[Bug 2173709] Re: ath9k_htc AR9271 USB Wi-Fi fails to come up on 6.8.0-149 ("Message too long"), works on 6.8.0-139

** Attachment added: "Crash log 149" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173709/+attachment/6016162/+files/kernel-6.8.0-149-oops.txt -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173709 Title: ath9k_htc AR9271 USB Wi-Fi fails to come up on 6.8.0-149 ("Message too long"), works on 6.8.0-139 Status in linux package in Ubuntu: New Bug description: Hardware: Atheros AR9271 USB Wi-Fi adapter (ath9k_htc, firmware htc_9271-1.4.0.fw), Ubuntu 24.04.5, 2014 Mac Mini. On 6.8.0-139-generic the adapter works normally. On 6.8.0-149-generic the firmware loads ("HTC initialized with 33 credits", "FW Version: 1.4") but the interface cannot be brought up: ip link set <iface> up returns "RTNETLINK answers: Message too long", and wpa_supplicant fails with "Could not set interface flags (UP): Message too long" / "Failed to initialize driver interface". An earlier attempt also produced a kernel oops in the driver. The only ath9k changes in 6.8.0-149.149 are "wifi: ath9k: reject short WMI command responses" (CVE-2026-98828) and "wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE". I suspect one of these is rejecting replies from the AR9271 firmware. Not yet tested on 6.8.0-146–148. This is a regression: users have to choose between a working adapter and the CVE-2026-98432 fix, which is only in 149. ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-139-generic 6.8.0-139.139 ProcVersionSignature: Ubuntu 6.8.0-139.139-generic 6.8.12 Uname: Linux 6.8.0-139-generic x86_64 NonfreeKernelModules: wl AlsaVersion: Advanced Linux Sound Architecture Driver Version k6.8.0-139-generic. AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' ApportVersion: 2.28.3-0ubuntu0.1 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/controlC1', '/dev/snd/hwC1D0', '/dev/snd/pcmC1D8p', '/dev/snd/pcmC1D7p', '/dev/snd/pcmC1D3p', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D1p', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' CasperMD5CheckResult: pass CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read kernel buffer failed: Operation not permitted Date: Sun Nov 8 22:36:43 2026 InstallationDate: Installed on 2025-10-01 (403 days ago) InstallationMedia: Ubuntu-Server 24.04.3 LTS "Noble Numbat" - Release amd64 (20250805.1) MachineType: Apple Inc. Macmini7,1 ProcEnviron: LANG=en_GB.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-139-generic root=UUID=af466c7b-6c14-44fc-9013-df78fcb3b3f5 ro RelatedPackageVersions: linux-restricted-modules-6.8.0-139-generic N/A linux-backports-modules-6.8.0-139-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) acpidump: dmi.bios.date: 01/13/2023 dmi.bios.release: 0.1 dmi.bios.vendor: Apple Inc. dmi.bios.version: 478.0.0.0.0 dmi.board.asset.tag: Base Board Asset Tag# dmi.board.name: Mac-35C5E08120C7EEAF dmi.board.vendor: Apple Inc. dmi.board.version: Macmini7,1 dmi.chassis.type: 10 dmi.chassis.vendor: Apple Inc. dmi.chassis.version: Mac-35C5E08120C7EEAF dmi.modalias: dmi:bvnAppleInc.:bvr478.0.0.0.0:bd01/13/2023:br0.1:svnAppleInc.:pnMacmini7,1:pvr1.0:rvnAppleInc.:rnMac-35C5E08120C7EEAF:rvrMacmini7,1:cvnAppleInc.:ct10:cvrMac-35C5E08120C7EEAF:skuSystemSKU#: dmi.product.family: Mac dmi.product.name: Macmini7,1 dmi.product.sku: System SKU# dmi.product.version: 1.0 dmi.sys.vendor: Apple Inc. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173709/+subscriptions

[Bug 2173709] Re: ath9k_htc AR9271 USB Wi-Fi fails to come up on 6.8.0-149 ("Message too long"), works on 6.8.0-139

The wl module is Broadcom STA for the unused built-in Wi-Fi (wlp2s0). The failing device is the separate USB AR9271 on ath9k_htc. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173709 Title: ath9k_htc AR9271 USB Wi-Fi fails to come up on 6.8.0-149 ("Message too long"), works on 6.8.0-139 Status in linux package in Ubuntu: New Bug description: Hardware: Atheros AR9271 USB Wi-Fi adapter (ath9k_htc, firmware htc_9271-1.4.0.fw), Ubuntu 24.04.5, 2014 Mac Mini. On 6.8.0-139-generic the adapter works normally. On 6.8.0-149-generic the firmware loads ("HTC initialized with 33 credits", "FW Version: 1.4") but the interface cannot be brought up: ip link set <iface> up returns "RTNETLINK answers: Message too long", and wpa_supplicant fails with "Could not set interface flags (UP): Message too long" / "Failed to initialize driver interface". An earlier attempt also produced a kernel oops in the driver. The only ath9k changes in 6.8.0-149.149 are "wifi: ath9k: reject short WMI command responses" (CVE-2026-98828) and "wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE". I suspect one of these is rejecting replies from the AR9271 firmware. Not yet tested on 6.8.0-146–148. This is a regression: users have to choose between a working adapter and the CVE-2026-98432 fix, which is only in 149. ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-139-generic 6.8.0-139.139 ProcVersionSignature: Ubuntu 6.8.0-139.139-generic 6.8.12 Uname: Linux 6.8.0-139-generic x86_64 NonfreeKernelModules: wl AlsaVersion: Advanced Linux Sound Architecture Driver Version k6.8.0-139-generic. AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' ApportVersion: 2.28.3-0ubuntu0.1 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/controlC1', '/dev/snd/hwC1D0', '/dev/snd/pcmC1D8p', '/dev/snd/pcmC1D7p', '/dev/snd/pcmC1D3p', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D1p', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' CasperMD5CheckResult: pass CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read kernel buffer failed: Operation not permitted Date: Sun Nov 8 22:36:43 2026 InstallationDate: Installed on 2025-10-01 (403 days ago) InstallationMedia: Ubuntu-Server 24.04.3 LTS "Noble Numbat" - Release amd64 (20250805.1) MachineType: Apple Inc. Macmini7,1 ProcEnviron: LANG=en_GB.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-139-generic root=UUID=af466c7b-6c14-44fc-9013-df78fcb3b3f5 ro RelatedPackageVersions: linux-restricted-modules-6.8.0-139-generic N/A linux-backports-modules-6.8.0-139-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) acpidump: dmi.bios.date: 01/13/2023 dmi.bios.release: 0.1 dmi.bios.vendor: Apple Inc. dmi.bios.version: 478.0.0.0.0 dmi.board.asset.tag: Base Board Asset Tag# dmi.board.name: Mac-35C5E08120C7EEAF dmi.board.vendor: Apple Inc. dmi.board.version: Macmini7,1 dmi.chassis.type: 10 dmi.chassis.vendor: Apple Inc. dmi.chassis.version: Mac-35C5E08120C7EEAF dmi.modalias: dmi:bvnAppleInc.:bvr478.0.0.0.0:bd01/13/2023:br0.1:svnAppleInc.:pnMacmini7,1:pvr1.0:rvnAppleInc.:rnMac-35C5E08120C7EEAF:rvrMacmini7,1:cvnAppleInc.:ct10:cvrMac-35C5E08120C7EEAF:skuSystemSKU#: dmi.product.family: Mac dmi.product.name: Macmini7,1 dmi.product.sku: System SKU# dmi.product.version: 1.0 dmi.sys.vendor: Apple Inc. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173709/+subscriptions

[Bug 2173709] [NEW] ath9k_htc AR9271 USB Wi-Fi fails to come up on 6.8.0-149 ("Message too long"), works on 6.8.0-139

