APPLIED/Cmnt: [SRU][Noble][PULL] Noble upstream stable patchset 2025-10-29
Stefan Bader
stefan.bader at canonical.com
Fri Oct 31 13:06:36 UTC 2025
On 29/10/2025 20:32, Manuel Diewald wrote:
> This pull request (130 commits) includes the following Noble stable patchsets:
>
> Noble update: upstream stable patchset 2025-10-29
> Ported from the following upstream stable releases:
> v6.6.91, v6.12.29
> https://bugs.launchpad.net/bugs/2130277
>
> Note also that the 'stable-next' branch head contains this and all
> prior pending upstream stable releases. I recommend fetching and
> applying just this reference ('stable-next') instead of each
> tags/noble-stable-* reference:
>
> git://git.launchpad.net/~ubuntu-kernel-stable/+git/noble stable-next
>
> -Manuel
>
> ------------------------------------------------------------------------
>
> The following changes since commit 519321bba0a5bbc311e9836f6c2e09efc87a4bb7:
>
> UBUNTU: Upstream stable to v6.6.90, v6.12.27, v6.12.28 (2025-10-22 16:35:40 +0200)
>
> are available in the Git repository at:
>
> git://git.launchpad.net/~ubuntu-kernel-stable/+git/noble tags/noble-stable-2025-10-29
>
> for you to fetch changes up to 4993cf39ac72cb319eb32c9b53eaa51dadbc0c08:
>
> UBUNTU: Upstream stable to v6.6.91, v6.12.29 (2025-10-29 20:23:56 +0100)
>
> ----------------------------------------------------------------
> Aditya Garg (3):
> Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
> Input: synaptics - enable InterTouch on Dell Precision M3800
> Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
>
> Al Viro (1):
> do_umount(): add missing barrier before refcount checks in sync case
>
> Alexander Lobakin (1):
> netdevice: add netdev_tx_reset_subqueue() shorthand
>
> Alexey Charkov (1):
> usb: uhci-platform: Make the clock really optional
>
> Andrei Kuchynski (1):
> usb: typec: ucsi: displayport: Fix NULL pointer access
>
> Andy Shevchenko (1):
> types: Complement the aligned types with signed 64-bit one
>
> Angelo Dureghello (1):
> iio: adc: ad7606: fix serial register access
>
> Borislav Petkov (AMD) (1):
> x86/microcode: Consolidate the loader enablement checking
>
> Clément Léger (2):
> riscv: misaligned: factorize trap handling
> riscv: misaligned: enable IRQs while handling misaligned accesses
>
> Cong Wang (1):
> sch_htb: make htb_deactivate() idempotent
>
> Cristian Marussi (1):
> firmware: arm_scmi: Fix timeout checks on polling path
>
> Dan Carpenter (1):
> dm: add missing unlock on in dm_keyslot_evict()
>
> Daniel Golle (1):
> net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
>
> Daniel Sneddon (2):
> x86/bpf: Call branch history clearing sequence on exit
> x86/bpf: Add IBHF call at end of classic BPF
>
> Dave Penkler (3):
> usb: usbtmc: Fix erroneous get_stb ioctl error returns
> usb: usbtmc: Fix erroneous wait_srq ioctl return
> usb: usbtmc: Fix erroneous generic_read ioctl return
>
> David Lechner (1):
> iio: imu: inv_mpu6050: align buffer for timestamp
>
> Dmitry Antipov (1):
> module: ensure that kobject_put() is safe for module type kobjects
>
> Dmitry Torokhov (1):
> Input: synaptics - enable SMBus for HP Elitebook 850 G1
>
> Eelco Chaudron (1):
> openvswitch: Fix unsafe attribute parsing in output_userspace()
>
> Eric Biggers (1):
> x86/its: Fix build errors when CONFIG_MODULES=n
>
> Feng Tang (1):
> selftests/mm: compaction_test: support platform with huge mount of memory
>
> Gabriel Shahrouzi (4):
> staging: iio: adc: ad7816: Correct conditional logic for store mode
> staging: axis-fifo: Remove hardware resets for user errors
> staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
> iio: adis16201: Correct inclinometer channel resolution
>
> Gao Xiang (1):
> erofs: ensure the extra temporary copy is valid for shortened bvecs
>
> Gary Bisson (1):
> Input: mtk-pmic-keys - fix possible null pointer dereference
>
> Gavin Guo (1):
> mm/huge_memory: fix dereferencing invalid pmd migration entry
>
> Guillaume Nault (1):
> gre: Fix again IPv6 link-local address generation.
