm/ttm: Should to return the evict error
- uapi: in6: restore visibility of most IPv6 socket options
- bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
- selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
- drm/amd/display: Avoid trying AUX transactions on disconnected ports
- drm/ttm: Respect the shrinker core free target
- net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
- vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
- vhost: fail early when __vhost_add_used() fails
- drm/amd/display: Only finalize atomic_obj if it was initialized
- drm/amd/display: Avoid configuring PSR granularity if PSR-SU not
supported
- watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race
condition
- cifs: Fix calling CIFSFindFirst() for root path without msearch
- crypto: hisilicon/hpre - fix dma unmap sequence
- clk: tegra: periph: Fix error handling and resolve unsigned compare
warning
- mfd: axp20x: Set explicit ID for AXP313 regulator
- phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
- fs/orangefs: use snprintf() instead of sprintf()
- watchdog: dw_wdt: Fix default timeout
- hwmon: (emc2305) Set initial PWM minimum value during probe based on
thermal state
- clk: qcom: ipq5018: keep XO clock always on
- MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
- watchdog: iTCO_wdt: Report error if timeout configuration fails
- crypto: jitter - fix intermediary handling
- MIPS: lantiq: falcon: sysctrl: fix request memory check logic
- media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ
control
- leds: leds-lp50xx: Handle reg to get correct multi_index
- dmaengine: stm32-dma: configure next sg only if there are more than 2
sgs
- RDMA/core: reduce stack using in nldev_stat_get_doit()
- power: supply: qcom_battmgr: Add lithium-polymer entry
- scsi: mpt3sas: Correctly handle ATA device errors
- scsi: mpi3mr: Correctly handle ATA device errors
- pinctrl: stm32: Manage irq affinity settings
- media: tc358743: Check I2C succeeded during probe
- media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
- media: tc358743: Increase FIFO trigger level to 374
- media: usb: hdpvr: disable zero-length read messages
- media: uvcvideo: Fix bandwidth issue for Alcor camera
- crypto: octeontx2 - add timeout for load_fvc completion poll
- soundwire: amd: serialize amd manager resume sequence during pm_prepare
- soundwire: Move handle_nested_irq outside of sdw_dev_lock
- md: dm-zoned-target: Initialize return variable r to avoid uninitialized
use
- module: Prevent silent truncation of module name in delete_module(2)
- i3c: add missing include to internal header
- rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
- i3c: don't fail if GETHDRCAP is unsupported
- i3c: master: Initialize ret in i3c_i2c_notifier_call()
- dm-mpath: don't print the "loaded" message if registering fails
- dm-table: fix checking for rq stackable devices
- apparmor: use the condition in AA_BUG_FMT even with debug disabled
- i2c: Force DLL0945 touchpad i2c freq to 100khz
- f2fs: check the generic conditions first
- kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
- vfio/type1: conditional rescheduling while pinning
- kconfig: nconf: Ensure null termination where strncpy is used
- scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
- scsi: target: core: Generate correct identifiers for PR OUT transport
IDs
- scsi: aacraid: Stop using PCI_IRQ_AFFINITY
- vfio/mlx5: fix possible overflow in tracking max message size
- ipmi: Use dev_warn_ratelimited() for incorrect message warnings
- kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
- kconfig: gconf: fix potential memory leak in renderer_edited()
- kconfig: lxdialog: fix 'space' to (de)select options
- ipmi: Fix strcpy source and destination the same
- net: phy: smsc: add proper reset flags for LAN8710A
- ASoC: Intel: avs: Fix uninitialized pointer error in probe()
- pNFS: Fix stripe mapping in block/scsi layout
- pNFS: Fix disk addr range check in block/scsi layout
- pNFS: Handle RPC size limit for layoutcommits
- rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
- scsi: lpfc: Remove redundant assignment to avoid memory leak
- ASoC: fsl_sai: replace regmap_write with regmap_update_bits
- cifs: reset iface weights when we cannot find a candidate
- iommufd: Report unmapped bytes in the error path of
iopt_unmap_iova_range
- ext4: fix zombie groups in average fragment size lists
- ext4: fix largest free orders lists corruption on mb_optimize_scan
switch
- misc: rtsx: usb: Ensure mmc child device is active when card is present
- usb: typec: ucsi: Update power_supply on power role change
- thunderbolt: Fix copy+paste error in match_service_id()
- cdc-acm: fix race between initial clearing halt and open
- btrfs: zoned: use filesystem size not disk size for reclaim decision
- btrfs: abort transaction during log replay if walk_log_tree() failed
- btrfs: zoned: do not remove unwritten non-data block group
- btrfs: clear dirty status from extent buffer on error at
insert_new_root()
- btrfs: fix log tree replay failure due to file with 0 links and extents
- btrfs: zoned: do not select metadata BG as finish target
- parisc: Makefile: fix a typo in palo.conf
- media: uvcvideo: Do not mark valid metadata as invalid
- tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
- HID: magicmouse: avoid setting up battery timer when not needed
- HID: apple: avoid setting up battery timer for devices without battery
- rcu: Fix racy re-initialization of irq_work causing hangs
- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
- m68k: Fix lost column on framebuffer debug console
- usb: atm: cxacru: Merge cxacru_upload_firmware() into
cxacru_heavy_init()
- usb: gadget: udc: renesas_usb3: fix device leak at unbind
- usb: musb: omap2430: fix device leak at unbind
- usb: dwc3: meson-g12a: fix device leaks at unbind
- bus: mhi: host: Fix endianness of BHI vector table
- vt: keyboard: Don't process Unicode characters in K_OFF mode
- vt: defkeymap: Map keycodes above 127 to K_HOLE
- lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
- crypto: qat - lower priority for skcipher and aead algorithms
- ksmbd: extend the connection limiting mechanism to support IPv6
- tracing: fprobe-event: Sanitize wildcard for fprobe event name
- ext4: check fast symlink for ea_inode correctly
- ext4: fix fsmap end of range reporting with bigalloc
- ext4: fix reserved gdt blocks handling in fsmap
- ext4: don't try to clear the orphan_present feature block device is r/o
- ext4: use kmalloc_array() for array space allocation
- ext4: fix hole length calculation overflow in non-extent inodes
- btrfs: zoned: fix write time activation failure for metadata block group
- arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
- arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
- arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
constraints
- scsi: mpi3mr: Fix race between config read submit and interrupt
completion
- ata: libata-scsi: Fix ata_to_sense_error() status handling
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like
host controllers
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels
- ata: libata-scsi: Fix CDL control
- zynq_fpga: use sgtable-based scatterlist wrappers
- iio: adc: ad_sigma_delta: change to buffer predisable
- wifi: brcmsmac: Remove const from tbl_ptr parameter in
wlc_lcnphy_common_read_table()
- wifi: ath12k: fix dest ring-buffer corruption
- wifi: ath12k: fix source ring-buffer corruption
- wifi: ath12k: fix dest ring-buffer corruption when ring is full
- wifi: ath11k: fix dest ring-buffer corruption
- wifi: ath11k: fix source ring-buffer corruption
- wifi: ath11k: fix dest ring-buffer corruption when ring is full
- pwm: imx-tpm: Reset counter if CMOD is 0
- pwm: mediatek: Handle hardware enable and clock enable separately
- pwm: mediatek: Fix duty and period setting
- hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
- mtd: spi-nor: Fix spi_nor_try_unlock_all()
- mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
- mtd: rawnand: fsmc: Add missing check after DMA map
- mtd: rawnand: renesas: Add missing check after DMA map
- PCI: endpoint: Fix configfs group removal on driver teardown
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs
- phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization
sequence
- soc/tegra: pmc: Ensure power-domains are in a known state
- parisc: Check region is readable by user in raw_copy_from_user()
- parisc: Define and use set_pte_at()
- parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit
compilers
- parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
- parisc: Try to fixup kernel exception in bad_area_nosemaphore path of
do_page_fault()
- parisc: Update comments in make_insert_tlb
- media: gspca: Add bounds checking to firmware parser
- media: hi556: correct the test pattern configuration
- media: imx: fix a potential memory leak in
imx_media_csc_scaler_device_init()
- media: vivid: fix wrong pixel_array control size
- media: verisilicon: Fix AV1 decoder clock frequency
- media: v4l2-ctrls: Don't reset handler's error in
v4l2_ctrl_handler_free()
- media: ov2659: Fix memory leaks in ov2659_probe()
- media: qcom: camss: cleanup media device allocated resource on error
path
- media: venus: hfi: explicitly release IRQ during teardown
- media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
- media: venus: venc: Clamp param smaller than 1fps and bigger than 240
- drm/amd: Restore cached power limit during resume
- drm/amdgpu: update mmhub 3.0.1 client id mappings
- drm/amd/display: Add primary plane to commits for correct VRR handling
- drm/amd/display: Don't overwrite dce60_clk_mgr
- mptcp: drop skb if MPTCP skb extension allocation fails
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
- selftests/memfd: add test for mapping write-sealed memfd read-only
- net: Add net_passive_inc() and net_passive_dec().
- smb: client: fix netns refcount leak after net_passive changes
- net_sched: sch_ets: implement lockless ets_dump()
- leds: flash: leds-qcom-flash: Limit LED current based on thermal
condition
- leds: flash: leds-qcom-flash: Fix registry access after re-bind
- fscrypt: Don't use problematic non-inline crypto engines
- block: Make REQ_OP_ZONE_FINISH a write operation
- usb: typec: fusb302: cache PD RX state
- btrfs: don't ignore inode missing when replaying log tree
- btrfs: move transaction aborts to the error site in
add_block_group_free_space()
- btrfs: always abort transaction on failure to add block group to free
space tree
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
- btrfs: fix ssd_spread overallocation
- btrfs: constify more pointer parameters
- btrfs: populate otime when logging an inode item
- btrfs: send: factor out common logic when sending xattrs
- btrfs: send: only use boolean variables at process_recorded_refs()
- btrfs: send: add and use helper to rename current inode when processing
refs
- btrfs: send: keep the current inode's path cached
- btrfs: send: avoid path allocation for the current inode when issuing
commands
- btrfs: send: use fallocate for hole punching with send stream v2
- btrfs: send: make fs_path_len() inline and constify its argument
- wifi: mac80211: check basic rates validity in sta_link_apply_parameters
- usb: dwc3: imx8mp: fix device leak at unbind
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
- PM: runtime: Take active children into account in
pm_runtime_get_if_in_use()
- ata: libata-scsi: Return aborted command when missing sense and result
TF
- kbuild: userprogs: use correct linker when mixing clang and GNU ld
- memstick: Fix deadlock by moving removing flag earlier
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for
consistency
- squashfs: fix memory leak in squashfs_fill_super
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and
EliteBook 830 G6
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
- drm/amd/display: Find first CRTC and its line time in
dce110_fill_display_configs
- drm/amd/display: Fill display clock and vblank time in
dce110_fill_display_configs
- soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
- PCI: rockchip: Use standard PCIe definitions
- PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
- PCI: imx6: Delay link start until configfs 'start' written
- PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in
epc_features
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
- ext4: preserve SB_I_VERSION on remount
- arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
- mptcp: remove duplicate sk_reset_timer call
- mptcp: disable add_addr retransmission when timeout is 0
- selftests: mptcp: pm: check flush doesn't reset limits
- mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
- mmc: sdhci-pci-gli: Add a new function to simplify the code
- cpuidle: menu: Remove iowait influence
- cpuidle: governors: menu: Avoid selecting states with too much latency
- fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
- iio: proximity: isl29501: fix buffered read on big-endian systems
- most: core: Drop device reference after usage in get_channel()
- cdx: Fix off-by-one error in cdx_rpmsg_probe()
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash
Drive
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
test
- usb: renesas-xhci: Fix External ROM access timeouts
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
- usb: storage: realtek_cr: Use correct byte order for bcs->Residue
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
- usb: dwc3: pci: add support for the Intel Wildcat Lake
- drm/amd/display: Don't overclock DCE 6 by 15%
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
- powerpc/boot: Fix build with gcc 15
- tracing: Remove unneeded goto out logic
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
- iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8)
to aligned_s64
- iio: imu: inv_icm42600: use = { } instead of memset()
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types
- iio: imu: inv_icm42600: change invalid data error to -EBUSY
- usb: xhci: Fix slot_id resource race conflict
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and
port is clean
- usb: typec: maxim_contaminant: disable low power mode when reading
comparator values
- spi: spi-fsl-lpspi: Clamp too high speed_hz
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on
cpusets_insane_config_key
- iosys-map: Fix undefined behavior in iosys_map_clear()
- RDMA/erdma: Fix ignored return value of init_kernel_qp
- RDMA/bnxt_re: Fix to do SRQ armena by default
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
- RDMA/bnxt_re: Fix to initialize the PBL array
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
- mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
- ALSA: usb-audio: Fix size validation in convert_chmap_v3()
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
- net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
- phy: mscc: Fix timestamping for vsc8584
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
- LoongArch: Optimize module load time by optimizing PLT/GOT counting
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
- igc: fix disabling L1.2 PCI-E link substate on I226 on init
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in
htb_activate
- bonding: update LACP activity flag after setting lacp_active
- bonding: Add independent control state machine
- bonding: send LACPDUs periodically in passive mode after receiving
partner's LACPDU
- Octeontx2-af: Skip overlap check for SPI field
- net/mlx5: Base ECVF devlink port attrs from 0
- net/mlx5e: Preserve shared buffer capacity during headroom updates
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
- s390/hypfs: Avoid unnecessary ioctl registration in debugfs
- s390/hypfs: Enable limited access during lockdown
- alloc_fdtable(): change calling conventions.
- LoongArch: Avoid in-place string operation on FDT content
- clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
- mm/memory-tier: fix abstract distance calculation overflow
- nvme-tcp: log TLS handshake failures at error level
- ata: ahci: Disallow LPM policy control if not supported
- ata: ahci: Disable DIPM if host lacks support
- usb: typec: tcpm/tcpci_maxim: fix irq wake usage
- pmdomain: ti: Select PM_GENERIC_DOMAINS
- cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
- platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready
- ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless
mode
- tty: serial: fix print format specifiers
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps
- wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn
- idpf: preserve coalescing settings across resets
- wifi: mac80211: don't unreserve never reserved chanctx
- sched/deadline: Fix accounting after global limits change
- wifi: mac80211: avoid weird state in error path
- perf/arm: Add missing .suppress_bind_attrs
- drm/imagination: Clear runtime PM errors while resetting the GPU
- drm/xe/xe_query: Use separate iterator while filling GT list
- wifi: ath12k: Fix station association with MBSSID Non-TX BSS
- lib: packing: Include necessary headers
- arm64: stacktrace: Check kretprobe_find_ret_addr() return value
- net: dsa: b53: ensure BCM5325 PHYs are enabled
- drm/amd/display: Update DMCUB loading sequence for DCN3.5
- drm/amd/display: Disable dsc_power_gate for dcn314 by default
- RDMA/bnxt_re: Fix size of uverbs_copy_to() in
BNXT_RE_METHOD_GET_TOGGLE_MEM
- media: ipu-bridge: Add _HID for OV5670
- scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in
dev_loss_tmo_callbk
- media: uvcvideo: Add quirk for HP Webcam HD 2300
- crypto: ccp - Add missing bootloader info reg for pspv6
- soundwire: amd: cancel pending slave status handling workqueue during
remove sequence
- tools/power turbostat: Fix build with musl
- tools/power turbostat: Handle cap_get_proc() ENOSYS
- smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in
_smbd_get_connection
- lib/sbitmap: convert shallow_depth from one word to the whole sbitmap
- drm/amdgpu: fix vram reservation issue
- btrfs: qgroup: set quota enabled bit if quota disable fails flushing
reservations
- btrfs: qgroup: fix qgroup create ioctl returning success after quotas
disabled
- btrfs: don't skip remaining extrefs if dir not found during log replay
- btrfs: error on missing block group when unaccounting log tree extent
buffers
- btrfs: fix iteration bug in __qgroup_excl_accounting()
- xfs: fix scrub trace with null pointer in quotacheck
- media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
- PCI: Store all PCIe Supported Link Speeds
- PCI: Allow PCI bridges to go to D3Hot on all non-x86
- PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
- ata: libata-sata: Add link_power_management_supported sysfs attribute
- io_uring/rw: cast rw->flags assignment to rwf_t
- PCI: Honor Max Link Speed when determining supported speeds
- ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is
disabled
- crypto: octeontx2 - Fix address alignment issue on ucode loading
- crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2
- crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0
- btrfs: fix incorrect log message for nobarrier mount option
- btrfs: restore mount option info messages during mount
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
- apparmor: Fix 8-byte alignment for initial dfa blob streams
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
- PCI: imx6: Remove apps_reset toggling from
imx_pcie_{assert/deassert}_core_reset
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
- ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume
context
- drm/amdgpu/discovery: fix fw based ip discovery
- lib/string_choices: Add str_true_false()/str_false_true() helper
- USB: typec: Use str_enable_disable-like helpers
- btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb()
- btrfs: explicitly ref count block_group on new_bgs list
- btrfs: codify pattern for adding block_group to bg_list
- btrfs: zoned: requeue to unused block group list if zone finish failed
- drm/vblank: Introduce drm_crtc_vblank_crtc()
- drm/vblank: add dynamic per-crtc vblank configuration support
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
- arch: consolidate existing CONFIG_PAGE_SIZE_*KB definitions
- arch: simplify architecture specific page size configuration
- [Config] update page size configuration
- arch: define CONFIG_PAGE_SIZE_*KB on all architectures
- [Config] update page size on all architectures
- Mark xe driver as BROKEN if kernel page size is not 4kB
- [Config] disable xe driver where page size is not 4kB
- arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot
- arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC
- arm64: dts: ti: k3-am6*: Add bootph-all property in MMC node
- arm64: dts: ti: k3-am6*: Remove DLL properties for soft PHYs
- arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC
- arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
- drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
- drm/i915/display: add intel_encoder_is_*() and _to_*() functions
- drm/i915/icl+/tc: Cache the max lane count value
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
- cgroup/cpuset: Fix a partition error with CPU hotplug
- drm/tests: Fix endian warning
- RDMA/bnxt_re: Fix a possible memory leak in the driver
- RDMA/hns: Fix dip entries leak on devices newer than hip09
- net: xilinx: axienet: Fix RX skb ring management in DMAengine mode
- drm/hisilicon/hibmc: refactored struct hibmc_drm_private
- drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init
failed
- drm/amd/display: Don't print errors for nonexistent connectors
- net: dsa: microchip: Fix KSZ9477 HSR port setup issue
- net/mlx5: Relocate function declarations from port.h to mlx5_core.h
- net/mlx5e: Extract checking of FEC support for a link mode
- net/mlx5e: Support FEC settings for 100G/lane modes
- net/mlx5: Add IFC bits and enums for buf_ownership
- net/mlx5e: Query FW for buffer ownership
- Upstream stable to v6.6.103, v6.12.43, v6.12.44
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39779
- btrfs: subpage: keep TOWRITE tag until folio is cleaned
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39759
- btrfs: qgroup: fix race between quota disable and quota rescan ioctl
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39705
- drm/amd/display: fix a Null pointer dereference vulnerability
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39707
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39712
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38686
- userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38703
- drm/xe: Make dma-fences compliant with the safe access rules
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39746
- wifi: ath10k: shutdown driver when hardware is unreliable
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39747
- drm/msm: Add error handling for krealloc in metadata setup
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38704
- rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39748
- bpf: Forget ranges when refining tnum after JSET
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38705
- drm/amd/pm: fix null pointer access
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38710
- gfs2: Validate i_depth for exhash directories
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38722
- habanalabs: fix UAF in export_dmabuf()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38732
- netfilter: nf_reject: don't leak dst refcount for loopback packets
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39766
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38734
- net/smc: fix UAF on smcsk after smc_listen_out()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38735
- gve: prevent ethtool ops after shutdown
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39673
- ppp: fix race conditions in ppp_fill_forward_path
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39770
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39675
- drm/amd/display: Add null pointer check in
mod_hdcp_hdcp1_create_session()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39772
- drm/hisilicon/hibmc: fix the hibmc loaded failed bug
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38676
- iommu/amd: Avoid stack buffer overflow from kernel cmdline
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39676
- scsi: qla4xxx: Prevent a potential error pointer dereference
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39773
- net: bridge: fix soft lockup in br_multicast_query_expired()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39679
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39681
- x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39687
- iio: light: as73211: Ensure buffer holes are zeroed
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39683
- tracing: Limit access to parser->buffer when trace_get_user failed
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39801
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39684
- comedi: Fix use of uninitialized memory in do_insn_ioctl() and
do_insnlist_ioctl()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39685
- comedi: pcl726: Prevent invalid irq number
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39686
- comedi: Make insn_rw_emulate_bits() do insn->n samples
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39689
- ftrace: Also allocate and copy hash for reading of filter files
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39691
- fs/buffer: fix use-after-free when call bh_read() helper
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39692
- smb: server: split ksmbd_rdma_stop_listening() out of
ksmbd_rdma_destroy()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39788
- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39693
- drm/amd/display: Avoid a NULL pointer dereference
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39694
- s390/sclp: Fix SCCB present check
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39776
- mm/debug_vm_pgtable: clear page table entries at destroy_args()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38681
- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39800
- btrfs: abort transaction on unexpected eb generation at
btrfs_copy_root()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38684
- net/sched: ets: use old 'nbands' while purging unused classes
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-21884
- net: better track kernel sockets lifetime
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39701
- ACPI: pfr_update: Fix the driver update version check
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39702
- ipv6: sr: Fix MAC comparison to be constant-time
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39703
- net, hsr: reject HSR frame if skb can't hold tag
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39706
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39709
- media: venus: protect against spurious interrupts during probe
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39710
- media: venus: Add a check for packet size after reading from shared
memory
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39711
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
calls
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39713
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39714
- media: usbtv: Lock resolution while streaming
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39715
- parisc: Revise gateway LWS calls to probe user read access
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39716
- parisc: Revise __get_user() to probe user read access
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39781
- parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39782
- jbd2: prevent softlockup in jbd2_log_do_checkpoint()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38677
- f2fs: fix to avoid out-of-boundary access in dnode page
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39718
- vsock/virtio: Validate length in packet header before skb_put()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39783
- PCI: endpoint: Fix configfs group list head handling
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39719
- iio: imu: bno055: fix OOB access of hw_xlate array
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39787
- soc: qcom: mdt_loader: Ensure we don't read past the ELF header
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39720
- ksmbd: fix refcount leak causing resource not released
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39721
- crypto: qat - flush misc workqueue during device shutdown
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39790
- bus: mhi: host: Detect events pointing to unexpected TREs
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39724
- serial: 8250: fix panic due to PSLVERR
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39758
- RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38679
- media: venus: Fix OOB read due to missing payload bound check
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38680
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39736
- mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39737
- mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38683
- hv_netvsc: Fix panic during namespace deletion with VF
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38685
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39738
- btrfs: do not allow relocation of partially dropped subvolumes
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38687
- comedi: fix race between polling and detaching
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39760
- usb: core: config: Prevent OOB read in SS endpoint companion parsing
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38688
- iommufd: Prevent ALIGN() overflow
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39739
- iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38691
- pNFS: Fix uninited ptr deref in block/scsi layout
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39795
- block: avoid possible overflow for chunk_sectors check in
blk_stack_limits()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38692
- exfat: add cluster chain loop check for dir
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38693
- media: dvb-frontends: w7090p: fix null-ptr-deref in
w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38694
- media: dvb-frontends: dib7090p: fix null-ptr-deref in
dib7090p_rw_on_apb()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38695
- scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport
structure
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39742
- RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38696
- MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38697
- jfs: upper bound check of tree index in dbAllocAG
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38698
- jfs: Regular file corruption check
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39743
- jfs: truncate good inode pages when hard link is 0
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38699
- scsi: bfa: Double-free fix
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38700
- scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is
allocated
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38701
- ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38702
- fbdev: fix potential buffer overflow in do_register_framebuffer()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39744
- rcu: Fix rcu_read_unlock() deadloop due to IRQ work
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39761
- wifi: ath12k: Decrement TID on RX peer frag setup error handling
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39797
- xfrm: Duplicate SPI Handling
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39749
- rcu: Protect ->defer_qs_iw_pending from data race
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39750
- wifi: ath12k: Correct tid cleanup when tid setup fails
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38706
- ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39794
- ARM: tegra: Use I/O memcpy to write to IRAM
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39752
- ARM: rockchip: fix kernel hang during smp initialization
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39763
- ACPI: APEI: send SIGBUS to current task if synchronous memory error not
recovered
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38707
- fs/ntfs3: Add sanity check for file name
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38708
- drbd: add missing kref_get in handle_write_conflicts
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39753
- gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38711
- smb/server: avoid deadlock when linking with ReplaceIfExists
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38712
- hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38713
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38714
- hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38715
- hfs: fix slab-out-of-bounds in hfs_bnode_read()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38716
- hfs: fix general protection fault in hfs_find_init()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38718
- sctp: linearize cloned gso packets in sctp_rcv
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38721
- netfilter: ctnetlink: fix refcount leak on table dump
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38614
- eventpoll: Fix semi-unbounded recursion
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39756
- fs: Prevent file descriptor table allocations exceeding INT_MAX
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39798
- NFS: Fix the setting of capabilities when automounting a new filesystem
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38724
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38730
- io_uring/net: commit partial buffers on retry
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38725
- net: usb: asix_devices: add phy_mask for ax88772 mdio bus
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38728
- smb3: fix for slab out of bounds on mount to ksmbd
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-39757
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors
* Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
CVE-2025-38729
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too
* CVE-2025-40297
- net: bridge: fix use-after-free due to MST port state bypass
* CVE-2025-40256
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that
were never added
* CVE-2025-40215
- xfrm: delete x->tunnel as we delete x
* CVE-2025-40214
- af_unix: Initialise scc_index in unix_add_edge().