Public bug reported: Hardware: Atheros AR9271 USB Wi-Fi adapter (ath9k_htc, firmware htc_9271-1.4.0.fw), Ubuntu 24.04.5, 2014 Mac Mini. On 6.8.0-139-generic the adapter works normally. On 6.8.0-149-generic the firmware loads ("HTC initialized with 33 credits", "FW Version: 1.4") but the interface cannot be brought up: ip link set <iface> up returns "RTNETLINK answers: Message too long", and wpa_supplicant fails with "Could not set interface flags (UP): Message too long" / "Failed to initialize driver interface". An earlier attempt also produced a kernel oops in the driver. The only ath9k changes in 6.8.0-149.149 are "wifi: ath9k: reject short WMI command responses" (CVE-2026-98828) and "wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE". I suspect one of these is rejecting replies from the AR9271 firmware. Not yet tested on 6.8.0-146–148. This is a regression: users have to choose between a working adapter and the CVE-2026-98432 fix, which is only in 149. ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-139-generic 6.8.0-139.139 ProcVersionSignature: Ubuntu 6.8.0-139.139-generic 6.8.12 Uname: Linux 6.8.0-139-generic x86_64 NonfreeKernelModules: wl AlsaVersion: Advanced Linux Sound Architecture Driver Version k6.8.0-139-generic. AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' ApportVersion: 2.28.3-0ubuntu0.1 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/controlC1', '/dev/snd/hwC1D0', '/dev/snd/pcmC1D8p', '/dev/snd/pcmC1D7p', '/dev/snd/pcmC1D3p', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D1p', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' CasperMD5CheckResult: pass CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read kernel buffer failed: Operation not permitted Date: Sun Nov 8 22:36:43 2026 InstallationDate: Installed on 2025-10-01 (403 days ago) InstallationMedia: Ubuntu-Server 24.04.3 LTS "Noble Numbat" - Release amd64 (20250805.1) MachineType: Apple Inc. Macmini7,1 ProcEnviron: LANG=en_GB.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-139-generic root=UUID=af466c7b-6c14-44fc-9013-df78fcb3b3f5 ro RelatedPackageVersions: linux-restricted-modules-6.8.0-139-generic N/A linux-backports-modules-6.8.0-139-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) acpidump: dmi.bios.date: 01/13/2023 dmi.bios.release: 0.1 dmi.bios.vendor: Apple Inc. dmi.bios.version: 478.0.0.0.0 dmi.board.asset.tag: Base Board Asset Tag# dmi.board.name: Mac-35C5E08120C7EEAF dmi.board.vendor: Apple Inc. dmi.board.version: Macmini7,1 dmi.chassis.type: 10 dmi.chassis.vendor: Apple Inc. dmi.chassis.version: Mac-35C5E08120C7EEAF dmi.modalias: dmi:bvnAppleInc.:bvr478.0.0.0.0:bd01/13/2023:br0.1:svnAppleInc.:pnMacmini7,1:pvr1.0:rvnAppleInc.:rnMac-35C5E08120C7EEAF:rvrMacmini7,1:cvnAppleInc.:ct10:cvrMac-35C5E08120C7EEAF:skuSystemSKU#: dmi.product.family: Mac dmi.product.name: Macmini7,1 dmi.product.sku: System SKU# dmi.product.version: 1.0 dmi.sys.vendor: Apple Inc. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug noble -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173709 Title: ath9k_htc AR9271 USB Wi-Fi fails to come up on 6.8.0-149 ("Message too long"), works on 6.8.0-139 Status in linux package in Ubuntu: New Bug description: Hardware: Atheros AR9271 USB Wi-Fi adapter (ath9k_htc, firmware htc_9271-1.4.0.fw), Ubuntu 24.04.5, 2014 Mac Mini. On 6.8.0-139-generic the adapter works normally. On 6.8.0-149-generic the firmware loads ("HTC initialized with 33 credits", "FW Version: 1.4") but the interface cannot be brought up: ip link set <iface> up returns "RTNETLINK answers: Message too long", and wpa_supplicant fails with "Could not set interface flags (UP): Message too long" / "Failed to initialize driver interface". An earlier attempt also produced a kernel oops in the driver. The only ath9k changes in 6.8.0-149.149 are "wifi: ath9k: reject short WMI command responses" (CVE-2026-98828) and "wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE". I suspect one of these is rejecting replies from the AR9271 firmware. Not yet tested on 6.8.0-146–148. This is a regression: users have to choose between a working adapter and the CVE-2026-98432 fix, which is only in 149. ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.8.0-139-generic 6.8.0-139.139 ProcVersionSignature: Ubuntu 6.8.0-139.139-generic 6.8.12 Uname: Linux 6.8.0-139-generic x86_64 NonfreeKernelModules: wl AlsaVersion: Advanced Linux Sound Architecture Driver Version k6.8.0-139-generic. AplayDevices: Error: [Errno 2] No such file or directory: 'aplay' ApportVersion: 2.28.3-0ubuntu0.1 Architecture: amd64 ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord' AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/controlC1', '/dev/snd/hwC1D0', '/dev/snd/pcmC1D8p', '/dev/snd/pcmC1D7p', '/dev/snd/pcmC1D3p', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D1p', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer' Card1.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer' CasperMD5CheckResult: pass CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read kernel buffer failed: Operation not permitted Date: Sun Nov 8 22:36:43 2026 InstallationDate: Installed on 2025-10-01 (403 days ago) InstallationMedia: Ubuntu-Server 24.04.3 LTS "Noble Numbat" - Release amd64 (20250805.1) MachineType: Apple Inc. Macmini7,1 ProcEnviron: LANG=en_GB.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-139-generic root=UUID=af466c7b-6c14-44fc-9013-df78fcb3b3f5 ro RelatedPackageVersions: linux-restricted-modules-6.8.0-139-generic N/A linux-backports-modules-6.8.0-139-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 RfKill: Error: [Errno 2] No such file or directory: 'rfkill' SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) acpidump: dmi.bios.date: 01/13/2023 dmi.bios.release: 0.1 dmi.bios.vendor: Apple Inc. dmi.bios.version: 478.0.0.0.0 dmi.board.asset.tag: Base Board Asset Tag# dmi.board.name: Mac-35C5E08120C7EEAF dmi.board.vendor: Apple Inc. dmi.board.version: Macmini7,1 dmi.chassis.type: 10 dmi.chassis.vendor: Apple Inc. dmi.chassis.version: Mac-35C5E08120C7EEAF dmi.modalias: dmi:bvnAppleInc.:bvr478.0.0.0.0:bd01/13/2023:br0.1:svnAppleInc.:pnMacmini7,1:pvr1.0:rvnAppleInc.:rnMac-35C5E08120C7EEAF:rvrMacmini7,1:cvnAppleInc.:ct10:cvrMac-35C5E08120C7EEAF:skuSystemSKU#: dmi.product.family: Mac dmi.product.name: Macmini7,1 dmi.product.sku: System SKU# dmi.product.version: 1.0 dmi.sys.vendor: Apple Inc. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173709/+subscriptions

[Bug 2172229] Re: AppArmor: profile attachment fails for diff-encoded xmatch DFAs (leftmatch_fb ignores MATCH_FLAG_DIFF_ENCODE) - firefox profile never attaches

Also affected on 26.04, kernel 7.0.0-43-generic, apparmor 5.0.2-0ubuntu1~26.04.1, Firefox deb from ppa:mozillateam. Please nominate for Resolute. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2172229 Title: AppArmor: profile attachment fails for diff-encoded xmatch DFAs (leftmatch_fb ignores MATCH_FLAG_DIFF_ENCODE) - firefox profile never attaches Status in linux package in Ubuntu: Confirmed Bug description: [Impact] Profiles whose attachment pattern compiles to a differentially encoded DFA never attach. The exec stays "unconfined", and because no conflict is involved, nothing is audited. Visible example: /etc/apparmor.d/firefox (from the apparmor package) profile firefox /{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin} flags=(unconfined) { userns, ... } never attaches to /usr/lib/firefox/firefox-bin (Firefox .deb from packages.mozilla.org). Firefox therefore runs unconfined and is moved to unprivileged_userns, which denies CAP_SYS_ADMIN. Its content sandbox loses user-namespace isolation: apparmor="AUDIT" operation="userns_create" info="Userns create - transitioning profile" profile="unconfined" comm="firefox-bin" target="unprivileged_userns" execpath="/usr/lib/firefox/firefox-bin" apparmor="DENIED" operation="capable" class="cap" profile="unprivileged_userns" comm="firefox-bin" capability=21 capname="sys_admin" ps -eo label,args shows "unconfined" for every firefox-bin process, although "firefox (unconfined)" is loaded. [Cause] security/apparmor/match.c: leftmatch_fb(), used by aa_dfa_leftmatch() and therefore by find_attach(), takes the default transition as if (check[pos] == state) state = next[pos]; else state = def[state]; and moves on to the next input character. It does not handle MATCH_FLAG_DIFF_ENCODE. match_char(), used by aa_dfa_match() for file rules, does: for a diff-encoded state it follows def[state] and retries the SAME character. apparmor_parser emits diff-encoded DFAs by default whenever the kernel advertises policy/diff_encode (it does), so larger attachment patterns end in a non-accepting state. File rules are not affected, since they go through match_char(). Simple attachments (plain paths, "/a/{b,c}/x", "/a/x{,-y}", "/{,usr/}{,s}bin/unix_chkpwd") still attach. Larger or nested alternations fail. [Test case] The attached aa-repro.sh (run as root) loads the firefox profile's attachment pattern, relocated to a scratch directory, twice: once with default options and once with "-O no-diff-encode". It then executes a copy of dash under each path and prints /proc/$$/attr/current. Expected: enc -> repro_enc (unconfined) noenc -> repro_noenc (unconfined) Actual: enc -> unconfined noenc -> repro_noenc (unconfined) The two profiles differ only in diff encoding. Reproduced on the stock 7.0.0-38-generic kernel (output attached as repro- output-7.0.0-38-generic.txt). Further confirmation: Ubuntu's real firefox profile does not attach, while a copy with the simpler attachment /usr/lib/firefox/firefox{,-bin} does. [Workarounds] - Set "Optimize=no-diff-encode" in /etc/apparmor/parser.conf and reload all profiles. - Alternatively, add a local profile with a simpler attachment, e.g. /usr/lib/firefox/firefox{,-bin}. [Suggested fix - untested] In leftmatch_fb(), compute the input byte first (c = equiv[(u8) *str++] or (u8) *str++), then replace the open-coded transition with match_char(state, def, base, next, check, c), as aa_dfa_match() does. The is_loop() history and longest-left count logic should then be reviewed for diff-encoded default chains. Upstream report: https://gitlab.com/apparmor/apparmor- kernel/-/work_items/8 [Environment] Ubuntu 26.04.1 LTS (resolute) linux-image-7.0.0-38-generic 7.0.0-38.38 (/proc/version_signature: Ubuntu 7.0.0-38.38-generic 7.0.14) apparmor / libapparmor1 5.0.2-0ubuntu1~26.04.1 firefox 158.0.1~build1 (packages.mozilla.org) /sys/kernel/security/apparmor/features/policy/diff_encode: yes --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: invarianz 1478 F.... wireplumber /dev/snd/controlC1: invarianz 1478 F.... wireplumber /dev/snd/seq: invarianz 1454 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-06-27 (121 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: LENOVO 30DH00H7GE Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=tmux-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=3c69bedc-0154-4019-a8e3-99860442ddb8 ro quiet splash ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 RebootRequiredPkgs: Error: path contained symlinks. Tags: resolute wayland-session Uname: Linux 7.0.0-38-generic x86_64 UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: adm cdrom dip lpadmin lxd plugdev sudo users _MarkForUpload: True dmi.bios.date: 03/21/2025 dmi.bios.release: 1.94 dmi.bios.vendor: LENOVO dmi.bios.version: S08KT5EA dmi.board.name: 1048 dmi.board.vendor: LENOVO dmi.board.version: SDK0T08861 WIN 3305348596304 dmi.chassis.type: 3 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.12 dmi.modalias: dmi:bvnLENOVO:bvrS08KT5EA:bd03/21/2025:br1.94:efr1.12:svnLENOVO:pn30DH00H7GE:pvrThinkStationP340:rvnLENOVO:rn1048:rvrSDK0T08861WIN3305348596304:cvnLENOVO:ct3:cvrNone:skuLENOVO_MT_30DH_BU_Think_FM_ThinkStationP340:pfaThinkStationP340: dmi.product.family: ThinkStation P340 dmi.product.name: 30DH00H7GE dmi.product.sku: LENOVO_MT_30DH_BU_Think_FM_ThinkStation P340 dmi.product.version: ThinkStation P340 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172229/+subscriptions

