[Bug 1786013] Autopkgtest regression report (linux-restricted-modules-ibm-6.8/6.8.0-1061.62~22.04.1)

All autopkgtests for the newly accepted linux-restricted-modules-ibm-6.8 (6.8.0-1061.62~22.04.1) for jammy have finished running. The following regressions have been reported in tests triggered by the package: nvidia-graphics-drivers-470-server/470.256.02-0ubuntu0.22.04.1 (amd64) Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1]. https://ubuntu-archive-team.ubuntu.com/proposed- migration/jammy/update_excuses.html#linux-restricted-modules-ibm-6.8 [1] https://documentation.ubuntu.com/project/SRU/howto/autopkgtest- failure/ Thank you! -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/1786013 Title: Packaging resync Status in linux package in Ubuntu: Fix Released Status in linux-azure package in Ubuntu: Fix Released Status in linux-azure-edge package in Ubuntu: Fix Released Status in linux source package in Precise: Fix Released Status in linux-azure source package in Precise: Won't Fix Status in linux-azure-edge source package in Precise: Won't Fix Status in linux source package in Trusty: Fix Released Status in linux-azure source package in Trusty: Fix Released Status in linux-azure-edge source package in Trusty: Won't Fix Status in linux source package in Xenial: Fix Released Status in linux-azure source package in Xenial: Fix Released Status in linux-azure-edge source package in Xenial: Fix Released Status in linux source package in Bionic: Fix Released Status in linux-azure source package in Bionic: Fix Released Status in linux-azure-edge source package in Bionic: Fix Released Status in linux source package in Cosmic: Fix Released Status in linux-azure source package in Cosmic: Fix Released Status in linux-azure-edge source package in Cosmic: Won't Fix Status in linux source package in Disco: Fix Released Status in linux-azure source package in Disco: Fix Released Status in linux-azure-edge source package in Disco: Won't Fix Bug description: Ongoing packaging resyncs. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1786013/+subscriptions

[Bug 2161495] Re: Dell Lattitude 7400 + 7.0.0-28-generic

Thanks for reporting the bug and providing the logs! This issue looks to be much alike https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161309, would you mind looking at comment #4 and #10 and possibly doing a few more checks? ** Changed in: linux (Ubuntu) Importance: Undecided => High ** Changed in: linux (Ubuntu) Status: New => Confirmed ** Changed in: linux (Ubuntu) Assignee: (unassigned) => Krystian Kaniewski (kkaniewski) -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2161495 Title: Dell Lattitude 7400 + 7.0.0-28-generic Status in linux package in Ubuntu: Confirmed Bug description: Hello. Running a Dell Latitude 7400. Internal display becomes dim when kernel 7.0.0-28-generic loads, despite backlight being at 100%. Kernel 7.0.0-14-generic works normally. Regression appeared after the first apt upgrade. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-14-generic 7.0.0-14.14 ProcVersionSignature: Ubuntu 7.0.0-14.14-generic 7.0.0 Uname: Linux 7.0.0-14-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: cavalier 3993 F.... wireplumber /dev/snd/seq: cavalier 3976 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Wed Jul 22 15:52:29 2026 InstallationDate: Installed on 2026-07-22 (0 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: Dell Inc. Latitude 7400 ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-14-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 03/06/2025 dmi.bios.release: 1.39 dmi.bios.vendor: Dell Inc. dmi.bios.version: 1.39.0 dmi.board.name: 07WDVW dmi.board.vendor: Dell Inc. dmi.board.version: A01 dmi.chassis.type: 10 dmi.chassis.vendor: Dell Inc. dmi.modalias: dmi:bvnDellInc.:bvr1.39.0:bd03/06/2025:br1.39:svnDellInc.:pnLatitude7400:pvr:rvnDellInc.:rn07WDVW:rvrA01:cvnDellInc.:ct10:cvr:sku08E1:pfaLatitude: dmi.product.family: Latitude dmi.product.name: Latitude 7400 dmi.product.sku: 08E1 dmi.sys.vendor: Dell Inc. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161495/+subscriptions

[Bug 2161448] Re: mt7921u: USB Wi-Fi enters unrecoverable state after prolonged uptime; NetworkManager/supplicant stalls followed by USB disconnect deadlock

** Changed in: linux (Ubuntu) Status: Incomplete => Confirmed -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2161448 Title: mt7921u: USB Wi-Fi enters unrecoverable state after prolonged uptime; NetworkManager/supplicant stalls followed by USB disconnect deadlock Status in linux package in Ubuntu: Confirmed Bug description: Netgear A8000 (MediaTek mt7921u/mt7922 USB) intermittently loses connectivity after many hours or overnight. The interface remains associated with the AP and retains a DHCP address, but no traffic passes. Symptoms: nmcli shows connected or attempts reconnection. Ping to the default gateway returns "Destination Host Unreachable". Kernel repeatedly logs: unregister_netdevice: waiting for wlx... to become free. Usage count = 2 Previous debugging showed tee blocked inside mt792xu_disconnect() during usb_unbind_interface(). Restarting sudo systemctl restart wpa_supplicant NetworkManager immediately restores connectivity without unplugging the adapter or rebooting. Additional observations USB runtime power management disabled (power/control=on) rfkill not blocked interface still exists during failure Wi-Fi PHY still present NetworkManager restart does not recover the severe failure USB unbind hangs Driver unload therefore cannot complete NOTE: I also have a 394 MB apport report. Would it be useful, or are the attached failure-time logs sufficient? --- ProblemType: Bug ApportVersion: 2.28.2-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: ysuhail 2853 F.... wireplumber /dev/snd/controlC0: ysuhail 2853 F.... wireplumber /dev/snd/seq: ysuhail 2851 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 24.04 InstallationDate: Installed on 2026-06-25 (28 days ago) InstallationMedia: Ubuntu-Server 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: ASUS System Product Name Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 nvidia-drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-28-generic root=UUID=8bb051d9-0961-4018-b123-40eba5aa4bdb ro nomodeset pcie_aspm=off loglevel=3 ProcVersionSignature: Ubuntu 7.0.0-28.28~24.04.1-generic 7.0.12 RelatedPackageVersions: linux-restricted-modules-7.0.0-28-generic N/A linux-backports-modules-7.0.0-28-generic N/A linux-firmware 20240318.git3b128b60-0ubuntu2.27 RfKill: 0: phy0: Wireless LAN Soft blocked: no Hard blocked: no Tags: noble Uname: Linux 7.0.0-28-generic x86_64 UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: adm cdrom dip lpadmin plugdev sudo users _MarkForUpload: True dmi.bios.date: 07/18/2025 dmi.bios.release: 12.3 dmi.bios.vendor: American Megatrends Inc. dmi.bios.version: 1203 dmi.board.asset.tag: Default string dmi.board.name: Pro WS WRX90E-SAGE SE dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: Rev 1.xx dmi.chassis.asset.tag: Default string dmi.chassis.type: 3 dmi.chassis.vendor: Default string dmi.chassis.version: Default string dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr1203:bd07/18/2025:br12.3:svnASUS:pnSystemProductName:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnProWSWRX90E-SAGESE:rvrRev1.xx:cvnDefaultstring:ct3:cvrDefaultstring:skuSKU:pfaTobefilledbyO.E.M.: dmi.product.family: To be filled by O.E.M. dmi.product.name: System Product Name dmi.product.sku: SKU dmi.product.version: System Version dmi.sys.vendor: ASUS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161448/+subscriptions

[Bug 1786013] Autopkgtest regression report (linux-restricted-modules-intel-iotg/5.15.0-1107.113)

All autopkgtests for the newly accepted linux-restricted-modules-intel-iotg (5.15.0-1107.113) for jammy have finished running. The following regressions have been reported in tests triggered by the package: nvidia-graphics-drivers-390/390.157-0ubuntu0.22.04.2 (armhf) nvidia-graphics-drivers-390/running (i386) nvidia-graphics-drivers-390/unknown (amd64) nvidia-graphics-drivers-418-server/418.226.00-0ubuntu5~0.22.04.1 (amd64) nvidia-graphics-drivers-450-server/450.248.02-0ubuntu0.22.04.1 (amd64) nvidia-graphics-drivers-470-server/470.256.02-0ubuntu0.22.04.1 (amd64) Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1]. https://ubuntu-archive-team.ubuntu.com/proposed- migration/jammy/update_excuses.html#linux-restricted-modules-intel-iotg [1] https://documentation.ubuntu.com/project/SRU/howto/autopkgtest- failure/ Thank you! -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/1786013 Title: Packaging resync Status in linux package in Ubuntu: Fix Released Status in linux-azure package in Ubuntu: Fix Released Status in linux-azure-edge package in Ubuntu: Fix Released Status in linux source package in Precise: Fix Released Status in linux-azure source package in Precise: Won't Fix Status in linux-azure-edge source package in Precise: Won't Fix Status in linux source package in Trusty: Fix Released Status in linux-azure source package in Trusty: Fix Released Status in linux-azure-edge source package in Trusty: Won't Fix Status in linux source package in Xenial: Fix Released Status in linux-azure source package in Xenial: Fix Released Status in linux-azure-edge source package in Xenial: Fix Released Status in linux source package in Bionic: Fix Released Status in linux-azure source package in Bionic: Fix Released Status in linux-azure-edge source package in Bionic: Fix Released Status in linux source package in Cosmic: Fix Released Status in linux-azure source package in Cosmic: Fix Released Status in linux-azure-edge source package in Cosmic: Won't Fix Status in linux source package in Disco: Fix Released Status in linux-azure source package in Disco: Fix Released Status in linux-azure-edge source package in Disco: Won't Fix Bug description: Ongoing packaging resyncs. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1786013/+subscriptions

[Bug 1786013] Autopkgtest regression report (linux-restricted-modules-aws-6.8/6.8.0-1061.64~22.04.1)

All autopkgtests for the newly accepted linux-restricted-modules-aws-6.8 (6.8.0-1061.64~22.04.1) for jammy have finished running. The following regressions have been reported in tests triggered by the package: nvidia-graphics-drivers-470-server/470.256.02-0ubuntu0.22.04.1 (amd64) Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1]. https://ubuntu-archive-team.ubuntu.com/proposed- migration/jammy/update_excuses.html#linux-restricted-modules-aws-6.8 [1] https://documentation.ubuntu.com/project/SRU/howto/autopkgtest- failure/ Thank you! -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/1786013 Title: Packaging resync Status in linux package in Ubuntu: Fix Released Status in linux-azure package in Ubuntu: Fix Released Status in linux-azure-edge package in Ubuntu: Fix Released Status in linux source package in Precise: Fix Released Status in linux-azure source package in Precise: Won't Fix Status in linux-azure-edge source package in Precise: Won't Fix Status in linux source package in Trusty: Fix Released Status in linux-azure source package in Trusty: Fix Released Status in linux-azure-edge source package in Trusty: Won't Fix Status in linux source package in Xenial: Fix Released Status in linux-azure source package in Xenial: Fix Released Status in linux-azure-edge source package in Xenial: Fix Released Status in linux source package in Bionic: Fix Released Status in linux-azure source package in Bionic: Fix Released Status in linux-azure-edge source package in Bionic: Fix Released Status in linux source package in Cosmic: Fix Released Status in linux-azure source package in Cosmic: Fix Released Status in linux-azure-edge source package in Cosmic: Won't Fix Status in linux source package in Disco: Fix Released Status in linux-azure source package in Disco: Fix Released Status in linux-azure-edge source package in Disco: Won't Fix Bug description: Ongoing packaging resyncs. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1786013/+subscriptions

[Bug 2161448] Re: mt7921u: USB Wi-Fi enters unrecoverable state after prolonged uptime; NetworkManager/supplicant stalls followed by USB disconnect deadlock

Actually for this kind of tests it's typically even better to have all out-of-tree drivers disabled, so as long as you can boot with any graphics, it should be fine and actually a preferred option. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2161448 Title: mt7921u: USB Wi-Fi enters unrecoverable state after prolonged uptime; NetworkManager/supplicant stalls followed by USB disconnect deadlock Status in linux package in Ubuntu: Confirmed Bug description: Netgear A8000 (MediaTek mt7921u/mt7922 USB) intermittently loses connectivity after many hours or overnight. The interface remains associated with the AP and retains a DHCP address, but no traffic passes. Symptoms: nmcli shows connected or attempts reconnection. Ping to the default gateway returns "Destination Host Unreachable". Kernel repeatedly logs: unregister_netdevice: waiting for wlx... to become free. Usage count = 2 Previous debugging showed tee blocked inside mt792xu_disconnect() during usb_unbind_interface(). Restarting sudo systemctl restart wpa_supplicant NetworkManager immediately restores connectivity without unplugging the adapter or rebooting. Additional observations USB runtime power management disabled (power/control=on) rfkill not blocked interface still exists during failure Wi-Fi PHY still present NetworkManager restart does not recover the severe failure USB unbind hangs Driver unload therefore cannot complete NOTE: I also have a 394 MB apport report. Would it be useful, or are the attached failure-time logs sufficient? --- ProblemType: Bug ApportVersion: 2.28.2-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC1: ysuhail 2853 F.... wireplumber /dev/snd/controlC0: ysuhail 2853 F.... wireplumber /dev/snd/seq: ysuhail 2851 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME DistroRelease: Ubuntu 24.04 InstallationDate: Installed on 2026-06-25 (28 days ago) InstallationMedia: Ubuntu-Server 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210) MachineType: ASUS System Product Name Package: linux (not installed) ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> ProcFB: 0 nvidia-drmdrmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-28-generic root=UUID=8bb051d9-0961-4018-b123-40eba5aa4bdb ro nomodeset pcie_aspm=off loglevel=3 ProcVersionSignature: Ubuntu 7.0.0-28.28~24.04.1-generic 7.0.12 RelatedPackageVersions: linux-restricted-modules-7.0.0-28-generic N/A linux-backports-modules-7.0.0-28-generic N/A linux-firmware 20240318.git3b128b60-0ubuntu2.27 RfKill: 0: phy0: Wireless LAN Soft blocked: no Hard blocked: no Tags: noble Uname: Linux 7.0.0-28-generic x86_64 UpgradeStatus: No upgrade log present (probably fresh install) UserGroups: adm cdrom dip lpadmin plugdev sudo users _MarkForUpload: True dmi.bios.date: 07/18/2025 dmi.bios.release: 12.3 dmi.bios.vendor: American Megatrends Inc. dmi.bios.version: 1203 dmi.board.asset.tag: Default string dmi.board.name: Pro WS WRX90E-SAGE SE dmi.board.vendor: ASUSTeK COMPUTER INC. dmi.board.version: Rev 1.xx dmi.chassis.asset.tag: Default string dmi.chassis.type: 3 dmi.chassis.vendor: Default string dmi.chassis.version: Default string dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr1203:bd07/18/2025:br12.3:svnASUS:pnSystemProductName:pvrSystemVersion:rvnASUSTeKCOMPUTERINC.:rnProWSWRX90E-SAGESE:rvrRev1.xx:cvnDefaultstring:ct3:cvrDefaultstring:skuSKU:pfaTobefilledbyO.E.M.: dmi.product.family: To be filled by O.E.M. dmi.product.name: System Product Name dmi.product.sku: SKU dmi.product.version: System Version dmi.sys.vendor: ASUS To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161448/+subscriptions

[Bug 2148638] Re: ubuntu 26.04 - When the NVME hard drives were hot-swapped, the OS reported an error and some of the drives were not recognized.