>
> Heiko Carstens (1):
> s390/entry: Fix last breaking event handling in case of stack corruption
>
> Hugo Villeneuve (1):
> Input: cyttsp5 - ensure minimum reset pulse width
>
> James Morse (6):
> arm64: insn: Add support for encoding DSB
> arm64: proton-pack: Expose whether the platform is mitigated by firmware
> arm64: proton-pack: Expose whether the branchy loop k value
> arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
> arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
> arm64: proton-pack: Add new CPUs 'k' values for branch mitigation
>
> Jan Kara (3):
> ocfs2: switch osb->disable_recovery to enum
> ocfs2: implement handshaking with ocfs2 recovery thread
> ocfs2: stop quota recovery before disabling quotas
>
> Jason Andryuk (1):
> xenbus: Use kref to track req lifetime
>
> Jens Axboe (2):
> io_uring: always arm linked timeouts prior to issue
> io_uring: ensure deferred completions are flushed for multishot
>
> Jim Lin (1):
> usb: host: tegra: Prevent host controller crash when OTG port is used
>
> John Ernberg (1):
> xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
>
> Jonas Gorski (11):
> net: dsa: b53: allow leaky reserved multicast
> net: dsa: b53: fix clearing PVID of a port
> net: dsa: b53: fix flushing old pvid VLAN on pvid change
> net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
> net: dsa: b53: always rejoin default untagged VLAN on bridge leave
> net: dsa: b53: fix learning on VLAN unaware bridges
> net: dsa: b53: keep CPU port always tagged again
> net: dsa: b53: do not allow to configure VLAN 0
> net: dsa: b53: do not program vlans when vlan filtering is off
> net: dsa: b53: fix toggling vlan_filtering
> net: dsa: b53: do not set learning and unicast/multicast on up
>
> Jonathan Cameron (3):
> iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
> iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
> iio: adc: dln2: Use aligned_s64 for timestamp
>
> Julian Anastasov (1):
> ipvs: fix uninit-value for saddr in do_output_route4
>
> Kelsey Maes (1):
> can: mcp251xfd: fix TDC setting for low data bit rates
>
> Kevin Baker (1):
> drm/panel: simple: Update timings for AUO G101EVN010
>
> Lode Willems (1):
> Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller
>
> Lothar Rubusch (1):
> iio: accel: adxl367: fix setting odr for activity time update
>
> Manuel Diewald (3):
> UBUNTU: SAUCE: Revert "sch_htb: make htb_deactivate() idempotent"
> UBUNTU: [Config] enable Indirect Target Selection mitigation
> UBUNTU: Upstream stable to v6.6.91, v6.12.29
>
> Manuel Fombuena (1):
> Input: synaptics - enable InterTouch on Dynabook Portege X30-D
>
> Marc Kleine-Budde (2):
> can: mcan: m_can_class_unregister(): fix order of unregistration calls
> can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
>
> Matthew Brost (1):
> drm/xe: Add page queue multiplier
>
> Maíra Canal (1):
> drm/v3d: Add job to pending list if the reset was skipped
>
> Miguel Ojeda (1):
> rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration
>
> Mikael Gonella-Bolduc (1):
> Input: cyttsp5 - fix power control issue on wakeup
>
> Mikhail Lobanov (1):
> KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
>
> Namjae Jeon (1):
> ksmbd: prevent rename with empty string