* CVE-2025-38248
- bridge: mcast: Fix use-after-free during router port configuration
* Enabling crypto selftests causes boot stall on 6.8 (LP: #2135716)
- SAUCE: Revert "crypto: api - Fix boot-up self-test race"
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region
- ASoC: cs35l56: probe() should fail if the device ID is not recognized
- Bluetooth: hci_sync: Fix not disabling advertising instance
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
- pinctrl: amd: Clear GPIO debounce for suspend
- fix proc_sys_compare() handling of in-lookup dentries
- vsock: fix `vsock_proto` declaration
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also
`transport_local`
- net: stmmac: Fix interrupt handling for level-triggered mode in
DWC_XGMAC2
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
- net: phy: smsc: Force predictable MDI-X state on LAN87xx
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
- perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
- x86/mce/amd: Add default names for MCA banks and blocks
- x86/mce/amd: Fix threshold limit reset
- x86/mce: Don't remove sysfs if thresholding sysfs init fails
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing
table.
- gre: Fix IPv6 multicast route creation.
- md/md-bitmap: fix GPF in bitmap_get_stats()
- drm/ttm: fix error handling in ttm_buffer_object_transfer
- drm/gem: Fix race in drm_gem_handle_create_tail()
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
- drm/framebuffer: Acquire internal references on GEM handles
- kallsyms: fix build without execinfo
- maple_tree: fix mt_destroy_walk() on root leaf node
- mm: fix the inaccurate memory statistics issue for users
- scripts/gdb: fix interrupts display after MCP on x86
- scripts/gdb: de-reference per-CPU MCE interrupts
- scripts/gdb: fix interrupts.py after maple tree conversion
- mm/vmalloc: leave lazy MMU mode on PTE mapping error
- pwm: mediatek: Ensure to disable clocks in error path
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
- x86/mm: Disable hugetlb page table sharing on 32-bit
- smb: server: make use of rdma_destroy_qp()
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
- erofs: fix to add missing tracepoint in erofs_read_folio()
- netlink: Fix rmem check in netlink_broadcast_deliver().
- netlink: make sure we allow at least one dump skb
- smb: client: avoid unnecessary reconnects when refreshing referrals
- smb: client: fix DFS interlink failover
- cifs: all initializations for tcon should happen in tcon_info_alloc
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
- net: phy: microchip: limit 100M workaround to link-down events on
LAN88xx
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to
debug level
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
- bnxt_en: Fix DCB ETS validation
- ublk: sanity check add_dev input for underflow
- atm: idt77252: Add missing `dma_map_error()`
- um: vector: Reduce stack usage in vector_eth_configure()
- io_uring: make fallocate be hashed work
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
- net: usb: qmi_wwan: add SIMCom 8230C composition
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
- net: mana: Record doorbell physical address in PF mode
- vt: add missing notification when switching back to text mode
- bpf: Adjust free target to avoid global starvation of LRU map
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
- selftests/bpf: adapt one more case in test_lru_map to the new
target_free
- smb: client: fix potential race in cifs_put_tcon()
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
- drm/amdgpu/ip_discovery: add missing ip_discovery fw
- x86/mce: Ensure user polling settings are honored when restarting timer
- ASoC: fsl_sai: Force a software reset when starting in consumer mode
- wifi: mt76: mt7921: prevent decap offload config before STA
initialization
- wifi: mt76: mt7925: fix the wrong config for tx interrupt
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw
scan
- drm/xe: Allocate PF queue size on pow2 boundary
- clk: scmi: Handle case where child clocks are initialized before their
parents
- erofs: address D-cache aliasing
- wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements
- wifi: cfg80211: fix S1G beacon head validation in nl80211
- wifi: mac80211: correctly identify S1G short beacon
- wifi: mac80211: fix non-transmitted BSSID profile search
- drm/nouveau/gsp: fix potential leak of memory used during acpi init
- erofs: free pclusters if no cached folio is attached
- erofs: get rid of `z_erofs_next_pcluster_t`
- erofs: tidy up zdata.c
- erofs: refine readahead tracepoint
- erofs: fix to add missing tracepoint in erofs_readahead()
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
- selftests: net: lib: Move logging from forwarding/lib.sh here
- selftests: net: lib: fix shift count out of range
- net/mlx5e: Add new prio for promiscuous mode
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
- ALSA: hda/realtek: Add quirks for some Clevo laptops
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment
- erofs: fix rare pcluster memory leak after unmounting
- net: libwx: fix alloc msix vectors failed
- net: wangxun: revert the adjustment of the IRQ vector sequence
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
- KVM: SVM: Set synthesized TSA CPUID flags
- Upstream stable to v6.6.98, v6.6.99, v6.12.38, v6.12.39
- SAUCE: selftests: net: altnames.sh fix following upstream updates
* vrf_route_leaking.sh in net from ubuntu_kernel_selftests linux ADT test
failure with linux/5.11.0-18.19 (Ping received ICMP Packet too big)
(LP: #1928890)
- selftests: net: use slowwait to stabilize vrf_route_leaking test
* ubuntu_bpf failed to build on Noble ( error: ‘struct prog_test_def’ has no
member named ‘should_tmon’) (LP: #2112357)
- selftests/bpf: Factor out get_xlated_program() helper
- selftests/bpf: extract utility function for BPF disassembly
- selftests/bpf: Add traffic monitor functions.
- selftests/bpf: Add the traffic monitor option to test_progs.
* ipsec_offload in rtnetlink.sh from ubunsu_kselftests_net fails on O/J
(LP: #2096976)
- netdevsim: fix rtnetlink.sh selftest
- [SAUCE] Fix selftest/net/rtnetlink.sh for Big Endian
* fib_tests.sh in ubuntu_kernel_selftests failed with IPv4 mangling tests
Connection check - server side (LP: #2012859)
- selftests: rtnetlink: correct error message in rtnetlink.sh fou test
* net:rtnetlink.sh in ubuntu_kernel_selftests failed with FAIL: address
proto IPv4 / IPv6 (LP: #2031531)
- selftests: rtnetlink: skip tests if tools or feats are missing
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740)
- ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
- ethernet: intel: fix building with large NR_CPUS
- ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
- ASoC: Intel: fix SND_SOC_SOF dependencies
- ASoC: amd: yc: add DMI quirk for ASUS M6501RM
- audit,module: restore audit logging in load failure case
- fs_context: fix parameter name in infofc() macro
- ublk: use vmalloc for ublk_device's __queues
- hfsplus: make splice write available again
- hfs: make splice write available again
- ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
- ASoC: ops: dynamically allocate struct snd_ctl_elem_value
- ASoC: mediatek: use reserved memory or enable buffer pre-allocation
- selftests: Fix errno checking in syscall_user_dispatch test
- soc: qcom: QMI encoding/decoding for big endian
- arm64: dts: qcom: sdm845: Expand IMEM region
- arm64: dts: qcom: sc7180: Expand IMEM region
- arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
- ARM: dts: vfxxx: Correctly use two tuples for timer address
- usb: host: xhci-plat: fix incorrect type for of_match variable in
xhci_plat_probe()
- usb: misc: apple-mfi-fastcharge: Make power supply names unique
- vmci: Prevent the dispatching of uninitialized payloads
- pps: fix poll support
- Revert "vmci: Prevent the dispatching of uninitialized payloads"
- usb: early: xhci-dbc: Fix early_ioremap leak
- arm: dts: ti: omap: Fixup pinheader typo
- soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
- ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
- arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
- arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
- cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
- cpufreq: Initialize cpufreq-based frequency-invariance later
- cpufreq: Init policy->rwsem before it may be possibly used
- samples: mei: Fix building on musl libc
- soc: qcom: pmic_glink: fix OF node leak
- interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
- interconnect: qcom: sc8180x: specify num_nodes
- staging: nvec: Fix incorrect null termination of battery manufacturer
- drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
- bpf, sockmap: Fix psock incorrectly pointing to sk
- selftests/bpf: fix signedness bug in redir_partial()
- net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
- drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
- bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
- caif: reduce stack size, again
- wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
- tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
- net: dst: annotate data-races around dst->input
- net: dst: annotate data-races around dst->output
- kselftest/arm64: Fix check for setting new VLs in sve-ptrace
- drm/msm/dpu: Fill in min_prefill_lines for SC8180X
- m68k: Don't unregister boot console needlessly
- drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
- sched/psi: Optimize psi_group_change() cpu_clock() usage
- fbcon: Fix outdated registered_fb reference in comment
- netfilter: nf_tables: Drop dead code from fill_*_info routines
- netfilter: nf_tables: adjust lockdep assertions handling
- arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
- um: rtc: Avoid shadowing err in uml_rtc_start()
- net_sched: act_ctinfo: use atomic64_t for three counters
- xen/gntdev: remove struct gntdev_copy_batch from stack
- tcp: call tcp_measure_rcv_mss() for ooo packets
- wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
- mwl8k: Add missing check after DMA map
- iommu/amd: Fix geometry.aperture_end for V2 tables
- wifi: plfxlc: Fix error handling in usb driver probe
- wifi: mac80211: Do not schedule stopped TXQs
- wifi: mac80211: Don't call fq_flow_idx() for management frames
- wifi: mac80211: Check 802.11 encaps offloading in
ieee80211_tx_h_select_key()
- Reapply "wifi: mac80211: Update skb's control block key in
ieee80211_tx_dequeue()"
- wifi: ath12k: fix endianness handling while accessing wmi service bit
- wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P
IE
- wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
- kcsan: test: Initialize dummy variable
- Bluetooth: hci_event: Mask data status from LE ext adv reports
- tools/rv: Do not skip idle in trace
- can: peak_usb: fix USB FD devices potential malfunction
- can: kvaser_pciefd: Store device channel index
- can: kvaser_usb: Assign netdev.dev_port based on device channel index
- net/mlx5e: Clear Read-Only port buffer size in PBMC before update
- selftests: rtnetlink.sh: remove esp4_offload after test
- vrf: Drop existing dst reference in vrf_ip6_input_dst
- ipv6: annotate data-races around rt->fib6_nsiblings
- bpf/preload: Don't select USERMODE_DRIVER
- PCI: rockchip-host: Fix "Unexpected Completion" log message
- crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
- crypto: qat - use unmanaged allocation for dc_data
- crypto: marvell/cesa - Fix engine load inaccuracy
- mtd: fix possible integer overflow in erase_xfer()
- media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
- power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
- crypto: arm/aes-neonbs - work around gcc-15 warning
- PCI: endpoint: pci-epf-vntb: Return -ENOENT if
pci_epc_get_next_free_bar() fails
- pinctrl: sunxi: Fix memory leak on krealloc failure
- fanotify: sanitize handle_type values when reporting fid
- clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
- Fix dma_unmap_sg() nents value
- perf tools: Fix use-after-free in help_unknown_cmd()
- perf sched: Free thread->priv using priv_destructor
- perf sched: Fix memory leaks for evsel->priv in timehist
- perf sched: Fix memory leaks in 'perf sched latency'
- crypto: inside-secure - Fix `dma_unmap_sg()` nents value
- RDMA/hns: Fix -Wframe-larger-than issue
- kernel: trace: preemptirq_delay_test: use offstack cpu mask
- perf tests bp_account: Fix leaked file descriptor
- clk: sunxi-ng: v3s: Fix de clock definition
- scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
- scsi: elx: efct: Fix dma_unmap_sg() nents value
- scsi: mvsas: Fix dma_unmap_sg() nents value
- scsi: isci: Fix dma_unmap_sg() nents value
- watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
- hwrng: mtk - handle devm_pm_runtime_enable errors
- crypto: keembay - Fix dma_unmap_sg() nents value
- crypto: img-hash - Fix dma_unmap_sg() nents value
- soundwire: stream: restore params when prepare ports fail
- PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem
attribute
- fs/orangefs: Allow 2 more characters in do_c_string()
- dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
- dmaengine: nbpfaxi: Add missing check after DMA map
- ASoC: fsl_xcvr: get channel status data when PHY is not exists
- sh: Do not use hyphen in exported variable name
- perf tools: Remove libtraceevent in .gitignore
- crypto: qat - fix DMA direction for compression on GEN2 devices
- crypto: qat - fix seq_file position update in adf_ring_next()
- jfs: fix metapage reference count leak in dbAllocCtl
- mtd: rawnand: atmel: Fix dma_mapping_error() address
- mtd: rawnand: rockchip: Add missing check after DMA map
- mtd: rawnand: atmel: set pmecc data setup time
- vhost-scsi: Fix log flooding with target does not exist errors
- bpf: Check flow_dissector ctx accesses are aligned
- bpf: Check netfilter ctx accesses are aligned
- apparmor: ensure WB_HISTORY_SIZE value is a power of 2
- apparmor: fix loop detection used in conflicting attachment resolution
- module: Restore the moduleparam prefix length check
- ucount: fix atomic_long_inc_below() argument type
- rtc: ds1307: fix incorrect maximum clock rate handling
- rtc: hym8563: fix incorrect maximum clock rate handling
- rtc: nct3018y: fix incorrect maximum clock rate handling
- rtc: pcf85063: fix incorrect maximum clock rate handling
- rtc: pcf8563: fix incorrect maximum clock rate handling
- rtc: rv3028: fix incorrect maximum clock rate handling
- f2fs: doc: fix wrong quota mount option description
- f2fs: fix to update upper_p in __get_secs_required() correctly
- f2fs: fix to calculate dirty data during has_not_enough_free_secs()
- vfio: Fix unbalanced vfio_df_close call in no-iommu mode
- vfio: Prevent open_count decrement to negative
- vfio/pci: Separate SR-IOV VF dev_set
- scsi: mpt3sas: Fix a fw_event memory leak
- scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
- scsi: ufs: core: Use link recovery when h8 exit fails during runtime
resume
- scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
- kconfig: qconf: fix ConfigList::updateListAllforAll()
- sched/psi: Fix psi_seq initialization
- PCI: pnv_php: Work around switches with broken presence detection
- powerpc/eeh: Export eeh_unfreeze_pe()
- pNFS/flexfiles: don't attempt pnfs on fatal DS errors
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
- NFSv4.2: another fix for listxattr
- NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
- md/md-cluster: handle REMOVE message earlier
- netpoll: prevent hanging NAPI when netcons gets enabled
- phy: mscc: Fix parsing of unicast frames
- net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
- netlink: specs: ethtool: fix module EEPROM input/output arguments
- net/mlx5: Correctly set gso_segs when LRO is used
- net/sched: taprio: enforce minimum value for picos_per_byte
- benet: fix BUG when creating VFs
- irqchip: Build IMX_MU_MSI only on ARM
- ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
- smb: server: remove separate empty_recvmsg_queue
- smb: server: make sure we call ib_dma_unmap_single() only if we called
ib_dma_map_single already
- smb: server: let recv_done() consistently call
put_recvmsg/smb_direct_disconnect_rdma_connection
- smb: server: let recv_done() avoid touching data_transfer after
cleanup/move
- smb: client: Use min() macro
- smb: client: Correct typos in multiple comments across various files
- smb: smbdirect: add smbdirect_socket.h
- smb: client: make use of common smbdirect_socket
- smb: client: make sure we call ib_dma_unmap_single() only if we called
ib_dma_map_single already
- smb: client: let recv_done() cleanup before notifying the callers.
- pptp: fix pptp_xmit() error path
- smb: client: return an error if rdma_connect does not return within 5
seconds
- selftests/perf_events: Add a mmap() correctness test
- ksmbd: fix corrupted mtime and ctime in smb2_open
- smb: server: Fix extension string in ksmbd_extract_shortname()
- USB: serial: option: add Foxconn T99W709
- Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
- net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
- net: usbnet: Fix the wrong netif_carrier_on() call
- ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
- ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
- x86/fpu: Delay instruction pointer fixup until after warning
- MIPS: mm: tlb-r4k: Uniquify TLB entries on init
- mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
- ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
- arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
- arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
- mei: vsc: Destroy mutex after freeing the IRQ
- mei: vsc: Event notifier fixes
- mei: vsc: Unset the event callback on remove and probe errors
- arm64: dts: st: fix timer used for ticks
- selftests: breakpoints: use suspend_stats to reliably check suspend
success
- PM / devfreq: Fix a index typo in trans_stat
- drm/panfrost: Fix panfrost device variable name in devfreq
- selftests/bpf: Fix unintentional switch case fall through
- drm/amdgpu: Remove nbiov7.9 replay count reporting
- bpf: Ensure RCU lock is held around bpf_prog_ksym_find
- refscale: Check that nreaders and loops multiplication doesn't overflow
- iommu/amd: Enable PASID and ATS capabilities in the correct order
- file: add take_fd() cleanup helper
- file: fix typo in take_fd() comment
- rcu: Fix delayed execution of hurry callbacks
- ring-buffer: Remove ring_buffer_read_prepare_sync()
- net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863
- stmmac: xsk: fix negative overflow of budget in zerocopy mode
- pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state()
- dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
- phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
- perf dso: Add missed dso__put to dso__load_kcore
- mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
- perf sched: Make sure it frees the usage string
- perf sched: Fix memory leaks in 'perf sched map'
- perf sched: Use RC_CHK_EQUAL() to compare pointers
- RDMA/hns: Fix HW configurations not cleared in error flow
- RDMA/hns: Get message length of ack_req from FW
- RDMA/hns: Add mutex_destroy()
- RDMA/hns: Fix accessing uninitialized resources
- RDMA/hns: Drop GFP_NOWARN
- crypto: qat - disable ZUC-256 capability for QAT GEN5
- remoteproc: xlnx: Disable unsupported features
- perf record: Cache build-ID of hit DSOs only
- vdpa: Fix IDR memory leak in VDUSE module exit
- vhost: Reintroduce kthread API and add mode selection
- [Config] enable VHOST_ENABLE_FORK_OWNER_CONTROL
- apparmor: Fix unaligned memory accesses in KUnit test
- f2fs: turn off one_time when forcibly set to foreground GC
- exfat: fdatasync flag should be same like generic_write_sync()
- s390/ap: Unmask SLCF bit in card and queue ap functions sysfs
- block: Fix default IO priority if there is no IO context
- ASoC: tas2781: Fix the wrong step for TLV on tas2781
- s390/mm: Allocate page table with PAGE_SIZE granularity
- smb: client: remove separate empty_packet_queue
- smb: client: let recv_done() avoid touching data_transfer after
cleanup/move
- drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type
- drm/i915/hdmi: propagate errors from intel_hdmi_init_connector()
- drm/i915/hdmi: add error handling in g4x_hdmi_init()
- drm/i915/ddi: gracefully handle errors from
intel_ddi_init_hdmi_connector()
- drm/i915/display: add intel_encoder_is_hdmi()
- drm/i915/ddi: only call shutdown hooks for valid encoders
- PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state()
- PCI/ASPM: Fix L1SS saving
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
- s390/mm: Remove possible false-positive warning in pte_free_defer()
- Upstream stable to v6.6.102, v6.12.42
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38619
- media: ti: j721e-csi2rx: fix list_del corruption
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38582
- RDMA/hns: Fix double destruction of rsv_qp
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38585
- staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38593
- Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-39732
- wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38595
- xen: fix UAF in dmabuf_exp_from_pages()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38660
- parse_longname(): strrchr() expects NUL-terminated string
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38555
- usb: gadget : fix use-after-free in composite_dev_cleanup()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2024-36331 // CVE-2025-38560
- x86/sev: Evict cache lines during SNP memory validation
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38501
- ksmbd: limit repeated connections from clients with the same IP
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38562
- ksmbd: fix null pointer dereference error in generate_encryptionkey
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38566
- sunrpc: fix handling of server side tls alerts
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38568
- net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38571
- sunrpc: fix client side handling of tls alerts
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38622
- net: drop UFO packets in udp_rcv_segment()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38572
- ipv6: reject malicious packets in ipv6_gso_segment()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38574
- pptp: ensure minimal skb length in pptp_xmit()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-39730
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38623
- PCI: pnv_php: Fix surprise plug detection and recovery
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38576
- powerpc/eeh: Make EEH driver device hotplug safe
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38624
- PCI: pnv_php: Clean up allocated IRQs on unplug
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38625
- vfio/pds: Fix missing detach_ioas op
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38626
- f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-39731
- f2fs: vm_unmap_ram() may be called from an invalid context
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38652
- f2fs: fix to avoid out-of-boundary access in devs.path
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38577
- f2fs: fix to avoid panic in f2fs_evict_inode
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38578
- f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38579
- f2fs: fix KMSAN uninit-value in extent_info usage
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38630
- fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38632
- pinmux: fix race causing mux_owner NULL with active mux_usecount
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38653
- proc: use the same treatment to check proc_lseek as ones for
proc_read_iter et.al
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38581
- crypto: ccp - Fix crash when rebind ccp device for ccp.ko
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38634
- power: supply: cpcap-charger: Fix null check for
power_supply_get_by_name
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38583
- clk: xilinx: vcu: unregister pll_post only if registered correctly
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38635
- clk: davinci: Add NULL check in davinci_lpsc_clk_register()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38587
- ipv6: fix possible infinite loop in fib6_info_uses_dev()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38588
- ipv6: prevent infinite loop in rt6_nlmsg_size()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38590
- net/mlx5e: Remove skb secpath if xfrm state is not found
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38639
- netfilter: xt_nfacct: don't assume acct name is null-terminated
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38640
- bpf: Disable migration in nf_hook_run_bpf().