Hi Aaron, Attached is the latest test result, please help to investigate. Thanks a lot! Anyway, something needing to mention first: Due to our test machine resource allocation reason, we conduct this batch of tests on a light-configuration machine (same server, same firmware, but only NVME disks installed, much less other adapters being installed),and we found a little bit different symptoms from last batch: 1. The original (missing disks) issue could be reproduced (very possibly) only when re-plug the disk to a different slot location from where it is plugged. 2. There is no failure-to-shut-down, nor failure-to-reboot symptom found, after these hot-plugs iterations. ------------------------------------------------------------------------------- Below is the procedure that we perform this batch of tests and logs collection: 1.Use ipmitool to capture the serial console log from before the tests being started. 2.Add parameters to the GRUB configuration file vim /etc/default/grub log_buf_len=64M ignore_loglevel nvme.dyndbg=+p pci.dyndbg=+p vmd.dyndbg=+p 3.Enable Persistent Logging a.Create the journal logs persistent directory: sudo mkdir -p /var/log/journal b.Set the correct permissions: sudo chown root:systemd-journal /var/log/journal sudo chmod 2755 /var/log/journal c.Restart the journal service: sudo systemctl restart systemd-journald 4.reboot，Install the provided deb package: linux-image-7.1.0-rc4+_7.1.0~rc4-00098-gf4790477726f-43_Bmd64.deb 5. reboot uname -r to check the kernel version 6.Collect dmesg, lspci -vvv, lsblk, nvme list,journalctl -f,journalctl -f -u systemd-udevd, zip and name this set of log file as 1-config_B.before_unplug.log 7.Test hot-plugging of VROC NVMe drives and collect logs. Note, please leave 120 seconds between each unplug / re-plug actions: a. unplug (slot1 2) b. Collect dmesg, lspci -vvv, lsblk, nvme list,journalctl -f,journalctl -f -u systemd-udevd, zip and name this set of log file as 2-config_B.after_unplug.log c. re-plug(slot1 2) d. Collect dmesg, lspci -vvv, lsblk, nvme list,journalctl -f,journalctl -f -u systemd-udevd, zip and name this set of log file as 3-config_B.after_replug.log e. unplug(slot1 2) f. Collect dmesg, lspci -vvv, lsblk, nvme list,journalctl -f,journalctl -f -u systemd-udevd, zip and name this set of log file as 4-config_B.after_unplug.log g. re-plug Other slot (slot3 4) h. Collect dmesg, lspci -vvv, lsblk, nvme list,journalctl -f,journalctl -f -u systemd-udevd, zip and name this set of log file as 5-config_B.after_replug.log i. unplug(slot3 4) j. Collect dmesg, lspci -vvv, lsblk, nvme list,journalctl -f,journalctl -f -u systemd-udevd, zip and name this set of log file as 6-config_B.after_unplug.log k. re-plug (slot1 2) l. Collect dmesg, lspci -vvv, lsblk, nvme list,journalctl -f,journalctl -f -u systemd-udevd, zip and name this set of log file as 7-config_B.after_replug.log 8. Reboot the system 9.Collect dmesg, lspci -vvv, lsblk, nvme list,journalctl -f,journalctl -f -u systemd-udevd, zip and name this set of log file as 8-config_B.after_reboot.log save serial log to config_B_2026_7_23.zip -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2148638 Title: ubuntu 26.04 - When the NVME hard drives were hot-swapped, the OS reported an error and some of the drives were not recognized. Status in linux package in Ubuntu: New Status in linux source package in Resolute: New Bug description: When the CD8P NVMe hard drives were hot-swapped, the OS reported an error and some of the drives were not recognized. This issue happens on CD8P NVMe disk and does not happens on bm1743 NVMe disk. CD8P drives are Kaoxia drives The BM1743 drives that work are Samsung devices. Nvme disk detail: CD8P https://lenovopress.lenovo.com/lp1904-thinksystem-cd8p-read-intensive-nvme-pcie-50-ssd bm1743 https://lenovopress.lenovo.com/lp2156-thinksystem-bm1743-read-intensive-nvme-pcie-50-x4-ssd Steps to reproduce: 1.In the UEFI, enable VMD without created RAID disk. 2.Install ubuntu26.04 on M.2 sata disk. 3.use command lsblk to check all NVMEe disk 4.Unplug all NVMe device, then check NVMe device information again via lsblk. 5.plug all NVMe SSD 6.OS reported an error and some of the drives were not recognized. Compare with Ubuntu 24.04: There is no errors messages and all NVMe disks can be recognized after re-plug all NVMe SSD Info: The issue also happens on latest daily build: 0415 This issue only happens on VMD enabled, there is no this issue when vmd feature disable. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2148638/+subscriptions

[Bug 2161575] Re: [regression] 7.0.0-28: eDP backlight stays off after resume on ThinkPad T480 (i915 selects DPCD/AUX backlight instead of native PWM)

** Description changed: **Package:** linux-image-generic-hwe-26.04 7.0.0-28.28 **Regression:** yes, 7.0.0-27.27 -> 7.0.0-28.28 **Tags:** `regression-update kernel-bug i915 suspend-resume backlight resolute` ## Summary After upgrading to kernel 7.0.0-28, the internal display backlight does not come on when resuming from suspend. The machine is running after resume (it accepted a blind `sudo reboot` typed at the dark screen), but the backlight stays off. Increasing brightness with the brightness keys does not bring it on. The panel is still driving an image: screen contents are legible under a bright external light. The failure is therefore confined to the backlight, not a modeset or output failure. Booting 7.0.0-27 avoids the problem. Booting 7.0.0-28 with `i915.enable_dpcd_backlight=0` also avoids it. ## Hardware - **Machine:** Lenovo ThinkPad T480, machine type 20L6S0MD00 - **BIOS:** N24ET81W (1.56), 2025-09-06 - **GPU:** Intel Kaby Lake-R GT2 [UHD Graphics 620] `[8086:5917]` rev 07, subsystem `[17aa:225d]` (lspci reports "Lenovo ThinkPad T480 (20L5)") - **Panel:** LG Display LP140WF6-SPB7 on eDP-1 (model string read from EDID) - **OS:** Ubuntu 26.04 LTS (resolute) ## Steps to reproduce 1. Boot 7.0.0-28-generic with stock kernel parameters (`quiet splash`). 2. Suspend. The journal records `PM: suspend entry (deep)`. 3. Resume. **Expected:** display lights up. **Actual:** panel stays dark. Brightness keys do not recover it. ## Observed: max_brightness differs between the two kernels Measured on this machine: | Configuration | `max_brightness` | Resume | |---|---|---| | 7.0.0-27, stock cmdline | **1515** | works | | 7.0.0-28, stock cmdline | **1023** | backlight stays off | | 7.0.0-28 + `i915.enable_dpcd_backlight=0` | **1515** | works | `enable_dpcd_backlight` reads `-1` (the default) on 7.0.0-28 when the failure occurs. *Interpretation, not measured:* 1023 is 10-bit full scale and 1515 is not a power-of-two boundary, which suggests the two kernels are driving the backlight through different control paths, and that the parameter selects between them. I have not confirmed from the driver which path is active in either case. That inference rests only on the `max_brightness` values and on the parameter changing the outcome. ## The failure is silent No errors or warnings related to the failure appear in the journal for the affected boots. `PM: suspend exit` completes, and i915 and mei_hdcp rebind. Backlight sysfs during the failure, with the panel dark: ``` /sys/class/backlight/intel_backlight/brightness 1023 /sys/class/backlight/intel_backlight/actual_brightness 1023 /sys/class/backlight/intel_backlight/max_brightness 1023 /sys/class/backlight/intel_backlight/bl_power 0 ``` `/var/lib/systemd/backlight/pci-0000:00:02.0:backlight:intel_backlight` contained `1023`, so the saved brightness value was not lost or zeroed. ## Regression range `linux-image-generic-hwe-26.04` was upgraded 7.0.0-27.27 -> 7.0.0-28.28 on **2026-07-19 18:38 (UTC+1)**, unattended via packagekit (`Commandline: packagekit role='update-packages'` in `/var/log/apt/history.log`). 7.0.0-28 first booted 2026-07-22 15:14. The three-day gap is why the update was not initially suspected. From `journalctl --list-boots` and suspend entries per boot: | Kernel | Boots | Suspend entries | Outcome | |---|---|---|---| | 7.0.0-27 | 2 | 63 | boots lasted days, spanning many resumes | | 7.0.0-28 | 3 | 4 | each boot ended 39s to 2min after its first resume | - The short sessions on 7.0.0-28 end in clean systemd shutdowns, from the - machine being rebooted blind at a dark screen. + The short sessions on 7.0.0-28 end because the machine was rebooted + blind at a dark screen. ## Workaround Add to `GRUB_CMDLINE_LINUX_DEFAULT` in `/etc/default/grub`, then `update-grub`: ``` i915.enable_dpcd_backlight=0 ``` `max_brightness` returns to 1515 and resume works. Confirmed working after this change. I have not yet run an extended soak of many suspend cycles. ## Checked and excluded - **Not `systemd-backlight` save/restore:** the saved value was intact and sysfs read back at maximum while the panel was dark. - **Not local misconfiguration:** no i915 module parameters set, no backlight-related files in `/etc/modprobe.d`, and the cmdline was stock `quiet splash` before the workaround was added. - **A userspace resume hook did not help:** an `/etc/systemd/system-sleep/` hook that cycled `bl_power` 4 to 0 and rewrote `brightness` on resume did not light the panel. Caveat: I did not independently confirm the hook executed on resume, so this is weaker evidence than the rest of this report. ## Not verified Listing these so they are not read into the report: - Which backlight control path the driver actually selects in either kernel. - Whether the machine is network-reachable while the screen is dark. - The specific upstream commit responsible. I did not bisect, and the shipped `linux-image-7.0.0-28-generic` changelog contains only packaging entries, so I could not identify a candidate change from the package itself. ## Possibly related prior art There is a history of this general symptom with DPCD/AUX backlight on i915. A commit adding a heuristic to choose automatically between AUX and PWM brightness control was reverted upstream after reportedly causing "enabling DPCD backlight leads to a black screen after suspend/resume": https://www.mail-archive.com/intel- gfx@lists.freedesktop.org/msg126115.html That report concerns different and much older hardware (a ThinkPad X1 Carbon 4th Gen and BXT-P), and predates this kernel by many releases. I offer it only as a pointer to a known failure mode in this area, not as a claim about the cause here. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic 7.0.0-28.28 ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 AudioDevicesInUse: - USER PID ACCESS COMMAND - /dev/snd/controlC0: sam 3370 F.... pipewire - sam 3389 F.... wireplumber - /dev/snd/pcmC0D0p: sam 3370 F...m pipewire - /dev/snd/seq: sam 3370 F.... pipewire +  USER PID ACCESS COMMAND +  /dev/snd/controlC0: sam 3370 F.... pipewire +                       sam 3389 F.... wireplumber +  /dev/snd/pcmC0D0p: sam 3370 F...m pipewire +  /dev/snd/seq: sam 3370 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: KDE Date: Wed Jul 22 22:51:57 2026 InstallationDate: Installed on 2026-02-13 (159 days ago) InstallationMedia: Ubuntu 24.04.1 LTS "Noble Numbat" - Release amd64 (20240827.1) MachineType: LENOVO 20L6S0MD00 ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-28-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M i915.enable_dpcd_backlight=0 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-07-09 (13 days ago) dmi.bios.date: 09/06/2025 dmi.bios.release: 1.56 dmi.bios.vendor: LENOVO dmi.bios.version: N24ET81W (1.56 ) dmi.board.asset.tag: Not Available dmi.board.name: 20L6S0MD00 dmi.board.vendor: LENOVO dmi.board.version: SDK0J40700 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.22 dmi.modalias: dmi:bvnLENOVO:bvrN24ET81W(1.56):bd09/06/2025:br1.56:efr1.22:svnLENOVO:pn20L6S0MD00:pvrThinkPadT480:rvnLENOVO:rn20L6S0MD00:rvrSDK0J40700WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_20L6_BU_Think_FM_ThinkPadT480:pfaThinkPadT480: dmi.product.family: ThinkPad T480 dmi.product.name: 20L6S0MD00 dmi.product.sku: LENOVO_MT_20L6_BU_Think_FM_ThinkPad T480 dmi.product.version: ThinkPad T480 dmi.sys.vendor: LENOVO ** Description changed: **Package:** linux-image-generic-hwe-26.04 7.0.0-28.28 **Regression:** yes, 7.0.0-27.27 -> 7.0.0-28.28 **Tags:** `regression-update kernel-bug i915 suspend-resume backlight resolute` ## Summary After upgrading to kernel 7.0.0-28, the internal display backlight does not come on when resuming from suspend. The machine is running after resume (it accepted a blind `sudo reboot` typed at the dark screen), but the backlight stays off. Increasing brightness with the brightness keys does not bring it on. The panel is still driving an image: screen contents are legible under a bright external light. The failure is therefore confined to the backlight, not a modeset or output failure. Booting 7.0.0-27 avoids the problem. Booting 7.0.0-28 with `i915.enable_dpcd_backlight=0` also avoids it. ## Hardware - **Machine:** Lenovo ThinkPad T480, machine type 20L6S0MD00 - **BIOS:** N24ET81W (1.56), 2025-09-06 - **GPU:** Intel Kaby Lake-R GT2 [UHD Graphics 620] `[8086:5917]` rev 07, subsystem `[17aa:225d]` (lspci reports "Lenovo ThinkPad T480 (20L5)") - **Panel:** LG Display LP140WF6-SPB7 on eDP-1 (model string read from EDID) - **OS:** Ubuntu 26.04 LTS (resolute) ## Steps to reproduce 1. Boot 7.0.0-28-generic with stock kernel parameters (`quiet splash`). 2. Suspend. The journal records `PM: suspend entry (deep)`. 3. Resume. **Expected:** display lights up. **Actual:** panel stays dark. Brightness keys do not recover it. ## Observed: max_brightness differs between the two kernels Measured on this machine: | Configuration | `max_brightness` | Resume | |---|---|---| | 7.0.0-27, stock cmdline | **1515** | works | | 7.0.0-28, stock cmdline | **1023** | backlight stays off | | 7.0.0-28 + `i915.enable_dpcd_backlight=0` | **1515** | works | `enable_dpcd_backlight` reads `-1` (the default) on 7.0.0-28 when the failure occurs. *Interpretation, not measured:* 1023 is 10-bit full scale and 1515 is not a power-of-two boundary, which suggests the two kernels are driving the backlight through different control paths, and that the parameter selects between them. I have not confirmed from the driver which path is active in either case. That inference rests only on the `max_brightness` values and on the parameter changing the outcome. ## The failure is silent No errors or warnings related to the failure appear in the journal for the affected boots. `PM: suspend exit` completes, and i915 and mei_hdcp rebind. Backlight sysfs during the failure, with the panel dark: ``` /sys/class/backlight/intel_backlight/brightness 1023 /sys/class/backlight/intel_backlight/actual_brightness 1023 /sys/class/backlight/intel_backlight/max_brightness 1023 /sys/class/backlight/intel_backlight/bl_power 0 ``` `/var/lib/systemd/backlight/pci-0000:00:02.0:backlight:intel_backlight` contained `1023`, so the saved brightness value was not lost or zeroed. ## Regression range `linux-image-generic-hwe-26.04` was upgraded 7.0.0-27.27 -> 7.0.0-28.28 on **2026-07-19 18:38 (UTC+1)**, unattended via packagekit (`Commandline: packagekit role='update-packages'` in `/var/log/apt/history.log`). 7.0.0-28 first booted 2026-07-22 15:14. The three-day gap is why the update was not initially suspected. From `journalctl --list-boots` and suspend entries per boot: | Kernel | Boots | Suspend entries | Outcome | |---|---|---|---| | 7.0.0-27 | 2 | 63 | boots lasted days, spanning many resumes | | 7.0.0-28 | 3 | 4 | each boot ended 39s to 2min after its first resume | The short sessions on 7.0.0-28 end because the machine was rebooted blind at a dark screen. ## Workaround Add to `GRUB_CMDLINE_LINUX_DEFAULT` in `/etc/default/grub`, then `update-grub`: ``` i915.enable_dpcd_backlight=0 ``` `max_brightness` returns to 1515 and resume works. Confirmed working after this change. I have not yet run an extended soak of many suspend cycles. ## Checked and excluded - **Not `systemd-backlight` save/restore:** the saved value was intact and sysfs read back at maximum while the panel was dark. - **Not local misconfiguration:** no i915 module parameters set, no backlight-related files in `/etc/modprobe.d`, and the cmdline was stock `quiet splash` before the workaround was added. - **A userspace resume hook did not help:** an `/etc/systemd/system-sleep/` hook that cycled `bl_power` 4 to 0 and rewrote `brightness` on resume did not light the panel. Caveat: I did not independently confirm the hook executed on resume, so this is weaker evidence than the rest of this report. ## Not verified Listing these so they are not read into the report: - Which backlight control path the driver actually selects in either kernel. - - Whether the machine is network-reachable while the screen is dark. - The specific upstream commit responsible. I did not bisect, and the shipped `linux-image-7.0.0-28-generic` changelog contains only packaging entries, so I could not identify a candidate change from the package itself. ## Possibly related prior art There is a history of this general symptom with DPCD/AUX backlight on i915. A commit adding a heuristic to choose automatically between AUX and PWM brightness control was reverted upstream after reportedly causing "enabling DPCD backlight leads to a black screen after suspend/resume": https://www.mail-archive.com/intel- gfx@lists.freedesktop.org/msg126115.html That report concerns different and much older hardware (a ThinkPad X1 Carbon 4th Gen and BXT-P), and predates this kernel by many releases. I offer it only as a pointer to a known failure mode in this area, not as a claim about the cause here. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic 7.0.0-28.28 ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 AudioDevicesInUse:  USER PID ACCESS COMMAND  /dev/snd/controlC0: sam 3370 F.... pipewire                       sam 3389 F.... wireplumber  /dev/snd/pcmC0D0p: sam 3370 F...m pipewire  /dev/snd/seq: sam 3370 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: KDE Date: Wed Jul 22 22:51:57 2026 InstallationDate: Installed on 2026-02-13 (159 days ago) InstallationMedia: Ubuntu 24.04.1 LTS "Noble Numbat" - Release amd64 (20240827.1) MachineType: LENOVO 20L6S0MD00 ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-28-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M i915.enable_dpcd_backlight=0 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-07-09 (13 days ago) dmi.bios.date: 09/06/2025 dmi.bios.release: 1.56 dmi.bios.vendor: LENOVO dmi.bios.version: N24ET81W (1.56 ) dmi.board.asset.tag: Not Available dmi.board.name: 20L6S0MD00 dmi.board.vendor: LENOVO dmi.board.version: SDK0J40700 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.22 dmi.modalias: dmi:bvnLENOVO:bvrN24ET81W(1.56):bd09/06/2025:br1.56:efr1.22:svnLENOVO:pn20L6S0MD00:pvrThinkPadT480:rvnLENOVO:rn20L6S0MD00:rvrSDK0J40700WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_20L6_BU_Think_FM_ThinkPadT480:pfaThinkPadT480: dmi.product.family: ThinkPad T480 dmi.product.name: 20L6S0MD00 dmi.product.sku: LENOVO_MT_20L6_BU_Think_FM_ThinkPad T480 dmi.product.version: ThinkPad T480 dmi.sys.vendor: LENOVO ** Description changed: **Package:** linux-image-generic-hwe-26.04 7.0.0-28.28 **Regression:** yes, 7.0.0-27.27 -> 7.0.0-28.28 **Tags:** `regression-update kernel-bug i915 suspend-resume backlight resolute` ## Summary After upgrading to kernel 7.0.0-28, the internal display backlight does not come on when resuming from suspend. The machine is running after resume (it accepted a blind `sudo reboot` typed at the dark screen), but the backlight stays off. Increasing brightness with the brightness keys does not bring it on. The panel is still driving an image: screen contents are legible under a bright external light. The failure is therefore confined to the backlight, not a modeset or output failure. Booting 7.0.0-27 avoids the problem. Booting 7.0.0-28 with `i915.enable_dpcd_backlight=0` also avoids it. ## Hardware - **Machine:** Lenovo ThinkPad T480, machine type 20L6S0MD00 - **BIOS:** N24ET81W (1.56), 2025-09-06 - **GPU:** Intel Kaby Lake-R GT2 [UHD Graphics 620] `[8086:5917]` rev 07, subsystem `[17aa:225d]` (lspci reports "Lenovo ThinkPad T480 (20L5)") - **Panel:** LG Display LP140WF6-SPB7 on eDP-1 (model string read from EDID) - **OS:** Ubuntu 26.04 LTS (resolute) ## Steps to reproduce 1. Boot 7.0.0-28-generic with stock kernel parameters (`quiet splash`). 2. Suspend. The journal records `PM: suspend entry (deep)`. 3. Resume. **Expected:** display lights up. **Actual:** panel stays dark. Brightness keys do not recover it. ## Observed: max_brightness differs between the two kernels Measured on this machine: - | Configuration | `max_brightness` | Resume | - |---|---|---| - | 7.0.0-27, stock cmdline | **1515** | works | - | 7.0.0-28, stock cmdline | **1023** | backlight stays off | - | 7.0.0-28 + `i915.enable_dpcd_backlight=0` | **1515** | works | + | Configuration | `max_brightness` | Resume | + |-------------------------------------------|------------------|--------| + | 7.0.0-27, stock cmdline | **1515** | works | + | 7.0.0-28, stock cmdline | **1023** | backlight off | + | 7.0.0-28 + `i915.enable_dpcd_backlight=0` | **1515** | works | `enable_dpcd_backlight` reads `-1` (the default) on 7.0.0-28 when the failure occurs. *Interpretation, not measured:* 1023 is 10-bit full scale and 1515 is not a power-of-two boundary, which suggests the two kernels are driving the backlight through different control paths, and that the parameter selects between them. I have not confirmed from the driver which path is active in either case. That inference rests only on the `max_brightness` values and on the parameter changing the outcome. ## The failure is silent No errors or warnings related to the failure appear in the journal for the affected boots. `PM: suspend exit` completes, and i915 and mei_hdcp rebind. Backlight sysfs during the failure, with the panel dark: ``` /sys/class/backlight/intel_backlight/brightness 1023 /sys/class/backlight/intel_backlight/actual_brightness 1023 /sys/class/backlight/intel_backlight/max_brightness 1023 /sys/class/backlight/intel_backlight/bl_power 0 ``` `/var/lib/systemd/backlight/pci-0000:00:02.0:backlight:intel_backlight` contained `1023`, so the saved brightness value was not lost or zeroed. ## Regression range `linux-image-generic-hwe-26.04` was upgraded 7.0.0-27.27 -> 7.0.0-28.28 on **2026-07-19 18:38 (UTC+1)**, unattended via packagekit (`Commandline: packagekit role='update-packages'` in `/var/log/apt/history.log`). 7.0.0-28 first booted 2026-07-22 15:14. The three-day gap is why the update was not initially suspected. From `journalctl --list-boots` and suspend entries per boot: - | Kernel | Boots | Suspend entries | Outcome | - |---|---|---|---| - | 7.0.0-27 | 2 | 63 | boots lasted days, spanning many resumes | - | 7.0.0-28 | 3 | 4 | each boot ended 39s to 2min after its first resume | + | Kernel | Boots | Suspends | Outcome | + |----------|-------|----------|------------------------------------------| + | 7.0.0-27 | 2 | 63 | boots lasted days, spanning many resumes | + | 7.0.0-28 | 3 | 4 | restart 39s to 2min after first resume | The short sessions on 7.0.0-28 end because the machine was rebooted blind at a dark screen. ## Workaround Add to `GRUB_CMDLINE_LINUX_DEFAULT` in `/etc/default/grub`, then `update-grub`: ``` i915.enable_dpcd_backlight=0 ``` `max_brightness` returns to 1515 and resume works. Confirmed working after this change. I have not yet run an extended soak of many suspend cycles. ## Checked and excluded - **Not `systemd-backlight` save/restore:** the saved value was intact and sysfs read back at maximum while the panel was dark. - **Not local misconfiguration:** no i915 module parameters set, no backlight-related files in `/etc/modprobe.d`, and the cmdline was stock `quiet splash` before the workaround was added. - **A userspace resume hook did not help:** an `/etc/systemd/system-sleep/` hook that cycled `bl_power` 4 to 0 and rewrote `brightness` on resume did not light the panel. Caveat: I did not independently confirm the hook executed on resume, so this is weaker evidence than the rest of this report. ## Not verified Listing these so they are not read into the report: - Which backlight control path the driver actually selects in either kernel. - The specific upstream commit responsible. I did not bisect, and the shipped `linux-image-7.0.0-28-generic` changelog contains only packaging entries, so I could not identify a candidate change from the package itself. ## Possibly related prior art There is a history of this general symptom with DPCD/AUX backlight on i915. A commit adding a heuristic to choose automatically between AUX and PWM brightness control was reverted upstream after reportedly causing "enabling DPCD backlight leads to a black screen after suspend/resume": https://www.mail-archive.com/intel- gfx@lists.freedesktop.org/msg126115.html That report concerns different and much older hardware (a ThinkPad X1 Carbon 4th Gen and BXT-P), and predates this kernel by many releases. I offer it only as a pointer to a known failure mode in this area, not as a claim about the cause here. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic 7.0.0-28.28 ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 AudioDevicesInUse:  USER PID ACCESS COMMAND  /dev/snd/controlC0: sam 3370 F.... pipewire                       sam 3389 F.... wireplumber  /dev/snd/pcmC0D0p: sam 3370 F...m pipewire  /dev/snd/seq: sam 3370 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: KDE Date: Wed Jul 22 22:51:57 2026 InstallationDate: Installed on 2026-02-13 (159 days ago) InstallationMedia: Ubuntu 24.04.1 LTS "Noble Numbat" - Release amd64 (20240827.1) MachineType: LENOVO 20L6S0MD00 ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-28-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M i915.enable_dpcd_backlight=0 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-07-09 (13 days ago) dmi.bios.date: 09/06/2025 dmi.bios.release: 1.56 dmi.bios.vendor: LENOVO dmi.bios.version: N24ET81W (1.56 ) dmi.board.asset.tag: Not Available dmi.board.name: 20L6S0MD00 dmi.board.vendor: LENOVO dmi.board.version: SDK0J40700 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.22 dmi.modalias: dmi:bvnLENOVO:bvrN24ET81W(1.56):bd09/06/2025:br1.56:efr1.22:svnLENOVO:pn20L6S0MD00:pvrThinkPadT480:rvnLENOVO:rn20L6S0MD00:rvrSDK0J40700WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_20L6_BU_Think_FM_ThinkPadT480:pfaThinkPadT480: dmi.product.family: ThinkPad T480 dmi.product.name: 20L6S0MD00 dmi.product.sku: LENOVO_MT_20L6_BU_Think_FM_ThinkPad T480 dmi.product.version: ThinkPad T480 dmi.sys.vendor: LENOVO -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2161575 Title: [regression] 7.0.0-28: eDP backlight stays off after resume on ThinkPad T480 (i915 selects DPCD/AUX backlight instead of native PWM) Status in linux package in Ubuntu: New Bug description: **Package:** linux-image-generic-hwe-26.04 7.0.0-28.28 **Regression:** yes, 7.0.0-27.27 -> 7.0.0-28.28 **Tags:** `regression-update kernel-bug i915 suspend-resume backlight resolute` ## Summary After upgrading to kernel 7.0.0-28, the internal display backlight does not come on when resuming from suspend. The machine is running after resume (it accepted a blind `sudo reboot` typed at the dark screen), but the backlight stays off. Increasing brightness with the brightness keys does not bring it on. The panel is still driving an image: screen contents are legible under a bright external light. The failure is therefore confined to the backlight, not a modeset or output failure. Booting 7.0.0-27 avoids the problem. Booting 7.0.0-28 with `i915.enable_dpcd_backlight=0` also avoids it. ## Hardware - **Machine:** Lenovo ThinkPad T480, machine type 20L6S0MD00 - **BIOS:** N24ET81W (1.56), 2025-09-06 - **GPU:** Intel Kaby Lake-R GT2 [UHD Graphics 620] `[8086:5917]` rev 07, subsystem `[17aa:225d]` (lspci reports "Lenovo ThinkPad T480 (20L5)") - **Panel:** LG Display LP140WF6-SPB7 on eDP-1 (model string read from EDID) - **OS:** Ubuntu 26.04 LTS (resolute) ## Steps to reproduce 1. Boot 7.0.0-28-generic with stock kernel parameters (`quiet splash`). 2. Suspend. The journal records `PM: suspend entry (deep)`. 3. Resume. **Expected:** display lights up. **Actual:** panel stays dark. Brightness keys do not recover it. ## Observed: max_brightness differs between the two kernels Measured on this machine: | Configuration | `max_brightness` | Resume | |-------------------------------------------|------------------|--------| | 7.0.0-27, stock cmdline | **1515** | works | | 7.0.0-28, stock cmdline | **1023** | backlight off | | 7.0.0-28 + `i915.enable_dpcd_backlight=0` | **1515** | works | `enable_dpcd_backlight` reads `-1` (the default) on 7.0.0-28 when the failure occurs. *Interpretation, not measured:* 1023 is 10-bit full scale and 1515 is not a power-of-two boundary, which suggests the two kernels are driving the backlight through different control paths, and that the parameter selects between them. I have not confirmed from the driver which path is active in either case. That inference rests only on the `max_brightness` values and on the parameter changing the outcome. ## The failure is silent No errors or warnings related to the failure appear in the journal for the affected boots. `PM: suspend exit` completes, and i915 and mei_hdcp rebind. Backlight sysfs during the failure, with the panel dark: ``` /sys/class/backlight/intel_backlight/brightness 1023 /sys/class/backlight/intel_backlight/actual_brightness 1023 /sys/class/backlight/intel_backlight/max_brightness 1023 /sys/class/backlight/intel_backlight/bl_power 0 ``` `/var/lib/systemd/backlight/pci-0000:00:02.0:backlight:intel_backlight` contained `1023`, so the saved brightness value was not lost or zeroed. ## Regression range `linux-image-generic-hwe-26.04` was upgraded 7.0.0-27.27 -> 7.0.0-28.28 on **2026-07-19 18:38 (UTC+1)**, unattended via packagekit (`Commandline: packagekit role='update-packages'` in `/var/log/apt/history.log`). 7.0.0-28 first booted 2026-07-22 15:14. The three-day gap is why the update was not initially suspected. From `journalctl --list-boots` and suspend entries per boot: | Kernel | Boots | Suspends | Outcome | |----------|-------|----------|------------------------------------------| | 7.0.0-27 | 2 | 63 | boots lasted days, spanning many resumes | | 7.0.0-28 | 3 | 4 | restart 39s to 2min after first resume | The short sessions on 7.0.0-28 end because the machine was rebooted blind at a dark screen. ## Workaround Add to `GRUB_CMDLINE_LINUX_DEFAULT` in `/etc/default/grub`, then `update-grub`: ``` i915.enable_dpcd_backlight=0 ``` `max_brightness` returns to 1515 and resume works. Confirmed working after this change. I have not yet run an extended soak of many suspend cycles. ## Checked and excluded - **Not `systemd-backlight` save/restore:** the saved value was intact and sysfs read back at maximum while the panel was dark. - **Not local misconfiguration:** no i915 module parameters set, no backlight-related files in `/etc/modprobe.d`, and the cmdline was stock `quiet splash` before the workaround was added. - **A userspace resume hook did not help:** an `/etc/systemd/system-sleep/` hook that cycled `bl_power` 4 to 0 and rewrote `brightness` on resume did not light the panel. Caveat: I did not independently confirm the hook executed on resume, so this is weaker evidence than the rest of this report. ## Not verified Listing these so they are not read into the report: - Which backlight control path the driver actually selects in either kernel. - The specific upstream commit responsible. I did not bisect, and the shipped `linux-image-7.0.0-28-generic` changelog contains only packaging entries, so I could not identify a candidate change from the package itself. ## Possibly related prior art There is a history of this general symptom with DPCD/AUX backlight on i915. A commit adding a heuristic to choose automatically between AUX and PWM brightness control was reverted upstream after reportedly causing "enabling DPCD backlight leads to a black screen after suspend/resume": https://www.mail-archive.com/intel- gfx@lists.freedesktop.org/msg126115.html That report concerns different and much older hardware (a ThinkPad X1 Carbon 4th Gen and BXT-P), and predates this kernel by many releases. I offer it only as a pointer to a known failure mode in this area, not as a claim about the cause here. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-28-generic 7.0.0-28.28 ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12 Uname: Linux 7.0.0-28-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 AudioDevicesInUse:  USER PID ACCESS COMMAND  /dev/snd/controlC0: sam 3370 F.... pipewire                       sam 3389 F.... wireplumber  /dev/snd/pcmC0D0p: sam 3370 F...m pipewire  /dev/snd/seq: sam 3370 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: KDE Date: Wed Jul 22 22:51:57 2026 InstallationDate: Installed on 2026-02-13 (159 days ago) InstallationMedia: Ubuntu 24.04.1 LTS "Noble Numbat" - Release amd64 (20240827.1) MachineType: LENOVO 20L6S0MD00 ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-28-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M i915.enable_dpcd_backlight=0 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-07-09 (13 days ago) dmi.bios.date: 09/06/2025 dmi.bios.release: 1.56 dmi.bios.vendor: LENOVO dmi.bios.version: N24ET81W (1.56 ) dmi.board.asset.tag: Not Available dmi.board.name: 20L6S0MD00 dmi.board.vendor: LENOVO dmi.board.version: SDK0J40700 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.22 dmi.modalias: dmi:bvnLENOVO:bvrN24ET81W(1.56):bd09/06/2025:br1.56:efr1.22:svnLENOVO:pn20L6S0MD00:pvrThinkPadT480:rvnLENOVO:rn20L6S0MD00:rvrSDK0J40700WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_20L6_BU_Think_FM_ThinkPadT480:pfaThinkPadT480: dmi.product.family: ThinkPad T480 dmi.product.name: 20L6S0MD00 dmi.product.sku: LENOVO_MT_20L6_BU_Think_FM_ThinkPad T480 dmi.product.version: ThinkPad T480 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161575/+subscriptions

