[Bug 2164507] Re: Dell Precision fails to shutdown when HDMI display is connected (22.04 HWE)

** Also affects: linux-hwe-6.8 (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2164507 Title: Dell Precision fails to shutdown when HDMI display is connected (22.04 HWE) Status in linux package in Ubuntu: New Status in linux-hwe-6.8 package in Ubuntu: New Status in linux source package in Jammy: New Status in linux-hwe-6.8 source package in Jammy: New Status in linux source package in Noble: Invalid Status in linux-hwe-6.8 source package in Noble: New Bug description: Discovered when running SRU, and initially recognized as an infra problem, we identified this issue with Dell Precision (internal ID 202301-31173), which is failing to shutdown in case an external monitor is connected over HDMI. The failure has been identified while running the Checkbox cold-reboot test case (see https://github.com/canonical/checkbox/blob/998d652a5402c42a62e6b5563f2f12cf119af8d8/providers/base/units/power- management/jobs.pxu#L389-L407). Steps to reproduce: - connect an external HDMI monitor - shut the device down, for instance in the same way described by the Checkbox test case above Expected result: - machine is off Actual result: - machine is still partially alive (not reachable over network) Enabling persistent logs, one can notice in dmesg: ``` <30>[ 93.659217] shutdown[1]: Powering off. <6>[ 96.945312] intel-ipu6-isys intel-ipu6-isys0: unbind Intel IVSC CSI <6>[ 97.272693] intel_vsc intel_vsc: silicon stepping version is 0:2 <4>[ 97.276042] intel_vsc intel_vsc: Direct firmware load for intel/vsc/ivsc_fw.bin failed with error -2 <6>[ 97.276050] fbcon: Taking over console <1>[ 97.276437] BUG: kernel NULL pointer dereference, address: 00000000000000f8 <1>[ 97.276440] #PF: supervisor read access in kernel mode <1>[ 97.276442] #PF: error_code(0x0000) - not-present page <6>[ 97.276444] PGD 0 P4D 0 <4>[ 97.276448] Oops: 0000 [#1] PREEMPT SMP NOPTI <4>[ 97.276452] CPU: 2 PID: 553 Comm: kworker/2:2 Tainted: G O 6.8.0-130-generic #130~22.04.1-Ubuntu <4>[ 97.276456] Hardware name: Dell Inc. Precision 5680/, BIOS 1.1.3 05/04/2023 <4>[ 97.276458] Workqueue: events fbcon_register_existing_fbs <4>[ 97.276469] RIP: 0010:intel_tc_port_in_dp_alt_mode+0x35/0x50 [i915] <4>[ 97.276807] Code: 53 4c 8b 27 48 89 fb 8b b7 84 00 00 00 4c 89 e7 e8 c0 5f f9 ff 4c 89 e7 48 8b 9b a0 0f 00 00 89 c6 e8 df 5e f9 ff 84 c0 74 0a <83> bb f8 00 00 00 02 0f 94 c0 5b 41 5c 5d 31 f6 31 ff c3 cc cc cc <4>[ 97.276810] RSP: 0018:ffffd1b7409df8b8 EFLAGS: 00010202 <4>[ 97.276814] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 000000000000000a <4>[ 97.276816] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 <4>[ 97.276818] RBP: ffffd1b7409df8c8 R08: 0000000000000000 R09: 0000000000000000 <4>[ 