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38644
- wifi: mac80211: reject TDLS operations when station is not associated
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38553
- net/sched: Restrict conditions for adding duplicating netems to qdisc
tree
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38645
- net/mlx5: Check device memory pointer before usage
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38601
- wifi: ath11k: clear initialized flag for deinit-ed srng lists
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38602
- iwlwifi: Add missing check for alloc_ordered_workqueue
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38604
- wifi: rtl818x: Kill URBs before clearing tx status queue
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38646
- wifi: rtw89: avoid NULL dereference when RX problematic packet on
unsupported 6 GHz band
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38608
- bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38609
- PM / devfreq: Check governor before using governor->name
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38610
- powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38612
- staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38648
- spi: stm32: Check for cfg availability in stm32_spi_probe
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38659
- gfs2: No more self recovery
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-39734
- Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38650
- hfsplus: remove mutex_lock check in hfsplus_free_extents
* Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
CVE-2025-38615
- fs/ntfs3: cancle set bad inode after removing name fails
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361)
- virtio_ring: Fix error reporting in virtqueue_resize
- RDMA/core: Rate limit GID cache warning messages
- interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
- iio: adc: ad7949: use spi_is_bpw_supported()
- regmap: fix potential memory leak of regmap_bus
- x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
- platform/x86: Fix initialization order for firmware_attributes_class
- staging: vchiq_arm: Make vchiq_shutdown never fail
- net/mlx5: Fix memory leak in cmd_exec()
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
- i40e: report VF tx_dropped with tx_errors instead of tx_discards
- i40e: When removing VF MAC filters, only check PF-set MAC
- drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
- net: hns3: fix concurrent setting vlan filter issue
- net: hns3: disable interrupt when ptp init failed
- net: hns3: fixed vf get max channels bug
- net: hns3: default enable tx bounce buffer when smmu enabled
- platform/x86: ideapad-laptop: Fix kbd backlight not remembered among
boots
- i2c: tegra: Fix reset error handling with ACPI
- i2c: virtio: Avoid hang by using interruptible completion wait
- bus: fsl-mc: Fix potential double device reference in
fsl_mc_get_endpoint()
- sprintf.h requires stdarg.h
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
- dpaa2-eth: Fix device reference count leak in MAC endpoint handling
- dpaa2-switch: Fix device reference count leak in MAC endpoint handling
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
- e1000e: ignore uninitialized checksum word on tgp
- gve: Fix stuck TX queue for DQ queue format
- kasan: use vmalloc_dump_obj() for vmalloc error reports
- resource: fix false warning in __request_region()
- selftests: mptcp: connect: also cover alt modes
- selftests: mptcp: connect: also cover checksum
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
- usb: typec: tcpm: allow to use sink in accessory mode
- usb: typec: tcpm: allow switching to mode accessory to mux properly
- usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
- comedi: comedi_test: Fix possible deletion of uninitialized timers
- ALSA: hda/tegra: Add Tegra264 support
- ALSA: hda: Add missing NVIDIA HDA codec IDs
- drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
- crypto: powerpc/poly1305 - add depends on BROKEN for now
- [Config] disable CRYPTO_POLY1305_P10
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation
- iio: hid-sensor-prox: Restore lost scale assignments
- mtd: rawnand: qcom: Fix last codeword read in
qcom_param_page_type_exec()
- ksmbd: add free_transport ops in ksmbd connection
- arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1
register
- ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
- Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid()
test"
- x86/traps: Initialize DR7 by writing its architectural reset value
- virtio_net: Enforce minimum TX ring size for reliability
- platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA
- platform/mellanox: mlxbf-pmc: Remove newline char from event name input
- platform/mellanox: mlxbf-pmc: Validate event/enable input
- platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input
- xfrm: state: use a consistent pcpu_id in xfrm_state_find
- xfrm: Set transport header to fix UDP GRO handling
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop
- drm/sched: Remove optimization that causes hang when killing dependent
jobs
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in
advisor_mode_show()
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx
- rust: give Clippy the minimum supported Rust version
- selftests/bpf: Add tests with stack ptr register in conditional jmp
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
- ext4: don't explicit update times in ext4_fallocate()
- ext4: refactor ext4_punch_hole()
- ext4: refactor ext4_zero_range()
- ext4: refactor ext4_collapse_range()
- ext4: refactor ext4_insert_range()
- ext4: factor out ext4_do_fallocate()
- ext4: move out inode_lock into ext4_fallocate()
- fs: sort out the fallocate mode vs flag mess
- ext4: move out common parts into ext4_fallocate()
- ext4: fix incorrect punch max_end
- ext4: correct the error handle in ext4_fallocate()
- ext4: fix out of bounds punch offset
- KVM: x86: drop x86.h include from cpuid.h
- KVM: x86: Route non-canonical checks in emulator through emulate_ops
- KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical
checks
- KVM: x86: model canonical checks more precisely
- x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()
- arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
- Drivers: hv: Make the sysfs node size for the ring buffer dynamic
- Upstream stable to v6.6.101, v6.12.41
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38351
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38675
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38322
- perf/x86/intel: Fix crash in icl_update_topdown_event()
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-37777
- ksmbd: fix use-after-free in __smb2_lease_break_noti()
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-37925
- jfs: reject on-disk inodes of an unsupported type
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38663
- nilfs2: reject invalid file types when reading inodes
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38664
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38670
- arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38671
- i2c: qup: jump out of the loop in case of timeout
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-39726
- s390/ism: fix concurrency management in ism_cmd()
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38665
- can: netlink: can_changelink(): fix NULL pointer deref of struct
can_priv::do_set_mode
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38668
- regulator: core: fix NULL dereference on unbind due to stale coupling
data
* Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
CVE-2025-38335
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
- phy: tegra: xusb: Disable periodic tracking on Tegra234
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
- USB: serial: option: add Foxconn T99W640
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
- usb: musb: fix gadget state on disconnect
- i2c: stm32: fix the device used for the DMA map
- thunderbolt: Fix wake on connect at runtime
- thunderbolt: Fix bit masking in tb_dp_port_set_hops()
- nvmem: imx-ocotp: fix MAC address byte length
- Input: xpad - set correct controller type for Acer NGR200
- pch_uart: Fix dma_sync_sg_for_device() nents value
- spi: Add check for 8-bit transfer with 8 IO mode support
- HID: core: ensure __hid_request reserves the report ID as the first byte
- tracing/probes: Avoid using params uninitialized in parse_btf_arg()
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
- io_uring/poll: fix POLLERR handling
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
pep_sock_accept()
- net/mlx5: Update the list of the PCI supported devices
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
- af_packet: fix soft lockup issue caused by tpacket_snd()
- isofs: Verify inode mode when loading from disk
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
- mmc: bcm2835: Fix dma_unmap_sg() nents value
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
Positivo models
- mmc: sdhci_am654: Workaround for Errata i2312
- pmdomain: governor: Consider CPU latency tolerance from
pm_domain_cpu_gov
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
- iio: adc: max1363: Reorder mode_list[] entries
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler
- comedi: Fix some signed shift left operations
- soundwire: amd: fix for handling slave alerts after link is down
- soundwire: amd: fix for clearing command status register
- cachefiles: Fix the incorrect return value in __cachefiles_write()
- net: emaclite: Fix missing pointer increment in aligned_read()
- block: fix kobject leak in blk_unregister_queue
- nvme: fix inconsistent RCU list manipulation in
nvme_ns_add_to_ctrl_list()
- nvme: fix misaccounting of nvme-mpath inflight I/O
- wifi: cfg80211: remove scan request n_channels counted_by
- selftests: net: increase inter-packet timeout in udpgro.sh
- Bluetooth: hci_sync: fix connectable extended advertising when using
static random address
- Bluetooth: SMP: If an unallowed command is received consider it a
failure
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant
without board ID
- net/mlx5: Correctly set gso_size when LRO is used
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent
IPv6 addrconf
- net: bridge: Do not offload IGMP/MLD messages
- rxrpc: Fix transmission of an abort in response to an abort
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
- sched: Change nr_uninterruptible type to unsigned long
- ipv6: make addrconf_wq single threaded
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
pm
- usb: hub: Fix flushing of delayed work used for post resume purposes
- usb: hub: Don't try to recover devices lost during warm reset.
- usb: dwc3: qcom: Don't leave BCR asserted
- i2c: omap: Add support for setting mux
- [Config] make mux support built-in on arm
- i2c: omap: Fix an error handling path in omap_i2c_probe()
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
- Revert "selftests/bpf: adjust dummy_st_ops_success to detect additional
error"
- Revert "selftests/bpf: dummy_st_ops should reject 0 for non-nullable
params"
- i2c: omap: fix deprecated of_property_read_bool() use
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion
- i2c: stm32f7: unmap DMA mapped buffer
- drm/amdgpu: Increase reset counter only on success
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
- mptcp: reset fallback status gracefully at disconnect() time
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
- nvme: fix endianness of command word prints in nvme_log_err_passthru()
- nvmet-tcp: fix callback lock for TLS handshake
- can: tcan4x5x: add option for selecting nWKRQ voltage
- can: tcan4x5x: fix reset gpio usage during probe
- ice: check correct pointer in fwlog debugfs
- riscv: Enable interrupt during exception handling
- riscv: traps_misaligned: properly sign extend value in misaligned load
handler
- Bluetooth: hci_core: add missing braces when using macro parameters
- drm/mediatek: Add wait_event_timeout when disabling plane
- drm/mediatek: only announce AFBC if really supported
- net: libwx: fix multicast packets received count
- sched,freezer: Remove unnecessary warning in __thaw_task
- drm/xe/mocs: Initialize MOCS index early
- drm/xe: Move page fault init after topology init
- smb: client: let smbd_post_send_iter() respect the peers max_send_size
and transmit all data
- Upstream stable to v6.6.100, v6.12.40
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-22115
- btrfs: fix block group refcount race in
btrfs_create_pending_block_groups()
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38549
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38551
- virtio-net: fix recursived rtnl_lock() during probe()
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38531
- iio: common: st_sensors: Fix use of uninitialize device structs
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38552
- mptcp: plug races between subflow fail and subflow creation
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38491
- mptcp: make fallback action and fallback decision atomic
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38469
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll
hypercalls
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38499
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the
right userns
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38524
- rxrpc: Fix recv-recv race of completed call
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38468
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38470
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
runtime
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38471
- tls: always refresh the queue when reading sock
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38472
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38550
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38473
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38474
- usb: net: sierra: check for no status endpoint
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38526
- ice: add NULL check in eswitch lag check
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38548
- hwmon: (corsair-cpro) Validate the size of the received input buffer
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38537
- net: phy: Don't register LEDs for genphy
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38527
- smb: client: fix use-after-free in cifs_oplock_break
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38476
- rpl: Fix use-after-free in rpl_do_srh_inline().
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38528
- bpf: Reject %p% format string in bprintf-like helpers
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38478
- comedi: Fix initialization of data for instructions that write to
subdevice
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38480
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38481
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38482
- comedi: das6402: Fix bit shift out of bounds
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38483
- comedi: das16m1: Fix bit shift out of bounds
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38529
- comedi: aio_iiro_16: Fix bit shift out of bounds
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38530
- comedi: pcl812: Fix bit shift out of bounds
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38485
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38487
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2024-50047 fix. // CVE-2025-38488
- smb: client: fix use-after-free in crypt_message when using async crypto
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38489
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38532
- net: libwx: properly reset Rx ring descriptor
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38533
- net: libwx: fix the using of Rx buffer DMA
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38490
- net: libwx: remove duplicate page_pool_put_full_page()
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38538
- dmaengine: nbpfaxi: Fix memory corruption in probe()
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38493
- tracing/osnoise: Fix crash in timerlat_dump_stack()
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38539
- tracing: Add down_write(trace_event_sem) when adding trace event
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38494
- HID: core: do not bypass hid_hw_raw_request
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38495
- HID: core: ensure the allocated report buffer can contain the reserved
report ID
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38496
- dm-bufio: fix sched in atomic context
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38497
- usb: gadget: configfs: Fix OOB read on empty string write
* Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
CVE-2025-38535
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382)
- configfs: Do not override creating attribute file failure in
populate_attrs()
- crypto: marvell/cesa - Do not chain submitted requests
- gfs2: move msleep to sleepable context
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
- io_uring: account drain memory to cgroup
- io_uring/kbuf: account ring io_buffer_list memory
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power
states
- regulator: max20086: Fix MAX200086 chip id
- regulator: max20086: Change enable gpio to optional
- net/mlx5_core: Add error handling
inmlx5_query_nic_vport_qkey_viol_cntr()
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
- wifi: ath11k: fix rx completion meta data corruption
- wifi: ath11k: fix ring-buffer corruption
- SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
- wifi: ath12k: fix ring-buffer corruption
- wifi: rtw88: usb: Reduce control message timeout to 500 ms
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
- media: ov8856: suppress probe deferral errors
- media: ov5675: suppress probe deferral errors
- media: nxp: imx8-isi: better handle the m2m usage_count
- media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
- media: davinci: vpif: Fix memory leak in probe error path
- media: gspca: Add error handling for stv06xx_read_sensor()
- media: mediatek: vcodec: Correct vsi_core framebuffer size
- media: omap3isp: use sgtable-based scatterlist wrappers
- media: v4l2-dev: fix error handling in __video_register_device()
- media: venus: Fix probe error handling
- media: videobuf2: use sgtable-based scatterlist wrappers
- media: imx-jpeg: Drop the first error frames
- media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
- media: imx-jpeg: Reset slot data pointers when freed
- media: uvcvideo: Return the number of processed controls
- media: uvcvideo: Send control events for partial succeeds
- media: uvcvideo: Fix deferred probing error
- arm64/mm: Close theoretical race where stale TLB entry remains valid
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
- bus: mhi: host: Fix conflict between power_up and SYSERR
- can: tcan4x5x: fix power regulator retrieval during probe
- ceph: set superblock s_magic for IMA fsmagic matching
- cgroup,freezer: fix incomplete freezing when attaching tasks
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
- bus: fsl-mc: fix GET/SET_TAILDROP command ids
- ext4: fix calculation of credits for extent tree modification
- ext4: factor out ext4_get_maxbytes()
- ext4: ensure i_size is smaller than maxbytes
- Input: gpio-keys - fix possible concurrent access in
gpio_keys_irq_timer()
- net: ftgmac100: select FIXED_PHY
- EDAC/altera: Use correct write width with the INTTEST register
- parisc/unaligned: Fix hex output to show 8 hex chars
- parisc: fix building with gcc-15
- clk: meson-g12a: add missing fclk_div2 to spicc
- watchdog: fix watchdog may detect false positive of softlockup
- mm: fix ratelimit_pages update error in dirty_ratio_handler()
- mtd: rawnand: sunxi: Add randomizer configuration in
sunxi_nfc_hw_ecc_write_chunk
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable
- KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
- KVM: VMX: Flush shadow VMCS on emergency reboot
- dm-mirror: fix a tiny race condition
- dm-verity: fix a memory leak if some arguments are specified multiple
times
- mtd: rawnand: qcom: Fix read len for onfi param page
- phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
- KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
- staging: iio: ad5933: Correct settling cycles encoding per datasheet
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
- regulator: max14577: Add error check for max14577_read_reg()
- cifs: reset connections for all channels when reconnect requested
- cifs: update dstaddr whenever channel iface is updated
- cifs: dns resolution is needed only for primary channel
- Drivers: hv: Allocate interrupt and monitor pages aligned to system page
boundary
- uio_hv_generic: Use correct size for interrupt and monitor pages
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback
- PCI: Add ACS quirk for Loongson PCIe
- PCI: Fix lock symmetry in pci_slot_unlock()
- PCI: dw-rockchip: Fix PHY function call sequence in
rockchip_pcie_phy_deinit()
- iio: accel: fxls8962af: Fix temperature scan element sign
- iio: imu: inv_icm42600: Fix temperature calculation
- iio: adc: ad7606_spi: fix reg write value mask
- ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification
- power: supply: collie: Fix wakeup source leaks on device unbind
- mmc: Add quirk to disable DDR50 tuning
- ACPICA: Avoid sequence overread in call to strncmp()
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
- ACPI: bus: Bail out if acpi_kobj registration fails
- ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
- power: supply: bq27xxx: Retrieve again when busy
- ACPICA: utilities: Fix overflow check in vsnprintf()
- ASoC: tegra210_ahub: Add check to of_device_get_match_data()
- gpiolib: of: Add polarity quirk for s5m8767
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
- net: macb: Check return value of dma_set_mask_and_coherent()
- tipc: use kfree_sensitive() for aead cleanup
- f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
- i2c: designware: Invoke runtime suspend on quick slave re-registration
- emulex/benet: correct command version selection in be_cmd_get_stats()
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
- wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
- sctp: Do not wake readers in __sctp_write_space()
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
- i2c: npcm: Add clock toggle recovery
- net: dlink: add synchronization for stats update
- wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
- wifi: ath12k: fix a possible dead lock caused by ab->base_lock
- wifi: ath11k: Fix QMI memory reuse logic
- wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
- tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
- net: atlantic: generate software timestamp just before the doorbell
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
- pinctrl: armada-37xx: propagate error from
armada_37xx_gpio_get_direction()
- pinctrl: armada-37xx: propagate error from
armada_37xx_pmx_gpio_set_direction()
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
- net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
- wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
- wifi: mac80211: do not offer a mesh path if forwarding is disabled
- clk: rockchip: rk3036: mark ddrphy as critical
- libbpf: Add identical pointer detection to btf_dedup_is_equiv()
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64
commands
- iommu/amd: Ensure GA log notifier callbacks finish running before module
unload
- wifi: iwlwifi: pcie: make sure to lock rxq->read
- wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
- wifi: mac80211: VLAN traffic in multicast path
- wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
- net: bridge: mcast: update multicast contex when vlan state is changed
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port
functions
- vxlan: Do not treat dst cache initialization errors as fatal
- net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
- pinctrl: mcp23s08: Reset all pins to input at probe
- wifi: ath12k: fix failed to set mhi state error during reboot with
hardware grouping
- sock: Correct error checking condition for (assign|release)_proto_idx()
- ice: fix check for existing switch rule
- usbnet: asix AX88772: leave the carrier control to phylink
- f2fs: fix to set atomic write status more clear
- bpf, sockmap: Fix data lost during EAGAIN retries
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
- wifi: ath11k: determine PM policy based on machine model
- wifi: ath12k: fix link valid field initialization in the monitor Rx
- wifi: ath12k: fix incorrect CE addresses
- wifi: ath12k: Pass correct values of center freq1 and center freq2 for
160 MHz
- watchdog: da9052_wdt: respect TWDMIN
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
- tee: Prevent size calculation wraparound on 32-bit kernels
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices
first"
- fs/xattr.c: fix simple_xattr_list()
- platform/x86/amd: pmc: Clear metrics table at start of cycle
- platform/x86: dell_rbu: Stop overwriting data buffer
- powerpc/vdso: Fix build of VDSO32 with pcrel
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH
recovery
- io_uring: fix task leak issue in io_wq_create()
- platform/loongarch: laptop: Get brightness setting from EC on probe
- platform/loongarch: laptop: Unregister generic_sub_drivers on exit
- LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
- cifs: deal with the channel loading lag while picking channels
- cifs: serialize other channels when query server interfaces is pending
- cifs: do not disable interface polling on failure
- smb: improve directory cache reuse for readdir operations
- scsi: storvsc: Increase the timeouts to storvsc_timeout
- scsi: s390: zfcp: Ensure synchronous unit_add
- udmabuf: use sgtable-based scatterlist wrappers
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
- platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
- Input: sparcspkr - avoid unannotated fall-through
- wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
- arm64: Restrict pagetable teardown to avoid false warning
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound
card
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
- iio: accel: fxls8962af: Fix temperature calculation
- net: Fix checksum update for ILA adj-transport
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
- erofs: remove unused trace event erofs_destroy_inode
- smb: fix secondary channel creation issue with kerberos by populating
hostname when adding channels
- drm/msm/disp: Correct porch timing for SDM845
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
- ionic: Prevent driver/fw getting out of sync on devcmd(s)
- drm/nouveau/bl: increase buffer size to avoid truncate warning
- drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
- hwmon: (occ) Rework attribute registration for stack usage
- hwmon: (occ) fix unaligned accesses
- pldmfw: Select CRC32 when PLDMFW is selected
- net: ice: Perform accurate aRFS flow match
- ptp: fix breakage after ptp_vclock_in_use() rework
- ptp: allow reading of currently dialed frequency to succeed on free-
running clocks
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen()
behavior
- tcp: fix passive TFO socket having invalid NAPI ID
- net: microchip: lan743x: Reduce PTP timeout on HW failure
- EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
- dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
- net: make for_each_netdev_dump() a little more bug-proof
- serial: sh-sci: Increment the runtime usage counter for the earlycon
device
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
- smb: client: fix first command failure during re-negotiation
- platform/loongarch: laptop: Add backlight power control support
- s390/pci: Fix __pcilg_mio_inuser() inline assembly
- perf: Fix cgroup state vs ERROR
- perf/core: Fix WARN in perf_cgroup_switch()
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
- RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
- RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
- perf evsel: Missed close() when probing hybrid core PMUs
- crypto: qat - add shutdown handler to qat_c3xxx
- crypto: qat - add shutdown handler to qat_420xx
- crypto: qat - add shutdown handler to qat_4xxx
- crypto: qat - add shutdown handler to qat_c62x
- crypto: qat - add shutdown handler to qat_dh895xcc
- wifi: mt76: mt7925: fix host interrupt register initialization
- wifi: rtw88: usb: Upload the firmware in bigger chunks
- NFSD: unregister filesystem in case genl_register_family() fails
- NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
- media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
- media: i2c: imx335: Fix frame size enumeration
- soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
- sysfb: Fix screen_info type check for VGA
- ovl: Fix nested backing file paths
- Drivers: hv: vmbus: Add utility function for querying ring size
- uio_hv_generic: Query the ringbuffer size for device
- uio_hv_generic: Align ring size to system page
- PCI: dwc: ep: Correct PBA offset in .set_msix() callback
- PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from
rockchip_pcie_link_up()
- accel/ivpu: Improve buffer object logging
- accel/ivpu: Fix warning in ivpu_gem_bo_free()
- tty: vt: make init parameter of consw::con_init() a bool
- tty: vt: sanitize arguments of consw::con_clear()
- tty: vt: make consw::con_switch() return a bool
- dummycon: Trigger redraw when switching consoles with deferred takeover
- ACPICA: Apply pack(1) to union aml_resource
- ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios
laptops
- pmdomain: core: Reset genpd->states to avoid freeing invalid data
- power: supply: max17040: adjust thermal channel scaling
- Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
- Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
- wifi: mt76: mt7925: introduce thermal protection
- libbpf/btf: Fix string handling to support multi-split BTF
- clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
- iommu/amd: Allow matching ACPI HID devices without matching UIDs
- tcp: remove zero TCP TS samples for autotuning
- tcp: add receive queue awareness in tcp_rcv_space_adjust()
- bpf: Pass the same orig_call value to trampoline functions
- net: stmmac: generate software timestamp just before the doorbell
- hid-asus: check ROG Ally MCU version and warn
- wifi: iwlwifi: mvm: fix beacon CCK flag
- scsi: smartpqi: Add new PCI IDs
- Revert "mac80211: Dynamically set CoDel parameters per station"
- bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
- wifi: ath12k: using msdu end descriptor to check for rx multicast
packets
- isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
- ixgbe: Fix unreachable retry logic in combined and byte I2C write
functions
- RDMA/hns: initialize db in update_srq_db()
- platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
- LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
- nvme: always punt polled uring_cmd end_io work to task_work
- mm: close theoretical race where stale TLB entries could linger
- x86/virt/tdx: Avoid indirect calls to TDX assembly functions
- wifi: rtw89: phy: add dummy C2H event handler for report of TAS power
- ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP
Victus 15-fa1xxx
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
- drm/amdgpu: read back register after written for VCN v4.0.5
- Kunit to check the longest symbol length
- x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
- ipv6: remove leftover ip6 cookie initializer
- ipv6: replace ipcm6_init calls with ipcm6_init_sk
- drm/ssd130x: fix ssd132x_clear_screen() columns
- workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
- mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
- gpio: pca953x: fix wrong error probe return value
- bpftool: Fix cgroup command to only show cgroup bpf programs
- Upstream stable to v6.6.95, v6.12.35
- bpftool: Query only cgroup-related attach types
- bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38507
- HID: nintendo: avoid bluetooth suspend/resume stalls
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38511
- drm/xe/pf: Clear all LMTT pages on alloc
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38520
- drm/amdkfd: Don't call mmput from MMU notifier callback
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38521
- drm/imagination: Fix kernel crash when hard resetting the GPU
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38506
- KVM: Allow CPU to reschedule while setting per-page memory attributes
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38104
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to
avoid Priority Inversion in SRIOV
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38067
- rseq: Fix segfault on registration when rseq_cs is non-zero
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-37984
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38437
- ksmbd: fix potential use-after-free in oplock/lease break ack
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38510
- kasan: remove kasan_find_vm_area() to prevent possible deadlock
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38503
- btrfs: fix assertion when building free space tree
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38439
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38542
- net: appletalk: Fix device refcount leak in atrtr_create()
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38441
- netfilter: flowtable: account for Ethernet header in
nf_flow_pppoe_proto()
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38443
- nbd: fix uaf in nbd_genl_connect() error path
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38444
- raid10: cleanup memleak at raid10_make_request
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38445
- md/raid1: Fix stack memory use after return in raid1_reshape
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38543
- drm/tegra: nvdec: Fix dma_alloc_coherent error check
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38513
- wifi: zd1211rw: Fix potential NULL pointer dereference in
zd_mac_tx_to_dev()
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38448
- usb: gadget: u_serial: Fix race condition in TTY wakeup
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38515
- drm/sched: Increment job count before swapping tail spsc queue
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38449
- drm/gem: Acquire references on GEM handles for framebuffers
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38516
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38455
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-
flight
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38456
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38514
- rxrpc: Fix oops due to non-existence of prealloc backlog struct
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38544
- rxrpc: Fix bug due to prealloc collision
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38457
- net/sched: Abort __tc_modify_qdisc if parent class does not exist
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38458
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38459
- atm: clip: Fix infinite recursive call of clip_push().