[Bug 2158920] Re: noble-stable-2026-06-16 dropped a bracket causing FTBFS

This bug was fixed in the package linux-azure - 6.8.0-1063.71 --------------- linux-azure (6.8.0-1063.71) noble; urgency=medium * noble/linux-azure: 6.8.0-1063.71 -proposed tracker (LP: #2157417) * Packaging resync (LP: #1786013) - [Packaging] debian.azure/dkms-versions -- update from kernel-versions (main/2026.06.22) * Add intel-speed-select to linux-tools-$(uname -r) (LP: #2131077) - [Packaging] azure: Add intel-speed-select to linux-tools * noble-stable-2026-06-16 dropped a bracket causing FTBFS (LP: #2158920) - SAUCE: Fix bracket drop FTBFS for Azure kernels * azure: backport "net: mana: validate rx_req_idx to prevent out-of-bounds array access" (LP: #2157545) - net: mana: validate rx_req_idx to prevent out-of-bounds array access * Fix MANA RX queue creation/error-cleanup path issues when RXQ initialization fails partway through (LP: #2156920) - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() - net: mana: Skip WQ object destruction for uninitialized RXQ - net: mana: remove double CQ cleanup in mana_create_rxq error path * net: mana: Avoid queue struct allocation failure under memory fragmentation (LP: #2155434) - net: mana: Use kvmalloc for large RX queue and buffer allocations - net: mana: Use per-queue allocation for tx_qp to reduce allocation size * [hyperv] Ensure MMIO Mapping is Correct for Kexec / kdump kernel on Azure v6 Instance Types (LP: #2155222) - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs * net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (LP: #2156472) - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer * Hairpinning Issue on AKS with Latest Linux Stable Kernels (LP: #2070072) - SAUCE: Revert "netfilter: br_netfilter: skip conntrack input hook for promisc packets" * Miscellaneous Ubuntu changes - [Config] azure: Reducing config to limited annotations [ Ubuntu: 6.8.0-136.136 ] * noble/linux: 6.8.0-136.136 -proposed tracker (LP: #2158930) * ext4: writeback causes kernel oops when low on space (LP: #2158377) - ext4: get rid of ppath in get_ext_path() * mount08 from ubuntu_ltp_syscalls failed - TFAIL: mount(/proc/139835/fd/4) succeeded (LP: #2137199) - proc: proc_readfd() -> proc_fd_iterate() - proc: proc_readfdinfo() -> proc_fdinfo_iterate() - proc: add proc_splice_unmountable() - proc: block mounting on top of /proc/<pid>/map_files/* - proc: block mounting on top of /proc/<pid>/fd/* - proc: block mounting on top of /proc/<pid>/fdinfo/* * Add intel-speed-select to linux-tools-$(uname -r) (LP: #2131077) - [Packaging] Add intel-speed-select to linux-tools * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) - blk-cgroup: wait for blkcg cleanup before initializing new disk - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - drbd: Balance RCU calls in drbd_adm_dump_devices() - loop: fix partition scan race between udev and loop_reread_partitions() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - pstore/ram: fix resource leak when ioremap() fails - ACPI: x86: cmos_rtc: Clean up address space handler driver - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - devres: fix missing node debug info in devm_krealloc() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: use generic driver_override infrastructure - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - hrtimers: Update the return type of enqueue_hrtimer() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Reduce trace noise in hrtimer_start() - locking: Fix rwlock support in <linux/spinlock_up.h> - firmware: dmi: Correct an indexing error in dmi.h - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - bpf: Add CHECKSUM_COMPLETE to bpf test progs - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - [Config] Adjust CONFIG_FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - params: Replace __modinit with __init_or_module - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - bpf, devmap: Remove unnecessary if check in for loop - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - r8152: fix incorrect register write to USB_UPHY_XTAL - powerpc/crash: fix backup region offset update to elfcorehdr - selftests/powerpc: Re-order *FLAGS to follow lib.mk - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - macvlan: annotate data-races around port->bc_queue_len_used - bpf: Fix stale offload->prog pointer after constant blinding - wifi: brcmfmac: Fix error pointer dereference - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - ACPI: AGDI: fix missing newline in error message - arm64: kexec: Remove duplicate allocation for trans_pgd - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: fix racing timeout handler - netfilter: xt_socket: enable defrag after all other checks - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - bpf: Fix RCU stall in bpf_fd_array_map_clear() - 6pack: propagage new tty types - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - net/rds: Optimize rds_ib_laddr_check - net/rds: Restrict use of RDS/IB to the initial network namespace - bpf: Fix OOB in pcpu_init_value - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - net: phy: move at803x PHY driver to dedicated directory - net: phy: qcom: at803x: Use the correct bit to disable extended next page - sctp: fix missing encap_port propagation for GSO fragments - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - drm/komeda: fix integer overflow in AFBC framebuffer size check - drm/sun4i: backend: fix error pointer dereference - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix concurrent write failure in passthrough mode - dm cache: support shrinking the origin device - dm cache: fix dirty mapping checking in passthrough mode switching - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache metadata: fix memory leak on metadata abort retry - dm log: fix out-of-bounds write due to region_count overflow - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/sun4i: Fix resource leaks - drm/amdgpu: Add default case in DVI mode validation - dm init: ensure device probing has finished in dm-mod.waitfor= - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - padata: Remove cpu online check from cpu add and removal - padata: Put CPU offline callback in ONLINE section to allow failure - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/msm/dpu: fix mismatch between power and frequency - drm/msm/dsi: add the missing parameter description - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - ALSA: core: Validate compress device numbers without dynamic minors - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - ASoC: SOF: Intel: hda: Place check before dereference - drm/msm/a6xx: Fix HLSQ register dumping - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Use barriers while updating HFI Q headers - pmdomain: ti: omap_prm: Fix a reference leak on device node - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: qcom: qdsp6: topology: check widget type before accessing data - crypto: qat - use swab32 macro - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - PCI: Enable AtomicOps only if Root Port supports them - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - selftests/mm: skip migration tests if NUMA is unavailable - Documentation: fix a hugetlbfs reservation statement - selftest: memcg: skip memcg_sock test if address family not supported - ALSA: scarlett2: Add missing sentinel initializer field - ASoC: SOF: compress: return the configured codec from get_params - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk- select" - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Use DWC IP core version - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - ALSA: sc6000: Use standard print API - ALSA: sc6000: Keep the programmed board state in card-private data - dm cache: fix missing return in invalidate_committed's error path - crypto: jitterentropy - replace long-held spinlock with mutex - gfs2: Call unlock_new_inode before d_instantiate - ktest: Avoid undef warning when WARNINGS_FILE is unset - ktest: Honor empty per-test option overrides - ktest: Run POST_KTEST hooks on failure and cancellation - quota: Fix race of dquot_scan_active() with quota deactivation - gfs2: add some missing log locking - gfs2: prevent NULL pointer dereference during unmount - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - arm64: dts: imx8-apalis: Fix LEDs name collision - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - iommufd: vfio compatibility extension check for noiommu mode - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - soc: qcom: ocmem: make the core clock optional - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - soc/tegra: cbb: Set ERD on resume for err interrupt - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - soc: qcom: llcc: fix v1 SB syndrome register offset - soc: qcom: aoss: compare against normalized cooling state - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64/xor: fix conflicting attributes for xor_block_template - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - ocfs2: fix listxattr handling when the buffer is full - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: cadence: Clear message complete before signaling waiting thread - tracing: Rebuild full_name on each hist_field_name() call - ima: check return value of crypto_shash_final() in boot aggregate - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: asus: do not abort probe when not necessary - mtd: physmap_of_gemini: Fix disabled pinctrl state check - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - HID: usbhid: fix deadlock in hid_post_reset() - bpf, arm64: Fix off-by-one in check_imm signed range check - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Take state lock for af_unix iter - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - perf branch: Avoid incrementing NULL - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - pinctrl: abx500: Fix type of 'argument' variable - perf lock: Fix option value type in parse_max_stack - perf expr: Return -EINVAL for syntax error in expr__find_ids() - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: change log level to dbg in irq callback - perf util: Kill die() prototype, dead for a long time - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - dev_printk: add new dev_err_probe() helpers - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - platform/surface: surfacepro3_button: Drop wakeup source on remove - leds: lgm-sso: Remove duplicate assignments for priv->mmap - tty: hvc_iucv: fix off-by-one in number of supported devices - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - RDMA/core: Prefer NLA_NUL_STRING - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - scsi: sg: Make sg_sysfs_class constant - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: target: core: Fix integer overflow in UNMAP bounds check - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx8mq: Correct the CSI PHY sels - clk: qoriq: avoid format string warning - clk: xgene: Fix mapping leak in xgene_pllclk_init() - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: qcom: dispcc-sc7180: Add missing MDSS resets - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: visconti: pll: initialize clk_init_data to zero - f2fs: Use sysfs_emit_at() to simplify code - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915/wm: Verify the correct plane DDB entry - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: ccp - copy IV using skcipher ivsize - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->plb_rehash - i40e: don't advertise IFF_SUPP_NOFCS - e1000e: Unroll PTP in probe error handling - ipv6: fix possible UAF in icmpv6_rcv() - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - pppoe: drop PFC frames - netfilter: nft_osf: restrict it to ipv4 - netfilter: conntrack: remove sprintf usage - netfilter: xtables: restrict several matches to inet family - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: add support for supplementary groups - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: scope conn->binding slowpath to bound sessions only - net/rds: zero per-item info buffer before handing it to visitors - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net: dsa: realtek: rtl8365mb: fix mode mask calculation - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - tipc: fix double-free in tipc_buf_append() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - fs/adfs: validate nzones in adfs_validate_bblk() - rtc: abx80x: Disable alarm feature if no interrupt attached - fbdev: offb: fix PCI device reference leak on probe failure - mailbox: mailbox-test: free channels on probe error - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: add sanity check for channel array - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - tracing: branch: Fix inverted check on stat tracer registration - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - nvme-pci: fix missed admin queue sq doorbell write - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: fix spelling typos - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: nf_conntrack_sip: don't use simple_strtoul - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - drm/sysfb: ofdrm: fix PCI device reference leaks - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - netdevsim: zero initialize struct iphdr in dummy sk_buff - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: check for negative latency and jitter - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - vrf: Fix a potential NPD when removing a port from a VRF - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - NFC: trf7970a: Ignore antenna noise when checking for RF field - neighbour: add RCU protection to neigh_tables[] - neigh: let neigh_xmit take skb ownership - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - net: mctp i2c: check length before marking flow active - net: phy: dp83869: fix setting CLK_O_SEL field. - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - ASoC: codecs: ab8500: Fix casting of private data - netfilter: skip recording stale or retransmitted INIT - sctp: discard stale INIT after handshake completion - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - net: netconsole: move newline trimming to function - netconsole: propagate device name truncation in dev_name_store() - ALSA: hda/conexant: fix some typos - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: Fix missing error check for jack detection - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Read EDID from VBIOS embedded panel info - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - net: bonding: add broadcast_neighbor option for 802.3ad - bonding: add support for per-port LACP actor priority - bonding: print churn state via netlink - bonding: 3ad: implement proper RCU rules for port->aggregator - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - ice: fix NULL pointer dereference in ice_reset_all_vfs() - net: tls: fix strparser anchor skb leak on offload RX setup failure - sfc: fix error code in efx_devlink_info_running_versions() - net/sched: cls_flower: revert unintended changes - smb: client: correctly handle ErrorContextData as a flexible array - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: fix leaking free_bds - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - netconsole: avoid out-of-bounds access on empty string in trim_newline() - bonding: fix NULL pointer dereference in actor_port_prio setting - crypto: af_alg - Cap AEAD AD length to 0x80000000 - i40e: Cleanup PTP pins on probe failure - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - netfilter: nf_conntrack_sip: get helper before allocating expectation - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nft_ct: fix missing expect put in obj eval - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: x86: Fix Xen hypercall tracepoint argument assignment - ASoC: SOF: Intel: hda-dai: remove dspless special case - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - smb/client: fix possible infinite loop and oob read in symlink_data() - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ceph: fix a buffer leak in __ceph_setxattr() - powerpc/warp: Fix error handling in pika_dtm_thread - netfs: fix error handling in netfs_extract_user_iter() - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: handle rbtree insertion error in decode_choose_args() - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - drm/i915: skip __i915_request_skip() for already signaled requests - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - smb: client: Use FullSessionKey for AES-256 encryption key derivation - btrfs: use inode already stored in local variable at btrfs_rmdir() - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fix rx timestamp corruption on fastopen - mptcp: pm: prio: skip closed subflows - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix false alarm of lockdep on cp_global_sem lock - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sifive: fix controller deregistration - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - io_uring/kbuf: use mem_is_zero() - md/raid1: fix the comparing region of interval tree - md: wake raid456 reshape waiters before suspend - btrfs: pass struct btrfs_inode to clone_copy_inline_extent() - btrfs: fix deadlock between reflink and transaction commit when using flushoncommit - bus: fsl-mc: use generic driver_override infrastructure - sparc/vdso: Always reject undefined references during linking - sparc64: vdso: Link with -z noexecstack - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() - wifi: mt76: mt7921: fix 6GHz regulatory update on connection - bpf: Fix variable length stack write over spilled pointers - wifi: ath10k: fix station lookup failure during disconnect - bpf: fix mm lifecycle in open-coded task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: return VMA snapshot from task_vma iterator - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec - ipv4: udp: fix typos in comments - ipv6: udp: fix typos in comments - udp: Force compute_score to always inline - PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs encoding - PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix() - PCI: dwc: Invoke post_init in dw_pcie_resume_noirq() - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq() - spi: spi-nxp-fspi: remove the goto in probe - spi: spi-nxp-fspi: enable runtime pm for fspi - spi: nxp-fspi: Use reinit_completion() for repeated operations - drm/v3d: Handle error from drm_sched_entity_init() - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation - drm/imagination: Switch reset_reason fields from enum to u32 - drm/msm/dsi: fix bits_per_pclk - drm/msm/dsi: fix hdisplay calculation for CMD mode panel - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support - drm/msm/a6xx: Fix dumping A650+ debugbus blocks - crypto: qat - introduce fuse array - crypto: qat - disable 4xxx AE cluster when lead engine is fused off - crypto: qat - disable 420xx AE cluster when lead engine is fused off - crypto: qat - fix type mismatch in RAS sysfs show functions - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode - PCI: tegra194: Free up Endpoint resources during remove() - arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon - arm64: dts: qcom: sm8650: Fix GIC_ITS range length - arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller - arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins - arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins - arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label - hte: tegra194: remove Kconfig dependency on Tegra194 SoC - [Config] Adjust CONFIG_HTE_TEGRA194 - cxl/pci: Check memdev driver binding status in cxl_reset_done() - ext4: fix possible null-ptr-deref in mbt_kunit_exit() - pinctrl: realtek: Fix function signature for config argument - perf maps: Fix copy_from that can break sorted by name order - platform/x86: asus-wmi: adjust screenpad power/brightness handling - platform/x86: asus-wmi: fix screenpad brightness range - tty: serial: ip22zilog: Fix section mispatch warning - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON - erofs: unify lcn as u64 for 32-bit platforms - net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE - ice: fix ICE_AQ_LINK_SPEED_M for 200G - net/mlx5: Fix HCA caps leak on notifier init failure - pwm: atmel-tcb: Cache clock rates and mark chip as atomic - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM - ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED - tcp: make probe0 timer handle expired user timeout - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi() - drm/xe/debugfs: Correct printing of register whitelist ranges - drm/xe/gsc: Fix BO leak on error in query_compatibility_version() - PCI: Initialize temporary device in new_id_store() - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - drm/loongson: Use managed KMS polling - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - drm/xe/dma-buf: handle empty bo and UAF races - btrfs: do not mark inode incompressible after inline attempt fails - tracing: Avoid NULL return from hist_field_name() on truncation - Upstream stable to v6.6.141, v6.12.91 * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-46117 - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-46137 - mptcp: pm: ADD_ADDR rtx: fix potential data-race * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-46160 - btrfs: fix missing last_unlink_trans update when removing a directory * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-46314 - drm/v3d: Reject empty multisync extension to prevent infinite loop * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-46274 - io-wq: check that the predecessor is hashed in io_wq_remove_pending() * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-31707 - ksmbd: validate response sizes in ipc_validate_msg() * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-46068 - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-31613 - smb: client: fix OOB reads parsing symlink error response * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-43245 - ntfs: ->d_compare() must not block * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45846 - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45845 - net/sched: taprio: fix NULL pointer dereference in class dump * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45844 - netfilter: arp_tables: fix IEEE1394 ARP payload parsing * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45843 - slip: bound decode() reads against the compressed packet length * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45842 - slip: reject VJ receive packets on instances with no rstate array * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45841 - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45840 - openvswitch: cap upcall PID array size and pre-size vport replies * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-46319 - net/sched: act_ct: Only release RCU read lock after ct_ft * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45839 - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() * Noble update: upstream stable patchset 2026-06-16 (LP: #2156956) // CVE-2026-45838 - bpf: fix end-of-list detection in cgroup_storage_get_next_key() * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) - regset: use kvzalloc() for regset_get_alloc() - selftests/bpf: validate fake register spill/fill precision backtracking logic - exit: Sleep at TASK_IDLE when waiting for application core dump - media: uvcvideo: Enable VB2_DMABUF for metadata stream - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - spi: bcm63xx: fix controller deregistration - spi: atmel: fix controller deregistration - regulator: mt6357: fix OF node reference imbalance - regulator: max77650: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - regulator: rk808: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - regulator: bd9571mwv: fix OF node reference imbalance - spi: lantiq-ssc: fix controller deregistration - spi: qup: fix controller deregistration - spi: at91-usart: fix controller deregistration - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: pci: zoran: fix potential memory leak in zoran_probe() - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: i2c: imx412: Assert reset GPIO during probe - media: staging: imx: request mbus_config in csi_start - media: i2c: ov08d10: fix image vertical start setting - media: omap3isp: drop the use count of v4l2 pipeline - spi: dln2: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: img-spfi: fix controller deregistration - spi: imx: fix runtime pm leak on probe deferral - spi: orion: fix runtime pm leak on unbind - spi: orion: fix clock imbalance on registration failure - spi: cadence: fix controller deregistration - spi: cadence: fix unclocked access on unbind - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdgpu/vce: Prevent partial address patches - drm/radeon: add missing revision check for CI - drm/amdgpu: zero-initialize GART table on allocation - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - ipmi:ssif: Fix a shutdown race - ALSA: hda: cs35l56: Propagate ASP TX source control errors - ALSA: misc: Use guard() for spin locks - ALSA: core: Serialize deferred fasync state checks - ALSA: seq: Notify client and port info changes - ALSA: seq: Fix UMP group 16 filtering - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: tegra20-sflash: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: fix controller deregistration - mm/hugetlb_cma: round up per_node before logging it - mm/damon/core: disallow time-quota setting zero esz - mm/damon/core: implement damon_kdamond_pid() - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - pwm: imx-tpm: Count the number of enabled channels in probe - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - tracing/probes: Limit size of event probe to 3K - usb: dwc3: Move GUID programming after PHY initialization - vsock/virtio: fix length and offset in tap skb for split packets - drm/amdgpu/vcn3: Avoid overflow on msg bound check - drm/amdgpu/vcn4: Avoid overflow on msg bound check - mtd: spi-nor: sst: Fix SST write failure - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() - media: chips-media: wave5: add missing spinlock protection for send_eos_event() - media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() - spi: st-ssc4: fix controller deregistration - spi: meson-spicc: fix controller deregistration - spi: aspeed-smc: fix controller deregistration - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy - spi: mxs: fix controller deregistration - spi: pic32: fix controller deregistration - spi: pl022: fix controller deregistration - spi: npcm-pspi: fix controller deregistration - spi: pic32-sqi: fix controller deregistration - spi: mxic: fix controller deregistration - spi: orion: fix controller deregistration - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. - drm/amdgpu: gate VM CPU HDP flush on reset lock - drm/amd/display: Change dither policy for 10 bpc output back to dithering - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() - drm/exynos: remove bridge when component_add fails - drm/amdkfd: Make all TLB-flushes heavy-weight - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() - Upstream stable to v6.6.140, v6.12.89, v6.12.90 * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46207 - vsock/virtio: fix empty payload in tap skb for non-linear buffers * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46164 - btrfs: fix double free in create_space_info_sub_group() error path * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46201 - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46211 - drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46200 - spi: mpc52xx: fix controller deregistration * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46241 - spi: mpc52xx: fix use-after-free on registration failure * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46214 - vsock/virtio: fix accept queue count leak on transport mismatch * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46234 - vsock: fix buffer size clamping order * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46159 - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46208 - batman-adv: stop tp_meter sessions during mesh teardown * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-23171 - bonding: fix use-after-free due to enslave fail after slave array update * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-45836 - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46191 - fbcon: Avoid OOB font access if console rotation fails * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46111 - Bluetooth: hci_conn: fix potential UAF in create_big_sync * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-45999 - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46044 - ipmi:ssif: Clean up kthread on errors * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46231 - batman-adv: bla: put backbone reference on failed claim hash insert * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46233 - batman-adv: bla: only purge non-released claims * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46212 - batman-adv: bla: prevent use-after-free when deleting claims * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46238 - batman-adv: stop caching unowned originator pointers in BAT IV * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46206 - batman-adv: reject new tp_meter sessions during teardown * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46198 - batman-adv: fix integer overflow on buff_pos * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46227 - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46220 - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46197 - drm/amdkfd: validate SVM ioctl nattr against buffer size * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46209 - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46230 - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46199 - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46204 - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46218 - drm/amdgpu: Add bounds checking to ib_{get,set}_value * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46229 - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46219 - spi: mpc52xx: fix use-after-free on unbind * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46225 - spi: rspi: fix controller deregistration * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46226 - spi: fsl: fix controller deregistration * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46235 - media: saa7164: add ioremap return checks and cleanups * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46312 - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46236 - media: rc: xbox_remote: heed DMA restrictions * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46205 - staging: media: atomisp: Disallow all private IOCTLs * Noble update: upstream stable patchset 2026-06-12 (LP: #2156619) // CVE-2026-46232 - HID: playstation: Clamp num_touch_reports * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) - xen/privcmd: fix double free via VMA splitting - Buffer overflow in drivers/xen/sys-hypervisor.c - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - ALSA: usb-audio: Evaluate packsize caps at the right place - driver core: Don't let a device probe until it's ready - firmware: google: framebuffer: Do not mark framebuffer as busy - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - device property: Make modifications of fwnode "flags" thread safe - um: drivers: call kernel_strrchr() explicitly in cow_user.c - Revert "ALSA: usb: Increase volume range that triggers a warning" - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - lib/ts_kmp: fix integer overflow in pattern length calculation - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - ALSA: aoa: i2sbus: fix OF node lifetime handling - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - parisc: _llseek syscall is only available for 32-bit userspace - sched: Use u64 for bandwidth ratio calculations - selftests/mqueue: Fix incorrectly named file - selftests/landlock: Fix format warning for __u64 in net_test - io_uring/timeout: check unused sqe fields - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/poll: fix signed comparison in io_poll_get_ownership() - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - ALSA: core: Fix potential data race at fasync handling - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: 6fire: Fix input volume change detection - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: pcmtest: Fix resource leaks in module init error paths - iio: adc: ad7768-1: fix one-shot mode data acquisition - tools/accounting: handle truncated taskstats netlink messages - arm64: dts: marvell: uDPU: add ethernet aliases - net: txgbe: fix firmware version check - net: ks8851: Avoid excess softirq scheduling - drm/arcpgu: fix device node leak - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - tpm: avoid -Wunused-but-set-variable - LoongArch: Show CPU vulnerabilites correctly - power: supply: axp288_charger: Do not cancel work before initializing it - randomize_kstack: Maintain kstack_offset per task - mmc: block: use single block write in retry - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - firmware: google: framebuffer: Do not unregister platform device - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - rename first/last to first_desc/last_desc - tpm: tpm_tis: add error logging for data transfer - tpm: tpm_tis: stop transmit if retries are exhausted - rtc: ntxec: fix OF node reference imbalance - mm/damon/core: use time_in_range_open() for damos quota window start - userfaultfd: allow registration of ranges below mmap_min_addr - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Always intercept VMMCALL when L2 is active - io_uring/poll: fix multishot recv missing EOF on wakeup race - perf annotate: Use jump__delete when freeing LoongArch jumps - mtd: spi-nor: sst: Fix write enable before AAI sequence - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 - check-uapi: link into shared objects - HID: apple: ensure the keyboard backlight is off if suspending - wifi: rtl8xxxu: fix potential use of uninitialized value - taskstats: set version in TGID exit notifications - apparmor: use target task's context in apparmor_getprocattr() - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - crypto: atmel-ecc - Release client on allocation failure - crypto: hisilicon - Fix dma_unmap_single() direction - IB/core: Fix zero dmac race in neighbor resolution - ktest: Fix the month in the name of the failure directory - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: use msleep instaed of schedule_timeout_interruptible() - ksmbd: replace connection list with hash table - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - ALSA: aoa: Use guard() for mutex locks - ALSA: aoa: i2sbus: clear stale prepared state - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - block: relax pgmap check in bio_add_page for compatible zone device pages - iio: frequency: admv1013: add dev variable - net: mctp: fix don't require received header reserved bits to be zero - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ACPI: scan: Use acpi_dev_put() in object add error paths - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: video: force native backlight on HP OMEN 16 (8A44) - iommufd: Fix a race with concurrent allocation and unmap - spi: rockchip: fix controller deregistration - ksmbd: rewrite stop_sessions() with restartable iteration - iommu/amd: Use atomic64_inc_return() in iommu.c - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - KVM: SVM: check validity of VMCB controls when returning from SMM - wifi: mt76: mt7925: fix incorrect length field in txpower command - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - ALSA: usb-audio: midi2: Restart output URBs on resume - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - USB: omap_udc: DMA: Don't enable burst 4 mode - USB: serial: option: add Telit Cinterion LE910Cx compositions - ALSA: firewire-tascam: Do not drop unread control events - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - xfrm: provide message size for XFRM_MSG_MAPPING - selinux: don't reserve xattr slot when we won't fill it - selinux: shrink critical section in sel_write_load() - selinux: prune /sys/fs/selinux/disable - LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read() - spi: syncuacer: fix controller deregistration - spi: sun4i: fix controller deregistration - spi: ti-qspi: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: zynqmp-gqspi: fix controller deregistration - staging: vme_user: fix root device leak on init failure - LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT - parisc: Fix IRQ leak in LASI driver - hwmon: (ltc2992) Clamp threshold writes to hardware range - hwmon: (ltc2992) Fix u32 overflow in power read path - clk: rk808: fix OF node reference imbalance - hwmon: (corsair-psu) Close HID device on probe errors - cifs: abort open_cached_dir if we don't request leases - cifs: change_conf needs to be called for session setup - extcon: ptn5150: handle pending IRQ events during system resume - gpio: of: clear OF_POPULATED on hog nodes in remove path - hv_sock: fix ARM64 support - spi: microchip-core-qspi: fix controller deregistration - udf: reject descriptors with oversized CRC length - thermal: core: Free thermal zone ID later during removal - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - spi: topcliff-pch: fix controller deregistration - clk: imx: imx8-acm: fix flags for acm clocks - cpuidle: powerpc: avoid double clear when breaking snooze - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - ASoC: fsl_easrc: fix comment typo - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: qcom: q6apm: remove child devices when apm is removed - dm: don't report warning when doing deferred remove - dm-verity-fec: correctly reject too-small FEC devices - dm-verity-fec: correctly reject too-small hash devices - lib/scatterlist: fix temp buffer in extract_user_to_sg() - nvme-apple: drop invalid put of admin queue reference count - openvswitch: vport: fix self-deadlock on release of tunnel ports - s390/debug: Reject zero-length input in debug_input_flush_fn() - PCI: Update saved_config_space upon resource assignment - PCI/AER: Clear only error bits in PCIe Device Status - PCI/AER: Stop ruling out unbound devices as error source - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage - power: supply: max17042: avoid overflow when determining health - mptcp: fastclose msk when linger time is 0 - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: sockopt: set timestamp flags on subflow socket, not msk - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS - LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software - LoongArch: KVM: Move unconditional delay into timer clear scenery - LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte() - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - fs: prepare for adding LSM blob to backing_file - dma-mapping: drop unneeded includes from dma-mapping.h - dma-mapping: add __dma_from_device_group_begin()/end() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - mtd: spinand: winbond: Declare the QE bit on W25NxxJW - gtp: disable BH before calling udp_tunnel_xmit_skb() - printk: add print_hex_dump_devel() - net: stmmac: avoid shadowing global buf_sz - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - wifi: mt76: mt7925: fix incorrect TLV length in CLC command - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - Upstream stable to v6.6.137, v6.6.138, v6.6.139, v6.12.85, v6.12.86, v6.12.87, v6.12.88 * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43490 - ksmbd: validate inherited ACE SID length * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46196 - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46110 - net: stmmac: Prevent NULL deref when RX memory exhausted * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46090 - ALSA: aloop: Fix peer runtime UAF during format-change stop * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46291 - crypto: caam - guard HMAC key hex dumps in hash_digest_key * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46299 - hfsplus: fix held lock freed on hfsplus_fill_super() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46169 - hfsplus: fix uninit-value by validating catalog record size * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45991 - udf: fix partition descriptor append bookkeeping * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46007 - hwmon: (powerz) Avoid cacheline sharing for DMA buffer * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46065 - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46194 - f2fs: fix node_cnt race between extent node destroy and writeback * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46168 - mptcp: fix scheduling with atomic in timestamp sockopt * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46189 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46133 - RDMA/rxe: Reject unknown opcodes before ICRC processing * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46114 - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46127 - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46176 - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46178 - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46145 - RDMA/mana: Validate rx_hash_key_len * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46126 - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46144 - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46121 - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46131 - KVM: x86: check for nEPT/nNPT in slow flush hypercalls * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46139 - smb: client: use kzalloc to zero-initialize security descriptor buffer * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46112 - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46292 - pmdomain: core: Fix detach procedure for virtual devices in genpd * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46304 - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46135 - nvmet-tcp: fix race between ICReq handling and queue teardown * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46161 - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43492 - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46124 - isofs: validate block number from NFS file handle in isofs_export_iget * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46303 - isofs: validate Rock Ridge CE continuation extent against volume size * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46106 - eventfs: Hold eventfs_mutex and SRCU when remount walks events * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46294 - dm: fix a buffer overflow in ioctl processing * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46107 - dm-thin: fix metadata refcount underflow * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46129 - btrfs: fix double free in create_space_info() error path * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46143 - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46293 - clk: microchip: mpfs-ccc: fix out of bounds access during output registration * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46301 - spi: topcliff-pch: fix use-after-free on unbind * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46273 - ibmveth: Disable GSO for packets with small MSS * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43495 - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43502 - net/rds: handle zerocopy send cleanup before the message is queued * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46120 - ip6_gre: Use cached t->net in ip6erspan_changelink(). * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46142 - net: libwx: fix VF illegal register access * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46184 - sound: ua101: fix division by zero at probe * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46132 - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46190 - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46150 - fanotify: fix false positive on permission events * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46296 - spi: s3c64xx: fix NULL-deref on driver unbind * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45834 - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45835 - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46138 - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46186 - Bluetooth: virtio_bt: validate rx pkt_type header length * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46123 - Bluetooth: virtio_bt: clamp rx length before skb_put * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46193 - xfrm: ah: account for ESN high bits in async callbacks * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46172 - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46116 - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46157 - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46146 - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46167 - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46151 - usb: usblp: fix heap leak in IEEE 1284 device ID via short response * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46180 - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46122 - wifi: b43: enforce bounds check on firmware key index in b43_rx() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46125 - wifi: mac80211: remove station if connection prep fails * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46307 - wifi: ath5k: do not access array OOB * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46187 - wifi: rsi: fix kthread lifetime race between self-exit and external-stop * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46152 - wifi: mac80211: drop stray 'static' from fast-RX rx_result * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46163 - wifi: b43legacy: enforce bounds check on firmware key index in RX path * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46136 - wifi: mt76: mt7921: fix a potential clc buffer length underflow * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46173 - exit: prevent preemption of oopsing TASK_DEAD task * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-31499 - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43496 - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43088 - net: af_key: zero aligned sockaddr tail in PF_KEY exports * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46287 - net: txgbe: fix RTNL assertion warning when remove module * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46306 - flow_dissector: do not dissect PPPoE PFC frames * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46113 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46063 - x86/shstk: Prevent deadlock during shstk sigreturn * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43109 - x86: shadow stacks: proper error handling for mmap lock * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46179 - ASoC: SOF: Don't allow pointer operations on unconfigured streams * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43497 - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46108 - ipmi:si: Return state to normal if message allocation fails * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46128 - ipmi: Check event message buffer response for bad data * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46177 - ipmi: Add limits to event and receive message requests * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46149 - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46101 - netfilter: reject zero shift in nft_bitwise * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46099 - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46276 - drm/amdgpu: fix zero-size GDS range init on RDNA4 * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46033 - crypto: authencesn - reject short ahash digests during instance creation * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46083 - spi: fix resource leaks on device setup failure * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46003 - net: qrtr: ns: Limit the total number of nodes * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46086 - net: bridge: use a stable FDB dst snapshot in RCU readers * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46026 - net: qrtr: ns: Limit the maximum number of lookups * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43491 - net: qrtr: ns: Limit the maximum server registration per node * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46282 - iio: frequency: admv1013: fix NULL pointer dereference on str * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46084 - RDMA/mana_ib: Disable RX steering on RSS QP destroy * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46091 - media: rc: igorplugusb: heed coherency rules * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46069 - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46021 - thermal: core: Fix thermal zone governor cleanup issues * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46280 - lib: test_hmm: evict device pages on file close to avoid use-after-free * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-31715 - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-31709 - smb: client: validate the whole DACL before rewriting it in cifsacl * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45997 - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-43499 - rtmutex: Use waiter::task instead of current in remove_waiter() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46062 - ntfs3: fix integer overflow in run_unpack() volume boundary check * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46072 - ntfs3: add buffer boundary checks to run_unpack() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46052 - ceph: only d_add() negative dentries when they are unhashed * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46023 - dm mirror: fix integer overflow in create_dirty_log() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46075 - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46077 - crypto: atmel-tdes - fix DMA sync direction * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45986 - crypto: ccree - fix a memory leak in cc_mac_digest() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46019 - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46103 - can: ucan: fix devres lifetime * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46056 - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46015 - tcp: call sk_data_ready() after listener migration * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46040 - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46070 - md/raid5: validate payload size before accessing journal metadata * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46051 - md/raid5: fix soft lockup in retry_aligned_read() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46046 - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46094 - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46076 - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46082 - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45987 - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46005 - xfs: fix a resource leak in xfs_alloc_buftarg() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46024 - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46037 - ipv4: icmp: validate reply type before using icmp_pointers * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46031 - net: ks8851: Reinstate disabling of BHs around IRQ handler * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46027 - net/smc: avoid early lgr access in smc_clc_wait_msg * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46053 - net: rds: fix MR cleanup on copy error * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46038 - net: qrtr: ns: Free the node during ctrl_cmd_bye() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46012 - rxrpc: Fix memory leaks in rxkad_verify_response() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46004 - ALSA: caiaq: Handle probe errors properly * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46079 - rbd: fix null-ptr-deref when device_add_disk() fails * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46016 - remoteproc: xlnx: Only access buffer information if IPI is buffered * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46285 - mtd: docg3: fix use-after-free in docg3_release() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46050 - md/raid10: fix deadlock with check operation and nowait requests * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46061 - jbd2: fix deadlock in jbd2_journal_cancel_revoke() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46078 - erofs: fix the out-of-bounds nameoff handling for trailing dirents * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46049 - ALSA: ctxfi: Add fallback to default RSR for S/PDIF * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46002 - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46047 - net: qrtr: ns: Fix use-after-free in driver remove() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46009 - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46011 - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46102 - net: strparser: fix skb_head leak in strp_abort_strp() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46098 - net: caif: clear client service pointer on teardown * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46088 - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46058 - media: amphion: Fix race between m2m job_abort and device_run * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46073 - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45989 - of: unittest: fix use-after-free in testdrv_probe() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45996 - spi: imx: fix use-after-free on unbind * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46092 - wifi: rtw88: check for PCI upstream bridge existence * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46089 - zram: do not forget to endio for partial discard requests * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46080 - ocfs2: split transactions in dio completion to avoid credit exhaustion * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-23468 - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46064 - ibmasm: fix heap over-read in ibmasm_send_i2o_message() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45994 - ibmasm: fix OOB reads in command_file_write due to missing size checks * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46022 - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46041 - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46286 - leds: qcom-lpg: Check for array overflow when selecting the high resolution * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46006 - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-45993 - LoongArch: Add spectre boundry for syscall dispatch table * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2026-46018 - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES * Noble update: upstream stable patchset 2026-06-11 (LP: #2156549) // CVE-2025-54518 // CVE-2026-46174 - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: asihpi: avoid write overflow check warning - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ASoC: SOF: topology: reject invalid vendor array size in token parser - can: mcp251x: add error handling for power enable in open and resume - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - ALSA: hda/realtek: add quirk for Framework F111:000F - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - PCI: hv: Set default NUMA node to 0 for devices without affinity info - drm/vc4: Release runtime PM reference after binding V3D - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - net: stmmac: Fix PTP ref clock for Tegra234 - dt-bindings: net: Fix Tegra234 MGBE PTP clock - tracing/probe: reject non-closed empty immediate strings - e1000: check return value of e1000_read_eeprom - xsk: respect tailroom for ZC setups - xsk: fix XDP_UMEM_SG_FLAG issues - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - gpio: tegra: fix irq_release_resources calling enable instead of disable - ALSA: usb-audio: Improve Focusrite sample rate filtering - usb: storage: Expand range of matched versions for VL817 quirks entry - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: port: add delay after usb_hub_set_port_power() - scripts: generate_rust_analyzer.py: avoid FD leak - USB: serial: option: add Telit Cinterion FN990A MBIM composition - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - checkpatch: add support for Assisted-by tag - Revert "perf unwind-libdw: Fix invalid reference counts" - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - scripts: generate_rust_analyzer.py: define scripts - KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs - rxrpc: Fix key quota calculation for multitoken keys - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - scripts/dtc: Remove unused dts_version in dtc-lexer.l - fuse: Check for large folio with SPLICE_F_MOVE - fuse: quiet down complaints in fuse_conn_limit_write - smb: server: fix max_connections off-by-one in tcp accept path - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - crypto: testmgr - Hide ENOENT errors - crypto: testmgr - Hide ENOENT errors better - platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED) - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9 - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules - arm64: dts: qcom: hamoa/x1: fix idle exit latency - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP - net: increase IP_TUNNEL_RECURSION_LIMIT to 5 - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation - netfilter: nfnetlink_queue: make hash table per queue - thermal: core: Mark thermal zones as exiting before unregistration - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay - PCI: Fix placement of pci_save_state() in pci_bus_add_device() - ima: verify if the segment size has changed - ima: do not copy measurement list to kdump kernel - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - Upstream stable to v6.6.136, v6.12.83, v6.12.84 * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31706 - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31712 - ksmbd: require minimum ACE size in smb_check_perm_dacl() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31575 - mm/userfaultfd: fix hugetlb fault mutex hash calculation * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31582 - hwmon: (powerz) Fix use-after-free on USB disconnect * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43073 - x86-64: rename misleadingly named '__copy_user_nocache()' function * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2025-21709 - kernel: be more careful about dup_mmap() failures and uprobe registering * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31606 - usb: gadget: f_hid: don't call cdev_init while cdev in use * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31731 - thermal: core: Address thermal zone removal races with resume * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31677 - crypto: af_alg - limit RX SG extraction by receive buffer budget * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43107 - xfrm: account XFRMA_IF_ID in aevent size calculation * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43119 - Bluetooth: hci_sync: annotate data-races around hdev->req_status * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31696 - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31697 - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31698 - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31699 - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31700 - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31701 - ALSA: caiaq: take a reference on the USB device in create_card() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31702 - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31704 - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31705 - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31708 - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43350 - smb: client: require a full NFS mode SID before reading mode bits * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31711 - smb: server: fix active_num_conn leak on transport allocation failure * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31694 - fuse: reject oversized dirents in page cache * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31714 - f2fs: fix to avoid memory leak in f2fs_rename() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31716 - fs/ntfs3: validate rec->used in journal-replay file record check * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43075 - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43076 - ocfs2: validate inline data i_size during inode read * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31595 - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-23444 - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-23442 - ipv6: add NULL checks for idev in SRv6 paths * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31594 - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31576 - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43058 - media: vidtv: fix pass-by-value structs causing MSAN warnings * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31577 - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31578 - media: as102: fix to not free memory after the device is registered in as102_usb_probe() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31580 - bcache: fix cached_dev.sb_bio use-after-free and crash * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31581 - ALSA: 6fire: fix use-after-free on disconnect * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31583 - media: em28xx: fix use-after-free in em28xx_v4l2_open() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31584 - media: mediatek: vcodec: fix use-after-free in encoder release path * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31585 - media: vidtv: fix nfeeds state corruption on start_streaming failure * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31586 - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31686 - mm/kasan: fix double free for kasan pXds * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31587 - ASoC: qcom: q6apm: move component registration to unmanaged version * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31588 - KVM: x86: Use scratch field in MMIO fragment to hold small write values * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31590 - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31596 - ocfs2: handle invalid dinode in ocfs2_group_extend * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31597 - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31598 - ocfs2: fix possible deadlock between unlink and dio_end_io_write * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31599 - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31602 - ALSA: ctxfi: Limit PTP to a single page * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31603 - staging: sm750fb: fix division by zero in ps_to_hz() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31604 - wifi: rtw88: fix device leak on probe failure * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31605 - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31610 - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31611 - ksmbd: require 3 sub-authorities before reading sub_auth[2] * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31612 - ksmbd: validate EaNameLength in smb2_get_ea() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31615 - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31616 - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31617 - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31618 - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31619 - ALSA: fireworks: bound device-supplied status before string array lookup * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43072 - drm/vc4: platform_get_irq_byname() returns an int * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31622 - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31623 - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31624 - HID: core: clamp report_size in s32ton() to avoid undefined shift * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31625 - HID: alps: fix NULL pointer dereference in alps_raw_event() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31626 - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31627 - i2c: s3c24xx: check the size of the SMBUS message before using it * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31532 - can: raw: fix ro->uniq use-after-free in raw_rcv() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31629 - nfc: llcp: add missing return after LLCP_CLOSED checks * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31407 - netfilter: conntrack: add missing netlink policy validations * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43079 - perf/x86/intel/uncore: Skip discovery table for offline dies * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43080 - l2tp: Drop large packets with UDP encap * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43345 - net: ipa: fix event ring index not programmed for IPA v5.0+ * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43081 - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31673 - af_unix: read UNIX_DIAG_VFS data under unix_state_lock * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43082 - net: txgbe: leave space for null terminators on property_entry * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31681 - netfilter: xt_multiport: validate range encoding in checkentry * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43085 - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43086 - ipvs: fix NULL deref in ip_vs_add_service error path * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43089 - xfrm_user: fix info leak in build_mapping() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43091 - xfrm: Wait for RCU readers during policy netns exit * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43092 - xsk: validate MTU against usable frame size on bind * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43093 - xsk: tighten UMEM headroom validation to account for tailroom and min frame * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43094 - ixgbevf: add missing negotiate_features op to Hyper-V ops table * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43098 - nfc: s3fwrn5: allocate rx skb before consuming bytes * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43099 - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43103 - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-31684 - net: sched: act_csum: validate nested VLAN headers * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43074 - eventpoll: defer struct eventpoll free to RCU grace period * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43104 - drm/vc4: Fix a memory leak in hang state error path * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43105 - drm/vc4: Fix memory leak of BO array in hang state * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43110 - wifi: brcmfmac: validate bsscfg indices in IF events * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43111 - HID: roccat: fix use-after-free in roccat_report_event * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43112 - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43113 - wifi: wl1251: validate packet IDs before indexing tx_frames * Noble update: upstream stable patchset 2026-06-10 (LP: #2156373) // CVE-2026-43120 - RDMA/irdma: Fix double free related to rereg_user_mr * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) - vfio/pci: Use unmap_mapping_range() - gfs2: Improve gfs2_consist_inode() usage - Input: uinput - take event lock when submitting FF request "event" - MIPS: Always record SEGBITS in cpu_data.vmbits - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - Revert "mptcp: add needs_id for netlink appending addr" - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - net/mlx5: Update the list of the PCI supported devices - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - usb: typec: ucsi: skip connector validation before init - drm/i915/psr: Do not use pipe_src as borders for SU area - rxrpc: Fix anonymous key handling - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - rxrpc: Fix rxkad crypto unalignment handling - Upstream stable to v6.6.134, v6.6.135, v6.12.82 * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31429 - net: skb: fix cross-cache free of KFENCE-allocated skb head * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31645 - net: lan966x: fix page pool leak in error paths * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-23302 - net: annotate data-races around sk->sk_{data_ready,write_space} * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-23330 - nfc: nci: complete pending data exchange on device close * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-23374 - blktrace: fix __this_cpu_read/write in preemptible context * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31634 - rxrpc: fix reference count leak in rxrpc_server_keyring() * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31638 - rxrpc: Only put the call ref if one was acquired * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31639 - rxrpc: Fix key reference count leak from call->key * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31642 - rxrpc: Fix call removal to use RCU safe deletion * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31646 - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31648 - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31651 - mmc: vub300: fix NULL-deref on disconnect * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31655 - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31656 - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31658 - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31689 - EDAC/mc: Fix error path ordering in edac_mc_alloc() * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31430 - X.509: Fix out-of-bounds access when parsing extensions * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31660 - nfc: pn533: allocate rx skb before consuming bytes * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31661 - wifi: brcmsmac: Fix dma_free_coherent() size * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31662 - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31664 - xfrm: clear trailing padding in build_polexpire() * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31665 - netfilter: nft_ct: fix use-after-free in timeout object destroy * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31667 - Input: uinput - fix circular locking dependency with ff-core * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31670 - net: rfkill: prevent unlimited numbers of rfkill events from being created * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31671 - xfrm_user: fix info leak in build_report() * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-31672 - wifi: rt2x00usb: fix devres lifetime * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2026-43336 - lib/crypto: chacha: Zeroize permuted_state before it leaves scope * Noble update: upstream stable patchset 2026-06-09 (LP: #2156149) // CVE-2025-54505 // CVE-2026-31628 - x86/CPU: Fix FPDSS on Zen1 * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - arm64/scs: Fix handling of advance_loc4 - HID: logitech-hidpp: Enable MX Master 4 over bluetooth - btrfs: don't take device_list_mutex when querying zone info - tg3: replace placeholder MAC address with device property - objtool: Fix Clang jump table detection - i2c: tegra: Don't mark devices with pins as IRQ safe - spi: geni-qcom: Check DMA interrupts early in ISR - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - net: fec: fix the PTP periodic output sysfs interface - tg3: Fix race for querying speed/duplex - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - net: enetc: check whether the RSS algorithm is Toeplitz - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - net: introduce mangleid_features - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: store netns and zone in expectation - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net/mlx5: Avoid "No data available" when FW version queries fail - net: hsr: fix VLAN add unwind on slave errors - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - hwmon: (occ) Fix missing newline in occ_show_extended() - mips: ralink: update CPU clock index - sched/fair: Fix zero_vruntime tracking fix - riscv: kgdb: fix several debug register assignment bugs - USB: serial: option: add MeiG Smart SRM825WN - MIPS: SiByte: Bring back cache initialisation - MIPS: Fix the GCC version check for `__multi3' workaround - mips: mm: Allocate tlb_vpn array atomically - iio: adc: ti-adc161s626: fix buffer read on big-endian - drm/ast: dp501: Fix initialization of SCU2C - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/amdgpu/pm: drop SMU driver if version not matched messages - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: bcm5974 - recover from failed mode switch - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - iio: adc: aspeed: clear reference voltage bits before configuring vref - iio: accel: fix ADXL355 temperature signature value - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - usb: ehci-brcm: fix sleep during atomic - cdc-acm: new quirk for EPSON HMD - firmware: microchip: fail auto-update probe if no flash found - dt-bindings: connector: add pd-disable dependency - nvmem: imx: assign nvmem_cell_info::raw_len - gpio: mxc: map Both Edge pad wakeup to Rising Edge - thunderbolt: Fix property read in nhi_wake_supported() - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - spi: cadence-qspi: Fix exec_mem_op error handling - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 - s390/perf_cpum_sf: Convert to use try_cmpxchg128() - s390/cpum_sf: Cap sampling rate to prevent lsctl exception - MPTCP: fix lock class name family in pm_nl_create_listen_socket - drm/amd/amdgpu: decouple ASPM with pcie dpm - drm/amd/amdgpu: disable ASPM in some situations - drm/amd/display: Disable fastboot on DCE 6 too - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4 - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming. - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15% - drm/amd/display: Disable scaling on DCE6 for now - drm/amd: Disable ASPM on SI - drm/amd/display: Correct logic check error for fastboot - bpf: Improve bounds when s64 crosses sign boundary - selftests/bpf: Test cross-sign 64bits range refinement - selftests/bpf: Test invariants on JSLT crossing sign - bpf: Add third round of bounds deduction - selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary - arm64/scs: Fix potential sign extension issue of advance_loc4 - usb: ulpi: fix memory leak on ulpi_register() error paths - Upstream stable to v6.6.132, v6.6.133, v6.12.81 * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2025-62626 - x86/CPU/AMD: Add additional fixed RDSEED microcode revisions * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31450 - ext4: publish jinode after initialization * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31466 - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43054 - scsi: target: tcm_loop: Drain commands in target_reset handler * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43056 - net: mana: fix use-after-free in add_adev() error path * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43057 - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31695 - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31720 - usb: gadget: f_uac1_legacy: validate control request size * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31721 - usb: gadget: f_hid: move list and spinlock inits from bind to alloc * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31722 - usb: gadget: f_rndis: Fix net_device lifecycle with device_move * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31723 - usb: gadget: f_subset: Fix net_device lifecycle with device_move * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31724 - usb: gadget: f_eem: Fix net_device lifecycle with device_move * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31725 - usb: gadget: f_ecm: Fix net_device lifecycle with device_move * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43342 - usb: gadget: f_rndis: Protect RNDIS options with mutex * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43343 - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31726 - usb: gadget: uvc: fix NULL pointer dereference during unbind race * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31728 - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2025-71269 - btrfs: do not free data reservation in fallback from inline due to -ENOSPC * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-23389 - ice: Fix memory leak in ice_set_ringparam() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31729 - usb: typec: ucsi: validate connector number in ucsi_notify_common() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43324 - USB: dummy-hcd: Fix interrupt synchronization error * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43327 - USB: dummy-hcd: Fix locking/synchronization error * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31730 - misc: fastrpc: possible double-free of cctx->remote_heap * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43332 - thermal: core: Fix thermal zone device registration error path * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43328 - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31737 - net: ftgmac100: fix ring allocation unwind on open failure * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31738 - vxlan: validate ND option lengths in vxlan_na_create * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31740 - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31741 - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31747 - comedi: me4000: Fix potential overrun of firmware buffer * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31748 - comedi: me_daq: Fix potential overrun of firmware buffer * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31749 - comedi: ni_atmio16d: Fix invalid clean-up after failed attach * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43340 - comedi: Reinit dev->spinlock between attachments to low-level drivers * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31751 - comedi: dt2815: add hardware detection to prevent crash * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31752 - bridge: br_nd_send: validate ND option lengths * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31754 - usb: cdns3: gadget: fix state inconsistency on gadget init failure * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31755 - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31756 - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31758 - usb: usbtmc: Flush anchored URBs in usbtmc_release * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31759 - usb: ulpi: fix double free in ulpi_register_interface() error path * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31761 - iio: gyro: mpu3050: Move iio_device_register() to correct location * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31762 - iio: gyro: mpu3050: Fix irq resource leak * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31763 - iio: gyro: mpu3050: Fix incorrect free_irq() variable * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31767 - drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31768 - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31770 - hwmon: (occ) Fix division by zero in occ_show_power_1() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31432 - ksmbd: fix OOB write in QUERY_INFO for compound requests * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31772 - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43334 - Bluetooth: SMP: force responder MITM requirements before building the pairing response * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31773 - Bluetooth: SMP: derive legacy responder STK authentication from MITM state * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31776 - ALSA: ctxfi: Fix missing SPDIFI1 index handling * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31778 - ALSA: caiaq: fix stack out-of-bounds read in init_card * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31779 - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31780 - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31781 - drm/ioc32: stop speculation on the drm_compat_ioctl path * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43007 - accel/qaic: Handle DBC deactivation if the owner went away * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43333 - bpf: reject direct access to nullable PTR_TO_BUF pointers * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31415 - ipv6: avoid overflows in ip6_datagram_send_ctl() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31422 - net/sched: cls_flow: fix NULL pointer dereference on shared blocks * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31421 - net/sched: cls_fw: fix NULL pointer dereference on shared blocks * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31417 - net/x25: Fix overflow when accumulating packets * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43012 - net/mlx5: Fix switchdev mode rollback in case of failure * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43013 - net/mlx5: lag: Check for LAG device before creating debugfs * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43014 - net: macb: properly unregister fixed rate clocks * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43015 - net: macb: fix clk handling on PCI glue driver removal * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31675 - net/sched: sch_netem: fix out-of-bounds access in packet corruption * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43016 - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31425 - rds: ib: reject FRMR registration before IB connection is established * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43017 - Bluetooth: MGMT: validate mesh send advertising payload length * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43018 - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43019 - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43020 - Bluetooth: MGMT: validate LTK enc_size on load * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43023 - Bluetooth: SCO: fix race conditions in sco_sock_connect() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43024 - netfilter: nf_tables: reject immediate NF_QUEUE verdict * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31424 - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43025 - netfilter: ctnetlink: ignore explicit helper on new expectations * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31414 - netfilter: nf_conntrack_expect: use expect->helper * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43026 - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43027 - netfilter: nf_conntrack_helper: pass helper to expect cleanup * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43028 - netfilter: x_tables: ensure names are nul-terminated * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31416 - netfilter: nfnetlink_log: account for netlink header size * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43329 - netfilter: flowtable: strictly check for maximum number of actions * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31680 - net: ipv6: flowlabel: defer exclusive option free until RCU teardown * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43030 - bpf: Fix regsafe() for pointers to packet * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43032 - NFC: pn533: bound the UART receive buffer * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43035 - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43036 - net: use skb_header_pointer() for TCPv4 GSO frag_off check * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43339 - ipv6: prevent possible UaF in addrconf_permanent_addr() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-31423 - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43040 - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43041 - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43043 - crypto: af-alg - fix NULL pointer dereference in scatterwalk * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43330 - crypto: caam - fix overflow on long hmac keys * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43044 - crypto: caam - fix DMA corruption on long hmac keys * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43046 - btrfs: reject root items with drop_progress and zero drop_level * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43338 - btrfs: reserve enough transaction items for qgroup ioctls * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43047 - HID: multitouch: Check to ensure report responses match the request * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43049 - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43050 - atm: lec: fix use-after-free in sock_def_readable() * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43051 - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq * Noble update: upstream stable patchset 2026-06-08 (LP: #2155958) // CVE-2026-43052 - wifi: mac80211: check tdls flag in ieee80211_tdls_oper * Noble update: upstream stable patchset 2026-06-05 (LP: #2155660) - perf: Extract a few helpers - perf: Make sure to use pmu_ctx->pmu for groups - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - hwmon: (axi-fan-control) Use device firmware agnostic API - hwmon: (axi-fan-control) Make use of dev_err_probe() - hwmon: axi-fan: don't use driver_override as IRQ name - sh: platform_early: remove pdev->driver_override check - bpf: Release module BTF IDR before module unload - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN - HID: asus: avoid memory leak in asus_report_fixup() - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - nvme-pci: cap queue creation to used queues - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - nvme-pci: ensure we're polling a polled queue - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() - net: usb: r8152: add TRENDnet TUC-ET2G - HID: mcp2221: cancel last I2C command on read error - HID: asus: add xg mobile 2023 external hardware support - module: Fix kernel panic when a symbol st_shndx is out of bounds - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - dma-buf: Include ioctl.h in UAPI header - HID: apple: avoid memory leak in apple_report_fixup() - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - objtool: Handle Clang RSP musical chairs - usb: core: new quirk to handle devices with zero configurations - spi: intel-pci: Add support for Nova Lake mobile SPI flash - xfrm: call xdo_dev_state_delete during state update - xfrm: Fix the usage of skb->sk - esp: fix skb leak with espintcp and async crypto - af_key: validate families in pfkey_send_migrate() - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - can: statistics: add missing atomic access in hot path - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - Bluetooth: hci_ll: Fix firmware leak on error path - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - pinctrl: mediatek: common: Fix probe failure for devices without EINT - ionic: fix persistent MAC address override on PF - nfc: nci: fix circular locking dependency in nci_close_device - net: openvswitch: Avoid releasing netdev before teardown completes - openvswitch: defer tunnel netdev_put to RCU release - openvswitch: validate MPLS set/set_masked payload length - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - ice: use ice_update_eth_stats() for representor stats - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. - tcp: optimize inet_use_bhash2_on_bind() - udp: Fix wildcard bind conflict check when using hash2 - net: enetc: fix the output issue of 'ethtool --show-ring' - dma-mapping: add missing `inline` for `dma_free_attrs` - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Bluetooth: btusb: clamp SCO altsetting table indices - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() - netfilter: nf_conntrack_expect: skip expectations in other netns via proc - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp - netfilter: ctnetlink: use netlink policy range checks - net: macb: use the current queue number for stats - regmap: Synchronize cache for the page selector - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - RDMA/irdma: Initialize free_qp completion before using it - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Return EINVAL for invalid arp index error - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - PM: hibernate: Don't ignore return from set_memory_ro() - PM: hibernate: Drain trailing zero pages on userspace restore - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - ASoC: Intel: catpt: Fix the device initialization - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - sysctl: fix uninitialized variable in proc_do_large_bitmap - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - ASoC: adau1372: Fix clock leak on PLL lock failure - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - s390/syscalls: Add spectre boundary for syscall dispatch table - s390/barrier: Make array_index_mask_nospec() __always_inline - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: do not expire session on binding failure - ALSA: firewire-lib: fix uninitialized local variable - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - can: gw: fix OOB heap access in cgw_csum_crc8_rel() - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - cpufreq: conservative: Reset requested_freq on limits change - platform/x86: ISST: Correct locked bit width - KVM: arm64: Discard PC update state on vcpu reset - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false - s390/entry: Scrub r12 register on kernel entry - erofs: add GFP_NOIO in the bio completion if needed - alarmtimer: Fix argument order in alarm_timer_forward() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - scsi: ses: Handle positive SCSI error from ses_recv_diag() - net: macb: Use dev_consume_skb_any() to free TX SKBs - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - jbd2: gracefully abort on checkpointing state corruptions - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - dmaengine: sh: rz-dmac: Protect the driver specific lists - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - xfs: stop reclaim before pushing AIL during unmount - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - ext4: fix journal credit check when setting fscrypt context - ext4: convert inline data to extents when truncate exceeds inline size - ext4: fix fsync(2) for nojournal mode - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: reject mount if bigalloc with s_first_data_block != 0 - ext4: fix use-after-free in update_super_work when racing with umount - ext4: fix the might_sleep() warnings in kvfree() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: always drain queued discard work in ext4_mb_release() - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - powerpc64/bpf: do not increment tailcall count when prog is NULL - ksmbd: fix memory leaks and NULL deref in smb2_lock() - tracing: Switch trace_osnoise.c code over to use guard() and __free() - tracing: Fix potential deadlock in cpu hotplug with osnoise - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - libbpf: Fix -Wdiscarded-qualifiers under C23 - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - xfs: avoid dereferencing log items after push callbacks - xfs: save ailp before dropping the AIL lock in push callbacks - dmaengine: idxd: Fix not releasing workqueue on .release() - dmaengine: idxd: Fix memory leak when a wq is reset - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - btrfs: fix super block offset in error message in btrfs_validate_super() - btrfs: fix leak of kobject name for sub-group space_info - btrfs: fix lost error when running device stats on multiple devices fs - dmaengine: idxd: Fix freeing the allocated ida too late - futex: Clear stale exiting pointer in futex_lock_pi() retry path - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter - kexec: Consolidate machine_kexec_mask_interrupts() implementation - [Config] Enable GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD by default. - kexec: Include kernel-end even without crashkernel - powerpc/kexec/core: use big-endian types for crash variables - drm/msm/dsi: fix hdisplay calculation when programming dsi registers - perf disasm: Fix off-by-one bug in outside check - net/mlx5: Fix crash when moving to switchdev mode - bonding: add ESP offload features when slaves support - bonding: Correctly support GSO ESP offload - net: add a common function to compute features for upper devices - bonding: use common function to compute the features - bonding: fix type confusion in bond_setup_by_slave() - xdp: allow attaching already registered memory model to xdp_rxq_info - net: add generic percpu page_pool allocator - net: do not consume a cacheline for system_page_pool - xdp: register system page pool as an XDP memory model - net: add xmit recursion limit to tunnel xmit functions - net: prevent NULL deref in ip[6]tunnel_xmit() - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives - usb: typec: altmode/displayport: set displayport signaling rate in