[Bug 2171588] Re: Legion Pro 7 16IRX8H (17aa:3886): built-in speakers silent on 7.0 kernels, work on 6.17 (TAS2781 amplifier)

The 7.0.0-43-generic kernel includes the fix I pointed out in comment #3 Please test and let us know if the firmware is now loading correctly without forcing it. ** Changed in: linux-hwe-7.0 (Ubuntu) Status: Confirmed => Incomplete -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171588 Title: Legion Pro 7 16IRX8H (17aa:3886): built-in speakers silent on 7.0 kernels, work on 6.17 (TAS2781 amplifier) Status in linux package in Ubuntu: Confirmed Status in linux-hwe-7.0 package in Ubuntu: Incomplete Bug description: # Bug report draft: Lenovo Legion Pro 7 16IRX8H built-in speakers silent on 7.0 kernels **Package:** linux (Ubuntu) ## Title Legion Pro 7 16IRX8H (17aa:3886): built-in speakers silent on 7.0 kernels, work on 6.17 (TAS2781 amplifier) ## Description The built-in speakers on my Lenovo Legion Pro 7 16IRX8H are silent on every 7.0 kernel I have used. They work on 6.17.0-29-generic. Headphones and external speakers work on all kernels. The speakers are driven by a Realtek ALC287 codec through a TI TAS2781 smart amplifier (I2C device `TIAS2781:00`, driver `snd_hda_scodec_tas2781_i2c`). ### Kernel results | Kernel | Built-in speakers | |---|---| | 6.17.0-29-generic | Work | | 7.0.0-31-generic | Silent | | 7.0.0-34-generic | Silent | | 7.0.0-38-generic | Silent | ### Steps to reproduce 1. Boot 7.0.0-38-generic. 2. Make sure "Built-in Audio Analog Stereo" is the output, on the speaker port, not muted, volume at 87%. 3. Run `speaker-test -D pipewire -c 2 -t pink -l 1`. **Expected:** pink noise from the left speaker, then the right speaker. **Actual:** no sound. `speaker-test` reports no errors, and the ALSA stream on card 0 is in the RUNNING state. On 6.17.0-29-generic, the same test plays from both speakers. ### Things that are the same on both kernels - The kernel log shows the same messages on both kernels, including this calibration error: ``` snd_hda_codec_alc269 hdaudioC0D0: ALC287: picked fixup for codec SSID 17aa:3886 snd_hda_codec_alc269 hdaudioC0D0: bound i2c-TIAS2781:00 (ops tas2781_hda_comp_ops [snd_hda_scodec_tas2781_i2c]) tas2781-hda i2c-TIAS2781:00: tas2781_apply_calib: V1 CRC error ``` Because the speakers work on 6.17 with this error, the error alone does not explain the silence. - Amplifier controls on card 0 are identical: `Speaker Analog Volume` = 20 (max), `Speaker Profile Id` = 0, `Speaker Program Id` = 0, `Speaker Config Id` = 0. - Setting `Speaker Force Firmware Load` to on (on 7.0.0-38) does not bring the speakers back. - Amplifier firmware: `/lib/firmware/TAS2XXX3886.bin.zst` (link to `ti/audio/tas2781/TAS2XXX3886.bin.zst`). ### System - Model: LENOVO 82WQ, Legion Pro 7 16IRX8H - BIOS: KWCN42WW (09/15/2023) - OS: Ubuntu 24.04.5 LTS - Audio controller: Intel Raptor Lake HD Audio [8086:7a50] - Codec: Realtek ALC287, vendor ID 0x10ec0287, subsystem ID 0x17aa3886 - linux-firmware 20240318.git3b128b60.0ubuntu3.1 - alsa-ucm-conf 1.2.10-1ubuntu5.15 - wireplumber 0.4.17-1ubuntu4.1 (PipeWire 1.0.5) ProblemType: Bug DistroRelease: Ubuntu 24.04 Package: linux-image-6.17.0-29-generic 6.17.0-29.29~24.04.1 ProcVersionSignature: Ubuntu 6.17.0-29.29~24.04.1-generic 6.17.13 Uname: Linux 6.17.0-29-generic x86_64 ApportVersion: 2.28.3-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: roope 3932 F.... wireplumber /dev/snd/controlC1: roope 3932 F.... wireplumber /dev/snd/seq: roope 3925 F.... pipewire CRDA: N/A CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Wed Oct 21 10:44:19 2026 InstallationDate: Installed on 2026-06-29 (114 days ago) InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: LENOVO 82WQ ProcFB: 0 simpledrmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-6.17.0-29-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash vt.handoff=7 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. RelatedPackageVersions: linux-restricted-modules-6.17.0-29-generic N/A linux-backports-modules-6.17.0-29-generic N/A linux-firmware 20240318.git3b128b60.0ubuntu3.1 SourcePackage: linux-hwe-6.17 UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 09/15/2023 dmi.bios.release: 1.42 dmi.bios.vendor: LENOVO dmi.bios.version: KWCN42WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76461 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Legion Pro 7 16IRX8H dmi.ec.firmware.release: 1.42 dmi.modalias: dmi:bvnLENOVO:bvrKWCN42WW:bd09/15/2023:br1.42:efr1.42:svnLENOVO:pn82WQ:pvrLegionPro716IRX8H:rvnLENOVO:rnLNVNB161216:rvrSDK0T76461WIN:cvnLENOVO:ct10:cvrLegionPro716IRX8H:skuLENOVO_MT_82WQ_BU_idea_FM_LegionPro716IRX8H: dmi.product.family: Legion Pro 7 16IRX8H dmi.product.name: 82WQ dmi.product.sku: LENOVO_MT_82WQ_BU_idea_FM_Legion Pro 7 16IRX8H dmi.product.version: Legion Pro 7 16IRX8H dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171588/+subscriptions

[Bug 2173702] Re: tas2781: divide error in tas2781_cali_preproc on HP ZBook Fury G1i 16 (SPI) - no speaker audio

The 7.0.0-43 kernel included this commit, which fixes some systems, but broke others: https://github.com/tiwai/sound/commit/408249089c48df1a4d23f60b831be3f3c311e6d1 A follow-up commit is needed too: https://github.com/torvalds/linux/commit/8dbab764f1e0a92c3fac0ce070ce30c0c33c2692 ** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Changed in: linux (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173702 Title: tas2781: divide error in tas2781_cali_preproc on HP ZBook Fury G1i 16 (SPI) - no speaker audio Status in linux package in Ubuntu: Confirmed Status in linux-signed-oem-7.0 package in Ubuntu: New Bug description: Hardware: HP ZBook Fury G1i 16, TI TAS2781 speaker amps via SPI (spi0-TXNW2781:00) OS: Kubuntu 26.04 Regression: built-in speakers stop working shortly after login. Kernel oopses with a divide error in tas2781_cali_preproc(). Kernel versions: - 7.0.0-14-generic: works (speakers OK) - 7.0.0-43-generic: crash - 7.0.0-1018-oem: crash (already contains "ALSA: hda/tas2781: Fix sound abnormal issue on some SPI device" and the HP ZBook TAS2781 fixes) dmesg: Oops: divide error: 0000 [#1] SMP NOPTI RIP: 0010:tas2781_cali_preproc+0x1e3/0x270 [snd_soc_tas2781_fmwlib] Call Trace: tasdev_load_calibrated_data+0x14b/0x160 [snd_soc_tas2781_fmwlib] tasdevice_select_tuningprm_cfg+0x574/0x7f0 [snd_soc_tas2781_fmwlib] tasdevice_tuning_switch+0x60/0xa0 [snd_soc_tas2781_fmwlib] tas2781_hda_playback_hook+0x116/0x140 [snd_hda_scodec_tas2781_spi] The crash appears to come from the calibration preprocessing added in "ALSA: hda/tas2781: A workaround solution to lower-vol issue among lower calibrated-impedance micro-speaker on TAS2781" (Feb 2026). Presumably a value read from the SPI device or from the UEFI calibration data is zero and is used as a divisor without a check. Also affects linux-oem-7.0. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-1018-oem 7.0.0-1018.18 ProcVersionSignature: Ubuntu 7.0.0-1018.18-oem 7.0.14 Uname: Linux 7.0.0-1018-oem x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CurrentDesktop: KDE Date: Sun Nov 8 19:52:58 2026 InstallationDate: Installed on 2026-11-07 (1 days ago) InstallationMedia: Kubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423) SourcePackage: linux-signed-oem-7.0 UpgradeStatus: No upgrade log present (probably fresh install) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173702/+subscriptions