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38546
- atm: clip: Fix memory leak of struct clip_vcc.
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38460
- atm: clip: Fix potential null-ptr-deref in to_atmarpd().
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38461
- vsock: Fix transport_* TOCTOU
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38462
- vsock: Fix transport_{g2h,h2g} TOCTOU
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38463
- tcp: Correct signedness in skb remaining space calculation
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38464
- tipc: Fix use-after-free in tipc_conn_close().
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38465
- netlink: Fix wraparounds of sk->sk_rmem_alloc.
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38466
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38467
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
* Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
CVE-2025-38349
- eventpoll: don't decrement ep refcount while still holding the ep mutex
* [UBUNTU 24.04] KVM: s390: improve interrupt cpu for wakeup (LP: #2132317)
- KVM: s390: improve interrupt cpu for wakeup
* veth.sh from ubuntu_kselftests_net failed on J-5.15 / N-6.8 (with xdp
attached - gro flag) (LP: #2065369)
- selftests: net: veth: test the ability to independently manipulate GRO
and XDP
* ftrace:test.d--event--subsystem-enable.tc fails on some instances
(LP: #2071861)
- selftests/tracing: Fix false failure of subsystem event test
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640)
- rtc: pcf2127: add missing semicolon after statement
- rtc: pcf2127: fix SPI command byte for PCF2131
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt
- mmc: sdhci: Add a helper function for dump register in dynamic debug
mode
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
- Bluetooth: hci_sync: revert some mesh modifications
- Bluetooth: MGMT: set_mesh: update LE scan interval and window
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
- mtk-sd: reset host->mrq on prepare_data() error
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
- scsi: ufs: core: Fix spelling of a sysfs attribute name
- RDMA/mlx5: Fix HW counters query for non-representor devices
- RDMA/mlx5: Fix CC counters query for MPV
- RDMA/mlx5: Fix vport loopback for MPV device
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
- Bluetooth: Prevent unintended pause by checking if advertising is active
- btrfs: fix missing error handling when searching for inode refs during
log replay
- btrfs: rename err to ret in btrfs_rmdir()
- btrfs: propagate last_unlink_trans earlier when doing a rmdir
- btrfs: use btrfs_record_snapshot_destroy() during rmdir
- ethernet: atl1: Add missing DMA mapping error checks and count errors
- dpaa2-eth: fix xdp_rxq_info leak
- drm/exynos: fimd: Guard display clock control with runtime PM calls
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer
- drm/i915/selftests: Change mock_request() to return error pointers
- platform/x86: make fw_attr_class constant
- platform/x86: firmware_attributes_class: Move include
linux/device/class.h
- platform/x86: firmware_attributes_class: Simplify API
- platform/x86: think-lmi: Directly use firmware_attributes_class
- platform/x86: think-lmi: Fix class device unregistration
- platform/x86: dell-sysman: Directly use firmware_attributes_class
- platform/x86: dell-wmi-sysman: Fix class device unregistration
- platform/mellanox: mlxreg-lc: Fix logic error in power state check
- smb: client: fix warning when reconnecting channel
- drm/i915/gsc: mei interrupt top half should be in irq disabled context
- igc: disable L1.2 PCI-E link substate to avoid performance issue
- lib: test_objagg: Set error message in check_expect_hints_stats()
- amd-xgbe: align CL37 AN sequence as per databook
- enic: fix incorrect MTU comparison in enic_change_mtu()
- nui: Fix dma_mapping_error() check
- amd-xgbe: do not double read link status
- smb: client: fix race condition in negotiate timeout by using more
precise timing
- wifi: mac80211: chan: chandef is non-NULL for reserved
- f2fs: prevent writing without fallocate() for pinned files
- f2fs: convert f2fs_vm_page_mkwrite() to use folio
- f2fs: fix to zero post-eof page
- drm/simpledrm: Do not upcast in release helpers
- ALSA: sb: Don't allow changing the DMA mode during operations
- ALSA: sb: Force to disable DMAs once when DMA mode is changed
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
- ata: pata_cs5536: fix build on 32-bit UML
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks
list
- powerpc: Fix struct termio related ioctl macros
- ASoC: amd: yc: update quirk data for HP Victus
- regulator: fan53555: add enable_time support and soft-start times
- aoe: defer rexmit timer downdev work to workqueue
- wifi: mac80211: drop invalid source address OCB frames
- rcu: Return early if callback is not specified
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class
- platform/x86: hp-bioscfg: Fix class device unregistration
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O
- usb: xhci: quirk for data loss in ISOC transfers
- xhci: dbctty: disable ECHO flag by default
- xhci: dbc: Flush queued requests before stopping dbc
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
- Input: xpad - support Acer NGR 200 Controller
- Input: iqs7222 - explicitly define number of external channels
- usb: cdnsp: do not disable slot for disabled slot
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2
- i2c/designware: Fix an initialization issue
- Logitech C-270 even more broken
- iommu/rockchip: prevent iommus dead loop when two masters share one
IOMMU
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be
changed
- platform/x86: think-lmi: Create ksets consecutively
- platform/x86: think-lmi: Fix kobject cleanup
- platform/x86: think-lmi: Fix sysfs group cleanup
- usb: typec: displayport: Fix potential deadlock
- powerpc/kernel: Fix ppc_save_regs inclusion in build
- [Config] enable Transient Scheduler Attacks mitigation
- x86/CPU/AMD: Properly check the TSA microcode
- x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode()
- net: txgbe: request MISC IRQ in ndo_open
- Bluetooth: HCI: Set extended advertising data synchronously
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes
- firmware: arm_ffa: Move memory allocation outside the mutex locking
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1
- btrfs: return a btrfs_inode from btrfs_iget_logging()
- btrfs: return a btrfs_inode from read_one_inode()
- btrfs: fix invalid inode pointer dereferences during log replay
- btrfs: fix inode lookup error handling during log replay
- nvme: Fix incorrect cdw15 value in passthru error logging
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node
- netfs: Fix i_size updating
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma
- crypto: iaa - Remove dst_null support
- crypto: iaa - Do not clobber req->base.data
- spinlock: extend guard with spinlock_bh variants
- crypto: zynqmp-sha - Add locking
- kunit: qemu_configs: sparc: use Zilog console
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC
- gfs2: Initialize gl_no_formal_ino earlier
- gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE
- gfs2: Rename dinode_demise to evict_behavior
- gfs2: Prevent inode creation race
- gfs2: Rename GLF_FREEING to GLF_UNLOCKED
- gfs2: Decode missing glock flags in tracepoints
- gfs2: Add GLF_PENDING_REPLY flag
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE
- gfs2: Move gfs2_dinode_dealloc
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc
- gfs2: deallocate inodes in gfs2_create_inode
- btrfs: fix wrong start offset for delalloc space release during mmap
write
- ASoC: tas2764: Extend driver to SN012776
- ASoC: tas2764: Reinit cache on part reset
- ACPI: thermal: Fix stale comment regarding trip points
- ACPI: thermal: Execute _SCP before reading trip points
- bonding: Mark active offloaded xfrm_states
- wifi: ath12k: Handle error cases during extended skb allocation
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup"
bug
- iommu: ipmmu-vmsa: avoid Wformat-security warning
- f2fs: decrease spare area for pinned files for zoned devices
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info
- f2fs: introduce SEGS_TO_BLKS/BLKS_TO_SEGS for cleanup
- f2fs: zone: fix to calculate first_zoned_segno correctly
- scsi: lpfc: Remove NLP_RELEASE_RPI flag from nodelist structure
- scsi: lpfc: Change lpfc_nodelist nlp_flag member into a bitmask
- hisi_acc_vfio_pci: bugfix cache write-back issue
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver
- bpf: use common instruction history across all states
- arm64: dts: qcom: sm8650: change labels to lower-case
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2
- arm64: dts: qcom: sm8650: add the missing l2 cache node
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions
- remoteproc: k3-r5: Add devm action to release reserved memory
- remoteproc: k3-r5: Use devm_kcalloc() helper
- remoteproc: k3-r5: Use devm_ioremap_wc() helper
- remoteproc: k3-r5: Use devm_rproc_alloc() helper
- remoteproc: k3-r5: Use devm_rproc_add() helper
- remoteproc: k3-r5: Refactor sequential core power up/down operations
- mfd: exynos-lpass: Fix another error handling path in
exynos_lpass_probe()
- selinux: change security_compute_sid to return the ssid or tsid on match
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
- drm/xe/bmg: Add BMG platform definition
- drm/i915/bmg: Define IS_BATTLEMAGE macro
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after
SINK_COUNT_ESI read
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag
- RDMA/mlx5: Fix cache entry update on dereg error
- drm/xe: Allow dropping kunit dependency as built-in
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper"
- usb: cdnsp: Fix issue with CV Bad Descriptor test
- usb: dwc3: Abort suspend on soft disconnect failure
- Upstream stable to v6.6.97, v6.12.37
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38407
- riscv: cpu_ops_sbi: Use static array for boot_data
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38374
- optee: ffa: fix sleep in atomic context
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38373
- IB/mlx5: Fix potential deadlock in MR deregistration
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38408
- genirq/irq_sim: Initialize work context pointers properly
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38279
- bpf: Do not include stack ptr register in precision backtracking
bookkeeping
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38289
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38392
- idpf: convert control queue mutex to a spinlock
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38402
- idpf: return 0 size for RSS key if not supported
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38405
- nvmet: fix memory leak of bio integrity
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38388
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic
context
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38390
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2024-36350 // CVE-2024-36357
- x86/bugs: Rename MDS machinery to something more generic
- x86/bugs: Add a Transient Scheduler Attacks mitigation
- KVM: SVM: Advertise TSA CPUID bits to guests
- x86/microcode/AMD: Add TSA microcode SHAs
- x86/process: Move the buffer clearing before MONITOR
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38376
- usb: chipidea: udc: disconnect/reconnect from host when do
suspend/resume
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38396
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38371
- drm/v3d: Disable interrupts before resetting the GPU
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38384
- mtd: spinand: fix memory leak of ECC engine conf
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38386
- ACPICA: Refuse to evaluate a method if arguments are missing
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38406
- wifi: ath6kl: remove WARN on bad firmware input
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38399
- scsi: target: Fix NULL pointer dereference in
core_scsi3_decode_spec_i_port()
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38409
- drm/msm: Fix another leak in the submit error path
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38410
- drm/msm: Fix a fence leak in submit error path
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38377
- rose: fix dangling neighbour pointers in rose_rt_device_down()
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38389
- drm/i915/gt: Fix timeline left held on VMA alloc error
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38385
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38412
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs
callbacks
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38382
- btrfs: fix iteration of extrefs during log replay
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38393
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38400
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38387
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38401
- mtk-sd: Prevent memory corruption from DMA map failure
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38391
- usb: typec: altmodes/displayport: do not index invalid pin_assignments
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38395
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38403
- vsock/vmci: Clear the vmci transport packet properly when initializing
it
* Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
CVE-2025-38375
- virtio-net: ensure the received length does not exceed allocated size
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499)
- cifs: Correctly set SMB1 SessionKey field in Session Setup Request
- cifs: Fix cifs_query_path_info() for Windows NT servers
- cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE
mode
- NFSv4: Always set NLINK even if the server doesn't support it
- NFSv4.2: fix listxattr to return selinux security label
- mailbox: Not protect module_put with spin_lock_irqsave
- mfd: max14577: Fix wakeup source leaks on device unbind
- sunrpc: don't immediately retransmit on seqno miss
- leds: multicolor: Fix intensity setting while SW blinking
- fuse: fix race between concurrent setattrs from multiple nodes
- cxl/region: Add a dev_err() on missing target list entries
- NFSv4: xattr handlers should check for absent nfs filehandles
- hwmon: (pmbus/max34440) Fix support for max34451
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix
extension
- ksmbd: provide zero as a unique ID to the Mac client
- rust: module: place cleanup_module() in .exit.text section
- dmaengine: xilinx_dma: Set dma_device directions
- PCI: dwc: Make link training more robust by setting
PORT_LOGIC_LINK_WIDTH to one lane
- PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
- md/md-bitmap: fix dm-raid max_write_behind setting
- amd/amdkfd: fix a kfd_process ref leak
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
- um: use proper care when taking mmap lock during segfault
- coresight: Only check bottom two claim bits
- usb: dwc2: also exit clock_gating when stopping udc while suspended
- iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
- usb: potential integer overflow in usbg_make_tpg()
- usb: common: usb-conn-gpio: use a unique name for usb connector device
- usb: Add checks for snprintf() calls in usb_alloc_dev()
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
- usb: typec: displayport: Receive DP Status Update NAK request exit dp
altmode
- usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
- ALSA: hda: Ignore unsol events for cards being shut down
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
- ceph: fix possible integer overflow in ceph_zero_objects()
- scsi: ufs: core: Don't perform UFS clkscaling during host async scan
- ovl: Check for NULL d_inode() in ovl_dentry_upper()
- fs/jfs: consolidate sanity checking in dbMount
- ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with
dev_err_probe()
- ASoC: codec: wcd9335: Convert to GPIO descriptors
- f2fs: don't over-report free space or inodes in statvfs
- PCI: apple: Use helper function for_each_child_of_node_scoped()
- PCI: apple: Set only available ports up
- platform/x86: ideapad-laptop: move ACPI helpers from header to source
file
- platform/x86: ideapad-laptop: use usleep_range() for EC polling
- i2c: tiny-usb: disable zero-length read messages
- i2c: robotfuzz-osif: disable zero-length read messages
- ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
- attach_recursive_mnt(): do not lock the covering tree when sliding
something under it
- libbpf: Fix null pointer dereference in btf_dump__free on allocation
failure
- wifi: mac80211: fix beacon interval calculation overflow
- af_unix: Don't set -ECONNRESET for consumed OOB skb.
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
- um: ubd: Add missing error check in start_io_thread()
- libbpf: Fix possible use-after-free for externs
- net: enetc: Correct endianness handling in _enetc_rd_reg64
- ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
- net: selftests: fix TCP packet checksum
- drm/i915: fix build error some more
- drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
- drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
- EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
- serial: imx: Restore original RXTL for console to fix data loss
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation
- dm-raid: fix variable in journal device check
- btrfs: update superblock's device bytes_used when dropping chunk
- net: libwx: fix the creation of page_pool
- HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
- HID: wacom: fix memory leak on kobject creation failure
- HID: wacom: fix memory leak on sysfs attribute creation failure
- HID: wacom: fix kobject reference count leak
- drm/ast: Fix comment on modeset lock
- drm/cirrus-qemu: Fix pitch programming
- drm/etnaviv: Protect the scheduler's pending list with its lock
- drm/tegra: Assign plane type before registration
- drm/udl: Unregister device before cleaning up on disconnect
- drm/amdkfd: Fix race in GWS queue scheduling
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
- drm/bridge: cdns-dsi: Fix phy de-init and flag it so
- drm/bridge: cdns-dsi: Fix connecting to next bridge
- drm/bridge: cdns-dsi: Check return value when getting default PHY config
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
- drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
- drm/amdgpu: Add kicker device detection
- drm/amdgpu: switch job hw_fence to amdgpu_fence
- ksmbd: Use unsafe_memcpy() for ntlm_negotiate
- ksmbd: remove unsafe_memcpy use in session setup
- media: uvcvideo: Rollback non processed entities on error
- firmware: arm_scmi: Add a common helper to check if a message is
supported
- firmware: arm_scmi: Ensure that the message-id supports fastchannel
- ARM: 9354/1: ptrace: Use bitfield helpers
- nvme-tcp: fix I/O stalls on congested sockets
- drm/amdgpu: seq64 memory unmap uses uninterruptible lock
- 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0
and later devices
- usb: gadget: f_hid: wake up readers on disable/unbind
- drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
- btrfs: fix qgroup reservation leak on failure to allocate ordered extent
- smb: client: remove \t from TP_printk statements
- fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
- drm/xe/display: Add check for alloc_ordered_workqueue()
- ethernet: ionic: Fix DMA mapping tests
- wifi: mac80211: Add link iteration macro for link data
- wifi: mac80211: Create separate links for VLAN interfaces
- wifi: mac80211: finish link init before RCU publish
- netlink: specs: tc: replace underscores with dashes in names
- drm/amdgpu/discovery: optionally use fw based ip discovery
- drm/amd: Adjust output for discovery error handling
- x86/traps: Initialize DR6 by writing its architectural reset value
- serial: core: restore of_node information in sysfs
- spi: spi-cadence-quadspi: Fix pm runtime unbalance
- mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
- scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
- drm/amd/display: Correct non-OLED pre_T11_delay.
- drm/xe/vm: move rebind_work init earlier
- drm/xe/sched: stop re-submitting signalled jobs
- drm/xe: Fix memset on iomem
- drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
- drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
- drm/amd/display: Fix mpv playback corruption on weston
- x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
- io_uring: fix potential page leak in io_sqe_buffer_register()
- iio: dac: ad3552r: changes to use FIELD_PREP
- drm/xe: Carve out wopcm portion from the stolen memory
- usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters
ERROR_RECOVERY
- drm/msm/dp: account for widebus and yuv420 during mode validation
- arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi
- ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA
- spi: fsl-qspi: Fix double cleanup in probe error path
- Upstream stable to v6.6.96, v6.12.36
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-37842
- spi: fsl-qspi: use devm function instead of driver remove
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-23155
- net: stmmac: Fix accessing freed irq affinity_hint
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-22101
- net: libwx: fix Tx L4 checksum
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38361
- drm/amd/display: Check dce_hwseq before dereferencing it
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38364
- maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38246
- bnxt: properly flush XDP redirect lists
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38250
- Bluetooth: hci_core: Fix use-after-free in vhci_flush()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38253
- HID: wacom: fix crash in wacom_aes_battery_handler()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38264
- nvme-tcp: sanitize request list handling
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38362
- drm/amd/display: Add null pointer check for get_first_active_display()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38354
- drm/msm/gpu: Fix crash when throttling GPU immediately during boot
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38363
- drm/tegra: Fix a possible null pointer dereference
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38239
- scsi: megaraid_sas: Fix invalid node index
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38365
- btrfs: fix a race between renames and directory logging
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38244
- smb: client: fix potential deadlock when reconnecting channels
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38245
- atm: Release atm_dev_mutex after removing procfs in
atm_dev_deregister().
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38249
- ALSA: usb-audio: Fix out-of-bounds read in
snd_usb_get_audioformat_uac3()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38251
- atm: clip: prevent NULL deref in clip_push()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38255
- lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38257
- s390/pkey: Prevent overflow in size calculation for memdup_user()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38258
- mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path
on write
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38259
- ASoC: codecs: wcd9335: Fix missing free of regulator supplies
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38230
- jfs: validate AG parameters in dbMount() to prevent crashes
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38260
- btrfs: handle csum tree error with rescue=ibadroots correctly
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38262
- tty: serial: uartlite: register uart driver in init
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38368
- misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38436
- drm/scheduler: signal scheduled fence when kill job
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38263
- bcache: fix NULL pointer in cache_set_flush()
* Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
CVE-2025-38369
- dmaengine: idxd: Check availability of workqueue allocated by idxd wq
driver before using
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-22128
- wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq()
in error path
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38333
- f2fs: fix to bail out in get_new_segment()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38210
- configfs-tsm-report: Fix NULL dereference of tsm_ops
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38232
- NFSD: fix race between nfsd registration and exports_proc
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38320
- arm64/ptrace: Fix stack-out-of-bounds read in
regs_get_kernel_stack_nth()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38424
- perf: Fix sample vs do_exit()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38321
- smb: Log an error when close_all_cached_dirs fails
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38180
- net: atm: fix /proc/net/atm/lec handling
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38323
- net: atm: add lec_mutex
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38181
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38182
- ublk: santizize the arguments from userspace when adding a device
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38183
- net: lan743x: fix potential out-of-bounds write in
lan743x_ptp_io_event_clock_get()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38184
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38185
- atm: atmtcp: Free invalid length skb in atmtcp_c_send().