>
> Norbert Szetei (1):
> ksmbd: prevent out-of-bounds stream writes by validating *pos
>
> Nylon Chen (1):
> riscv: misaligned: Add handling for ZCB instructions
>
> Nysal Jan K.A (1):
> selftests/mm: fix a build failure on powerpc
>
> Oliver Hartkopp (1):
> can: gw: fix RCU/BH usage in cgw_create_job()
>
> Oliver Neukum (1):
> USB: usbtmc: use interruptible sleep in usbtmc_read
>
> Paul Aurich (1):
> smb: client: Avoid race in open_cached_dir with lease breaks
>
> Paul Chaignon (1):
> bpf: Scrub packet on bpf_redirect_peer
>
> Pawan Gupta (15):
> x86/bhi: Do not set BHI_DIS_S in 32-bit mode
> x86/speculation: Simplify and make CALL_NOSPEC consistent
> x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
> x86/speculation: Remove the extra #ifdef around CALL_NOSPEC
> Documentation: x86/bugs/its: Add ITS documentation
> x86/its: Enumerate Indirect Target Selection (ITS) bug
> x86/its: Add support for ITS-safe indirect thunk
> x86/its: Add support for ITS-safe return thunk
> x86/its: Enable Indirect Target Selection mitigation
> x86/its: Add "vmexit" option to skip mitigation on some CPUs
> x86/its: Add support for RSB stuffing mitigation
> x86/its: Align RETs in BHB clear sequence to avoid thunking
> x86/ibt: Keep IBT disabled during alternative patching
> x86/its: Fix build error for its_static_thunk()
> selftest/x86/bugs: Add selftests for ITS
>
> Pawel Laszczak (2):
> usb: cdnsp: Fix issue with resuming from L1
> usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
>
> Peter Xu (1):
> mm/userfaultfd: fix uninitialized output field for -EAGAIN race
>
> Peter Zijlstra (2):
> x86/its: Use dynamic thunks for indirect branches
> x86/its: FineIBT-paranoid vs ITS
>
> Prashanth K (3):
> usb: gadget: f_ecm: Add get_status callback
> usb: gadget: Use get_status callback to set remote wakeup capability
> usb: dwc3: gadget: Make gadget_wakeup asynchronous
>
> RD Babiera (1):
> usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
>
> Sean Heelan (1):
> ksmbd: Fix UAF in __close_file_table_ids
>
> Sebastian Andrzej Siewior (1):
> clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
>
> Silvano Seva (2):
> iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
> iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
>
> Simon Xue (1):
> iio: adc: rockchip: Fix clock initialization sequence
>
> Thorsten Blum (1):
> MIPS: Fix MAX_REG_OFFSET
>
> Tom Lendacky (1):
> memblock: Accept allocated memory before use in memblock_double_array()
>
> Veerendranath Jakkam (1):
> wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
>
> Vicki Pfau (1):
> Input: xpad - fix Share button on Xbox One controllers
>
> Wang Zhaolong (1):
> ksmbd: fix memory leak in parse_lease_state()
>
> Wayne Chang (1):
> usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
>
> Wayne Lin (5):
> drm/amd/display: Shift DMUB AUX reply command if necessary
> drm/amd/display: Fix the checking condition in dmub aux handling
> drm/amd/display: Remove incorrect checking in dmub aux handler
> drm/amd/display: Fix wrong handling for AUX_DEFER case
> drm/amd/display: Copy AUX read reply data whenever length > 0
>
> Wojciech Dubowik (1):
> arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2