[Bug 2173669] Re: l2tp: use-after-free (refcount_t: addition on 0) on every L2TP/IPsec VPN connect since 6.8.0-146 - bad backport of CVE-2026-53262 fix in pppol2tp_ioctl()

*** This bug is a duplicate of bug 2169477 *** https://bugs.launchpad.net/bugs/2169477 ** This bug has been marked a duplicate of bug 2169477 [regression] 6.8.0-146: l2tp/pppol2tp use-after-free -> kernel panic / soft lockup (L2TP/IPsec, xl2tpd) -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173669 Title: l2tp: use-after-free (refcount_t: addition on 0) on every L2TP/IPsec VPN connect since 6.8.0-146 - bad backport of CVE-2026-53262 fix in pppol2tp_ioctl() Status in linux package in Ubuntu: New Bug description: ### Summary Starting with linux 6.8.0-146.146 (noble), connecting an L2TP/IPsec VPN (network-manager-l2tp + strongSwan + pppd) triggers a kernel `refcount_t: addition on 0; use-after-free` warning in `l2tp_core` within about one second of the connection coming up, every single time. The slab corruption that follows later takes down unrelated processes (we observed oopses in `kioslave5`, `kscreenlocker_greet` and `rsync` inside `kmalloc`/`kfree`) and ends in a full system freeze. 6.8.0-142.142 is unaffected. 6.8.0-146, 6.8.0-147 and 6.8.0-149 are all affected; 6.8.0-149's "xfrm: add missing rcu_read_lock() ... for xfrm_trans_reinject()" does not fix it. The cause is a reference-counting mismatch introduced by the noble backport of the CVE-2026-53262 fix ("l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()"). Details and a proposed fix below. ### Environment - Ubuntu 24.04.5 LTS (noble), amd64 - Lenovo ThinkPad (20NECTO1WW), 8 CPUs, 29 GiB RAM, no hardware errors logged (no MCE/EDAC) - Affected kernels: linux-image-6.8.0-146-generic, -147-generic, -149-generic - Unaffected kernel: linux-image-6.8.0-142-generic - VPN stack: network-manager-l2tp 1.20.12-1build2 (uses kl2tpd), strongswan 5.9.13-2ubuntu4.24.04.5, ppp 2.4.9-1+1.1ubuntu4, network-manager 1.46.0-1ubuntu2.8 - VPN type: L2TP over IPsec (IKEv1, ESP in UDP encapsulation) ### Steps to reproduce 1. Boot 6.8.0-146 or later (tested 146, 147, 149). 2. Connect an L2TP/IPsec VPN with network-manager-l2tp. 3. `journalctl -k | grep refcount_t` Expected: no warnings. Actual: within ~1 s of `l2tp_ppp: PPPoL2TP kernel driver, V2.0` being logged, three warnings appear in sequence: ``` refcount_t: addition on 0; use-after-free. (l2tp_tunnel_get_session) refcount_t: underflow; use-after-free. (l2tp_session_dec_refcount / l2tp_session_put in 149) refcount_t: saturated; leaking memory. (l2tp_tunnel_get_session) ``` Reproduces 100% of the time on every connect. Booting 6.8.0-142 with the same VPN and configuration shows no warning. ### Trace (6.8.0-149, first warning; full log attached) ``` refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 31 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150 CPU: 4 PID: 31 Comm: kworker/4:0 Not tainted 6.8.0-149-generic #149-Ubuntu Workqueue: events xfrm_trans_reinject Call Trace: <TASK> l2tp_tunnel_get_session+0xc8/0xd0 [l2tp_core] l2tp_udp_recv_core+0xb1/0x350 [l2tp_core] l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core] udp_queue_rcv_one_skb+0x27b/0x550 udp_queue_rcv_skb+0x4f/0x80 udp_unicast_rcv_skb+0x7a/0xa0 __udp4_lib_rcv+0x627/0x6f0 udp_rcv+0x25/0x40 ip_protocol_deliver_rcu+0xd8/0x210 ip_local_deliver_finish+0x77/0xa0 ip_local_deliver+0x6e/0x120 xfrm4_rcv_encap_finish2+0x3c/0x60 xfrm_trans_reinject+0xf0/0x190 process_one_work+0x184/0x3a0 worker_thread+0x18b/0x330 kthread+0xf2/0x120 ret_from_fork+0x47/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> ``` Later consequences seen on 6.8.0-146 (same machine, 2026-10-05 and 2026-10-06): `BUG: unable to handle page fault` in `kmalloc_trace` (comm kioslave5, then kscreenlocker_greet), `free_large_kmalloc` / `__kmalloc` oops from `cifs_get_fattr` (comm rsync), followed by a hard freeze with the journal cut off. ### Root cause Comparing `net/l2tp/l2tp_ppp.c` between the Ubuntu-6.8.0-142.142 and Ubuntu-6.8.0-146.146 tags (https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble), the only change is the backport of l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (CVE-2026-53262) The upstream fix targets 6.12+, where `pppol2tp_sock_to_session()` takes a reference on the *session* and callers drop it with `l2tp_session_put()`. In 6.8, `pppol2tp_sock_to_session()` is different: it takes a reference on the *socket* (`sock_hold(sk)`) and takes none on the session: ```c static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) { ... sock_hold(sk); session = (struct l2tp_session *)(sk->sk_user_data); if (!session) { sock_put(sk); goto out; } ... } ``` Every other caller in 6.8 (`pppol2tp_recvmsg`, `pppol2tp_sendmsg`, `pppol2tp_release`, `pppol2tp_setsockopt`, `pppol2tp_getsockopt`) accordingly releases it with `sock_put(sk)`. The backported `pppol2tp_ioctl()` instead does: ```c session = pppol2tp_sock_to_session(sock->sk); /* sock_hold() only */ ... if (session) l2tp_session_dec_refcount(session); /* drops a session ref it never took */ return err; ``` (In 6.8.0-149 the helper is renamed to `l2tp_session_put()`; the logic is unchanged.) The `-EBADF` path has the same mismatch. Result: every `pppol2tp_ioctl()` call decrements the session refcount by one without a matching increment, and leaks one socket reference. pppd issues ioctls on the pppol2tp socket right after connect (`PPPIOCGL2TPSTATS` etc.), so the session refcount drops to zero while the session is still in the tunnel's session hash. The next incoming L2TP data packet looks it up via `l2tp_tunnel_get_session()`, which uses plain `refcount_inc()`, producing `addition on 0` and a use-after-free. This matches the observed deterministic ~1 s delay (first inbound L2TP packet after the PPP ioctls) and the fact that 142 (no such code) is clean while 146/147/149 (same ioctl logic) all fail. ### Proposed fix In `pppol2tp_ioctl()`, release what was taken: replace both `l2tp_session_dec_refcount(session)` (149: `l2tp_session_put(session)`) calls with `sock_put(sock->sk)`, matching the other callers of `pppol2tp_sock_to_session()` in 6.8. Alternatively, backport the 6.11+ change that makes `pppol2tp_sock_to_session()` take a session reference (and convert all callers), but the one-line `sock_put` change is the minimal correct fix for this branch. The same mismatch should be checked in the other Ubuntu kernels that received this CVE backport on a pre-6.11 `pppol2tp_sock_to_session()` (e.g. 6.8 HWE kernels, jammy 5.15 if applicable). ### Workaround Boot 6.8.0-142 (pinned via GRUB_DEFAULT), or avoid L2TP VPN on affected kernels. (Attachments: full dmesg from 6.8.0-149 after VPN connect, and the 142->146 diff of pppol2tp_ioctl(), will be added after filing.) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173669/+subscriptions

[Bug 2173669] [NEW] l2tp: use-after-free (refcount_t: addition on 0) on every L2TP/IPsec VPN connect since 6.8.0-146 - bad backport of CVE-2026-53262 fix in pppol2tp_ioctl()