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38324
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38420
- wifi: carl9170: do not ping device which has failed to load firmware
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38326
- aoe: clean device rq_list in aoedev_downdev()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38089
- sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38084
- mm/hugetlb: unshare page tables during VMA split, not before
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38190
- atm: Revert atm_account_tx() if copy_from_iter_full() fails.
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38191
- ksmbd: fix null pointer dereference in destroy_previous_session
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38192
- net: clear the dst when changing skb protocol
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38193
- net_sched: sch_sfq: reject invalid perturb period
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38328
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38194
- jffs2: check that raw node were preallocated before writing summary
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38090
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38197
- platform/x86: dell_rbu: Fix list usage
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38198
- fbcon: Make sure modelist not set on unregistered console
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38331
- net: ethernet: cortina: Use TOE/TSO on all TCP
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38200
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38332
- scsi: lpfc: Use memcpy() for BIOS version
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38342
- software node: Correct a OOB check in software_node_get_reference_args()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38334
- x86/sgx: Prevent attempts to reclaim poisoned pages
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38425
- i2c: tegra: check msg length in SMBUS block read
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38343
- wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38202
- bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38422
- net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38344
- ACPICA: fix acpi parse and parseext cache leaks
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38345
- ACPICA: fix acpi operand cache leak in dswstate.c
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38085
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38208
- smb: client: add NULL check in automount_fullpath
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38418
- remoteproc: core: Release rproc->clean_table after rproc_attach() fails
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38419
- remoteproc: core: Cleanup acquired resources when
rproc_handle_resources() fails in rproc_attach()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38427
- video: screen_info: Relocate framebuffers behind PCI bridges
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38086
- net: ch9200: fix uninitialised access during mii_nway_restart
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38346
- ftrace: Fix UAF when lookup kallsym after ftrace disabled
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38211
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38212
- ipc: fix to protect IPCS lookups using RCU
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38214
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38215
- fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in
fb_videomode_to_var
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38087
- net/sched: fix use-after-free in taprio_dev_notifier
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38416
- NFC: nci: uart: Set tty->disc_data only in success path
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38217
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38218
- f2fs: fix to do sanity check on sit_bitmap_size
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38219
- f2fs: prevent kernel warning due to negative i_nlink from corrupted
image
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38347
- f2fs: fix to do sanity check on ino and xnid
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38428
- Input: ims-pcu - check record size in ims_pcu_flash_firmware()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38220
- ext4: only dirty folios when data journaling regular files
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38222
- ext4: inline: fix len overflow in ext4_prepare_inline_data
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38336
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38429
- bus: mhi: ep: Update read pointer only after buffer is written
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38225
- media: imx-jpeg: Cleanup after an allocation error
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38226
- media: vivid: Change the siize of the composing
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38229
- media: cxusb: no longer judge rbuf when the write fails
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38337
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38338
- fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38231
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38430
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
* Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
CVE-2025-38348
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786)
- tracing: Fix compilation warning on arm32
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
- pinctrl: armada-37xx: set GPIO output value before setting direction
- acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio()
- rtc: Make rtc_time64_to_tm() support dates before 1970
- rtc: Fix offset calculation for .start_secs < 0
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
- usb: typec: ucsi: fix Clang -Wsign-conversion warning
- Bluetooth: hci_qca: move the SoC type check to the right place
- usb: usbtmc: Fix timeout value in get_stb
- dt-bindings: usb: cypress,hx3: Add support for all variants
- dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt
property
- tools/x86/kcpuid: Fix error handling
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in
mwait_idle_with_hints() and prefer_mwait_c1_over_halt()
- crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run()
- gfs2: gfs2_create_inode error handling fix
- perf/core: Fix broken throttling when max_samples_per_tick=1
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
- powerpc: do not build ppc_save_regs.o always
- powerpc/crash: Fix non-smp kexec preparation
- x86/microcode/AMD: Do not return error when microcode update is not
necessary
- x86/cpu: Sanitize CPUID(0x80000000) output
- crypto: marvell/cesa - Avoid empty transfer descriptor
- btrfs: scrub: update device stats when an error is detected
- btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
- rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
- crypto: lrw - Only add ecb if it is not already there
- crypto: xts - Only add ecb if it is not already there
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct
- kunit: Fix wrong parameter to kunit_deactivate_static_stub()
- ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
- ASoC: tas2764: Enable main IRQs
- EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo
channel 0
- spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
- spi: tegra210-quad: remove redundant error handling code
- spi: tegra210-quad: modify chip select (CS) deactivation
- power: reset: at91-reset: Optimize at91_reset()
- ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
- PM: wakeup: Delete space in the end of string shown by
pm_show_wakelocks()
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
- PM: sleep: Print PM debug messages during hibernation
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
- spi: sh-msiof: Fix maximum DMA transfer size
- ASoC: apple: mca: Constrain channels according to TDM mask
- drm/vmwgfx: Add seqno waiter for sync_files
- drm/vc4: tests: Use return instead of assert
- media: rkvdec: Fix frame size enumeration
- arm64/fpsimd: Avoid RES0 bits in the SME trap handler
- arm64/fpsimd: Fix merging of FPSIMD state during signal return
- drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe()
- watchdog: exar: Shorten identity name to fit correctly
- m68k: mac: Fix macintosh_config for Mac II
- firmware: psci: Fix refcount leak in psci_dt_init
- arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
- selftests/seccomp: fix syscall_restart test for arm compat
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
- drm/vkms: Adjust vkms_state->active_planes allocation type
- drm/tegra: rgb: Fix the unbound reference count
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
- arm64/fpsimd: Do not discard modified SVE state
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
- drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr
- drm/mediatek: Fix kobject put for component sub-drivers
- drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err
- xen/x86: fix initial memory balloon target
- IB/cm: use rwlock for MAD agent lock
- selftests/bpf: Fix bpf_nf selftest failure
- bpf, sockmap: fix duplicated data transmission
- wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
- net: ncsi: Fix GCPS 64-bit member variables
- libbpf: Fix buffer overflow in bpf_object__init_prog
- xfrm: Use xdo.dev instead of xdo.real_dev
- wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
- wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
- wifi: rtw88: do not ignore hardware read error during DPK
- wifi: ath12k: Add MSDU length validation for TKIP MIC error
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
- scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
- libbpf: Remove sample_period init in perf_buffer
- Use thread-safe function pointer in libbpf_print
- iommu: Protect against overflow in iommu_pgsize()
- bonding: assign random address if device address is same as bond
- f2fs: clean up w/ fscrypt_is_bounce_page()
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
- libbpf: Use proper errno value in linker
- bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps
- netfilter: bridge: Move specific fragmented packet to slow_path instead
of dropping it
- netfilter: nft_quota: match correctly when the quota just depleted
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
- tracing: Move histogram trigger variables from stack to per CPU
structure
- clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs
- clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
- clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs
- efi/libstub: Describe missing 'out' parameter in efi_load_initrd
- tracing: Rename event_trigger_alloc() to trigger_data_alloc()
- tracing: Fix error handling in event_trigger_parse()
- ktls, sockmap: Fix missing uncharge operation
- libbpf: Use proper errno value in nlattr
- clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
- s390/bpf: Store backchain even for leaf progs
- iommu: remove duplicate selection of DMAR_TABLE
- hisi_acc_vfio_pci: add eq and aeq interruption restore
- scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
- wifi: mt76: mt7996: set EHT max ampdu length capability
- wifi: mt76: mt7996: fix RX buffer size of MCU event
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
- vfio/type1: Fix error unwind in migration dirty bitmap allocation
- Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
- netfilter: nft_tunnel: fix geneve_opt dump
- RISC-V: KVM: lock the correct mp_state during reset
- RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
- net: lan966x: Fix 1-step timestamping over ipv4 or ipv6
- net: phy: fix up const issues in to_mdio_device() and to_phy_device()
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
- f2fs: use d_inode(dentry) cleanup dentry->d_inode
- f2fs: fix to correct check conditions in f2fs_cross_rename
- arm64: dts: qcom: sdm845-starqltechn: remove wifi
- arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake
- arm64: dts: qcom: sdm845-starqltechn: refactor node order
- arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios
- arm64: dts: qcom: sm8350: Reenable crypto & cryptobam
- arm64: dts: qcom: sm8250: Fix CPU7 opp table
- arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
- ARM: dts: at91: at91sam9263: fix NAND chip selects
- arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
- arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect
GPIO
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load
- arm64: dts: imx8mp-beacon: Fix RTC capacitive load
- arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI
audio
- arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI
audio
- arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles
- arm64: dts: mt6359: Add missing 'compatible' property to regulators node
- arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply
- arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning
- arm64: dts: rockchip: Update eMMC for NanoPi R5 series
- arm64: tegra: Drop remaining serial clock-names and reset-names
- arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
- ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
- nilfs2: add pointer check for nilfs_direct_propagate()
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
- dt-bindings: vendor-prefixes: Add Liontron name
- ARM: dts: qcom: apq8064: add missing clocks to the timer node
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon
device
- arm64: defconfig: mediatek: enable PHY drivers
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399
Puma with Haikou
- arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
- arm64: dts: mt6359: Rename RTC node to match binding expectations
- ARM: aspeed: Don't select SRAM
- soc: aspeed: lpc: Fix impossible judgment condition
- randstruct: gcc-plugin: Remove bogus void member
- randstruct: gcc-plugin: Fix attribute addition
- perf build: Warn when libdebuginfod devel files are not available
- perf ui browser hists: Set actions->thread before calling
do_zoom_thread()
- dm: don't change md if dm_table_set_restrictions() fails
- dm: free table mempools if not used in __bind
- dm-flakey: error all IOs when num_features is absent
- dm-flakey: make corrupting read bios work
- perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids()
- perf intel-pt: Fix PEBS-via-PT data_src
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with
Python 3
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
- remoteproc: k3-r5: Drop check performed in
k3_r5_rproc_{mbox_callback/kick}
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in
exynos_lpass_remove()
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
- perf tests switch-tracking: Fix timestamp comparison
- perf record: Fix incorrect --user-regs comments
- perf trace: Always print return value for syscalls returning a pid
- nfs: clear SB_RDONLY before getting superblock
- nfs: ignore SB_RDONLY when remounting nfs
- cifs: Fix validation of SMB1 query reparse point response
- rtc: sh: assign correct interrupts with DT
- PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
- PCI: cadence: Fix runtime atomic count underflow
- PCI: apple: Use gpiod_set_value_cansleep in probe flow
- PCI/DPC: Initialize aer_err_info before using it
- rtc: loongson: Add missing alarm notifications for ACPI RTC events
- thunderbolt: Fix a logic error in wake on connect
- iio: filter: admv8818: fix band 4, state 15
- iio: filter: admv8818: fix integer overflow
- iio: filter: admv8818: fix range calculation
- iio: filter: admv8818: Support frequencies >= 2^32
- iio: adc: ad7124: Fix 3dB filter frequency reading
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
- counter: interrupt-cnt: Protect enable/disable OPs with mutex
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
- net: stmmac: platform: guarantee uniqueness of bus_id
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
- net: tipc: fix refcount warning in tipc_aead_encrypt
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
- net/mlx4_en: Prevent potential integer overflow calculating Hz
- net: lan966x: Make sure to insert the vlan tags also in host mode
- spi: bcm63xx-spi: fix shared reset
- spi: bcm63xx-hsspi: fix shared reset
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
- ice: create new Tx scheduler nodes for new queues only
- ice: fix rebuilding the Tx scheduler tree for large queue counts
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length
- vmxnet3: correctly report gso type for UDP tunnels
- PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
- netfilter: nf_nat: also check reverse tuple to obtain clashing entry
- net: dsa: b53: do not enable RGMII delay on bcm63xx
- net: dsa: b53: allow RGMII for bcm63xx RGMII ports
- wireguard: device: enable threaded NAPI
- scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
- ASoC: codecs: hda: Fix RPM usage count underflow
- ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
- ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
- path_overmount(): avoid false negatives
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
- Input: synaptics-rmi - fix crash with unsupported versions of F34
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators
- serial: sh-sci: Move runtime PM enable to sci_probe_single()
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit
- Bluetooth: hci_core: fix list_for_each_entry_rcu usage
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery
- wifi: ath11k: fix soc_dp_stats debugfs file permission
- wifi: ath11k: convert timeouts to secs_to_jiffies()
- wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
- wifi: ath11k: don't use static variables in
ath11k_debugfs_fw_stats_process()
- wifi: ath11k: don't wait when there is no vdev started
- wifi: ath11k: validate ath11k_crypto_mode on top of
ath11k_core_qmi_firmware_ready
- regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
- pinctrl: qcom: pinctrl-qcm2290: Add missing pins
- scsi: iscsi: Fix incorrect error path labels for flashnode operations
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
- drm/meson: use unsigned long long / Hz for frequency types
- drm/meson: fix debug log statement when setting the HDMI clocks
- drm/meson: use vclk_freq instead of pixel_freq in debug print
- drm/meson: fix more rounding issues with 59.94Hz modes
- i40e: return false from i40e_reset_vf if reset is in progress
- i40e: retry VFLR handling if there is ongoing VF reset
- macsec: MACsec SCI assignment for ES = 0
- Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
- net/mlx5: Ensure fw pages are always allocated on same NUMA
- net/mlx5: Fix return value when searching for existing flow group
- net/mlx5e: Fix leak of Geneve TLV option object
- net_sched: tbf: fix a race in tbf_change()
- fs/filesystems: Fix potential unsigned integer underflow in fs_name()
- nvmet-fcloop: access fcpreq only when holding reqlock
- perf: Ensure bpf_perf_link path is properly serialized
- bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
- block: Fix bvec_set_folio() for very large folios
- tools/resolve_btfids: Fix build when cross compiling kernel with clang.
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
- io_uring: expand main struct io_kiocb flags to 64-bits
- io_uring: add io_file_can_poll() helper
- io_uring/rw: allow pollable non-blocking attempts for !FMODE_NOWAIT
- io_uring/rw: fix wrong NOWAIT check in io_rw_init_file()
- usb: usbtmc: Fix read_stb function and get_stb ioctl
- usb: cdnsp: Fix issue with detecting command completion event
- usb: cdnsp: Fix issue with detecting USB 3.2 speed
- usb: Flush altsetting 0 endpoints before reinitializating them after
reset.
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
- calipso: unlock rcu before returning -EAFNOSUPPORT
- regulator: dt-bindings: mt6357: Drop fixed compatible requirement
- net: usb: aqc111: debug info before sanitation
- drm/meson: Use 1000ULL when operating with mode->clock
- Documentation: ACPI: Use all-string data node references
- PCI/ASPM: Consolidate link state defines
- PCI/ASPM: Disable L1 before disabling L1 PM Substates
- perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member
- perf/x86/amd/uncore: Prevent UMC counters from saturating
- crypto: sun8i-ce - undo runtime PM changes during driver removal
- erofs: fix file handle encoding for 64-bit NIDs
- btrfs: fix invalid data space release when truncating block in NOCOW
mode
- ACPI: resource: fix a typo for MECHREVO in
irq1_edge_low_force_override[]
- thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure
- drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource
- drm/vmwgfx: Fix dumb buffer leak
- drm/xe/d3cold: Set power state to D3Cold during s2idle/s3
- drm/panel: samsung-sofef00: Drop s6e3fc2x01 support
- kunit/usercopy: Disable u64 test on 32-bit SPARC
- drm/msm/dpu: enable SmartDMA on SM8150
- drm/msm/dpu: enable SmartDMA on SC8180X
- overflow: Fix direct struct member initialization in _DEFINE_FLEX()
- drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3
- media: verisilicon: Free post processor buffers on error
- wifi: ath12k: Fix memory leak during vdev_id mismatch
- wifi: ath12k: Fix invalid memory access while forming 802.11 header
- bpf: Check link_create.flags parameter for multi_kprobe
- wifi: ath12k: fix cleanup path after mhi init
- f2fs: clean up unnecessary indentation
- f2fs: prevent the current section from being selected as a victim during
GC
- net/mlx5: Avoid using xso.real_dev unnecessarily
- wifi: ath12k: Fix the QoS control field offset to build QoS header
- libbpf: Fix event name too long error
- wifi: iwlfiwi: mvm: Fix the rate reporting
- selftests/bpf: Fix caps for __xlated/jited_unpriv
- wifi: rtw89: pci: enlarge retry times of RX tag to 1000
- wifi: mt76: mt7925: prevent multiple scan commands
- wifi: mt76: mt7925: refine the sniffer commnad
- wifi: mt76: mt7925: ensure all MCU commands wait for response
- netfilter: nf_tables: nft_fib: consistent l3mdev handling
- vsock/virtio: fix `rx_bytes` accounting for stream sockets
- net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in
dmaengine xmit
- net: lan743x: Fix PHY reset handling during initialization and WOL
- octeontx2-af: Sync NIX and NPA contexts from NDC to LLC/DRAM
- octeontx2-pf: QOS: Perform cache sync on send queue teardown
- arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the
mdss node
- arm64: dts: qcom: ipq9574: Fix USB vdd info
- arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588
- arm64: dts: mediatek: mt8183-kukui-jacuzzi: Simplify DSI endpoint
replacement
- arm64: dts: mt8183: Add port node to mt8183.dtsi
- soc: qcom: smp2p: Fix fallback to qcom,ipc parse
- ARM: dts: qcom: apq8064: move replicator out of soc node
- arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects
- perf symbol-minimal: Fix double free in filename__read_build_id
- mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe()
- mailbox: imx: Fix TXDB_V2 sending
- mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting
- perf symbol: Fix use-after-free in filename__read_build_id
- PCI/DPC: Log Error Source ID only when valid
- coresight: catu: Introduce refcount and spinlock for enabling/disabling
- mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array()
- iio: adc: mcp3911: fix device dependent mappings for conversion result
registers
- drm/xe: Make xe_gt_freq part of the Documentation
- Fix sock_exceed_buf_limit not being triggered in
__sk_mem_raise_allocated
- idpf: fix netdev Tx queue stop/wake
- idpf: fix a race in txq wakeup
- nvme: fix command limits status code
- drm/panel-simple: fix the warnings for the Evervision VGG644804
- net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces.
- net: dsa: b53: Introduce b53_adjust_531x5_rgmii()
- net: dsa: b53: do not touch DLL_IQQD on bcm53115
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315
- ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247
- ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA
- ALSA: hda/realtek - Support mute led function for HP platform
- ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
- ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
- dt-bindings: pinctrl: samsung: google,gs101-pinctrl needs a clock
- pinctrl: samsung: support a bus clock
- pinctrl: samsung: refactor drvdata suspend & resume callbacks
- pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks
- pinctrl: samsung: add gs101 specific eint suspend/resume callbacks
- net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0
- wifi: ath11k: move some firmware stats related functions outside of
debugfs
- wifi: ath12k: refactor ath12k_hw_regs structure
- gfs2: pass through holder from the VFS for freeze/thaw
- btrfs: exit after state split error at set_extent_bit()
- block: use q->elevator with ->elevator_lock held in elv_iosched_show()
- 9p: Add a migrate_folio method
- overflow: Introduce __DEFINE_FLEX for having no initializer
- thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit
- Upstream stable to v6.6.94, v6.12.33, v6.12.34
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38101
- ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38269
- btrfs: exit after state insertion failure at btrfs_convert_extent_bit()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38303
- Bluetooth: eir: Fix possible crashes on eir_create_adv_data
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38414
- wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38125
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38129
- page_pool: Fix use-after-free in page_pool_recycle_in_ring
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38156
- wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38162
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38292
- wifi: ath12k: fix invalid access to memory
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38164
- f2fs: zone: fix to avoid inconsistence in between SIT and SSA
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38169
- arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38299
- ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38100
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38102
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38103
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38107
- net_sched: ets: fix a race in ets_qdisc_change()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38108
- net_sched: red: fix a race in __red_change()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38109
- net/mlx5: Fix ECVF vports unload on shutdown flow
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38304
- Bluetooth: Fix NULL pointer deference on eir_get_service_data
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38110
- net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38111
- net/mdiobus: Fix potential out-of-bounds read/write access
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38112
- net: Fix TOCTOU issue in sk_is_readable()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38113
- ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38088
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38115
- net_sched: sch_sfq: fix a potential crash on gso_skb handling
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38305
- ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38119
- scsi: core: ufs: Fix a hang in the error handler
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38307
- ASoC: Intel: avs: Verify content returned by parse_int_array()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38310
- seg6: Fix validation of nexthop addresses
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38120
- netfilter: nf_set_pipapo_avx2: fix initial map fill
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38122
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38123
- net: wwan: t7xx: Fix napi rx poll issue
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38124
- net: fix udp gso skb_segment after pull from frag_list
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38126
- net: stmmac: make sure that ptp_rate is not 0 before configuring
timestamping
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38127
- ice: fix Tx scheduler error handling in XDP callback
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38131
- coresight: prevent deactivate active config while enabling the config
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38274
- fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38135
- serial: Fix potential null-ptr-deref in mlb_usio_probe()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38136
- usb: renesas_usbhs: Reorder clock handling and power management in probe
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38138
- dmaengine: ti: Add NULL check in udma_probe()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38275
- phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38142
- hwmon: (asus-ec-sensors) check sensor index in read_string()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38277
- mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38143
- backlight: pm8941: Add NULL check in wled_configure()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38312
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38145
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38313
- bus: fsl-mc: fix double-free on mc_dev
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38415
- Squashfs: check return result of sb_min_blocksize
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38146
- net: openvswitch: Fix the dead loop of MPLS parse
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38147
- calipso: Don't call calipso functions for AF_INET sk.