>
> .clippy.toml | 2 +-
> Documentation/ABI/testing/sysfs-devices-system-cpu | 1 +
> Documentation/admin-guide/hw-vuln/index.rst | 1 +
> .../hw-vuln/indirect-target-selection.rst | 168 ++++++++++++++++
> Documentation/admin-guide/kernel-parameters.txt | 18 ++
> arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 25 ++-
> arch/arm64/include/asm/cputype.h | 2 +
> arch/arm64/include/asm/insn.h | 1 +
> arch/arm64/include/asm/spectre.h | 3 +
> arch/arm64/kernel/proton-pack.c | 13 +-
> arch/arm64/lib/insn.c | 60 +++---
> arch/arm64/net/bpf_jit_comp.c | 57 +++++-
> arch/mips/include/asm/ptrace.h | 3 +-
> arch/riscv/kernel/traps.c | 64 +++---
> arch/riscv/kernel/traps_misaligned.c | 17 ++
> arch/s390/kernel/entry.S | 2 +-
> arch/x86/Kconfig | 11 ++
> arch/x86/entry/entry_64.S | 20 +-
> arch/x86/include/asm/alternative.h | 32 +++
> arch/x86/include/asm/cpufeatures.h | 3 +
> arch/x86/include/asm/microcode.h | 2 +
> arch/x86/include/asm/msr-index.h | 8 +
> arch/x86/include/asm/nospec-branch.h | 38 ++--
> arch/x86/kernel/alternative.c | 216 ++++++++++++++++++++-
> arch/x86/kernel/cpu/bugs.c | 177 ++++++++++++++++-
> arch/x86/kernel/cpu/common.c | 72 +++++--
> arch/x86/kernel/cpu/microcode/amd.c | 6 +-
> arch/x86/kernel/cpu/microcode/core.c | 58 +++---
> arch/x86/kernel/cpu/microcode/intel.c | 2 +-
> arch/x86/kernel/cpu/microcode/internal.h | 1 -
> arch/x86/kernel/ftrace.c | 2 +-
> arch/x86/kernel/head32.c | 4 -
> arch/x86/kernel/module.c | 6 +
> arch/x86/kernel/static_call.c | 4 +-
> arch/x86/kernel/vmlinux.lds.S | 10 +
> arch/x86/kvm/smm.c | 1 +
> arch/x86/kvm/svm/svm.c | 4 +
> arch/x86/kvm/x86.c | 4 +-
> arch/x86/lib/retpoline.S | 39 ++++
> arch/x86/net/bpf_jit_comp.c | 59 +++++-
> debian.master/config/annotations | 1 +
> debian.master/upstream-stable | 4 +-
> drivers/base/cpu.c | 3 +
> drivers/clocksource/i8253.c | 4 +-
> drivers/firmware/arm_scmi/driver.c | 16 +-
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 20 +-
> .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 28 ++-
> drivers/gpu/drm/panel/panel-simple.c | 25 +--
> drivers/gpu/drm/v3d/v3d_sched.c | 28 ++-
> drivers/gpu/drm/xe/xe_gt_pagefault.c | 11 +-
> drivers/iio/accel/adis16201.c | 4 +-
> drivers/iio/accel/adxl355_core.c | 2 +-
> drivers/iio/accel/adxl367.c | 10 +-
> drivers/iio/adc/ad7606_spi.c | 2 +-
> drivers/iio/adc/dln2-adc.c | 2 +-
> drivers/iio/adc/rockchip_saradc.c | 17 +-
> drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 2 +-
> drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 6 +
> drivers/iio/temperature/maxim_thermocouple.c | 2 +-
> drivers/input/joystick/xpad.c | 36 ++--
> drivers/input/keyboard/mtk-pmic-keys.c | 4 +-
> drivers/input/mouse/synaptics.c | 5 +
> drivers/input/touchscreen/cyttsp5.c | 7 +-
> drivers/md/dm-table.c | 3 +-
> drivers/net/can/m_can/m_can.c | 2 +-
> drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 42 +++-
> drivers/net/dsa/b53/b53_common.c | 202 +++++++++++++------
> drivers/net/dsa/b53/b53_priv.h | 3 +
> drivers/net/dsa/bcm_sf2.c | 1 +
> drivers/net/ethernet/mediatek/mtk_eth_soc.c | 16 +-
> drivers/staging/axis-fifo/axis-fifo.c | 14 +-
> drivers/staging/iio/adc/ad7816.c | 2 +-
> drivers/usb/cdns3/cdnsp-gadget.c | 31 +++