Public bug reported: ### Summary Starting with linux 6.8.0-146.146 (noble), connecting an L2TP/IPsec VPN (network-manager-l2tp + strongSwan + pppd) triggers a kernel `refcount_t: addition on 0; use-after-free` warning in `l2tp_core` within about one second of the connection coming up, every single time. The slab corruption that follows later takes down unrelated processes (we observed oopses in `kioslave5`, `kscreenlocker_greet` and `rsync` inside `kmalloc`/`kfree`) and ends in a full system freeze. 6.8.0-142.142 is unaffected. 6.8.0-146, 6.8.0-147 and 6.8.0-149 are all affected; 6.8.0-149's "xfrm: add missing rcu_read_lock() ... for xfrm_trans_reinject()" does not fix it. The cause is a reference-counting mismatch introduced by the noble backport of the CVE-2026-53262 fix ("l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()"). Details and a proposed fix below. ### Environment - Ubuntu 24.04.5 LTS (noble), amd64 - Lenovo ThinkPad (20NECTO1WW), 8 CPUs, 29 GiB RAM, no hardware errors logged (no MCE/EDAC) - Affected kernels: linux-image-6.8.0-146-generic, -147-generic, -149-generic - Unaffected kernel: linux-image-6.8.0-142-generic - VPN stack: network-manager-l2tp 1.20.12-1build2 (uses kl2tpd), strongswan 5.9.13-2ubuntu4.24.04.5, ppp 2.4.9-1+1.1ubuntu4, network-manager 1.46.0-1ubuntu2.8 - VPN type: L2TP over IPsec (IKEv1, ESP in UDP encapsulation) ### Steps to reproduce 1. Boot 6.8.0-146 or later (tested 146, 147, 149). 2. Connect an L2TP/IPsec VPN with network-manager-l2tp. 3. `journalctl -k | grep refcount_t` Expected: no warnings. Actual: within ~1 s of `l2tp_ppp: PPPoL2TP kernel driver, V2.0` being logged, three warnings appear in sequence: ``` refcount_t: addition on 0; use-after-free. (l2tp_tunnel_get_session) refcount_t: underflow; use-after-free. (l2tp_session_dec_refcount / l2tp_session_put in 149) refcount_t: saturated; leaking memory. (l2tp_tunnel_get_session) ``` Reproduces 100% of the time on every connect. Booting 6.8.0-142 with the same VPN and configuration shows no warning. ### Trace (6.8.0-149, first warning; full log attached) ``` refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 31 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150 CPU: 4 PID: 31 Comm: kworker/4:0 Not tainted 6.8.0-149-generic #149-Ubuntu Workqueue: events xfrm_trans_reinject Call Trace: <TASK> l2tp_tunnel_get_session+0xc8/0xd0 [l2tp_core] l2tp_udp_recv_core+0xb1/0x350 [l2tp_core] l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core] udp_queue_rcv_one_skb+0x27b/0x550 udp_queue_rcv_skb+0x4f/0x80 udp_unicast_rcv_skb+0x7a/0xa0 __udp4_lib_rcv+0x627/0x6f0 udp_rcv+0x25/0x40 ip_protocol_deliver_rcu+0xd8/0x210 ip_local_deliver_finish+0x77/0xa0 ip_local_deliver+0x6e/0x120 xfrm4_rcv_encap_finish2+0x3c/0x60 xfrm_trans_reinject+0xf0/0x190 process_one_work+0x184/0x3a0 worker_thread+0x18b/0x330 kthread+0xf2/0x120 ret_from_fork+0x47/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> ``` Later consequences seen on 6.8.0-146 (same machine, 2026-10-05 and 2026-10-06): `BUG: unable to handle page fault` in `kmalloc_trace` (comm kioslave5, then kscreenlocker_greet), `free_large_kmalloc` / `__kmalloc` oops from `cifs_get_fattr` (comm rsync), followed by a hard freeze with the journal cut off. ### Root cause Comparing `net/l2tp/l2tp_ppp.c` between the Ubuntu-6.8.0-142.142 and Ubuntu-6.8.0-146.146 tags (https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble), the only change is the backport of l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (CVE-2026-53262) The upstream fix targets 6.12+, where `pppol2tp_sock_to_session()` takes a reference on the *session* and callers drop it with `l2tp_session_put()`. In 6.8, `pppol2tp_sock_to_session()` is different: it takes a reference on the *socket* (`sock_hold(sk)`) and takes none on the session: ```c static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) { ... sock_hold(sk); session = (struct l2tp_session *)(sk->sk_user_data); if (!session) { sock_put(sk); goto out; } ... } ``` Every other caller in 6.8 (`pppol2tp_recvmsg`, `pppol2tp_sendmsg`, `pppol2tp_release`, `pppol2tp_setsockopt`, `pppol2tp_getsockopt`) accordingly releases it with `sock_put(sk)`. The backported `pppol2tp_ioctl()` instead does: ```c session = pppol2tp_sock_to_session(sock->sk); /* sock_hold() only */ ... if (session) l2tp_session_dec_refcount(session); /* drops a session ref it never took */ return err; ``` (In 6.8.0-149 the helper is renamed to `l2tp_session_put()`; the logic is unchanged.) The `-EBADF` path has the same mismatch. Result: every `pppol2tp_ioctl()` call decrements the session refcount by one without a matching increment, and leaks one socket reference. pppd issues ioctls on the pppol2tp socket right after connect (`PPPIOCGL2TPSTATS` etc.), so the session refcount drops to zero while the session is still in the tunnel's session hash. The next incoming L2TP data packet looks it up via `l2tp_tunnel_get_session()`, which uses plain `refcount_inc()`, producing `addition on 0` and a use-after-free. This matches the observed deterministic ~1 s delay (first inbound L2TP packet after the PPP ioctls) and the fact that 142 (no such code) is clean while 146/147/149 (same ioctl logic) all fail. ### Proposed fix In `pppol2tp_ioctl()`, release what was taken: replace both `l2tp_session_dec_refcount(session)` (149: `l2tp_session_put(session)`) calls with `sock_put(sock->sk)`, matching the other callers of `pppol2tp_sock_to_session()` in 6.8. Alternatively, backport the 6.11+ change that makes `pppol2tp_sock_to_session()` take a session reference (and convert all callers), but the one-line `sock_put` change is the minimal correct fix for this branch. The same mismatch should be checked in the other Ubuntu kernels that received this CVE backport on a pre-6.11 `pppol2tp_sock_to_session()` (e.g. 6.8 HWE kernels, jammy 5.15 if applicable). ### Workaround Boot 6.8.0-142 (pinned via GRUB_DEFAULT), or avoid L2TP VPN on affected kernels. (Attachments: full dmesg from 6.8.0-149 after VPN connect, and the 142->146 diff of pppol2tp_ioctl(), will be added after filing.) ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: noble regression-update ** Attachment added: "dmesg from 6.8.0-149-generic, from l2tp module load (VPN connect) until shutdown; all three refcount_t warnings" https://bugs.launchpad.net/bugs/2173669/+attachment/6016004/+files/dmesg-6.8.0-149-full.txt ** CVE added: https://cve.org/CVERecord?id=CVE-2026-53262 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173669 Title: l2tp: use-after-free (refcount_t: addition on 0) on every L2TP/IPsec VPN connect since 6.8.0-146 - bad backport of CVE-2026-53262 fix in pppol2tp_ioctl() Status in linux package in Ubuntu: New Bug description: ### Summary Starting with linux 6.8.0-146.146 (noble), connecting an L2TP/IPsec VPN (network-manager-l2tp + strongSwan + pppd) triggers a kernel `refcount_t: addition on 0; use-after-free` warning in `l2tp_core` within about one second of the connection coming up, every single time. The slab corruption that follows later takes down unrelated processes (we observed oopses in `kioslave5`, `kscreenlocker_greet` and `rsync` inside `kmalloc`/`kfree`) and ends in a full system freeze. 6.8.0-142.142 is unaffected. 6.8.0-146, 6.8.0-147 and 6.8.0-149 are all affected; 6.8.0-149's "xfrm: add missing rcu_read_lock() ... for xfrm_trans_reinject()" does not fix it. The cause is a reference-counting mismatch introduced by the noble backport of the CVE-2026-53262 fix ("l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()"). Details and a proposed fix below. ### Environment - Ubuntu 24.04.5 LTS (noble), amd64 - Lenovo ThinkPad (20NECTO1WW), 8 CPUs, 29 GiB RAM, no hardware errors logged (no MCE/EDAC) - Affected kernels: linux-image-6.8.0-146-generic, -147-generic, -149-generic - Unaffected kernel: linux-image-6.8.0-142-generic - VPN stack: network-manager-l2tp 1.20.12-1build2 (uses kl2tpd), strongswan 5.9.13-2ubuntu4.24.04.5, ppp 2.4.9-1+1.1ubuntu4, network-manager 1.46.0-1ubuntu2.8 - VPN type: L2TP over IPsec (IKEv1, ESP in UDP encapsulation) ### Steps to reproduce 1. Boot 6.8.0-146 or later (tested 146, 147, 149). 2. Connect an L2TP/IPsec VPN with network-manager-l2tp. 3. `journalctl -k | grep refcount_t` Expected: no warnings. Actual: within ~1 s of `l2tp_ppp: PPPoL2TP kernel driver, V2.0` being logged, three warnings appear in sequence: ``` refcount_t: addition on 0; use-after-free. (l2tp_tunnel_get_session) refcount_t: underflow; use-after-free. (l2tp_session_dec_refcount / l2tp_session_put in 149) refcount_t: saturated; leaking memory. (l2tp_tunnel_get_session) ``` Reproduces 100% of the time on every connect. Booting 6.8.0-142 with the same VPN and configuration shows no warning. ### Trace (6.8.0-149, first warning; full log attached) ``` refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 31 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x150 CPU: 4 PID: 31 Comm: kworker/4:0 Not tainted 6.8.0-149-generic #149-Ubuntu Workqueue: events xfrm_trans_reinject Call Trace: <TASK> l2tp_tunnel_get_session+0xc8/0xd0 [l2tp_core] l2tp_udp_recv_core+0xb1/0x350 [l2tp_core] l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core] udp_queue_rcv_one_skb+0x27b/0x550 udp_queue_rcv_skb+0x4f/0x80 udp_unicast_rcv_skb+0x7a/0xa0 __udp4_lib_rcv+0x627/0x6f0 udp_rcv+0x25/0x40 ip_protocol_deliver_rcu+0xd8/0x210 ip_local_deliver_finish+0x77/0xa0 ip_local_deliver+0x6e/0x120 xfrm4_rcv_encap_finish2+0x3c/0x60 xfrm_trans_reinject+0xf0/0x190 process_one_work+0x184/0x3a0 worker_thread+0x18b/0x330 kthread+0xf2/0x120 ret_from_fork+0x47/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> ``` Later consequences seen on 6.8.0-146 (same machine, 2026-10-05 and 2026-10-06): `BUG: unable to handle page fault` in `kmalloc_trace` (comm kioslave5, then kscreenlocker_greet), `free_large_kmalloc` / `__kmalloc` oops from `cifs_get_fattr` (comm rsync), followed by a hard freeze with the journal cut off. ### Root cause Comparing `net/l2tp/l2tp_ppp.c` between the Ubuntu-6.8.0-142.142 and Ubuntu-6.8.0-146.146 tags (https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/noble), the only change is the backport of l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (CVE-2026-53262) The upstream fix targets 6.12+, where `pppol2tp_sock_to_session()` takes a reference on the *session* and callers drop it with `l2tp_session_put()`. In 6.8, `pppol2tp_sock_to_session()` is different: it takes a reference on the *socket* (`sock_hold(sk)`) and takes none on the session: ```c static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) { ... sock_hold(sk); session = (struct l2tp_session *)(sk->sk_user_data); if (!session) { sock_put(sk); goto out; } ... } ``` Every other caller in 6.8 (`pppol2tp_recvmsg`, `pppol2tp_sendmsg`, `pppol2tp_release`, `pppol2tp_setsockopt`, `pppol2tp_getsockopt`) accordingly releases it with `sock_put(sk)`. The backported `pppol2tp_ioctl()` instead does: ```c session = pppol2tp_sock_to_session(sock->sk); /* sock_hold() only */ ... if (session) l2tp_session_dec_refcount(session); /* drops a session ref it never took */ return err; ``` (In 6.8.0-149 the helper is renamed to `l2tp_session_put()`; the logic is unchanged.) The `-EBADF` path has the same mismatch. Result: every `pppol2tp_ioctl()` call decrements the session refcount by one without a matching increment, and leaks one socket reference. pppd issues ioctls on the pppol2tp socket right after connect (`PPPIOCGL2TPSTATS` etc.), so the session refcount drops to zero while the session is still in the tunnel's session hash. The next incoming L2TP data packet looks it up via `l2tp_tunnel_get_session()`, which uses plain `refcount_inc()`, producing `addition on 0` and a use-after-free. This matches the observed deterministic ~1 s delay (first inbound L2TP packet after the PPP ioctls) and the fact that 142 (no such code) is clean while 146/147/149 (same ioctl logic) all fail. ### Proposed fix In `pppol2tp_ioctl()`, release what was taken: replace both `l2tp_session_dec_refcount(session)` (149: `l2tp_session_put(session)`) calls with `sock_put(sock->sk)`, matching the other callers of `pppol2tp_sock_to_session()` in 6.8. Alternatively, backport the 6.11+ change that makes `pppol2tp_sock_to_session()` take a session reference (and convert all callers), but the one-line `sock_put` change is the minimal correct fix for this branch. The same mismatch should be checked in the other Ubuntu kernels that received this CVE backport on a pre-6.11 `pppol2tp_sock_to_session()` (e.g. 6.8 HWE kernels, jammy 5.15 if applicable). ### Workaround Boot 6.8.0-142 (pinned via GRUB_DEFAULT), or avoid L2TP VPN on affected kernels. (Attachments: full dmesg from 6.8.0-149 after VPN connect, and the 142->146 diff of pppol2tp_ioctl(), will be added after filing.) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173669/+subscriptions