configure message - rust: kbuild: allow `unused_features` - ceph: add a bunch of missing ceph_path_info initializers - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x - tracing: Fix enabling multiple events on the kernel command line and bootconfig - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size - xfs: fix returned valued from xfs_defer_can_append - iio: imu: inv_icm42600: add support of ICM-42686-P - iio: imu: inv_icm42600: fix odr switch when turning buffer off - perf/x86/intel/uncore: Support more units on Granite Rapids - perf/x86/intel/uncore: Add per-scheduler IMC CAS count events - cleanup: Provide retain_and_null_ptr() - usb: gadget: f_ncm: Fix net_device lifecycle with device_move - KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() - KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration - KVM: x86: do not allow re-enabling quirks - KVM: x86: Allow vendor code to disable quirks - KVM: x86: Introduce supported_quirks to block disabling quirks - KVM: x86: Remove VMX support for virtualizing guest MTRR memtypes - KVM: VMX: Drop support for forcing UC memory when guest CR0.CD=1 - KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT - KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET - KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM - drm/xe/sync: Cleanup partially initialized sync on parse failure - ice: fix devlink reload call trace - io_uring/uring_cmd: fix too strict requirement on ioctl - erofs: fix inline data read failure for ztailpacking pclusters - mm: merge folio_is_secretmem() and folio_fast_pin_allowed() into gup_fast_folio_allowed() - mm: thp: deny THP for files on anonymous inodes - sched/fair: Fix zero_vruntime tracking - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations - drm/i915/dsc: Add Selective Update register definitions - drm/imagination: Fix deadlock in soft reset sequence - ata: libata-scsi: Return residual for emulated SCSI commands - ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in() - soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() - firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap() - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - bonding: prevent potential infinite loop in bond_header_parse() - drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state - perf/x86/intel: Add missing branch counters constraint apply - Revert "LoongArch: Add machine_kexec_mask_interrupts() implementation" - cxl/port: Fix use after free of parent_port in cxl_detach_ep() - driver core: generalize driver_override in struct device - driver core: platform: use generic driver_override infrastructure - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list - kbuild: install-extmod-build: Package resolve_btfids if necessary - nvmet: move async event work off nvmet-wq - ALSA: hda/realtek: add quirk for ASUS UM6702RC - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len - xfrm: prevent policy_hthresh.work from racing with netns teardown - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - net: bcmasp: remove eee_enabled/eee_active in bcmasp_get_eee() - net: bcm: asp2: fix LPI timer handling - net: bcm: asp2: remove tx_lpi_enabled - net: bcmasp: Add support for ASP 2.2 - net: bcm: asp2: convert to phylib managed EEE - net: bcmasp: Remove support for asp-v2.0 - net: bcmasp: streamline early exit in probe - net: bcmasp: fix double free of WoL irq - net: bcmasp: Add support for asp-v3.0 - net: bcmasp: fix double disable of clk - platform/x86: intel-hid: disable wakeup_mode during hibernation - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() - team: fix header_ops type confusion with non-Ethernet ports - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: Group CS related fields in struct spi_device - spi: use generic driver_override infrastructure - hwmon: (pmbus/core) Fix various coding style issues - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only - hwmon: (pmbus) Introduce the concept of "write-only" attributes - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - ovl: fix wrong detection of 32bit inode numbers - net: macb: Move devm_{free,request}_irq() out of spin lock area - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - LoongArch: Fix missing NULL checks for kstrdup() - xfs: scrub: unlock dquot before early return in quota scrub - ext4: validate p_idx bounds in ext4_ext_correct_indexes - LoongArch: vDSO: Emit GNU_EH_FRAME correctly - spi: tegra210-quad: Protect curr_xfer check in IRQ handler - media: nxp: imx8-isi: Fix streaming cleanup on release - rust: pin-init: internal: init: document load-bearing fact of field accessors - ovl: Use str_on_off() helper in ovl_show_options() - ovl: make fsync after metadata copy-up opt-in mount option - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length - net: add proper RCU protection to /proc/net/ptype - landlock: Optimize file path walks and prepare for audit support - landlock: Fix handling of disconnected directories - idpf: check error for register_netdev() on init - idpf: detach and close netdevs while handling a reset - idpf: Fix RSS LUT NULL pointer crash on early ethtool operations - idpf: Fix RSS LUT NULL ptr issue after soft reset - ASoC: ak4458: Convert to RUNTIME_PM_OPS() & co - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators - xen/privcmd: unregister xenstore notifier on module exit - futex: Require sys_futex_requeue() to have identical flags - dmaengine: idxd: Fix leaking event log memory - net: bcmasp: Restore programming of TX map vector register - net: bcmasp: Fix network filter wake for asp-3.0 - idpf: nullify pointers after they are freed - Upstream stable to v6.6.131, v6.12.78, v6.12.79, v6.12.80 * Noble update: upstream stable patchset 2026-05-28 (LP: #2154496) - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - scsi: lpfc: Properly set WC for DPP mapping - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - rseq: Clarify rseq registration rseq_size bound check comment - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - ALSA: usb-audio: Cap the packet size pre-calculations - ALSA: usb-audio: Use inclusive terms - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix compat mask in error messages in btrfs_check_features() - bpf: Fix stack-out-of-bounds write in devmap - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: fix device leak on larb probe - resource: Add resource set range and size helpers - PCI: Use resource_set_range() that correctly sets ->end - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() - drm/tegra: dsi: fix device leak on probe - ext4: get rid of ppath in ext4_split_extent_at() - ext4: subdivide EXT4_EXT_DATA_VALID1 - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_convert_unwritten_extents_endio() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: drop extent cache when splitting extent fails - mailbox: Use of_property_match_string() instead of open-coding - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: sort headers alphabetically - mailbox: remove unused header files - mailbox: Use dev_err when there is error - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Allow controller specific mapping using fwnode - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - ext4: convert bd_bitmap_page to bd_bitmap_folio - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: fix e4b bitmap inconsistency reports - arm64: dts: rockchip: Fix rk356x PCIe range mappings - clk: tegra: tegra124-emc: fix device leak on set_rate() - usb: cdns3: remove redundant if branch - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() - usb: cdns3: fix role switching during resume - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - eventpoll: Fix integer overflow in ep_loop_check_proc() - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - nfc: pn533: properly drop the usb interface reference on disconnect - net: usb: kaweth: validate USB endpoints - net: usb: kalmia: validate USB endpoints - net: usb: pegasus: validate USB endpoints - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ucan: Fix infinite loop from zero-length messages - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: handle bulk write errors properly - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - x86/efi: defer freeing of boot services memory - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - platform/x86: dell-wmi: Add audio/mic mute key codes - ALSA: usb-audio: Use correct version for UAC3 header validation - wifi: radiotap: reject radiotap with unknown bits - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - net/sched: ets: fix divide by zero in the offload path - scsi: target: Fix recursive locking in __configfs_open_file() - Squashfs: check metadata block offset is within range - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - drbd: fix null-pointer dereference on local read error - smb: client: fix cifs_pick_channel when channels are equally loaded - smb: client: fix broken multichannel with krb5+signing - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - scsi: core: Fix refcount leak for tagset_refcnt - selftests: mptcp: more stable simult_flows tests - selftests: mptcp: join: check removing signal+subflow endp - ARM: clean up the memset64() C wrapper - hwmon: (aht10) Add support for dht20 - hwmon: (aht10) Fix initialization commands for AHT20 - pinctrl: equilibrium: rename irq_chip function callbacks - pinctrl: equilibrium: fix warning trace on load - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - hwmon: (it87) Check the it87_lock() return value - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - drm/solomon: Fix page start when updating rectangle in page addressing mode - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - xsk: Get rid of xdp_buff_xsk::xskb_list_node - xsk: s/free_list_node/list_node/ - xsk: Fix fragment node deletion to prevent buffer leak - xsk: Fix zero-copy AF_XDP fragment drop - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - can: bcm: fix locking for bcm_op runtime updates - can: mcp251x: fix deadlock in error path of mcp251x_open - rust: kunit: fix warning when !CONFIG_PRINTK - kunit: tool: copy caller args in run_kernel to prevent mutation - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - octeon_ep: Relocate counter updates before NAPI - octeon_ep: avoid compiler and IQ/OQ reordering - wifi: cw1200: Fix locking in error paths - wifi: wlcore: Fix a locking bug - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - indirect_call_wrapper: do not reevaluate function pointer - net/rds: Fix circular locking dependency in rds_tcp_tune - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - bpf: export bpf_link_inc_not_zero. - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - amd-xgbe: fix sleep while atomic on suspend/resume - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - nvme: reject invalid pr_read_keys() num_keys values - nvme: fix memory allocation in nvme_pr_read_keys() - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - net: nfc: nci: Fix zero-length proprietary notifications - nfc: nci: free skb on nci_transceive early error paths - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: rawsock: cancel tx_work before socket teardown - net: stmmac: Fix error handling in VLAN add and delete paths - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net/sched: act_ife: Fix metalist update behavior - xdp: use modulo operation to calculate XDP frag tailroom - xsk: introduce helper to determine rxq->frag_size - i40e: fix registering XDP RxQ info - i40e: use xdp.frame_sz as XDP RxQ info frag_size - xdp: produce a warning when calculated tailroom is negative - selftest/arm64: Fix sve2p1_sigill() to hwcap test - tracing: Add NULL pointer check to trigger_data_free() - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net: tcp: accept old ack during closing - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - ACPI: PM: Save NVS memory on Lenovo G70-35 - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - unshare: fix unshare_fs() handling - wifi: mac80211: set default WMM parameters on all links - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - scsi: ses: Fix devices attaching to different hosts - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - ASoC: cs42l43: Report insert for exotic peripherals - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc: 83xx: km83xx: Fix keymile vendor prefix - xprtrdma: Decrement re_receiving on the early exit paths - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - drm/msm/dsi: fix pclk rate calculation for bonded dsi - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - net/mlx5: IFC updates for disabled host PF - net/mlx5: Query to see if host PF is disabled - net/mlx5: Fix deadlock between devlink lock and esw->wq - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - ASoC: soc-core: drop delayed_work_pending() check before flush - ASoC: soc-core: flush delayed work before removing DAIs and widgets - ASoC: simple-card-utils: use __free(device_node) for device node - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays - net: sfp: improve Huawei MA5671a fixup - serial: caif: hold tty->link reference in ldisc_open and ser_release - mctp: i2c: fix skb memory leak in receive path - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: route: hold key->lock in mctp_flow_prepare_output() - amd-xgbe: fix link status handling in xgbe_rx_adaptation - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - regulator: pca9450: Make IRQ optional - regulator: pca9450: Correct interrupt type - sched: idle: Make skipping governor callbacks more consistent - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - nvme-pci: Fix race bug in nvme_poll_irqdisable() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - e1000/e1000e: Fix leak in DMA error cleanup - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ASoC: detect empty DMI strings - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - cgroup: fix race between task migration and iteration - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - net: usb: lan78xx: fix silent drop of packets with checksum errors - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: skip LTM configuration for LAN7850 - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - USB: add QUIRK_NO_BOS for video capture several devices - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb: xhci: Fix memory leak in xhci_disable_slot() - usb: xhci: Prevent interrupt storm on host controller error (HCE) - usb: yurex: fix race in probe - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: roles: get usb role switch from parent only for usb-b-connector - USB: usbcore: Introduce usb_bulk_msg_killable() - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts - USB: core: Limit the length of unkillable synchronous timeouts - usb: class: cdc-wdm: fix reordering issue in read code path - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: mdc800: handle signal and read racing - usb: image: mdc800: kill download URB on timeout - mm/tracing: rss_stat: ensure curr is false from kthread context - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: core: Avoid bitfield RMW for claim/retune flags - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - tipc: fix divide-by-zero in tipc_sk_filter_connect() - kprobes: avoid crash when rmmod/insmod after ftrace killed - libceph: reject preamble if control segment is empty - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: admit message frames only in CEPH_CON_S_OPEN state - ceph: fix i_nlink underrun during async unlink - ceph: fix memory leaks in ceph_mdsc_build_path() - time/jiffies: Mark jiffies_64_to_clock_t() notrace - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec - scsi: hisi_sas: Use macro instead of magic number - scsi: hisi_sas: Fix NULL pointer exception during user_scan() - Revert "tcpm: allow looking for role_sw device in the main node" - drm/bridge: samsung-dsim: Fix memory leak in error path - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - device property: Allow secondary lookup in fwnode_get_next_child_node() - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - ice: reintroduce retry mechanism for indirect AQ - ixgbevf: fix link setup issue - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - media: dvb-net: fix OOB access in ULE extension header tables - net: mana: Ring doorbell at 4 CQ wraparounds - ice: fix retry for AQ command 0x06EE - tracing: Fix syscall events activation by ensuring refcount hits zero - batman-adv: Avoid double-rtnl_lock ELP metric worker - parisc: Increase initial mapping to 64 MB with KALLSYMS - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Fix initial page table creation for boot - parisc: Check kernel mapping earlier at bootup - pmdomain: bcm: bcm2835-power: Fix broken reset status read - net: ncsi: fix skb leak in error paths - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: dsa: microchip: Fix error path in PTP IRQ setup - drm/amdgpu: Fix use-after-free race in VM acquire - drm/amd: Set num IP blocks to 0 if discovery fails - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/i915: Fix potential overflow of shmem scatterlist length - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - cifs: make default value of retrans as zero - xfs: fix undersized l_iclog_roundoff values - s390/dasd: Move quiesce state with pprc swap - s390/dasd: Copy detected format information to secondary device - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - scsi: core: Fix error handling for scsi_alloc_sdev() - x86/apic: Disable x2apic on resume if the kernel expects so - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - smb: client: fix atomic open with O_DIRECT & O_SYNC - smb: client: fix in-place encryption corruption in SMB2_write() - smb: client: fix iface port assignment in parse_server_interfaces - btrfs: abort transaction on failure to update root in the received subvol ioctl - iio: dac: ds4424: reject -128 RAW value - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: bme680: Fix measurement wait duration calculation - iio: buffer: Fix wait_queue not being removed - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: imu: inv_icm42600: fix odr switch to the same value - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - gve: defer interrupt enabling until NAPI registration - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - wifi: libertas: fix use-after-free in lbs_free_adapter() - platform/x86: hp-bioscfg: Support allocations of larger data - x86/sev: Allow IBPB-on-Entry feature for SNP guests - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - mptcp: pm: avoid sending RM_ADDR over same subflow - mptcp: pm: in-kernel: always mark signal+subflow endp as used - selftests: mptcp: add a check for 'add_addr_accepted' - selftests: mptcp: join: check RM_ADDR not sent over same subflow - kbuild: Leave objtool binary around with 'make clean' - net/sched: act_gate: snapshot parameters with RCU on replace - can: gs_usb: gs_can_open(): always configure bitrates before starting device - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - KVM: SVM: Add a helper to look up the max physical ID for AVIC - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated - mm/kfence: fix KASAN hardware tag faults during late enablement - iomap: reject delalloc mappings during writeback - ksmbd: Don't log keys in SMB3 signing and encryption key generation - drm/msm: Fix dma_free_attrs() buffer size - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - net: macb: Shuffle the tx ring before enabling tx - cifs: open files should not hold ref on superblock - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - xfs: fix integer overflow in bmap intent sort comparator - xfs: ensure dquot item is deleted from AIL only after log shutdown - smb: client: Compare MACs in constant time - ksmbd: Compare MACs in constant time - f2fs: fix to avoid migrating empty section - ext4: fix dirtyclusters double decrement on fs shutdown - btrfs: always fallback to buffered write if the inode requires checksum - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - arm64: mm: Batch dsb and isb when populating pgtables - arm64: mm: Don't remap pgtables for allocate vs populate - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - ext4: always allocate blocks only from groups inode can use - rxrpc: Fix recvmsg() unconditional requeue - dm-verity: disable recursive forward error correction - ipv6: use RCU in ip6_xmit() - rxrpc: Fix data-race warning and potential load/store tearing - btrfs: do not strictly require dirty metadata threshold for metadata writepages - riscv: Sanitize syscall table indexing under speculation - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - tracing: Add recursion protection in kernel stack trace recording - net: add support for segmenting TCP fraglist GSO packets - net: gso: fix tcp fraglist segmentation after pull from frag_list - net: fix segmentation of forwarding fraglist GRO - net: dsa: properly keep track of conduit reference - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) - drm/amdgpu: Add basic validation for RAS header - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - x86/uprobes: Fix XOL allocation failure for 32-bit tasks - platform/x86/amd/pmc: Add support for Van Gogh SoC - binfmt_misc: restore write access before closing files opened by open_exec() - net: stmmac: remove support for lpi_intr_o - mptcp: pm: in-kernel: always set ID as avail when rm endp - s390/xor: Fix xor_xc_2() inline assembly constraints - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node() - io_uring/kbuf: check if target buffer list is still legacy on recycle - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd - sunrpc: fix cache_request leak in cache_release - nvdimm/bus: Fix potential use after free in asynchronous initialization - LoongArch: Give more information if kmem access failed - NFC: nxp-nci: allow GPIOs to sleep - net: macb: fix use-after-free access to PTP clock - parisc: Flush correct cache in cacheflush() syscall - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - smb: client: fix krb5 mount with username option - ksmbd: unset conn->binding on failed binding request - kprobes: Remove unneeded goto - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - btrfs: fix transaction abort when snapshotting received subvolumes - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort on file creation due to name hash collision - iio: light: bh1780: fix PM runtime leak on error path - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - net: macb: queue tie-off or disable during WOL suspend - net: macb: Introduce gem_init_rx_ring() - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - mmc: sdhci: fix timing selection for 1-bit bus width - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - spi: fix use-after-free on controller registration failure - spi: fix statistics allocation - mtd: rawnand: pl353: make sure optimal timings are applied - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: Avoid boot crash in RedBoot partition table parser - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - serial: 8250_pci: add support for the AX99100 - serial: 8250: Fix TX deadlock when using DMA - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: uartlite: fix PM runtime usage count underflow on probe - drm/amdgpu/gmc9.0: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - btrfs: log new dentries when logging parent dir of a conflicting inode - btrfs: tree-checker: fix misleading root drop_level error message - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - soc: fsl: qbman: fix race condition in qman_destroy_fq - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - firmware: arm_scpi: Fix device_node reference leak in probe path - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy - Bluetooth: ISO: Fix defer tests being unstable - Bluetooth: hci_sync: Fix hci_le_create_conn_sync - Bluetooth: HIDP: Fix possible UAF - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: qca: fix ROM version reading on WCN3998 chips - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - mpls: add missing unregister_netdevice_notifier to mpls_init - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case - netfilter: nft_ct: drop pending enqueued packets on removal - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_time: use unsigned int for monthday bit shift - net: bcmgenet: increase WoL poll timeout - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown - sched: idle: Consolidate the handling of two special cases - PM: runtime: Fix a race condition related to device removal - net/sched: teql: Fix double-free in teql_master_xmit - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: usb: aqc111: Do not perform PM inside suspend callback - igc: fix missing update of skb->tail in igc_xmit_frame() - iavf: fix VLAN filter lost on add/delete race - wifi: mac80211: fix NULL deref in mesh_matches_local() - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix - net: macb: fix uninitialized rx_fs_lock - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net/mlx5e: Prevent concurrent access to IPSec ASO context - net/mlx5e: Fix race condition during IPSec ESN update - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n - net: bonding: fix NULL deref in bond_debug_rlb_hash_show - netfilter: bpf: defer hook memory release until rcu readers are done - nfnetlink_osf: validate individual option lengths in fingerprints - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - icmp: fix NULL pointer dereference in icmp_tag_validation() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - USB: serial: f81232: fix incomplete serial port generation - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - i2c: pxa: defer reset on Armada 3700 when recovery is used - x86/platform/uv: Handle deconfigured sockets - i2c: cp2615: fix serial string NULL-deref at probe - mtd: rawnand: serialize lock/unlock against other NAND operations - mtd: rawnand: brcmnand: skip DMA during panic write - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - drm/i915/gt: Check set_default_submission() before deferencing - lib/bootconfig: check xbc_init_node() return in override path - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - xen/privcmd: restrict usage in unprivileged domU - xen/privcmd: add boot control for restricted usage in domU - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier() - s390/idle: Fix cpu idle exit cpu time accounting - s390/vtime: Fix virtual timer forwarding - PCI: endpoint: Introduce pci_epc_function_is_valid() - PCI: endpoint: Introduce pci_epc_mem_map()/unmap() - PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr() operation - PCI: dwc: ep: Use align addr function for dw_pcie_ep_raise_{msi,msix}_irq() - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user - drm/amdgpu: Fix locking bugs in error paths - btrfs: print correct subvol num if active swapfile prevents deletion - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - x86/acpi/boot: Correct acpi_is_processor_usable() check again - PCI: dw-rockchip: Don't wait for link since we can detect Link Up - Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up" - ata: libata-scsi: Refactor ata_scsi_simulate() - ata: libata-scsi: Refactor ata_scsiop_read_cap() - ata: libata-scsi: Refactor ata_scsiop_maint_in() - ata: libata-scsi: Document all VPD page inquiry actors - ata: libata-scsi: Remove struct ata_scsi_args - ata: libata: Remove ATA_DFLAG_ZAC device flag - ata: libata: Introduce ata_port_eh_scheduled() - ata: libata-scsi: avoid Non-NCQ command starvation - workqueue: Add system_percpu_wq and system_dfl_wq - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq - Input: synaptics_i2c - guard polling restart in resume - arm64: dts: rockchip: Fix rk3588 PCIe range mappings - ima: kexec: silence RCU list traversal warning - ima: rename variable the seq_file "file" to "ima_kexec_file" - ima: define and call ima_alloc_kexec_file_buf() - kexec: define functions to map and unmap segments - ima: kexec: define functions to copy IMA log at soft boot - ima: verify the previous kernel's IMA buffer lies in addressable RAM - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes() - btrfs: zoned: fix alloc_offset calculation for partly conventional block groups - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1 - btrfs: zoned: fixup last alloc pointer after extent removal for DUP - btrfs: zoned: fix stripe width calculation - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10 - ksmbd: check return value of xa_store() in krb5_authenticate - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023) - ALSA: hda/realtek: Implement sound init sequence for Samsung Galaxy Book3 Pro 360 - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book3 Ultra - ALSA: hda/realtek: Refactor and simplify Samsung Galaxy Book init - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG) - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18 - nvme: fix admin queue leak on controller reset - HID: multitouch: add quirks for Lenovo Yoga Book 9i - HID: multitouch: new class MT_CLS_EGALAX_P80H84 - idpf: change IRQ naming to match netdev and ethtool queue numbering - i40e: Fix preempt count leak in napi poll tracepoint - drm/xe: Do not preempt fence signaling CS instructions - wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" - drm/xe/reg_sr: Fix leak on xa_store failure - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset() - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-eh: Fix detection of deferred qc timeouts - Upstream stable to v6.6.129, v6.6.130, v6.12.76, v6.12.77 * Noble update: upstream stable patchset 2026-05-28 (LP: #2154496) // CVE-2026-43067 - ext4: handle wraparound when searching for blocks for indirect mapped blocks * Noble update: upstream stable patchset 2026-05-28 (LP: #2154496) // CVE-2025-39930 - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() * CVE-2026-46244 - netfilter: nft_inner: Fix IPv6 inner_thoff desync * CVE-2026-43185 - ksmbd: fix signededness bug in smb_direct_prepare_negotiation() * CVE-2026-46289 - lib/scatterlist: fix length calculations in extract_kvec_to_sg * CVE-2026-46119 - libceph: Fix slab-out-of-bounds access in auth message processing * CVE-2026-46135 - nvmet-tcp: fix race between ICReq handling and queue teardown * CVE-2026-46185 - smb/client: fix out-of-bounds read in symlink_data() * CVE-2026-46195 - smb: client: validate dacloffset before building DACL pointers * CVE-2026-46115 - block: add pgmap check to biovec_phys_mergeable * CVE-2026-43501 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows * CVE-2026-45988 - rxrpc: Fix re-decryption of RESPONSE packets * CVE-2026-46043 - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv * CVE-2026-43493 - crypto: pcrypt - Fix handling of MAY_BACKLOG requests * CVE-2026-43071 - dcache: Limit the minimal number of bucket to two * CVE-2026-31685 - netfilter: ip6t_eui64: reject invalid MAC header for all packets * CVE-2026-43117 - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() * CVE-2026-43114 - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry * CVE-2026-31607 - usbip: validate number_of_packets in usbip_pack_ret_submit() * CVE-2026-31659 - batman-adv: reject oversized global TT response buffers * CVE-2026-31649 - net: stmmac: fix integer underflow in chain mode * CVE-2026-31657 - batman-adv: hold claim