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38278
- octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38148
- net: phy: mscc: Fix memory leak when using one step timestamping
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38149
- net: phy: clear phydev->devlink when the link is deleted
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38280
- bpf: Avoid __bpf_prog_ret0_warn when jit fails
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38153
- net: usb: aqc111: fix error handling of usbnet read calls
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38154
- bpf, sockmap: Avoid using sk_socket after free when sending
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38155
- wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38282
- kernfs: Relax constraint in draining guard
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38157
- wifi: ath9k_htc: Abort software beacon handling if disabled
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38283
- hisi_acc_vfio_pci: bugfix live migration function without VF device
driver
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38158
- hisi_acc_vfio_pci: fix XQE dma address error
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-39890
- wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38159
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38285
- bpf: Fix WARN() in get_bpf_raw_tp_regs
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38286
- pinctrl: at91: Fix possible out-of-boundary access
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38160
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38161
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38290
- wifi: ath12k: fix node corruption in ar->arvifs list
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38163
- f2fs: fix to do sanity check on sbi->total_valid_block_count
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38165
- bpf, sockmap: Fix panic when calling skb_linearize
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38166
- bpf: fix ktls panic with sockmap
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38293
- wifi: ath11k: fix node corruption in ar->arvifs list
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38295
- perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in
meson_ddr_pmu_create()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38167
- fs/ntfs3: handle hdr_first_de() return value
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38170
- arm64/fpsimd: Discard stale CPU state when handling SME traps
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38319
- drm/amd/pp: Fix potential NULL pointer dereference in
atomctrl_initialize_mc_reg_table
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38298
- EDAC/skx_common: Fix general protection fault
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38173
- crypto: marvell/cesa - Handle zero-length skcipher requests
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38300
- crypto: sun8i-ce-cipher - fix error handling in
sun8i_ce_cipher_prepare()
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38174
- thunderbolt: Do not double dequeue a configuration request
* Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
CVE-2025-38265
- serial: jsm: fix NPE during jsm_uart_port_init
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301)
- i2c: designware: Uniform initialization flow for polling mode
- i2c: designware: Remove ->disable() callback
- i2c: designware: Use temporary variable for struct device
- i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
- phy: renesas: rcar-gen3-usb2: Add support to initialize the bus
- phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
- phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver
data
- phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
- cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
- nvmem: rockchip-otp: Move read-offset into variant-data
- nvmem: rockchip-otp: add rk3576 variant data
- nvmem: core: verify cell's raw_len
- nvmem: core: update raw_len if the bit reading is required
- nvmem: qfprom: switch to 4-byte aligned reads
- scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
- intel_th: avoid using deprecated page->mapping, index fields
- dma-mapping: avoid potential unused data compilation warning
- cgroup: Fix compilation issue due to cgroup_mutex not being exported
- scsi: mpi3mr: Add level check to control event logging
- net: enetc: refactor bulk flipping of RX buffers to separate function
- ima: process_measurement() needlessly takes inode_lock() on MAY_READ
- drm/amdgpu: Allow P2P access through XGMI
- selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
- bpf: fix possible endless loop in BPF map iteration
- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
- kconfig: merge_config: use an empty file as initfile
- s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel
log
- cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
- cifs: Fix querying and creating MF symlinks over SMB1
- cifs: Fix negotiate retry functionality
- smb: client: Store original IO parameters and prevent zero IO sizes
- fuse: Return EPERM rather than ENOSYS from link()
- NFSv4: Check for delegation validity in
nfs_start_delegation_return_locked()
- NFS: Don't allow waiting for exiting tasks
- arm64: Add support for HIP09 Spectre-BHB mitigation
- tracing: Mark binary printing functions with __printf() attribute
- ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
- mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
- mailbox: use error ret code of of_parse_phandle_with_args()
- riscv: Allow NOMMU kernels to access all of RAM
- fbdev: fsl-diu-fb: add missing device_remove_file()
- fbcon: Use correct erase colour for clearing in fbcon
- fbdev: core: tileblit: Implement missing margin clearing for tileblit
- cifs: add validation check for the fields in smb_aces
- cifs: Fix establishing NetBIOS session for SMB2+ connection
- NFSv4: Treat ENETUNREACH errors as fatal for state recovery
- SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
- SUNRPC: rpcbind should never reset the port to the value '0'
- thermal/drivers/qoriq: Power down TMU on system suspend
- dql: Fix dql->limit value when reset.
- lockdep: Fix wait context check on softirq for PREEMPT_RT
- objtool: Properly disable uaccess validation
- PCI: dwc: ep: Ensure proper iteration over outbound map windows
- tools/build: Don't pass test log files to linker
- pNFS/flexfiles: Report ENETDOWN as a connection error
- PCI: vmd: Disable MSI remapping bypass under Xen
- ext4: on a remount, only log the ro or r/w state when it has changed
- mmc: host: Wait for Vdd to settle on card power off
- wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
- wifi: mt76: mt7996: revise TXS size
- x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
- i2c: qup: Vote for interconnect bandwidth to DRAM
- i2c: pxa: fix call balance of i2c->clk handling routines
- btrfs: make btrfs_discard_workfn() block_group ref explicit
- btrfs: avoid linker error in btrfs_find_create_tree_block()
- btrfs: run btrfs_error_commit_super() early
- btrfs: fix non-empty delayed iputs list on unmount due to async workers
- btrfs: get zone unusable bytes while holding lock at
btrfs_reclaim_bgs_work()
- btrfs: send: return -ENAMETOOLONG when attempting a path that is too
long
- drm/amd/display: Guard against setting dispclk low for dcn31x
- i3c: master: svc: Fix missing STOP for master request
- dlm: make tcp still work in multi-link env
- um: Store full CSGSFS and SS register from mcontext
- um: Update min_low_pfn to match changes in uml_reserved
- ext4: reorder capability check last
- hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
- scsi: st: Tighten the page format heuristics with MODE SELECT
- scsi: st: ERASE does not change tape location
- vfio/pci: Handle INTx IRQ_NOTCONNECTED
- bpf: Return prog btf_id without capable check
- jbd2: do not try to recover wiped journal
- tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
- rtc: rv3032: fix EERD location
- thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for
retimer
- ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
- bpf: Allow pre-ordering for bpf cgroup progs
- kbuild: fix argument parsing in scripts/config
- crypto: octeontx2 - suppress auth failure screaming due to negative
tests
- dm: restrict dm device size to 2^63-512 bytes
- net/smc: use the correct ndev to find pnetid by pnetid table
- xen: Add support for XenServer 6.1 platform device
- pinctrl-tegra: Restore SFSEL bit when freeing pins
- mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
- drm/amdgpu: Update SRIOV video codec caps
- ASoC: sun4i-codec: support hp-det-gpios property
- ext4: reject the 'data_err=abort' option in nojournal mode
- ext4: do not convert the unwritten extents if data writeback fails
- RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
- posix-timers: Add cond_resched() to posix_timer_add() search loop
- timer_list: Don't use %pK through printk()
- netfilter: conntrack: Bound nf_conntrack sysctl writes
- arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
- mmc: dw_mmc: add exynos7870 DW MMC support
- usb: xhci: Don't change the status of stalled TDs on failed Stop EP
- hwmon: (dell-smm) Increment the number of fans
- printk: Check CON_SUSPEND when unblanking a console
- drm/amd/display: remove minimum Dispclk and apply oem panel timing.
- drm/amd/display: calculate the remain segments for all pipes
- drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
- gfs2: Check for empty queue in run_queue
- auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct
hd44780_common"
- ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
- iommu/amd/pgtbl_v2: Improve error handling
- watchdog: aspeed: Update bootstatus handling
- drm/amdkfd: Set per-process flags only once cik/vi
- arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
- arm64: tegra: Resize aperture for the IGX PCIe C5 slot
- powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
- ALSA: seq: Improve data consistency at polling
- tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
- rtc: ds1307: stop disabling alarms on probe
- ieee802154: ca8210: Use proper setters and getters for bitwise types
- ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
- media: c8sectpfe: Call of_node_put(i2c_bus) only once in
c8sectpfe_probe()
- drm/gem: Test for imported GEM buffers with helper
- net: phylink: use pl->link_interface in phylink_expects_phy()
- remoteproc: qcom_wcnss: Handle platforms with only single power domain
- drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
- drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
- pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
- net: ethernet: ti: cpsw_new: populate netdev of_node
- net: pktgen: fix mpls maximum labels list parsing
- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
- ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
- ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
- drm/rockchip: vop2: Add uv swap for cluster window
- media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
- media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
- clk: imx8mp: inform CCF of maximum frequency of clocks
- hwmon: (gpio-fan) Add missing mutex locks
- ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
- drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
- fpga: altera-cvp: Increase credit timeout
- perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters
- soc: apple: rtkit: Use high prio work queue
- soc: apple: rtkit: Implement OSLog buffers properly
- wifi: ath12k: Report proper tx completion status to mac80211
- PCI: brcmstb: Expand inbound window size up to 64GB
- PCI: brcmstb: Add a softdep to MIP MSI-X driver
- net/mlx5: Avoid report two health errors on same syndrome
- selftests/net: have `gro.sh -t` return a correct exit code
- drm/amdkfd: KFD release_work possible circular locking
- leds: pwm-multicolor: Add check for fwnode_property_read_u32
- net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
- net: xgene-v2: remove incorrect ACPI_PTR annotation
- bonding: report duplicate MAC address in all situations
- wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
- soc: ti: k3-socinfo: Do not use syscon helper to build regmap
- Octeontx2-af: RPM: Register driver with PCI subsys IDs
- x86/build: Fix broken copy command in genimage.sh when making isoimage
- drm/amd/display: handle max_downscale_src_width fail check
- ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
- ASoC: mediatek: mt8188: Add reference for dmic clocks
- x86/nmi: Add an emergency handler in nmi_desc & use it in
nmi_shootdown_cpus()
- vhost-scsi: Return queue full for page alloc failures during copy
- vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
- media: adv7180: Disable test-pattern control on adv7180
- media: tc358746: improve calculation of the D-PHY timing registers
- libbpf: Fix out-of-bound read
- net/mlx5: Change POOL_NEXT_SIZE define value and make it global
- crypto: ahash - Set default reqsize from ahash_alg
- crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
- MIPS: Use arch specific syscall name match function
- MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
- clocksource: mips-gic-timer: Enable counter when CPUs start
- scsi: mpt3sas: Send a diag reset if target reset fails
- wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
- wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
- wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
- wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
- EDAC/ie31200: work around false positive build warning
- i3c: master: svc: Flush FIFO before sending Dynamic Address
Assignment(DAA)
- drm/amd/display: Add support for disconnected eDP streams
- RDMA/core: Fix best page size finding when it can cross SG entries
- pmdomain: imx: gpcv2: use proper helper for property detection
- can: c_can: Use of_property_present() to test existence of DT property
- bpf: don't do clean_live_states when state->loop_entry->branches > 0
- eth: mlx4: don't try to complete XDP frames in netpoll
- PCI: Fix old_size lower bound in calculate_iosize() too
- ACPI: HED: Always initialize before evged
- vxlan: Join / leave MC group after remote changes
- media: test-drivers: vivid: don't call schedule in loop
- net/mlx5: Modify LSB bitmask in temperature event to include only the
first bit
- net/mlx5: Apply rate-limiting to high temperature warning
- firmware: arm_ffa: Reject higher major version as incompatible
- ASoC: ops: Enforce platform maximum on initial value
- ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
- ASoC: tas2764: Mark SW_RESET as volatile
- ASoC: tas2764: Power up/down amp on mute ops
- ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
- pinctrl: devicetree: do not goto err when probing hogs in
pinctrl_dt_to_map
- smack: recognize ipv4 CIPSO w/o categories
- smack: Revert "smackfs: Added check catlen"
- kunit: tool: Use qboot on QEMU x86_64
- media: i2c: imx219: Correct the minimum vblanking value
- media: v4l: Memset argument to 0 before calling get_mbus_config pad op
- net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
- clk: qcom: ipq5018: allow it to be bulid on arm32
- [Config] clk: qcom: ipq5018: enable module on armhf
- clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
- x86/traps: Cleanup and robustify decode_bug()
- sched: Reduce the default slice to avoid tasks getting an extra tick
- serial: sh-sci: Update the suspend/resume support
- phy: core: don't require set_mode() callback for phy_get_mode() to work
- soundwire: amd: change the soundwire wake enable/disable sequence
- drm/amdgpu: Set snoop bit for SDMA for MI series
- drm/amd/display: Don't try AUX transactions on disconnected link
- drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
- drm/amd/display: Update CR AUX RD interval interpretation
- drm/amd/display: Initial psr_version with correct setting
- drm/amdgpu: enlarge the VBIOS binary size limit
- drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
- scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
- net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
- net/mlx5e: set the tx_queue_len for pfifo_fast
- net/mlx5e: reduce rep rxq depth to 256 for ECPF
- net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
- drm/v3d: Add clock handling
- wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
- wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
- net: fec: Refactor MAC reset to function
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
- arch/powerpc/perf: Check the instruction type before creating sample
with perf_mem_data_src
- ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
- r8152: add vendor/device ID pair for Dell Alienware AW1022z
- pstore: Change kmsg_bytes storage size to u32
- ext4: don't write back data before punch hole in nojournal mode
- ext4: remove writable userspace mappings before truncating page cache
- wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
- wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
- clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
- hwmon: (xgene-hwmon) use appropriate type for the latency value
- f2fs: introduce f2fs_base_attr for global sysfs entries
- media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is
available
- ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
- r8169: don't scan PHY addresses > 0
- bridge: mdb: Allow replace of a host-joined group
- ice: treat dyn_allowed only as suggestion
- rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
- rcu: handle unstable rdp in rcu_read_unlock_strict()
- rcu: fix header guard for rcu_all_qs()
- perf: Avoid the read if the count is already updated
- ice: count combined queues using Rx/Tx count
- net/mana: fix warning in the writer of client oob
- scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
- scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when
pci_irq_vector() fails
- scsi: st: Restore some drive settings after reset
- wifi: ath12k: Avoid napi_sync() before napi_enable()
- HID: usbkbd: Fix the bit shift number for LED_KANA
- arm64: zynqmp: add clock-output-names property in clock nodes
- ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
- ASoC: rt722-sdca: Add some missing readable registers
- drm/ast: Find VBIOS mode from regular display size
- bpftool: Fix readlink usage in get_fd_type
- firmware: arm_scmi: Relax duplicate name constraint across protocol ids
- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
- perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
- wifi: rtl8xxxu: retry firmware download on error
- wifi: rtw88: Don't use static local variable in
rtw8822b_set_tx_power_index_by_rate
- wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
- spi: zynqmp-gqspi: Always acknowledge interrupts
- regulator: ad5398: Add device tree support
- wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
- accel/qaic: Mask out SR-IOV PCI resources
- wifi: ath9k: return by of_get_mac_address
- wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
- drm: bridge: adv7511: fill stream capabilities
- drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
- drm/panel-edp: Add Starry 116KHD024006
- drm: Add valid clones check
- ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
- book3s64/radix: Fix compile errors when
CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
- pinctrl: meson: define the pull up/down resistor value as 60 kOhm
- ASoC: cs42l43: Disable headphone clamps during type detection
- ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
- ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
- nvme-pci: add quirks for device 126f:1001
- nvme-pci: add quirks for WDC Blue SN550 15b7:5009
- io_uring/fdinfo: annotate racy sq/cq head/tail reads
- cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
- cifs: Fix changing times and read-only attr over SMB1
smb_set_file_info() function
- tools: ynl-gen: validate 0 len strings from kernel
- wifi: iwlwifi: add support for Killer on MTL
- xenbus: Allow PVH dom0 a non-local xenstore
- soundwire: bus: Fix race on the creation of the IRQ domain
- dmaengine: idxd: Fix allowing write() from different address spaces
- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
- remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
- clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
- xfrm: Sanitize marks before insert
- dmaengine: idxd: Fix ->poll() return value
- dmaengine: fsl-edma: Fix return code for unhandled interrupts
- Bluetooth: L2CAP: Fix not checking l2cap_chan security level
- Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump
handling
- bridge: netfilter: Fix forwarding of fragmented packets
- ice: fix vf->num_mac count with port representors
- ice: Fix LACP bonds without SRIOV environment
- pinctrl: qcom: switch to devm_register_sys_off_handler()
- net: dwmac-sun8i: Use parsed internal PHY address instead of 1
- net: lan743x: Restore SGMII CTRL register on resume
- io_uring: fix overflow resched cqe reordering
- octeontx2-pf: Add AF_XDP non-zero copy support
- octeontx2-af: Set LMT_ENA bit for APR table entries
- octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
- clk: s2mps11: initialise clk_hw_onecell_data::num before accessing
::hws[] in probe()
- can: slcan: allow reception of short error messages
- ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
- ASoc: SOF: topology: connect DAI to a single DAI link
- ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback
direction
- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
- llc: fix data loss when reading from a socket in llc_ui_recvmsg()
- can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
- thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
- drm/edid: fixed the bug that hdr metadata was not reset
- arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
- smb: client: Reset all search buffer pointers when releasing buffer
- Input: xpad - add more controllers
- memcg: always call cond_resched() after fn()
- mm/page_alloc.c: avoid infinite retries caused by cpuset race
- Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
- ksmbd: fix stream write failure
- spi: spi-fsl-dspi: restrict register range for regmap access
- spi: spi-fsl-dspi: Halt the module after a new message transfer
- spi: spi-fsl-dspi: Reset SR flags before sending a new message
- serial: sh-sci: Save and restore more registers
- watchdog: aspeed: fix 64-bit division
- pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
- i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
- drm/gem: Internally test import_attach for imported objects
- can: kvaser_pciefd: Force IRQ edge in case of nested IRQ
- af_unix: Return struct unix_sock from unix_get_socket().
- af_unix: Run GC on only one CPU.
- af_unix: Try to run GC async.
- af_unix: Replace BUG_ON() with WARN_ON_ONCE().
- af_unix: Remove io_uring code for GC.
- af_unix: Remove CONFIG_UNIX_SCM.
- [Config] af_unix: remove UNIX_SCM config option
- af_unix: Allocate struct unix_vertex for each inflight AF_UNIX fd.
- af_unix: Allocate struct unix_edge for each inflight AF_UNIX fd.
- af_unix: Link struct unix_edge when queuing skb.
- af_unix: Bulk update unix_tot_inflight/unix_inflight when queuing skb.
- af_unix: Iterate all vertices by DFS.
- af_unix: Detect Strongly Connected Components.
- af_unix: Save listener for embryo socket.
- af_unix: Fix up unix_edge.successor for embryo socket.
- af_unix: Save O(n) setup of Tarjan's algo.
- af_unix: Skip GC if no cycle exists.
- af_unix: Avoid Tarjan's algorithm if unnecessary.
- af_unix: Assign a unique index to SCC.
- af_unix: Detect dead SCC.
- Revert "UBUNTU: SAUCE: af_unix: Fix GC compatibility with upstream OOB
refcount changes"
- af_unix: Replace garbage collection algorithm.
- af_unix: Remove lock dance in unix_peek_fds().
- af_unix: Try not to hold unix_gc_lock during accept().
- af_unix: Don't access successor in unix_del_edges() during GC.
- af_unix: Add dead flag to struct scm_fp_list.
- af_unix: Fix garbage collection of embryos carrying OOB with SCM_RIGHTS
- af_unix: Fix uninit-value in __unix_walk_scc()
- SAUCE: Revert "af_unix: Don't return OOB skb in manage_oob()."
- SAUCE: Revert "af_unix: Move spin_lock() in manage_oob()."
- SAUCE: Revert "af_unix: Rename unlinked_skb in manage_oob()."
- SAUCE: Revert "af_unix: Remove single nest in manage_oob()."
- SAUCE: Revert "af_unix: Don't call skb_get() for OOB skb."
- af_unix: Define locking order for unix_table_double_lock().
- af_unix: Define locking order for U_LOCK_SECOND in
unix_state_double_lock().
- af_unix: Define locking order for U_RECVQ_LOCK_EMBRYO in
unix_collect_skb().
- af_unix: Don't call skb_get() for OOB skb.
- af_unix: Don't leave consecutive consumed OOB skbs.
- af_unix: Remove single nest in manage_oob().
- af_unix: Rename unlinked_skb in manage_oob().
- af_unix: Move spin_lock() in manage_oob().
- af_unix: Don't return OOB skb in manage_oob().
- arm64: dts: qcom: ipq9574: Add missing properties for cryptobam
- arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node
- arm64: dts: qcom: sm8450: Add missing properties for cryptobam
- arm64: dts: qcom: sm8550: Add missing properties for cryptobam
- arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy
- perf/arm-cmn: Fix REQ2/SNP2 mixup
- perf/arm-cmn: Initialise cmn->cpu earlier
- coredump: fix error handling for replace_fd()
- dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open
- HID: quirks: Add ADATA XPG alpha wireless mouse support
- nfs: don't share pNFS DS connections between net namespaces
- platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
- um: let 'make clean' properly clean underlying SUBARCH as well
- drm/amd/display: fix link_set_dpms_off multi-display MST corner case
- phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure
- spi: spi-sun4i: fix early activation
- nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro
- NFS: Avoid flushing data while holding directory locks in nfs_rename()
- platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
- platform/x86: thinkpad_acpi: Ignore battery threshold change event
notification
- net: ethernet: ti: am65-cpsw: Lower random mac address error print to
info
- dma/mapping.c: dev_dbg support for dma_addressing_limited
- mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type
- vhost_task: fix vhost_task_create() documentation
- dma-mapping: Fix warning reported for missing prototype
- fs/buffer: split locking for pagecache lookups
- fs/buffer: introduce sleeping flavors for pagecache lookups
- fs/buffer: use sleeping version of __find_get_block()
- fs/ocfs2: use sleeping version of __find_get_block()
- fs/jbd2: use sleeping version of __find_get_block()
- fs/ext4: use sleeping version of sb_find_get_block()
- drm/amd/display: Enable urgent latency adjustment on DCN35
- iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
- cifs: Set default Netbios RFC1001 server name to hostname in UNC
- ASoC: codecs: wsa884x: Correct VI sense channel mask
- ASoC: codecs: wsa883x: Correct VI sense channel mask
- thermal/drivers/mediatek/lvts: Start sensor interrupts disabled
- Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler
removal
- drm/amdgpu/discovery: check ip_discovery fw file available
- drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12
- xen/pci: Do not register devices with segments >= 0x10000
- drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
- cgroup/rstat: avoid disabling irqs for O(num_cpu)
- wifi: mt76: mt7996: fix SER reset trigger on WED reset
- wifi: mt76: mt7925: load the appropriate CLC data based on hardware type
- wifi: mt76: mt7925: fix fails to enter low power mode in suspend state
- x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers
- x86/cpu/intel: Replace PAT erratum model/family magic numbers with
symbolic IFM references
- x86/smpboot: Fix INIT delay assignment for extended Intel Families
- x86/microcode/intel: Switch to new Intel CPU model defines
- x86/microcode: Update the Intel processor flag scan check
- blk-cgroup: improve policy registration error handling
- drm/amdgpu: release xcp_mgr on exit
- drm/amdgpu: adjust drm_firmware_drivers_only() handling
- s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste()
- clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
- erofs: initialize decompression early
- clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490
- posix-timers: Ensure that timer initialization is fully visible
- net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe
- net: hsr: Fix PRP duplicate detection
- PNP: Expand length of fixup id string
- arm64/mm: Check pmd_table() in pmd_trans_huge()
- wifi: iwlwifi: mark Br device not integrated
- wifi: mac80211: fix warning on disconnect during failed ML reconf
- wifi: mac80211_hwsim: Fix MLD address translation
- badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable
< 0
- coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t
- misc: pci_endpoint_test: Give disabled BARs a distinct error code
- drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
- drm/xe: Retry BO allocation
- soc: samsung: include linux/array_size.h where needed
- usb: xhci: set page size to the xHCI-supported size
- soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables
- drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
- drm/amd/display: Fix p-state type when p-state is unsupported
- perf/core: Clean up perf_try_init_event()
- net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104
- dpll: Add an assertion to check freq_supported_num
- ublk: enforce ublks_max only for unprivileged devices
- scsi: logging: Fix scsi_logging_level bounds
- ublk: complete command synchronously on error
- drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
- bpf: Search and add kfuncs in struct_ops prologue and epilogue
- drm/amd/display: fix dcn4x init failed
- net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode
- scsi: mpi3mr: Update timestamp only for supervisor IOCs
- scsi: scsi_debug: First fixes for tapes
- net: ipv6: Init tunnel link-netns before registering dev
- drm/amdgpu: remove all KFD fences from the BO on release
- eeprom: ee1004: Check chip before probing
- drm/amd/pm: Fetch current power limit from PMFW
- drm/amd/display: DCN35 set min dispclk to 50Mhz
- drm/amd/display: Fix DCN35 set min dispclk logic
- drm/amd/display: Guard against setting dispclk low when active
- drm/amd/display: Fix BT2020 YCbCr limited/full range input
- drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
- hrtimers: Replace hrtimer_clock_to_base_table with switch-case
- firmware: arm_ffa: Handle the presence of host partition in the
partition info
- firmware: xilinx: Dont send linux address to get fpga config get status
- drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
- x86/ibt: Handle FineIBT in handle_cfi_failure()
- soundwire: cadence_master: set frame shape and divider based on actual
clk freq
- net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size
- drm/amdkfd: fix missing L2 cache info in topology
- drm/amd/display: pass calculated dram_speed_mts to dml2
- drm/amd/pm: Skip P2S load for SMU v13.0.12
- drm/amd/display: Support multiple options during psr entry.