[Bug 2173668] [NEW] Lenovo Legion Slim 5 16AHP9: ACPI hotplug removes NVIDIA GPU during battery suspend/resume, causing kernel crash

Public bug reported: Lenovo Legion Slim 5 16AHP9: ACPI hotplug removes NVIDIA GPU during battery suspend/resume, causing kernel protection fault Hardware - Lenovo Legion Slim 5 16AHP9, product code 83DH - AMD Phoenix platform - NVIDIA GeForce RTX 4070 Laptop GPU (`0000:01:00.0`) - GPU parent PCIe port: `0000:00:01.1` (ACPI `GPP0`) Software - Ubuntu 26.04.1 LTS - Kernel: `7.0.0-43-generic` - NVIDIA open driver: `595.99.02` - BIOS: `NRCN27WW` (also reproduced with `NRCN24WW`) - Suspend mode: `s2idle` - BIOS graphics mode: Dedicated GPU Description Battery-powered suspend/resume repeatedly causes a black screen and unresponsive keyboard, requiring a forced shutdown. AC-powered suspend/resume succeeded in an earlier test. During resume, the ACPI hotplug workqueue attempts to remove the NVIDIA PCI device while its graphics driver is active. This produces DRM cleanup warnings, followed by a general protection fault and a recursive fault. Reproduction 1. Boot Ubuntu in Dedicated GPU mode. 2. Disconnect AC power. 3. Execute `systemctl suspend`. 4. Attempt to resume. **Observed results** The kernel log records: ```text PM: suspend exit [nvidia-drm] Removing device Workqueue: kacpi_hotplug acpi_hotplug_work_fn acpiphp_disable_and_eject_slot nv_pci_remove_helper [nvidia] NVRM: Attempting to remove device 0000:01:00.0 with non-zero usage count! Oops: general protection fault RIP: drm_framebuffer_cleanup Fixing recursive fault but reboot is needed! ``` Workarounds attempted - Updated Lenovo BIOS from NRCN24WW to NRCN27WW: issue persists. - Disabled ACPI GPP0 wakeup (`/proc/acpi/wakeup`): issue persists. - Dedicated GPU mode prevents immediate freezing when disconnecting AC power but does not prevent battery suspend/resume failure. - AC-powered suspend/resume passed one test. Potentially related upstream work `[PATCH RESEND v3] pci: Add broken-GPE quirk for some Lenovo Legions with Nvidia GPUs` (October 21, 2026). The patch addresses erroneous firmware wakeup events on the NVIDIA GPU's parent PCIe port. It is not established whether it also addresses this ACPI hotplug removal failure. Expected behavior The system should resume from suspend without unexpectedly removing the active NVIDIA graphics device or crashing the kernel. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-43-generic 7.0.0-43.43 ProcVersionSignature: Ubuntu 7.0.0-43.43-generic 7.0.14 Uname: Linux 7.0.0-43-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC2: rehan 5101 F.... wireplumber /dev/snd/controlC0: rehan 5101 F.... wireplumber /dev/snd/controlC1: rehan 5101 F.... wireplumber /dev/snd/seq: rehan 5097 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Sat Nov 7 20:49:17 2026 InstallationDate: Installed on 2024-12-15 (692 days ago) InstallationMedia: Ubuntu 24.04.1 LTS "Noble Numbat" - Release amd64 (20240827.1) MachineType: LENOVO 83DH ProcFB: 0 nvidia-drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-43-generic root=UUID=8c8760f7-57f2-4bda-8783-35c3a61cb20b ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 04/13/2025 dmi.bios.release: 1.27 dmi.bios.vendor: LENOVO dmi.bios.version: NRCN27WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76463 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Legion Slim 5 16AHP9 dmi.ec.firmware.release: 1.27 dmi.modalias: dmi:bvnLENOVO:bvrNRCN27WW:bd04/13/2025:br1.27:efr1.27:svnLENOVO:pn83DH:pvrLegionSlim516AHP9:rvnLENOVO:rnLNVNB161216:rvrSDK0T76463WIN:cvnLENOVO:ct10:cvrLegionSlim516AHP9:skuLENOVO_MT_83DH_BU_idea_FM_LegionSlim516AHP9:pfaLegionSlim516AHP9: dmi.product.family: Legion Slim 5 16AHP9 dmi.product.name: 83DH dmi.product.sku: LENOVO_MT_83DH_BU_idea_FM_Legion Slim 5 16AHP9 dmi.product.version: Legion Slim 5 16AHP9 dmi.sys.vendor: LENOVO ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173668 Title: Lenovo Legion Slim 5 16AHP9: ACPI hotplug removes NVIDIA GPU during battery suspend/resume, causing kernel crash Status in linux package in Ubuntu: New Bug description: Lenovo Legion Slim 5 16AHP9: ACPI hotplug removes NVIDIA GPU during battery suspend/resume, causing kernel protection fault Hardware - Lenovo Legion Slim 5 16AHP9, product code 83DH - AMD Phoenix platform - NVIDIA GeForce RTX 4070 Laptop GPU (`0000:01:00.0`) - GPU parent PCIe port: `0000:00:01.1` (ACPI `GPP0`) Software - Ubuntu 26.04.1 LTS - Kernel: `7.0.0-43-generic` - NVIDIA open driver: `595.99.02` - BIOS: `NRCN27WW` (also reproduced with `NRCN24WW`) - Suspend mode: `s2idle` - BIOS graphics mode: Dedicated GPU Description Battery-powered suspend/resume repeatedly causes a black screen and unresponsive keyboard, requiring a forced shutdown. AC-powered suspend/resume succeeded in an earlier test. During resume, the ACPI hotplug workqueue attempts to remove the NVIDIA PCI device while its graphics driver is active. This produces DRM cleanup warnings, followed by a general protection fault and a recursive fault. Reproduction 1. Boot Ubuntu in Dedicated GPU mode. 2. Disconnect AC power. 3. Execute `systemctl suspend`. 4. Attempt to resume. **Observed results** The kernel log records: ```text PM: suspend exit [nvidia-drm] Removing device Workqueue: kacpi_hotplug acpi_hotplug_work_fn acpiphp_disable_and_eject_slot nv_pci_remove_helper [nvidia] NVRM: Attempting to remove device 0000:01:00.0 with non-zero usage count! Oops: general protection fault RIP: drm_framebuffer_cleanup Fixing recursive fault but reboot is needed! ``` Workarounds attempted - Updated Lenovo BIOS from NRCN24WW to NRCN27WW: issue persists. - Disabled ACPI GPP0 wakeup (`/proc/acpi/wakeup`): issue persists. - Dedicated GPU mode prevents immediate freezing when disconnecting AC power but does not prevent battery suspend/resume failure. - AC-powered suspend/resume passed one test. Potentially related upstream work `[PATCH RESEND v3] pci: Add broken-GPE quirk for some Lenovo Legions with Nvidia GPUs` (October 21, 2026). The patch addresses erroneous firmware wakeup events on the NVIDIA GPU's parent PCIe port. It is not established whether it also addresses this ACPI hotplug removal failure. Expected behavior The system should resume from suspend without unexpectedly removing the active NVIDIA graphics device or crashing the kernel. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-43-generic 7.0.0-43.43 ProcVersionSignature: Ubuntu 7.0.0-43.43-generic 7.0.14 Uname: Linux 7.0.0-43-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC2: rehan 5101 F.... wireplumber /dev/snd/controlC0: rehan 5101 F.... wireplumber /dev/snd/controlC1: rehan 5101 F.... wireplumber /dev/snd/seq: rehan 5097 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Sat Nov 7 20:49:17 2026 InstallationDate: Installed on 2024-12-15 (692 days ago) InstallationMedia: Ubuntu 24.04.1 LTS "Noble Numbat" - Release amd64 (20240827.1) MachineType: LENOVO 83DH ProcFB: 0 nvidia-drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-43-generic root=UUID=8c8760f7-57f2-4bda-8783-35c3a61cb20b ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 04/13/2025 dmi.bios.release: 1.27 dmi.bios.vendor: LENOVO dmi.bios.version: NRCN27WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76463 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Legion Slim 5 16AHP9 dmi.ec.firmware.release: 1.27 dmi.modalias: dmi:bvnLENOVO:bvrNRCN27WW:bd04/13/2025:br1.27:efr1.27:svnLENOVO:pn83DH:pvrLegionSlim516AHP9:rvnLENOVO:rnLNVNB161216:rvrSDK0T76463WIN:cvnLENOVO:ct10:cvrLegionSlim516AHP9:skuLENOVO_MT_83DH_BU_idea_FM_LegionSlim516AHP9:pfaLegionSlim516AHP9: dmi.product.family: Legion Slim 5 16AHP9 dmi.product.name: 83DH dmi.product.sku: LENOVO_MT_83DH_BU_idea_FM_Legion Slim 5 16AHP9 dmi.product.version: Legion Slim 5 16AHP9 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173668/+subscriptions