> drivers/usb/cdns3/cdnsp-gadget.h | 6 +
> drivers/usb/cdns3/cdnsp-pci.c | 12 +-
> drivers/usb/cdns3/cdnsp-ring.c | 3 +-
> drivers/usb/cdns3/core.h | 3 +
> drivers/usb/class/usbtmc.c | 59 +++---
> drivers/usb/dwc3/core.h | 4 +
> drivers/usb/dwc3/gadget.c | 60 +++---
> drivers/usb/gadget/composite.c | 12 +-
> drivers/usb/gadget/function/f_ecm.c | 7 +
> drivers/usb/gadget/udc/tegra-xudc.c | 4 +
> drivers/usb/host/uhci-platform.c | 2 +-
> drivers/usb/host/xhci-tegra.c | 3 +
> drivers/usb/typec/tcpm/tcpm.c | 2 +-
> drivers/usb/typec/ucsi/displayport.c | 2 +
> drivers/xen/swiotlb-xen.c | 1 +
> drivers/xen/xenbus/xenbus.h | 2 +
> drivers/xen/xenbus/xenbus_comms.c | 9 +-
> drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +-
> drivers/xen/xenbus/xenbus_xs.c | 18 +-
> fs/erofs/zdata.c | 31 ++-
> fs/namespace.c | 3 +-
> fs/ocfs2/journal.c | 80 +++++---
> fs/ocfs2/journal.h | 1 +
> fs/ocfs2/ocfs2.h | 17 +-
> fs/ocfs2/quota_local.c | 9 +-
> fs/ocfs2/super.c | 3 +
> fs/smb/client/cached_dir.c | 10 +-
> fs/smb/server/oplock.c | 7 +-
> fs/smb/server/smb2pdu.c | 5 +
> fs/smb/server/vfs.c | 7 +
> fs/smb/server/vfs_cache.c | 33 +++-
> fs/userfaultfd.c | 28 ++-
> include/linux/cpu.h | 2 +
> include/linux/module.h | 5 +
> include/linux/netdevice.h | 13 +-
> include/linux/types.h | 3 +-
> include/uapi/linux/types.h | 1 +
> io_uring/io_uring.c | 58 +++---
> kernel/params.c | 4 +-
> mm/huge_memory.c | 11 +-
> mm/memblock.c | 9 +-
> net/can/gw.c | 149 ++++++++------
> net/core/filter.c | 1 +
> net/ipv6/addrconf.c | 15 +-
> net/netfilter/ipvs/ip_vs_xmit.c | 27 +--
> net/openvswitch/actions.c | 3 +-
> net/sched/sch_htb.c | 2 -
> net/wireless/scan.c | 2 +-
> tools/testing/selftests/Makefile | 1 +
> tools/testing/selftests/mm/compaction_test.c | 19 +-
> tools/testing/selftests/mm/pkey-powerpc.h | 12 +-
> tools/testing/selftests/x86/bugs/Makefile | 3 +
> tools/testing/selftests/x86/bugs/common.py | 164 ++++++++++++++++
> .../selftests/x86/bugs/its_indirect_alignment.py | 150 ++++++++++++++
> .../testing/selftests/x86/bugs/its_permutations.py | 109 +++++++++++
> .../selftests/x86/bugs/its_ret_alignment.py | 139 +++++++++++++
> tools/testing/selftests/x86/bugs/its_sysfs.py | 65 +++++++
> 130 files changed, 2573 insertions(+), 610 deletions(-)
> create mode 100644 Documentation/admin-guide/hw-vuln/indirect-target-selection.rst
> create mode 100644 tools/testing/selftests/x86/bugs/Makefile
> create mode 100644 tools/testing/selftests/x86/bugs/common.py
> create mode 100644 tools/testing/selftests/x86/bugs/its_indirect_alignment.py
> create mode 100644 tools/testing/selftests/x86/bugs/its_permutations.py
> create mode 100644 tools/testing/selftests/x86/bugs/its_ret_alignment.py
> create mode 100644 tools/testing/selftests/x86/bugs/its_sysfs.py
>
The range of ITS mitigation patches had to be reworked to adjust for
having VMSCAPE applied.
Skipped (already applied):
- mm/huge_memory: fix dereferencing invalid pmd migration entry
(CVE-2025-37958)
Applied to noble:linux/master-next. Thanks.
-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20251031/f3a96bd6/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20251031/f3a96bd6/attachment-0001.sig>
More information about the kernel-team
mailing list