- drm/amdgpu: Use active umc info from discovery
- net/mlx5: XDP, Enable TX side XDP multi-buffer support
- wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV
- wifi: iwlwifi: use correct IMR dump variable
- wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than
64-bits
- wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang
- wifi: rtw89: fw: validate multi-firmware header before getting its size
- wifi: rtw89: fw: validate multi-firmware header before accessing
- wifi: rtw89: call power_on ahead before selecting firmware
- net: page_pool: avoid false positive warning if NAPI was never added
- media: qcom: camss: Add default case in vfe_src_pad_code
- drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0
- tools: ynl-gen: don't output external constants
- ice: init flow director before RDMA
- wifi: ath12k: Fetch regdb.bin file from board-2.bin
- drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
- wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan
event
- drm/xe/sa: Always call drm_suballoc_manager_fini()
- drm/xe: Reject BO eviction if BO is bound to current VM
- smb: server: smb2pdu: check return value of xa_store()
- ACPI: platform-profile: add platform_profile_cycle()
- platform/x86: ideapad-laptop: add support for some new buttons
- ALSA: usb-audio: Fix duplicated name in MIDI substream names
- btrfs: handle empty eb->folios in num_extent_folios()
- xfrm: Fix UDP GRO handling for some corner cases
- idpf: fix idpf_vport_splitq_napi_poll()
- net: dsa: microchip: update tag_ksz masks for KSZ9477 family
- net: dsa: microchip: linearize skb for tail-tagging switches
- vmxnet3: update MTU after device quiesce
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
- highmem: add folio_test_partial_kmap()
- mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled
- nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
- Bluetooth: btmtksdio: Check function enabled before doing close
- Bluetooth: btmtksdio: Do close if SDIO card removed without close
- platform/x86: think-lmi: Fix attribute name usage for non-compliant
items
- err.h: move IOMEM_ERR_PTR() to err.h
- gcc-15: make 'unterminated string initialization' just a warning
- gcc-15: disable '-Wunterminated-string-initialization' entirely for now
- Fix mis-uses of 'cc-option' for warning disablement
- bpf: abort verification if env->cur_state->loop_entry != NULL
- drm/amdkfd: Correct F8_MODE for gfx950
- arm64: dts: qcom: sm8650: Add missing properties for cryptobam
- arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage
- arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on
- arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default
- arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to
default
- arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219
overlay
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay
- arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay
- arm64: dts: ti: k3-am65-main: Fix sdhci node properties
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0
- arm64: dts: ti: k3-j721e-sk: Model CSI2RX connector mux
- arm64: dts: ti: k3-j721e-sk: Add support for multiple CAN instances
- arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators
- drm/xe: Save the gt pointer in lrc and drop the tile
- Upstream stable to v6.6.93, v6.12.31, v6.12.32
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38053
- idpf: fix null-ptr-deref in idpf_features_check
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38055
- perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38057
- espintcp: fix skb leaks
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38060
- bpf: copy_verifier_state() should copy 'loop_entry' field
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38098
- drm/amd/display: Don't treat wb connector as physical in
create_validate_stream_for_sink
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38099
- Bluetooth: Disable SCO support if READ_VOICE_SETTING is
unsupported/broken
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38073
- block: fix race between set_blocksize and read paths
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38051
- smb: client: Fix use-after-free in cifs_fill_dirent
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38077
- platform/x86: dell-wmi-sysman: Avoid buffer overflow in
current_password_store()
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38078
- ALSA: pcm: Fix race of buffer access at PCM OSS layer
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38003
- can: bcm: add missing rcu read protection for procfs content
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38004
- can: bcm: add locking for bcm_op runtime updates
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38031
- padata: do not leak refcount in reorder_work
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38079
- crypto: algif_hash - fix double free in hash_accept
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38052
- net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38097
- espintcp: remove encap socket caching to avoid reference leak
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38058
- __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38059
- btrfs: avoid NULL pointer dereference if no valid csum tree
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38034
- btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38035
- nvmet-tcp: don't restore null sk_state_change
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38037
- vxlan: Annotate FDB data races
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38039
- net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload
enabled
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38080
- drm/amd/display: Increase block_sequence array size
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38040
- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38061
- net: pktgen: fix access outside of user given buffer in
pktgen_thread_write()
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38062
- genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of
iommu_cookie
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38063
- dm: fix unconditional IO throttle caused by REQ_PREFLUSH
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38043
- firmware: arm_ffa: Set dma_mask for ffa devices
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38044
- media: cx231xx: set device_caps for 417
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38065
- orangefs: Do not truncate file size
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38066
- dm cache: prevent BUG_ON by blocking retries on failed device resumes
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38068
- crypto: lzo - Fix compression buffer overrun
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38045
- wifi: iwlwifi: fix debug actions order
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38071
- x86/mm: Check return value from memblock_phys_alloc_range()
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38072
- libnvdimm/labels: Fix divide error in nd_label_data_init()
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38081
- spi-rockchip: Fix register out of bounds access
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38074
- vhost-scsi: protect vq->log_used with vq->mutex
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38048
- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
* Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
CVE-2025-38075
- scsi: target: iscsi: Fix timeout on deleted connection
* CAP_PERFMON insufficient to get perf data (LP: #2131046)
- SAUCE: perf/core: Allow CAP_PERFMON for paranoid level 4
* Dell AIO backlight is not working, dell_uart_backlight module is missing
(LP: #2083800)
- SAUCE: Removed sauce dell-uart-backlight driver
- Revert "UBUNTU: SAUCE: ACPI: video: Dell AIO UART backlight detection"
- platform/x86: Add new Dell UART backlight driver
- ACPI: video: Add Dell UART backlight controller detection
- SAUCE: dell_uart_backlight: size_t -> ssize_t
- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7760 AIO
- ACPI: video: Add backlight=native quirk for Dell OptiPlex 5480 AIO
- [Config] enable CONFIG_DELL_UART_BACKLIGHT
* Ubuntu x86_64 6.8 kernels won't build if CONFIG_FB_HYPERV config option is
enabled (LP: #2127971)
- fbdev: Introduce devm_register_framebuffer()
* Run iio_info will be stucked forever (HID-
SENSOR-200011.5.auto/iio:device1) (LP: #2102077)
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
* kernel: sysfs: cannot create duplicate filename
'/bus/platform/devices/iTCO_wdt' (LP: #2121997)
- i2c: i801: Hide Intel Birch Stream SoC TCO WDT
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344)
- fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
- selftests/exec: load_address: conform test to TAP format output
- binfmt_elf: Leave a gap between .bss and brk
- selftests/exec: Build both static and non-static load_address tests
- binfmt_elf: Calculate total_size earlier
- binfmt_elf: Honor PT_LOAD alignment for static PIE
- binfmt_elf: Move brk for static PIE even if ASLR disabled
- platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie
14XA (GX4HRXL)
- platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
- cgroup/cpuset: Extend kthread_is_per_cpu() check to all
PF_NO_SETAFFINITY tasks
- tracing: probes: Fix a possible race in trace_probe_log APIs
- tpm: tis: Double the timeout B to 4s
- firmware: arm_scmi: Add helper to trace bad messages
- firmware: arm_scmi: Add message dump traces for bad and unexpected
replies
- firmware: arm_scmi: Add support for debug metrics at the interface
- [Config] do not enable new support for SCMI debug metrics
- firmware: arm_scmi: Track basic SCMI communication debug metrics
- iio: adc: ad7266: Fix potential timestamp alignment issue.
- iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
- iio: chemical: sps30: use aligned_s64 for timestamp
- HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
- spi: loopback-test: Do not split 1024-byte hexdumps
- Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
- tools: ynl: ethtool.py: Output timestamping statistics from tsinfo-get
operation
- tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
- mctp: no longer rely on net->dev_index_head[]
- net: mctp: Ensure keys maintain only one ref to corresponding dev
- ALSA: seq: Fix delivery of UMP events to group ports
- ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
- net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
- nvme-pci: make nvme_pci_npages_prp() __always_inline
- nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
- ALSA: sh: SND_AICA should depend on SH_DMA_API
- qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
- octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
- net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW
capability
- octeontx2-af: Fix CGX Receive counters
- tsnep: fix timestamping with a stacked DSA driver
- NFSv4/pnfs: Reset the layout state after a layoutreturn
- udf: Make sure i_lenExtents is uptodate on inode eviction
- LoongArch: Prevent cond_resched() occurring within kernel-fpu
- LoongArch: Save and restore CSR.CNTC for hibernation
- LoongArch: Fix MAX_REG_OFFSET calculation
- LoongArch: uprobes: Remove user_{en,dis}able_single_step()
- LoongArch: uprobes: Remove redundant code about resume_era
- drm/amd/display: Correct the reply value when AUX write incomplete
- drm/amd/display: Avoid flooding unnecessary info messages
- ACPI: PPTT: Fix processor subtable walk
- ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
- ALSA: usb-audio: Add sample rate quirk for Audioengine D1
- ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
- hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
- hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
- hv_netvsc: Remove rmsg_pgcnt
- Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
- Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
- ftrace: Fix preemption accounting for stacktrace trigger command
- ftrace: Fix preemption accounting for stacktrace filter command
- tracing: samples: Initialize trace_array_printk() with the correct
function
- phy: Fix error handling in tegra_xusb_port_init
- phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
- phy: renesas: rcar-gen3-usb2: Set timing registers only once
- scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
- smb: client: fix memory leak during error handling for POSIX mkdir
- spi: tegra114: Use value to check for invalid delays
- net: qede: Initialize qede_ll_ops with designated initializer
- dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure
instead of a local copy
- dmaengine: idxd: fix memory leak in error handling path of
idxd_setup_wqs
- dmaengine: idxd: fix memory leak in error handling path of
idxd_setup_engines
- dmaengine: idxd: fix memory leak in error handling path of
idxd_setup_groups
- dmaengine: idxd: Add missing cleanup for early error out in
idxd_setup_internals
- dmaengine: idxd: Add missing cleanups in cleanup internals
- dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove
call
- dmaengine: idxd: fix memory leak in error handling path of
idxd_pci_probe
- LoongArch: Explicitly specify code model in Makefile
- SAUCE: Revert "memblock: Accept allocated memory before use in
memblock_double_array()"
- phy: tegra: xusb: remove a stray unlock
- drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC
Policies
- drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies
- uio_hv_generic: Fix sysfs creation path for ring buffer
- KVM: Add member to struct kvm_gfn_range to indicate private/shared
- KVM: x86/mmu: Prevent installing hugepages when mem attributes are
changing
- iio: chemical: pms7003: use aligned_s64 for timestamp
- iio: pressure: mprls0025pa: use aligned_s64 for timestamp
- net: dsa: b53: prevent standalone from trying to forward to other ports
- netlink: specs: tc: fix a couple of attribute names
- LoongArch: Move __arch_cpu_idle() to .cpuidle.text section
- btrfs: fix discard worker infinite loop after disabling discard
- btrfs: fix folio leak in submit_one_async_extent()
- btrfs: add back warning for mount option commit values exceeding 300
- drm/amdgpu: fix incorrect MALL size for GFX1151
- gpio: pca953x: fix IRQ storm on system wake up
- kbuild: Disable -Wdefault-const-init-unsafe
- mm: userfaultfd: correct dirty flags set for both present and swap pte
- accel/ivpu: Rename ivpu_log_level to fw_log_level
- accel/ivpu: Reset fw log on cold boot
- accel/ivpu: Refactor functions in ivpu_fw_log.c
- drm/fbdev-dma: Support struct drm_driver.fbdev_probe
- Upstream stable to v6.6.92, v6.12.30
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-37968
- iio: light: opt3001: fix deadlock due to concurrent flag access
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38011
- drm/amdgpu: csa unmap use uninterruptible lock
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-21931
- hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-37960
- memblock: Accept allocated memory before use in memblock_double_array()
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-37967
- usb: typec: ucsi: displayport: Fix deadlock
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-22102
- Bluetooth: btnxpuart: Fix kernel panic during FW release
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38008
- mm/page_alloc: fix race condition in unaccepted memory handling
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38014
- dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38015
- dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38005
- dmaengine: ti: k3-udma: Add missing locking
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38009
- wifi: mt76: disable napi on driver removal
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38010
- phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38095
- dma-buf: insert memory barrier before updating num_fences
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38018
- net/tls: fix kernel panic when alloc_page failed
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38019
- mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38013
- wifi: mac80211: Set n_channels after allocating struct
cfg80211_scan_request
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38027
- regulator: max20086: fix invalid memory access
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38020
- net/mlx5e: Disable MACsec offload for uplink representor profile
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38094
- net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38006
- net: mctp: Don't access ifa_index when missing
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-37992
- net_sched: Flush gso_skb list too during ->change()
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38023
- nfs: handle failure of nfs_get_lock_context in unlock path
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38007
- HID: uclogic: Add NULL check in uclogic_input_configured()
* Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
CVE-2025-38024
- RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277)
- dm: add missing unlock on in dm_keyslot_evict()
- arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2
- can: mcan: m_can_class_unregister(): fix order of unregistration calls
- can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
- ksmbd: fix memory leak in parse_lease_state()
- SAUCE: Revert "sch_htb: make htb_deactivate() idempotent"
- sch_htb: make htb_deactivate() idempotent
- gre: Fix again IPv6 link-local address generation.
- netdevice: add netdev_tx_reset_subqueue() shorthand
- net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
- can: mcp251xfd: fix TDC setting for low data bit rates
- can: gw: fix RCU/BH usage in cgw_create_job()
- net: dsa: b53: allow leaky reserved multicast
- net: dsa: b53: fix clearing PVID of a port
- net: dsa: b53: fix flushing old pvid VLAN on pvid change
- net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
- net: dsa: b53: always rejoin default untagged VLAN on bridge leave
- net: dsa: b53: fix learning on VLAN unaware bridges
- Input: cyttsp5 - ensure minimum reset pulse width
- Input: cyttsp5 - fix power control issue on wakeup
- Input: xpad - fix Share button on Xbox One controllers
- Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller
- Input: synaptics - enable InterTouch on Dynabook Portege X30-D
- Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
- Input: synaptics - enable InterTouch on Dell Precision M3800
- Input: synaptics - enable SMBus for HP Elitebook 850 G1
- Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
- staging: iio: adc: ad7816: Correct conditional logic for store mode
- staging: axis-fifo: Remove hardware resets for user errors
- staging: axis-fifo: Correct handling of tx_fifo_depth for size
validation
- drm/amd/display: Shift DMUB AUX reply command if necessary
- iio: adc: ad7606: fix serial register access
- iio: adc: rockchip: Fix clock initialization sequence
- iio: adis16201: Correct inclinometer channel resolution
- drm/amd/display: Fix the checking condition in dmub aux handling
- drm/amd/display: Remove incorrect checking in dmub aux handler
- drm/amd/display: Fix wrong handling for AUX_DEFER case
- drm/amd/display: Copy AUX read reply data whenever length > 0
- usb: uhci-platform: Make the clock really optional
- xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
- clocksource/i8253: Use raw_spinlock_irqsave() in
clockevent_i8253_disable()
- x86/microcode: Consolidate the loader enablement checking
- ocfs2: switch osb->disable_recovery to enum
- ocfs2: implement handshaking with ocfs2 recovery thread
- ocfs2: stop quota recovery before disabling quotas
- usb: cdnsp: Fix issue with resuming from L1
- usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
- usb: gadget: f_ecm: Add get_status callback
- usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
- usb: gadget: Use get_status callback to set remote wakeup capability
- usb: host: tegra: Prevent host controller crash when OTG port is used
- usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
- USB: usbtmc: use interruptible sleep in usbtmc_read
- usb: usbtmc: Fix erroneous get_stb ioctl error returns
- usb: usbtmc: Fix erroneous wait_srq ioctl return
- usb: usbtmc: Fix erroneous generic_read ioctl return
- iio: accel: adxl367: fix setting odr for activity time update
- iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
- types: Complement the aligned types with signed 64-bit one
- iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
- iio: adc: dln2: Use aligned_s64 for timestamp
- MIPS: Fix MAX_REG_OFFSET
- drm/panel: simple: Update timings for AUO G101EVN010
- do_umount(): add missing barrier before refcount checks in sync case
- io_uring: always arm linked timeouts prior to issue
- arm64: insn: Add support for encoding DSB
- arm64: proton-pack: Expose whether the platform is mitigated by firmware
- arm64: proton-pack: Expose whether the branchy loop k value
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation
- x86/bpf: Call branch history clearing sequence on exit
- x86/bpf: Add IBHF call at end of classic BPF
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode
- x86/speculation: Simplify and make CALL_NOSPEC consistent
- x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
- x86/speculation: Remove the extra #ifdef around CALL_NOSPEC
- Documentation: x86/bugs/its: Add ITS documentation
- x86/its: Enumerate Indirect Target Selection (ITS) bug
- x86/its: Add support for ITS-safe indirect thunk
- [Config] enable Indirect Target Selection mitigation
- x86/its: Add support for ITS-safe return thunk
- x86/its: Enable Indirect Target Selection mitigation
- x86/its: Add "vmexit" option to skip mitigation on some CPUs
- x86/its: Add support for RSB stuffing mitigation
- x86/its: Align RETs in BHB clear sequence to avoid thunking
- x86/ibt: Keep IBT disabled during alternative patching
- x86/its: Use dynamic thunks for indirect branches
- x86/its: Fix build errors when CONFIG_MODULES=n
- x86/its: FineIBT-paranoid vs ITS
- x86/its: Fix build error for its_static_thunk()
- firmware: arm_scmi: Fix timeout checks on polling path
- s390/entry: Fix last breaking event handling in case of stack corruption
- erofs: ensure the extra temporary copy is valid for shortened bvecs
- net: dsa: b53: keep CPU port always tagged again
- net: dsa: b53: do not allow to configure VLAN 0
- net: dsa: b53: do not program vlans when vlan filtering is off
- net: dsa: b53: fix toggling vlan_filtering
- net: dsa: b53: do not set learning and unicast/multicast on up
- rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros`
configuration
- mm/userfaultfd: fix uninitialized output field for -EAGAIN race
- selftests/mm: compaction_test: support platform with huge mount of
memory
- selftests/mm: fix a build failure on powerpc
- io_uring: ensure deferred completions are flushed for multishot
- iio: imu: inv_mpu6050: align buffer for timestamp
- drm/xe: Add page queue multiplier
- usb: dwc3: gadget: Make gadget_wakeup asynchronous
- riscv: misaligned: Add handling for ZCB instructions
- riscv: misaligned: factorize trap handling
- riscv: misaligned: enable IRQs while handling misaligned accesses
- selftest/x86/bugs: Add selftests for ITS
- Upstream stable to v6.6.91, v6.12.29
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37960
- memblock: Accept allocated memory before use in memblock_double_array()
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37957
- KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37963
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37948
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37994
- usb: typec: ucsi: displayport: Fix NULL pointer access
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37995
- module: ensure that kobject_put() is safe for module type kobjects
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37949
- xenbus: Use kref to track req lifetime
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37954
- smb: client: Avoid race in open_cached_dir with lease breaks
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37951
- drm/v3d: Add job to pending list if the reset was skipped
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37969
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37970
- iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37972
- Input: mtk-pmic-keys - fix possible null pointer dereference
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37959
- bpf: Scrub packet on bpf_redirect_peer
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37961
- ipvs: fix uninit-value for saddr in do_output_route4
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37998
- openvswitch: Fix unsafe attribute parsing in output_userspace()
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37952
- ksmbd: Fix UAF in __close_file_table_ids
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37947
- ksmbd: prevent out-of-bounds stream writes by validating *pos
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37956
- ksmbd: prevent rename with empty string
* Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
CVE-2025-37973
- wifi: cfg80211: fix out-of-bounds access during multi-link element
defragmentation
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559)
- ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()
- ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset
- btrfs: fix COW handling in run_delalloc_nocow()
- drm/fdinfo: Protect against driver unbind
- EDAC/altera: Test the correct error reg offset
- EDAC/altera: Set DDR and SDMMC interrupt mask before registration
- i2c: imx-lpi2c: Fix clock count when probe defers
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
- amd-xgbe: Fix to ensure dependent features are toggled with RX checksum
offload
- mm/memblock: pass size instead of end to memblock_set_node()
- mm/memblock: repeat setting reserved region nid if array is doubled
- mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe
- spi: tegra114: Don't fail set_cs_timing when delays are zero
- tracing: Do not take trace_event_sem in print_event_fields()
- dm-integrity: fix a warning on invalid table line
- dm: always update the array size in realloc_argv on success
- iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)
- platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep
cycles
- platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU
hotplug
- smb: client: fix zero length for mkdir POSIX create context
- cpufreq: Avoid using inconsistent policy->min and policy->max
- cpufreq: Fix setting policy limits when frequency tables are used
- PCI: imx6: Skip controller_id generation logic for i.MX7D
- ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence
- powerpc/boot: Check for ld-option support
- drm/i915/pxp: fix undefined reference to
`intel_pxp_gsccs_is_ready_for_sessions'
- powerpc/boot: Fix dash warning
- net/mlx5: E-Switch, Initialize MAC Address for Default GID
- net/mlx5: E-switch, Fix error handling for enabling roce
- net: Rename mono_delivery_time to tstamp_type for scalabilty
- Bluetooth: L2CAP: copy RX timestamp to new fragments
- net: mscc: ocelot: treat 802.1ad tagged traffic as 802.1Q-untagged
- net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID
- net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when
advised
- pds_core: delete VF dev on reset
- pds_core: make pdsc_auxbus_dev_del() void
- pds_core: specify auxiliary_device to be created
- nvme-pci: fix queue unquiesce check on slot_reset
- net: dlink: Correct endianness handling of led_mode
- net: mdio: mux-meson-gxl: set reversed bit when using internal phy
- igc: fix lock order in igc_ptp_reset
- net: dsa: felix: fix broken taprio gate states after clock jump
- net: ipv6: fix UDPv6 GSO segmentation with NAT
- bnxt_en: Fix coredump logic to free allocated buffer
- bnxt_en: Fix ethtool -d byte order for 32-bit values
- nvme-tcp: fix premature queue removal and I/O failover
- net: fec: ERR007885 Workaround for conventional TX
- net: hns3: store rx VLAN tag offload state for VF
- net: hns3: fix an interrupt residual problem
- net: hns3: fixed debugfs tm_qset size
- net: hns3: defer calling ptp_clock_register()
- net: vertexcom: mse102x: Fix possible stuck of SPI interrupt
- net: vertexcom: mse102x: Fix LEN_MASK
- net: vertexcom: mse102x: Add range check for CMD_RTS
- net: vertexcom: mse102x: Fix RX error handling
- ASoC: Use of_property_read_bool()
- ASoC: soc-core: Stop using of_property_read_bool() for non-boolean
properties
- firmware: arm_ffa: Skip Rx buffer ownership release if not acquired
- ARM: dts: opos6ul: add ksz8081 phy properties
- arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs
- arm64: dts: st: Use 128kB size for aliased GIC400 register access on
stm32mp25 SoCs
- Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"
- xhci: Add helper to set an interrupters interrupt moderation interval
- xhci: support setting interrupt moderation IMOD for secondary
interrupters
- xhci: Limit time spent with xHC interrupts disabled during bus resume
- kernel: param: rename locate_module_kobject
- kernel: globalize lookup_or_create_module_kobject()
- drivers: base: handle module_kobject creation
- iommu/arm-smmu-v3: Use the new rb tree helpers
- iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream
ids
- drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp
- dm: fix copying after src array boundaries
- bpf: Fix BPF_INTERNAL namespace import
- binder: fix offset calculation in debug log
- perf/x86/intel: Only check the group flag for X86 leader
- drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS
- iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
- pinctrl: imx: Return NULL if no group is matched and found
- Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync
- idpf: fix offloads support for encapsulated packets
- drm/tests: shmem: Fix memleak
- idpf: fix potential memory leak on kcalloc() failure
- idpf: protect shutdown from reset
- ALSA: hda/realtek: Fix built-mic regression on other ASUS models
- bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan()
- nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS
- nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS
- accel/ivpu: Fix a typo
- drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change
- Upstream stable to v6.6.90, v6.12.27, v6.12.28
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37920
- xsk: Fix race condition in AF_XDP generic RX path
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37900
- iommu: Fix two issues in iommu_copy_struct_from_user()
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37931
- btrfs: adjust subpage bit start based on sectorsize
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37903
- drm/amd/display: Fix slab-use-after-free in hdcp
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37905
- firmware: arm_scmi: Balance device refcount when destroying devices
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37933
- octeon_ep: Fix host hang issue during device reboot
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37909
- net: lan743x: Fix memleak issue when GSO enabled
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37911
- bnxt_en: Fix out-of-bound memcpy() during ethtool -w
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37935
- net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37891
- ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37912
- ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37913
- net_sched: qfq: Fix double list add in class with netem as child qdisc
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37914
- net_sched: ets: Fix double list add in class with netem as child qdisc
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37915
- net_sched: drr: Fix double list add in class with netem as child qdisc
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37916
- pds_core: remove write-after-free of client_id
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37917
- net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx
poll
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37918
- Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37921
- vxlan: vnifilter: Fix unlocked deletion of default FDB entry
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37897
- wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37922
- book3s64/radix : Align section vmemmap start address to PAGE_SIZE
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37923
- tracing: Fix oob write in trace_seq_to_buffer()
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37924
- ksmbd: fix use-after-free in kerberos authentication
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37927
- iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37928
- dm-bufio: don't schedule in atomic context
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37990
- wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37901
- irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37936
- perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's
value.