[Bug 2173667] [NEW] No sound on XPS 14 9440 after update to 7.0.0-43 — CS35L56 amps not probing, Dummy Output only

Public bug reported: Dell XPS 14 9440 (Meteor Lake, SoundWire, Cirrus CS35L56 amps). Sound worked on the previous kernel 7.0.0-38-generic; after updating to 7.0.0-43-generic only “Dummy Output” appears and aplay -l shows no soundcards. SOF firmware loads and boots fine (2.14.1.1), but the cs35l56 amps never probe (no cs35l56 lines in dmesg) and sof_sdw reports: sof_sdw sof_sdw: ASoC: CODEC DAI cs35l56-ot25 not registered ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-43-generic 7.0.0-43.43 ProcVersionSignature: Ubuntu 7.0.0-43.43-generic 7.0.14 Uname: Linux 7.0.0-43-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/seq: rb 9115 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Sat Nov 7 21:37:21 2026 InstallationDate: Installed on 2026-10-19 (19 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: Dell Inc. XPS 14 9440 ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-43-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 04/23/2026 dmi.bios.release: 1.24 dmi.bios.vendor: Dell Inc. dmi.bios.version: 1.24.0 dmi.board.name: 0K5P83 dmi.board.vendor: Dell Inc. dmi.board.version: A00 dmi.chassis.type: 10 dmi.chassis.vendor: Dell Inc. dmi.ec.firmware.release: 1.34 dmi.modalias: dmi:bvnDellInc.:bvr1.24.0:bd04/23/2026:br1.24:efr1.34:svnDellInc.:pnXPS149440:pvr:rvnDellInc.:rn0K5P83:rvrA00:cvnDellInc.:ct10:cvr:sku0C6B:pfaXPS: dmi.product.family: XPS dmi.product.name: XPS 14 9440 dmi.product.sku: 0C6B dmi.sys.vendor: Dell Inc. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute wayland-session -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173667 Title: No sound on XPS 14 9440 after update to 7.0.0-43 — CS35L56 amps not probing, Dummy Output only Status in linux package in Ubuntu: New Bug description: Dell XPS 14 9440 (Meteor Lake, SoundWire, Cirrus CS35L56 amps). Sound worked on the previous kernel 7.0.0-38-generic; after updating to 7.0.0-43-generic only “Dummy Output” appears and aplay -l shows no soundcards. SOF firmware loads and boots fine (2.14.1.1), but the cs35l56 amps never probe (no cs35l56 lines in dmesg) and sof_sdw reports: sof_sdw sof_sdw: ASoC: CODEC DAI cs35l56-ot25 not registered ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-43-generic 7.0.0-43.43 ProcVersionSignature: Ubuntu 7.0.0-43.43-generic 7.0.14 Uname: Linux 7.0.0-43-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/seq: rb 9115 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Sat Nov 7 21:37:21 2026 InstallationDate: Installed on 2026-10-19 (19 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: Dell Inc. XPS 14 9440 ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-43-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 04/23/2026 dmi.bios.release: 1.24 dmi.bios.vendor: Dell Inc. dmi.bios.version: 1.24.0 dmi.board.name: 0K5P83 dmi.board.vendor: Dell Inc. dmi.board.version: A00 dmi.chassis.type: 10 dmi.chassis.vendor: Dell Inc. dmi.ec.firmware.release: 1.34 dmi.modalias: dmi:bvnDellInc.:bvr1.24.0:bd04/23/2026:br1.24:efr1.34:svnDellInc.:pnXPS149440:pvr:rvnDellInc.:rn0K5P83:rvrA00:cvnDellInc.:ct10:cvr:sku0C6B:pfaXPS: dmi.product.family: XPS dmi.product.name: XPS 14 9440 dmi.product.sku: 0C6B dmi.sys.vendor: Dell Inc. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173667/+subscriptions

[Bug 2173641] Re: ath9k_htc regression in Kubuntu 26.04 - TP-Link TL-WN422G v2 (Atheros AR9271) fails to initialize (Target is unresponsive)

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173641 Title: ath9k_htc regression in Kubuntu 26.04 - TP-Link TL-WN422G v2 (Atheros AR9271) fails to initialize (Target is unresponsive) Status in linux package in Ubuntu: New Bug description: After a recent update in Kubuntu 26.04, my USB Wi-Fi adapter (Qualcomm Atheros AR9271, USB ID 0cf3:1006) stopped working. The device loads the htc_9271-1.4.0.fw firmware successfully, but right after renaming the interface, the kernel returns: ath9k_htc: Target is unresponsive ath9k_htc: Failed to initialize the device usbcore: USB layer deinitialized Temporarily disabling USB autosuspend via modprobe options (options ath9k_htc nohwcrypt=1) helps keep the interface alive, but the regression seems to be related to USB power management changes in the latest kernel series. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-43-generic 7.0.0-43.43 ProcVersionSignature: Ubuntu 7.0.0-43.43-generic 7.0.14 Uname: Linux 7.0.0-43-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: saimon 3589 F.... wireplumber /dev/snd/controlC1: saimon 3589 F.... wireplumber /dev/snd/seq: saimon 3584 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: KDE Date: Sat Nov 7 19:52:22 2026 MachineType: Foxconn Flaming Blade GTI ProcFB: 0 radeondrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-43-generic root=UUID=93ef500e-7536-40dd-a6c6-fcb85d1a0a96 ro quiet splash PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. RfKill: 12: phy14: Wireless LAN Soft blocked: no Hard blocked: no SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-09-29 (39 days ago) dmi.bios.date: 10/12/2010 dmi.bios.release: 6.0 dmi.bios.vendor: Phoenix Technologies, LTD dmi.bios.version: 6.00 PG dmi.board.name: Flaming Blade GTI dmi.board.vendor: Foxconn dmi.board.version: Fab 1.0 dmi.chassis.type: 3 dmi.chassis.vendor: OEM dmi.chassis.version: OEM dmi.modalias: dmi:bvnPhoenixTechnologies,LTD:bvr6.00PG:bd10/12/2010:br6.0:svnFoxconn:pnFlamingBladeGTI:pvrFab1.0:rvnFoxconn:rnFlamingBladeGTI:rvrFab1.0:cvnOEM:ct3:cvrOEM:sku:pfa: dmi.product.name: Flaming Blade GTI dmi.product.version: Fab 1.0 dmi.sys.vendor: Foxconn To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173641/+subscriptions