backbone gateways by reference * CVE-2026-31637 - rxrpc: reject undecryptable rxkad response tickets * CVE-2026-31669 - mptcp: fix slab-use-after-free in __inet_lookup_established * CVE-2026-31668 - seg6: separate dst_cache for input and output paths in seg6 lwtunnel * CVE-2026-43011 - net/x25: Fix potential double free of skb * CVE-2026-43037 - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() * CVE-2026-43341 - net/ipv6: ioam6: prevent schema length wraparound in trace fill * CVE-2026-43038 - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() * CVE-2026-31682 - bridge: br_nd_send: linearize skb before parsing ND options * CVE-2026-31436 - dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() * CVE-2026-43384 - net/tcp-ao: Fix MAC comparison to be constant-time * CVE-2026-31448 - ext4: get rid of ppath in ext4_find_extent() - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: avoid infinite loops caused by residual data * CVE-2026-31478 - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() * CVE-2026-23428 - ksmbd: fix use-after-free of share_conf in compound request * CVE-2026-23450 - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() * CVE-2026-23455 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() * CVE-2026-31402 - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache * CVE-2026-43383 - net/tcp-md5: Fix MAC comparison to be constant-time * CVE-2026-43378 - smb: server: fix use-after-free in smb2_open() * CVE-2026-46243 - smb: client: reject userspace cifs.spnego descriptions * CVE-2026-43414 - scsi: qla2xxx: Completely fix fcport double free * CVE-2026-43407 - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() * CVE-2026-43406 - libceph: prevent potential out-of-bounds reads in process_message_header() -- John Cabaj <john.cabaj@canonical.com> Fri, 03 Jul 2026 09:02:28 -0500 ** Changed in: linux-azure (Ubuntu Noble) Status: Fix Committed => Fix Released ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21709 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39930 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-54505 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-54518 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-62626 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-71269 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23171 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23302 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23330 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23374 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23389 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23428 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23442 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23444 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23450 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23455 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23468 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31402 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31407 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31414 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31415 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31416 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31417 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31421 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31422 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31423 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31424 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31425 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31429 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31430 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31432 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31436 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31448 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31450 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31466 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31478 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31499 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31532 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31575 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31576 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31577 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31578 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31580 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31581 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31583 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31584 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31585 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31586 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31587 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31588 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31590 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31594 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31595 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31596 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31597 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31598 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31599 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31602 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31603 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31604 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31605 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31606 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31607 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31610 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31611 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31612 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31613 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31615 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31616 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31617 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31618 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31619 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31622 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31623 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31624 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31625 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31626 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31627 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31628 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31629 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31634 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31637 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31638 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31639 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31642 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31645 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31646 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31648 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31649 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31651 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31655 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31656 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31657 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31658 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31659 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31660 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31661 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31662 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31664 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31665 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31667 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31668 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31669 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31670 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31671 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31672 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31673 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31675 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31677 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31680 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31681 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31682 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31684 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31685 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31686 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31689 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31694 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31695 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31696 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31697 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31698 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31699 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31700 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31701 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31702 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31704 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31705 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31706 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31707 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31708 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31709 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31711 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31712 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31714 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31715 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31716 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31720 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31721 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31722 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31723 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31724 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31725 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31726 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31728 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31729 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31730 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31731 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31737 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31738 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31740 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31741 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31747 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31748 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31749 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31751 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31752 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31754 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31755 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31756 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31758 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31759 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31761 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31762 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31763 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31767 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31768 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31770 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31772 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31773 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31776 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31778 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31779 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31780 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31781 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43007 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43011 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43012 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43013 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43014 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43015 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43016 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43017 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43018 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43019 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43020 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43023 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43024 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43025 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43026 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43027 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43028 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43030 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43032 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43035 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43036 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43037 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43038 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43040 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43041 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43043 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43044 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43046 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43047 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43049 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43050 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43051 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43052 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43054 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43056 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43057 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43058 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43067 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43071 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43072 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43073 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43074 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43075 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43076 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43079 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43080 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43081 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43082 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43085 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43086 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43089 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43091 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43092 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43093 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43094 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43098 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43099 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43103 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43104 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43105 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43107 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43109 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43110 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43111 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43112 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43113 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43114 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43117 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43119 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43120 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43185 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43245 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43324 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43327 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43328 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43329 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43330 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43332 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43333 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43334 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43336 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43338 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43339 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43340 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43341 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43342 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43343 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43345 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43350 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43378 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43383 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43384 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43406 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43407 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43414 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43490 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43491 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43492 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43493 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43495 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43497 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43499 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43501 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43502 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45834 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45835 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45836 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45838 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45839 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45840 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45841 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45842 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45843 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45844 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45845 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45846 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45986 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45987 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45988 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45989 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45991 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45993 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45994 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45996 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45997 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-45999 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46002 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46003 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46004 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46005 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46006 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46007 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46009 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46011 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46012 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46015 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46016 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46018 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46019 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46021 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46022 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46023 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46024 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46026 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46027 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46031 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46033 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46037 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46038 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46040 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46041 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46043 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46044 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46046 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46047 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46049 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46050 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46051 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46052 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46053 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46056 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46058 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46061 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46062 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46063 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46064 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46065 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46068 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46069 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46070 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46072 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46073 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46075 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46076 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46077 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46079 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46080 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46082 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46083 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46084 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46086 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46089 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46090 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46091 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46092 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46094 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46098 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46099 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46101 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46102 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46103 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46106 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46107 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46108 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46110 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46111 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46112 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46113 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46114 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46115 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46116 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46117 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46119 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46120 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46121 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46122 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46123 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46124 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46125 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46126 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46127 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46128 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46129 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46131 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46132 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46133 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46135 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46136 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46137 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46138 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46139 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46142 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46143 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46144 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46145 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46146 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46149 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46150 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46151 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46152 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46157 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46159 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46160 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46161 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46163 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46164 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46167 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46168 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46169 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46172 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46173 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46174 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46176 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46177 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46178 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46179 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46180 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46184 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46185 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46186 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46187 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46189 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46190 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46191 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46193 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46194 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46195 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46196 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46197 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46198 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46199 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46200 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46201 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46204 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46205 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46206 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46207 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46208 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46209 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46211 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46212 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46214 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46218 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46219 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46220 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46225 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46226 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46227 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46229 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46230 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46231 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46232 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46233 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46234 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46235 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46236 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46238 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46241 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46243 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46244 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46273 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46274 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46276 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46280 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46282 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46285 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46286 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46287 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46289 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46291 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46292 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46293 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46294 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46296 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46299 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46301 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46303 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46304 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46306 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46307 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46312 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46314 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46319 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2158920 Title: noble-stable-2026-06-16 dropped a bracket causing FTBFS Status in linux package in Ubuntu: New Status in linux-azure package in Ubuntu: New Status in linux-raspi package in Ubuntu: New Status in linux source package in Noble: In Progress Status in linux-azure source package in Noble: Fix Released Status in linux-raspi source package in Noble: Fix Committed Bug description: [ Impact ] Azure and raspi noble kernels have recently been seeing FTBFS' due to a broken change introduced by upstream stable. Configs in that kernel bring out a compilation error due to a broken patch I adjusted in noble-stable-2026-06-16. [ Test Plan ] Kernel should compile properly after patch application. [ Where problems could occur ] Since the previous state was already a regression, there is no real risk of getting much worse. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2158920/+subscriptions