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37991
- parisc: Fix double SIGFPE crash
* Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
CVE-2025-37930
- drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307)
- module: sign with sha512 instead of sha1 by default
- x86/extable: Remove unused fixup type EX_TYPE_COPY
- tracing: Add __string_len() example
- tracing: Add __print_dynamic_array() helper
- soc: qcom: ice: introduce devm_of_qcom_ice_get
- mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get
- auxdisplay: hd44780: Convert to platform remove callback returning void
- auxdisplay: hd44780: Fix an API misuse in hd44780.c
- net: dsa: mv88e6xxx: fix internal PHYs for 6320 family
- net: dsa: mv88e6xxx: fix VTU methods for 6320 family
- ASoC: qcom: q6apm-dai: drop unused 'q6apm_dai_rtd' fields
- ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs
- ASoC: q6apm-dai: make use of q6apm_get_hw_pointer
- iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary
return value check
- iio: adc: ad7768-1: Fix conversion result sign
- arm64: tegra: Remove the Orin NX/Nano suspend key
- clk: renesas: r9a07g04[34]: Fix typo for sel_shdi variable
- clk: renesas: r9a07g043: Fix HP clock source for RZ/Five
- of: resolver: Simplify of_resolve_phandles() using __free()
- of: resolver: Fix device node refcount leakage in of_resolve_phandles()
- scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get
- cpufreq/sched: Explicitly synchronize limits_changed flag handling
- ceph: Fix incorrect flush end position calculation
- dma/contiguous: avoid warning about unused size_bytes
- cpufreq: cppc: Fix invalid return value in .get() callback
- btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range()
- scsi: core: Clear flags for scsi_cmnd that did not complete
- net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration
- net: dsa: mt7530: sync driver-specific behavior of MT7531 variants
- pds_core: Remove unnecessary check in pds_client_adminq_cmd()
- iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
- splice: remove duplicate noinline from pipe_clear_nowait
- perf/x86: Fix non-sampling (counting) events on certain x86 platforms
- LoongArch: Select ARCH_USE_MEMTEST
- LoongArch: Make regs_irqs_disabled() more clear
- LoongArch: Make do_xyz() exception handlers more robust
- virtio_console: fix missing byte order handling for cols and rows
- crypto: atmel-sha204a - Set hwrng quality to lowest possible
- net: selftests: initialize TCP header and skb payload with zero
- net: phy: microchip: force IRQ polling mode for lan88xx
- drm/amd/display: Fix gpu reset in multidisplay config
- LoongArch: Return NULL from huge_pte_offset() for invalid PMD
- LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
- LoongArch: Remove a bogus reference to ZONE_DMA
- io_uring: fix 'sync' handling of io_fallback_tw()
- KVM: SVM: Allocate IR data using atomic allocation
- cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports
- ata: libata-scsi: Improve CDL control
- ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type
- ata: libata-scsi: Fix ata_msense_control_ata_feature()
- USB: storage: quirk for ADATA Portable HDD CH94
- scsi: Improve CDL control
- mei: me: add panther lake H DID
- KVM: x86: Explicitly treat routing entry type changes as changes
- char: misc: register chrdev region with all possible minors
- misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack
- serial: msm: Configure correct working mode before starting earlycon
- serial: sifive: lock port in startup()/shutdown() callbacks
- USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
- USB: serial: option: add Sierra Wireless EM9291
- USB: serial: simple: add OWON HDS200 series oscilloscope support
- usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
- usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
- USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
- usb: dwc3: xilinx: Prevent spike in reset signal
- usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
- usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
- USB: VLI disk crashes if LPM is used
- USB: wdm: handle IO errors in wdm_wwan_port_start
- USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
- USB: wdm: add annotation
- pinctrl: renesas: rza2: Fix potential NULL pointer dereference
- MIPS: cm: Detect CM quirks from device tree
- crypto: ccp - Add support for PCI device 0x1134
- clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
- parisc: PDT: Fix missing prototype warning
- s390/tty: Fix a potential memory leak bug
- bpf: bpftool: Setting error code in do_loader()
- bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it
creates storage
- bpf: Reject attaching fexit/fmod_ret to __noreturn functions
- mailbox: pcc: Fix the possible race in updation of chan_in_use flag
- mailbox: pcc: Always clear the platform ack interrupt first
- usb: host: max3421-hcd: Add missing spi_device_id table
- fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
- usb: dwc3: gadget: Refactor loop to avoid NULL endpoints
- usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
- usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func
- thunderbolt: Scan retimers after device router has been enumerated
- objtool: Silence more KCOV warnings
- objtool, panic: Disable SMAP in __stack_chk_fail()
- objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in
wcd934x_slim_irq_handler()
- objtool, regulator: rk808: Remove potential undefined behavior in
rk806_set_mode_dcdc()
- objtool, lkdtm: Obfuscate the do_nothing() pointer
- ntb: reduce stack usage in idt_scan_mws
- ntb_hw_amd: Add NTB PCI ID for new gen CPU
- rtc: pcf85063: do a SW reset if POR failed
- io_uring: always do atomic put from iowq
- sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
- KVM: s390: Don't use %pK through tracepoints
- KVM: s390: Don't use %pK through debug printing
- selftests: ublk: fix test_stripe_04
- xen: Change xen-acpi-processor dom0 dependency
- ACPI: EC: Set ec_no_wakeup for Lenovo Go S
- ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
- nvme: multipath: fix return value of nvme_available_path
- objtool: Stop UNRET validation on UD2
- gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment
- selftests/mincore: Allow read-ahead pages to reach the end of the file
- x86/bugs: Use SBPB in write_ibpb() if applicable
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
- x86/bugs: Don't fill RSB on context switch with eIBRS
- nvmet-fc: take tgtport reference only once
- cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE
mode
- timekeeping: Add a lockdep override in tick_freeze()
- ext4: make block validity check resistent to sb bh corruption
- scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
- scsi: ufs: exynos: Ensure pre_link() executes before
exynos_ufs_phy_init()
- scsi: pm80xx: Set phy_attached to zero when device is gone
- x86/i8253: Call clockevent_i8253_disable() with interrupts disabled
- iomap: skip unnecessary ifs_block_is_uptodate check
- riscv: Provide all alternative macros all the time
- loop: aio inherit the ioprio of original request
- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts
- spi: tegra210-quad: add rate limiting and simplify timeout error message
- ubsan: Fix panic from test_ubsan_out_of_bounds
- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove
cores
- x86/pvh: Call C code via the kernel virtual mapping
- Revert "drivers: core: synchronize really_probe() and dev_uevent()"
- driver core: introduce device_set_driver() helper
- comedi: jr3_pci: Fix synchronous deletion of timer
- net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
- net: dsa: mv88e6xxx: enable PVT for 6321 switch
- net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
- net: dsa: mv88e6xxx: enable STU methods for 6320 family
- MIPS: cm: Fix warning if MIPS_CM is disabled
- objtool: Ignore end-of-section jumps for KCOV/GCOV
- objtool: Silence more KCOV warnings, part 2
- ALSA: hda/cirrus_scodec_test: Don't select dependencies
- ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA
- ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130
- ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
- net: ethernet: mtk_eth_soc: reapply mdc divider on reset
- riscv: Use kvmalloc_array on relocation_hashtable
- riscv: module: Allocate PLT entries for R_RISCV_PLT32
- ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START
event
- dma-buf/sw_sync: Decrement refcount on error in
sw_sync_ioctl_get_deadline()
- mm/compaction: fix bug in hugetlb handling pathway
- platform/x86: amd: pmf: Fix STT limits
- drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1
- drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on
DP1
- drm/xe/dma_buf: stop relying on placement in unmap
- drm/amdgpu: fix warning of drm_mm_clean
- arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1
- arm64/sysreg: Add register fields for HDFGRTR2_EL2
- arm64/sysreg: Add register fields for HDFGWTR2_EL2
- arm64/sysreg: Add register fields for HFGITR2_EL2
- arm64/sysreg: Add register fields for HFGRTR2_EL2
- arm64/sysreg: Add register fields for HFGWTR2_EL2
- kbuild: Add '-fno-builtin-wcslen'
- drm/amd/display: Temporarily disable hostvm on DCN31
- block: remove rq_list_move
- bpf: add find_containing_subprog() utility function
- selftests/bpf: test for changing packet data from global functions
- selftests/bpf: freplace tests for tracking of changes_packet_data
- selftests/bpf: validate that tail call invalidates packet pointers
- selftests/bpf: extend changes_pkt_data with cases w/o subprograms
- media: i2c: imx214: Use subdev active state
- media: i2c: imx214: Simplify with dev_err_probe()
- media: i2c: imx214: Convert to CCI register access helpers
- media: i2c: imx214: Replace register addresses with macros
- media: i2c: imx214: Check number of lanes from device tree
- media: i2c: imx214: Fix link frequency validation
- scsi: ufs: exynos: Move UFS shareability value to drvdata
- cgroup/cpuset: Expose cpuset filesystem with cpuset v1 only
- cgroup/cpuset-v1: Add missing support for cpuset_v2_mode
- vhost-scsi: Add better resource allocation failure handling
- vhost-scsi: Fix vhost_scsi_send_bad_target()
- vhost-scsi: Fix vhost_scsi_send_status()
- scsi: ufs: mcq: Use ufshcd_mcq_req_to_hwq() to simplify updating hwq
- riscv: Replace function-like macro by static inline function
- bpf: Add namespace to BPF internal symbols
- netfilter: fib: avoid lookup if socket is available
- drm: panel: jd9365da: fix reset signal polarity in unprepare
- drm/amd/display: Force full update in gpu reset
- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
- firmware: stratix10-svc: Add of_platform_default_populate()
- i3c: master: svc: Add support for Nuvoton npcm845 i3c
- 9p/trans_fd: mark concurrent read and writes to p9_conn->err
- x86/xen: disable CPU idle and frequency drivers for PVH dom0
- nvmet-fc: put ref when assoc->del_work is already scheduled
- scsi: ufs: exynos: Move phy calls to .exit() callback
- ASoC: fsl_asrc_dma: get codec or cpu dai from backend
- xfs: do not check NEEDSREPAIR if ro,norecovery mount.
- xfs: Do not allow norecovery mount with quotacheck
- xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate
- xfs: flush inodegc before swapon
- selftests/bpf: fix bpf_map_redirect call for cpu map test
- selftests/bpf: make xdp_cpumap_attach keep redirect prog attached
- selftests/bpf: check program redirect in xdp_cpumap_attach
- selftests/bpf: Adjust data size to have ETH_HLEN
- Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family"
- iommu: Handle race with default domain setup
- media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl()
- usb: typec: class: Unlocked on error in typec_register_partner()
- Upstream stable to v6.6.89, v6.12.25, v6.12.26
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37986
- usb: typec: class: Invalidate USB device pointers on partner
unregistration
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37809
- usb: typec: class: Fix NULL pointer access
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37816
- mei: vsc: Fix fortify-panic caused by invalid counted_by() use
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37822
- riscv: uprobes: Add missing fence.i after building the XOL buffer
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37987
- pds_core: Prevent possible adminq overflow/stuck condition
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37826
- scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37827
- btrfs: zoned: return EIO on RAID1 block group write pointer mismatch
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37977
- scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37944
- wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37761
- drm/xe: Fix an out-of-bounds shift when invalidating TLB
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37763
- drm/imagination: take paired job reference
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37764
- drm/imagination: fix firmware memory leaks
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37869
- drm/xe: Use local fence in error path of xe_migrate_clear
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37978
- block: integrity: Do not call set_page_dirty_lock()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37975
- riscv: module: Fix out-of-bounds relocation access
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37872
- net: txgbe: fix memory leak in txgbe_probe() error path
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37873
- eth: bnxt: fix missing ring index trim on error path
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-22120
- ext4: goto right label 'out_mmap_sem' in ext4_setattr()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37799
- vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37800
- driver core: fix potential NULL pointer dereference in dev_uevent()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37878
- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37803
- udmabuf: fix a buf size overflow issue during udmabuf creation
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37983
- qibfs: fix _another_ leak
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37881
- usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37805
- sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37883
- s390/sclp: Add check for get_zeroed_page()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37884
- bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37808
- crypto: null - Use spin lock instead of mutex
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37985
- USB: wdm: close race between wdm_open and wdm_wwan_port_stop
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37810
- usb: dwc3: gadget: check that event count does not exceed event buffer
length
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37811
- usb: chipidea: ci_hdrc_imx: fix usbmisc handling
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37812
- usb: cdns3: Fix deadlock when using NCM gadget
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37813
- usb: xhci: Fix invalid pointer dereference in Etron workaround
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37815
- misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler
registration
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if *new* route isn't postable
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37817
- mcb: fix a double free bug in chameleon_parse_gdd()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37819
- irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37820
- xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37886
- pds_core: make wait_context part of q_info
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37887
- pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37823
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37988
- fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37824
- tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37989
- net: phy: leds: fix memory leak
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37828
- scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37829
- cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37830
- cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37831
- cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-37938
- tracing: Verify event formats that have "%*p.."
* Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
CVE-2025-39989
- x86/mce: use is_copy_from_user() to determine copy-from-user context
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-22026
- nfsd: don't ignore the return code of svc_proc_register()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37836
- PCI: Fix reference leak in pci_register_host_bridge()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37846
- arm64: mops: Do not dereference src reg for a set operation
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37942
- HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37856
- btrfs: harden block_group::bg_list against list_del() races
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37861
- scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37744
- wifi: ath12k: fix memory leak in ath12k_pci_remove()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37745
- PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37945
- net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-
controlled PHY
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37759
- ublk: fix handling recovery & reissue in ublk_abort_queue()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23140
- misc: pci_endpoint_test: Avoid issue of interrupts remaining after
request_irq error
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-22126
- md: fix mddev uaf while iterating all_mddevs list
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37765
- drm/nouveau: prime: fix ttm_bo_delayed_delete oops
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37766
- drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37767
- drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37768
- drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37769
- drm/amd/pm/smu11: Prevent division by zero
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37770
- drm/amd/pm/powerplay: Prevent division by zero
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37768 // CVE-2025-37771
- drm/amd/pm: Prevent division by zero
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37772
- RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37773
- virtiofs: add filesystem context source name check
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37775
- ksmbd: fix the warning from __kernel_write_iter
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37778
- ksmbd: Fix dangling pointer in krb_authenticate
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37863
- ovl: don't allow datadir only
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37780
- isofs: Prevent the use of too small fid
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37781
- i2c: cros-ec-tunnel: defer probe if parent EC is not present
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37979
- ASoC: qcom: Fix sc7280 lpass potential buffer overflow
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37784
- net: ti: icss-iep: Fix possible NULL pointer dereference for perout
request
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37786
- net: dsa: free routing table on probe failure
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37864
- net: dsa: clean up FDB, MDB, VLAN entries on unbind
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37865
- net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is
unsupported
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37787
- net: dsa: mv88e6xxx: avoid unregistering devlink regions which were
never registered
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37788
- cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37874
- net: ngbe: fix memory leak in ngbe_probe() error path
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37789
- net: openvswitch: fix nested key length validation in the set() action
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37980
- block: fix resource leak in blk_register_queue() error path
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37790
- net: mctp: Set SOCK_RCU_FREE
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37875
- igc: fix PTM cycle trigger logic
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37792
- Bluetooth: btrtl: Prevent potential NULL dereference
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37867
- RDMA/core: Silence oversized kvmalloc() warning
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37793
- ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37982
- wifi: wl1251: fix memory leak in wl1251_tx_work
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37794
- wifi: mac80211: Purge vif txq in ieee80211_do_stop()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37796
- wifi: at76c50x: fix use after free access in at76_disconnect
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23141
- KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory
accesses
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37940
- ftrace: Add cond_resched() to ftrace_graph_set_hash()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37844
- cifs: avoid NULL pointer dereference in dbg call
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23142
- sctp: detect and prevent references to a freed transport in sendmsg
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23144
- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37892
- mtd: inftlcore: Add error check for inftl_read_oob()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23145
- mptcp: fix NULL pointer in can_accept_new_subflow
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23146
- mfd: ene-kb3930: Fix a potential NULL pointer dereference
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37839
- jbd2: remove wrong sb->s_sequence check
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23147
- i3c: Add NULL pointer check in i3c_master_queue_ibi()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23148
- soc: samsung: exynos-chipid: Add NULL pointer check in
exynos_chipid_probe()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23149
- tpm: do not start chip while suspended
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23150
- ext4: fix off-by-one error in do_split
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23151
- bus: mhi: host: Fix race between unprepare and queue_buf
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23156
- media: venus: hfi_parser: refactor hfi packet parsing logic
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23157
- media: venus: hfi_parser: add check to avoid out of bound access
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37840
- mtd: rawnand: brcmnand: fix PM resume warning
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37849
- KVM: arm64: Tear down vGIC on failed vCPU creation
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23158
- media: venus: hfi: add check to handle incorrect queue size
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23159
- media: venus: hfi: add a check to handle OOB in sfr region
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23160
- media: mediatek: vcodec: Fix a resource leak related to the scp device
in FW initialization
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37850
- pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37851
- fbdev: omapfb: Add 'plane' value check
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23161
- PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37852
- drm/amdgpu: handle amdgpu_cgs_create_device() errors in
amd_powerplay_create()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37853
- drm/amdkfd: debugfs hang_hws skip GPU with MES
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37854
- drm/amdkfd: Fix mode1 reset crash issue
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-23163
- net: vlan: don't propagate flags on open
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37857
- scsi: st: Fix array overflow in st_setup()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37738
- ext4: ignore xattrs past end
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37739
- f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37943
- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37740
- jfs: add sanity check for agwidth in dbMount
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37741
- jfs: Prevent copying of nlink with value 0 from disk inode
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37858
- fs/jfs: Prevent integer overflow in AG size calculation
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37742
- jfs: Fix uninit-value access of imap allocated in the diMount() function
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37859
- page_pool: avoid infinite loop to schedule delayed worker
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37862
- HID: pidff: Fix null pointer dereference in pidff_find_fields
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37841
- pm: cpupower: bench: Prevent NULL dereference on malloc failure
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37748
- iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37749
- net: ppp: Add bound checking for skb data on ppp_sync_txmung
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37754
- drm/i915/huc: Fix fence not released on early probe errors
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37755
- net: libwx: handle page_pool_dev_alloc_pages error
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37757
- tipc: fix memory leak in tipc_link_xmit
* Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
CVE-2025-37758
- ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
* CVE-2025-37801
- spi: spi-imx: Add check for spi_imx_setupxfer()
* CVE-2025-39946
- tls: make sure to abort the stream if headers are bogus
* CVE-2025-38584
- padata: Fix pd UAF once and for all
- padata: Remove comment for reorder_work
* CVE-2025-40019
- crypto: essiv - Check ssize for decryption and in-place encryption
* CVE-2025-38561
- ksmbd: fix Preauh_HashValue race condition
* CVE-2025-39698
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure
Date: 2026-01-19 15:51:11.376594+00:00
Changed-By: Stefan Bader <stefan.bader at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux-hwe-6.8/6.8.0-100.100~22.04.1
-------------- next part --------------
Sorry, changesfile not available.
More information about the jammy-changes
mailing list