[Bug 2173636] Re: ITE Super I/O chip (IDs 0x8696 / 0x8883) unsupported on Gigabyte X870 AORUS ELITE WIFI7, causing sensor read-out failures and erratic maximum fan speed behavior

I doubt Ubuntu can/will do anything about this. I don't see support for the ITE8696 in latest kernel. ITE is not known to be friendly to open- source in terms of giving code or datasheets. Your best bet is probably the repo from Frank Crawford, which can be installed like: sudo apt install build-essential linux-headers-$(uname -r) dkms git cd ~/ && git clone https://github.com/frankcrawford/it87.git && cd it87/ sudo ./dkms-install.sh echo "options it87 mmio=on" | sudo tee /etc/modprobe.d/it87.conf echo "it87" | sudo tee /etc/modules-load.d/it87.conf sudo update-initramfs -u -k all (Reboot) Check output of: sensors But I don't think it has fan control support. Are you running the latest BIOS? ** Changed in: linux (Ubuntu) Status: New => Incomplete -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173636 Title: ITE Super I/O chip (IDs 0x8696 / 0x8883) unsupported on Gigabyte X870 AORUS ELITE WIFI7, causing sensor read-out failures and erratic maximum fan speed behavior Status in linux package in Ubuntu: Incomplete Bug description: On the Gigabyte X870 AORUS ELITE WIFI7 motherboard equipped with an AMD Ryzen 7 9700X processor, native Linux kernels (specifically tested on 7.0.0-38-generic and later 7.0.0-42-generic) completely lack driver support for the onboard ITE Super I/O hardware monitoring chips. During hardware probing (sensors-detect), the system identifies unknown chips with IDs 0x8696 and 0x8883, but sensors cannot read subfeatures (such as fan1_min, fan1_max, and power caps), returning persistent N/A readouts and execution errors. Because the kernel cannot interface with these newer ITE chip IDs, the motherboard's Embedded Controller (EC) loses continuous communication with userspace sensors and repeatedly triggers a failsafe routine, forcing all system and CPU fans to run continuously at maximum speed (100% duty cycle) as a thermal protective measure. Full Incident History & Current Status: 1. Kernel Regressions: Kernel 7.0.0-42-generic was identified as problematic, placed on hold, and purged. The system was reverted to running on the older 7.0.0-38-generic kernel, but the underlying sensor communication failure persists on both kernel versions. 2. Failed Driver Compilation Attempts: Multiple attempts to compile and load community/third-party it87 drivers and DKMS modules via various GitHub repositories (ucw/it87, a1winston/it87-dkms, and hjlcmb/it87) continuously failed due to repository redirection/HTTP errors, missing dependencies/packages in Mint repositories, and authentication prompts. 3. Hardware Mitigation & Ongoing Instability Monitoring: To immediately suppress the extreme fan noise, a manual "Normal" fan profile was applied directly in the BIOS (Gigabyte Smart Fan 6). Following a complete cold shutdown and power cycle (which temporarily cleared the EC's locked failsafe state), the fan speeds currently appear to adhere to the hardware BIOS profile. However, the root cause at the kernel driver level remains entirely unresolved. Because userspace sensor readouts still output N/A, it is currently unknown whether the hardware-level BIOS override will hold over time or if the EC will trip back into maximum failsafe fan speeds during extended runtime or load. Environment & System Information: - OS / Release (lsb_release -rd): Linux Mint (Ubuntu-based distribution) - Kernel Signature (cat /proc/version_signature): Stored in version.log - Motherboard: Gigabyte X870 AORUS ELITE WIFI7 - Super I/O Chips: ITE IDs 0x8696 and 0x8883 - Processor: AMD Ryzen 7 9700X 8-Core Attached Logs: 1. version.log (generated via cat /proc/version_signature > version.log) 2. lspci-vnvn.log (generated via sudo lspci -vnvn > lspci-vnvn.log) Steps to Reproduce: 1. Boot into Linux Mint on a Gigabyte X870 AORUS ELITE WIFI7 motherboard. 2. Run sensors-detect --auto. 3. Observe Super I/O probe results identifying unsupported chip IDs 0x8696 and 0x8883. 4. Run sensors and observe N/A readouts and subfeature read errors (fan1_min, fan1_max, etc.). 5. Observe the Embedded Controller failing over to 100% max fan speeds (which currently requires a cold shutdown and manual BIOS curve forcing to temporarily suppress). Expected Behavior: The Linux kernel (or standard hwmon driver stack) should natively support ITE 0x8696 and 0x8883 chips to provide proper sensor telemetry, allowing controlled fan operation without relying on manual BIOS workarounds or risking EC failsafe lock-ins To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173636/+subscriptions

[Bug 2173587] Re: [Acer Aspire Go 15 AG15-71P] Microphone mute LED does not work

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2173587 Title: [Acer Aspire Go 15 AG15-71P] Microphone mute LED does not work Status in linux package in Ubuntu: New Bug description: The F4 key mutes the microphone correctly after mapping it to micmute (see bug #2173586), but its LED never changes. It should light up when the microphone is muted. There is no micmute LED under /sys/class/leds, so the kernel does not seem to expose it. Hardware: Acer Aspire AG15-71P, board Gummy_RTH, BIOS V1.14 (03/03/2026). Audio: Intel Raptor Lake-P/U/H cAVS [8086:51ca]. Release: Ubuntu 26.04.1 LTS. Kernel: Ubuntu 7.0.0-43.43-generic 7.0.14 No workaround is known. --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse:  USER PID ACCESS COMMAND  /dev/snd/controlC0: leory 3900 F.... pipewire                       leory 3906 F.... wireplumber  /dev/snd/seq: leory 3900 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-11-02 (4 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: Acer Aspire AG15-71P Package: linux (not installed) ProcEnviron:  LANG=pt_BR.UTF-8  PATH=(custom, user)  SHELL=/bin/bash  TERM=xterm-256color  XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-43-generic root=UUID=73dc2cf5-3d8c-4313-a4a0-4398f4a29454 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-43.43-generic 7.0.14 Tags: resolute wayland-session Uname: Linux 7.0.0-43-generic x86_64 UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: adm cdrom dip lpadmin lxd plugdev sudo users _MarkForUpload: True dmi.bios.date: 03/03/2026 dmi.bios.release: 1.14 dmi.bios.vendor: Insyde Corp. dmi.bios.version: V1.14 dmi.board.asset.tag: Type2 - Board Asset Tag dmi.board.name: Gummy_RTH dmi.board.vendor: RPL dmi.board.version: V1.14 dmi.chassis.type: 10 dmi.chassis.vendor: Acer dmi.chassis.version: V1.14 dmi.ec.firmware.release: 1.11 dmi.modalias: dmi:bvnInsydeCorp.:bvrV1.14:bd03/03/2026:br1.14:efr1.11:svnAcer:pnAspireAG15-71P:pvrV1.14:rvnRPL:rnGummy_RTH:rvrV1.14:cvnAcer:ct10:cvrV1.14:sku0000000000000000:pfaAspireGo15: dmi.product.family: Aspire Go 15 dmi.product.name: Aspire AG15-71P dmi.product.sku: 0000000000000000 dmi.product.version: V1.14 dmi.sys.vendor: Acer --- ProblemType: Bug ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse:  USER PID ACCESS COMMAND  /dev/snd/controlC0: leory 3900 F.... pipewire                       leory 3906 F.... wireplumber  /dev/snd/seq: leory 3900 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 26.04 InstallationDate: Installed on 2026-11-02 (4 days ago) InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 (20260826) MachineType: Acer Aspire AG15-71P Package: linux (not installed) ProcEnviron:  LANG=pt_BR.UTF-8  PATH=(custom, user)  SHELL=/bin/bash  TERM=xterm-256color  XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-43-generic root=UUID=73dc2cf5-3d8c-4313-a4a0-4398f4a29454 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M ProcVersionSignature: Ubuntu 7.0.0-43.43-generic 7.0.14 Tags: resolute wayland-session Uname: Linux 7.0.0-43-generic x86_64 UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: adm cdrom dip lpadmin lxd plugdev sudo users _MarkForUpload: True dmi.bios.date: 03/03/2026 dmi.bios.release: 1.14 dmi.bios.vendor: Insyde Corp. dmi.bios.version: V1.14 dmi.board.asset.tag: Type2 - Board Asset Tag dmi.board.name: Gummy_RTH dmi.board.vendor: RPL dmi.board.version: V1.14 dmi.chassis.type: 10 dmi.chassis.vendor: Acer dmi.chassis.version: V1.14 dmi.ec.firmware.release: 1.11 dmi.modalias: dmi:bvnInsydeCorp.:bvrV1.14:bd03/03/2026:br1.14:efr1.11:svnAcer:pnAspireAG15-71P:pvrV1.14:rvnRPL:rnGummy_RTH:rvrV1.14:cvnAcer:ct10:cvrV1.14:sku0000000000000000:pfaAspireGo15: dmi.product.family: Aspire Go 15 dmi.product.name: Aspire AG15-71P dmi.product.sku: 0000000000000000 dmi.product.version: V1.14 dmi.sys.vendor: Acer To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173587/+subscriptions