97.276819] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8b35e7b78000 <4>[ 97.276821] R13: ffff8b35f4794000 R14: ffff8b35f506e4c0 R15: ffff8b35f506e000 dmesg-efi_pstore-178711700504001: Oops#1 Part4 <4>[ 97.276823] FS: 0000000000000000(0000) GS:ffff8b393f300000(0000) knlGS:0000000000000000 <4>[ 97.276825] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 97.276827] CR2: 00000000000000f8 CR3: 000000012bae6006 CR4: 0000000000f70ef0 <4>[ 97.276830] PKRU: 55555554 <4>[ 97.276831] Call Trace: <4>[ 97.276834] <TASK> <4>[ 97.276838] icl_update_active_dpll+0xa6/0xe0 [i915] <4>[ 97.277161] icl_get_dplls+0x126/0x250 [i915] <4>[ 97.277478] intel_reserve_shared_dplls+0x20/0x80 [i915] <4>[ 97.277785] hsw_crtc_get_shared_dpll+0x64/0x80 [i915] <3>[ 97.278081] intel_vsc intel_vsc: hw_reset failed ret = -2 <4>[ 97.278074] intel_dpll_crtc_get_shared_dpll+0x105/0x180 [i915] <4>[ 97.278357] intel_crtc_atomic_check+0x1fe/0x2b0 [i915] <4>[ 97.278665] intel_atomic_check+0x6ea/0xc50 [i915] <4>[ 97.278954] drm_atomic_check_only+0x1ac/0x400 <4>[ 97.278962] ? update_output_state+0x184/0x1a0 <4>[ 97.278967] drm_atomic_commit+0x58/0xd0 <4>[ 97.278972] ? __pfx___drm_printfn_info+0x10/0x10 <4>[ 97.278977] drm_client_modeset_commit_atomic+0x203/0x240 <4>[ 97.278983] drm_client_modeset_commit_locked+0x5b/0x170 <4>[ 97.278988] ? mutex_lock+0x12/0x50 <4>[ 97.278995] drm_client_modeset_commit+0x26/0x50 <4>[ 97.279000] __drm_fb_helper_restore_fbdev_mode_unlocked+0xc2/0x100 <4>[ 97.279005] drm_fb_helper_set_par+0x2f/0x50 <4>[ 97.279008] intel_fbdev_set_par+0x1a/0x70 [i915] <4>[ 97.279259] ? con_is_visible+0x35/0x50 <4>[ 97.279265] fbcon_init+0x57d/0x650 <4>[ 97.279271] visual_init+0xef/0x190 <4>[ 97.279275] ? update_attr+0xcf/0x100 <4>[ 97.279279] do_bind_con_driver.isra.0+0x1ee/0x4c0 dmesg-efi_pstore-178711700503001: Oops#1 Part3 <4>[ 97.279285] do_take_over_console+0x3a/0x60 <4>[ 97.279291] do_fbcon_takeover+0x78/0x150 <4>[ 97.279295] ? raw_spin_rq_unlock+0x10/0x40 <4>[ 97.279301] do_fb_registered+0x140/0x270 <4>[ 97.279306] fbcon_register_existing_fbs+0x52/0xb0 <4>[ 97.279311] process_one_work+0x181/0x3a0 <4>[ 97.279316] worker_thread+0x18b/0x330 <4>[ 97.279320] ? __pfx_worker_thread+0x10/0x10 <4>[ 97.279323] kthread+0xef/0x120 <4>[ 97.279326] ? __pfx_kthread+0x10/0x10 <4>[ 97.279329] ret_from_fork+0x44/0x70 <4>[ 97.279335] ? __pfx_kthread+0x10/0x10 <4>[ 97.279337] ret_from_fork_asm+0x1b/0x30 <4>[ 97.279342] </TASK> <4>[ 97.279343] Modules linked in: snd_ctl_led snd_soc_sof_sdw snd_soc_intel_hda_dsp_common snd_soc_intel_sof_maxim_common snd_sof_probes snd_soc_rt711_sdca snd_soc_rt715_sdca snd_soc_rt1318_sdw regmap_sdw_mbq regmap_sdw snd_soc_dmic snd_sof_pci_intel_tgl nvme_fabrics snd_sof_intel_hda_common nvme_keyring soundwire_intel snd_sof_intel_hda_mlink soundwire_cadence snd_sof_intel_hda snd_hda_codec_hdmi snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi soundwire_generic_allocation soundwire_bus intel_uncore_frequency intel_uncore_frequency_common snd_soc_core ivsc_csi ivsc_ace snd_compress ac97_bus snd_pcm_dmaengine snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec x86_pkg_temp_thermal intel_powerclamp snd_hda_core snd_hwdep coretemp ccm bnep dell_rbtn mei_pxp mei_hdcp mei_vsc snd_pcm intel_rapl_msr snd_seq_midi iwlmvm kvm_intel snd_seq_midi_event dell_laptop btusb binfmt_misc snd_rawmidi mac80211 btrtl kvm btintel snd_seq btbcm btmtk dmesg-efi_pstore-178711700502001: Oops#1 Part2 <4>[ 97.279404] snd_seq_device intel_skl_int3472_tps68470 input_leds joydev dell_wmi irqbypass rapl intel_cstate libarc4 nls_iso8859_1 bluetooth serio_raw dell_wmi_ddv tps68470_regulator iwlwifi dell_smbios snd_timer intel_ipu6_isys(O) dell_smm_hwmon clk_tps68470 ecdh_generic dcdbas dell_wmi_sysman firmware_attributes_class ecc cmdlinepart spi_nor snd videobuf2_dma_contig mei_me hid_sensor_custom_intel_hinge hid_sensor_gyro_3d videobuf2_memops hid_sensor_als ledtrig_audio dell_wmi_descriptor wmi_bmof mtd soundcore hid_multitouch 8250_dw videobuf2_v4l2 hid_sensor_trigger cfg80211 mei processor_thermal_device_pci industrialio_triggered_buffer videobuf2_common processor_thermal_device kfifo_buf processor_thermal_wt_hint processor_thermal_rfim hid_sensor_iio_common processor_thermal_rapl intel_ipu6_psys(O) industrialio intel_rapl_common processor_thermal_wt_req intel_ipu6(O) processor_thermal_power_floor processor_thermal_mbox ipu_bridge igen6_edac mei_vsc_hw int3403_thermal int340x_thermal_zone ov02c10(O) intel_pmc_core dmesg-efi_pstore-178711700501001: Oops#1 Part1 <4>[ 97.279461] mac_hid v4l2_fwnode v4l2_async intel_skl_int3472_discrete intel_vsec intel_hid int3400_thermal pmt_telemetry acpi_thermal_rel sparse_keymap pmt_class acpi_pad acpi_tad sch_fq_codel v4l2loopback(O) videodev mc msr parport_pc ppdev lp parport efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 dm_mirror dm_region_hash dm_log xe drm_gpuvm drm_exec gpu_sched drm_suballoc_helper drm_ttm_helper spi_ljca gpio_ljca i2c_ljca usb_ljca hid_sensor_custom hid_sensor_hub intel_ishtp_hid i915 hid_generic spi_pxa2xx_platform crct10dif_pclmul dw_dmac crc32_pclmul drm_buddy dw_dmac_core polyval_clmulni i2c_algo_bit polyval_generic ttm ghash_clmulni_intel rtsx_pci_sdmmc nvme sha256_ssse3 sha1_ssse3 psmouse drm_display_helper spi_intel_pci i2c_i801 thunderbolt ucsi_acpi spi_intel i2c_smbus nvme_core intel_ish_ipc cec rtsx_pci intel_lpss_pci typec_ucsi xhci_pci intel_ishtp intel_lpss idma64 xhci_pci_renesas <4>[ 97.279536] nvme_auth rc_core typec video i2c_hid_acpi i2c_hid hid wmi pinctrl_tigerlake aesni_intel crypto_simd cryptd <4>[ 97.279548] CR2: 00000000000000f8 <4>[ 97.279550] ---[ end trace 0000000000000000 ]--- ``` ProblemType: Bug DistroRelease: Ubuntu 22.04 Package: linux-image-6.8.0-139-generic 6.8.0-139.139~22.04.1 ProcVersionSignature: Ubuntu 6.8.0-139.139~22.04.1-generic 6.8.12 Uname: Linux 6.8.0-139-generic x86_64 ApportVersion: 2.20.11-0ubuntu82.10 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: ubuntu 1263 F.... pulseaudio CasperMD5json: { "result": "skip" } Date: Wed Aug 19 15:05:36 2026 DistributionChannelDescriptor: # This is the distribution channel descriptor for the OEM CDs # For more information see http://wiki.ubuntu.com/DistributionChannelDescriptor canonical-oem-somerville-jammy-amd64-20220504-33+jellyfish-torchic+X77 InstallationDate: Installed on 2026-08-17 (1 days ago) InstallationMedia: Ubuntu 22.04 LTS "Jammy Jellyfish" - somerville-jammy-amd64-20220504-33 MachineType: Dell Inc. Precision 5480 ProcEnviron: TERM=xterm-256color PATH=(custom, no user) LANG=en_US.UTF-8 SHELL=/bin/bash ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-139-generic root=UUID=50b4f72e-9c49-4b8e-88c0-45ad05a5e30d ro automatic-oem-config quiet splash drm.debug=0x1ff vt.handoff=7 PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon. RelatedPackageVersions: linux-restricted-modules-6.8.0-139-generic N/A linux-backports-modules-6.8.0-139-generic N/A linux-firmware 20220329.git681281e4-0ubuntu3.42 SourcePackage: linux-hwe-6.8 UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 05/10/2023 dmi.bios.release: 1.3 dmi.bios.vendor: Dell Inc. dmi.bios.version: 1.3.0 dmi.board.vendor: Dell Inc. dmi.chassis.type: 10 dmi.chassis.vendor: Dell Inc. dmi.ec.firmware.release: 1.5 dmi.modalias: dmi:bvnDellInc.:bvr1.3.0:bd05/10/2023:br1.3:efr1.5:svnDellInc.:pnPrecision5480:pvr:rvnDellInc.:rn:rvr:cvnDellInc.:ct10:cvr:sku0C40: dmi.product.family: Precision dmi.product.name: Precision 5480 dmi.product.sku: 0C40 dmi.sys.vendor: Dell Inc. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2164507/+subscriptions

[Bug 2165291] Re: Ubuntu deployed by MAAS cannot be logged in and checkbox is not installed

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165291 Title: Ubuntu deployed by MAAS cannot be logged in and checkbox is not installed Status in linux package in Ubuntu: New Bug description: Deploy Ubuntu 26.04 from MAAS/stable (3.7.3-18030-g.9122eee68). After deployment complete, try to log in Ubuntu 26.04 with the default username and password (ubuntu/ubuntu), failed to log in with error "Login incorrect". It can be logged in via ssh from MAAS. Meanwhile, the checkbox is not istalled on the Ubuntu. Both the above two problems cannot be reproduced on Ubuntu deployed by MAAS/dege (3.7.3-18034-g.5409742bc). ubuntu@Perth-3720:~$ lsb_release -rd Description: Ubuntu 26.04 LTS Release: 26.04 ubuntu@Perth-3720:/etc/xdg$ snap info checkbox | grep installed ubuntu@Perth-3720:/etc/xdg$ snap info checkbox name: checkbox summary: Checkbox test runner publisher: Canonical Certification Team (ce-certification-qa) store-url: https://snapcraft.io/checkbox license: GPL-3.0+ description: | Checkbox is a flexible test automation software. It’s the main tool used in Ubuntu Certification program. snap-id: 06zlGRiJvdhJMO5NFVNjIOcZ1g3m8yVb channels: latest/stable: 7.4.0-dev135 2026-08-24 (26684) 28.7kB classic latest/candidate: ↑ latest/beta: 7.4.0-dev135 2026-08-16 (26684) 28.7kB classic latest/edge: 7.5.0-dev29 2026-08-26 (27045) 28.7kB classic uc26/stable: 7.4.0-dev135 2026-08-24 (26695) 11.8MB - uc26/candidate: ↑ uc26/beta: 7.4.0-dev135 2026-08-16 (26695) 11.8MB - uc26/edge: 7.5.0-dev29 2026-08-26 (27057) 11.8MB - uc24/stable: 7.4.0-dev135 2026-08-24 (26711) 11.5MB - uc24/candidate: ↑ uc24/beta: 7.4.0-dev135 2026-08-16 (26711) 11.5MB - uc24/edge: 7.5.0-dev29 2026-08-26 (27044) 11.5MB - uc22/stable: 7.4.0-dev135 2026-08-24 (26688) 28.7kB - uc22/candidate: ↑ uc22/beta: 7.4.0-dev135 2026-08-16 (26688) 28.7kB - uc22/edge: 7.5.0-dev29 2026-08-26 (27053) 28.7kB - uc20/stable: 7.4.0-dev135 2026-08-24 (26697) 28.7kB - uc20/candidate: ↑ uc20/beta: 7.4.0-dev135 2026-08-16 (26697) 28.7kB - uc20/edge: 7.5.0-dev29 2026-08-26 (27063) 28.7kB - uc18/stable: 7.4.0-dev135 2026-08-24 (26699) 28.7kB - uc18/candidate: ↑ uc18/beta: 7.4.0-dev135 2026-08-16 (26699) 28.7kB - uc18/edge: 7.5.0-dev29 2026-08-26 (27050) 28.7kB - uc16/stable: 7.4.0-dev135 2026-08-24 (26719) 28.7kB - uc16/candidate: ↑ uc16/beta: 7.4.0-dev135 2026-08-16 (26719) 28.7kB - uc16/edge: 7.5.0-dev29 2026-08-26 (27069) 28.7kB - certification_uc24/stable: 4.0.0-dev333 2024-07-24 (7721) 11.5MB - certification_uc24/candidate: ↑ certification_uc24/beta: ↑ certification_uc24/edge: ↑ certification_24.04/stable: 4.0.0-dev333 2024-07-24 (7720) 24.6kB classic certification_24.04/candidate: ↑ certification_24.04/beta: ↑ certification_24.04/edge: ↑ 26.04/stable: 7.4.0-dev135 2026-08-24 (26691) 16.4kB classic 26.04/candidate: ↑ 26.04/beta: 7.4.0-dev135 2026-08-16 (26691) 16.4kB classic 26.04/edge: 7.5.0-dev29 2026-08-26 (27058) 16.4kB classic 24.04/stable: 7.4.0-dev135 2026-08-24 (26684) 28.7kB classic 24.04/candidate: ↑ 24.04/beta: 7.4.0-dev135 2026-08-16 (26684) 28.7kB classic 24.04/edge: 7.5.0-dev29 2026-08-26 (27045) 28.7kB classic 22.04/stable: 7.4.0-dev135 2026-08-24 (26685) 28.7kB classic 22.04/candidate: ↑ 22.04/beta: 7.4.0-dev135 2026-08-16 (26685) 28.7kB classic 22.04/edge: 7.5.0-dev29 2026-08-26 (27042) 28.7kB classic 20.04/stable: 7.4.0-dev135 2026-08-24 (26694) 28.7kB classic 20.04/candidate: ↑ 20.04/beta: 7.4.0-dev135 2026-08-16 (26694) 28.7kB classic 20.04/edge: 7.5.0-dev29 2026-08-26 (27065) 28.7kB classic 18.04/stable: 7.4.0-dev135 2026-08-24 (26692) 28.7kB classic 18.04/candidate: ↑ 18.04/beta: 7.4.0-dev135 2026-08-16 (26692) 28.7kB classic 18.04/edge: 7.5.0-dev29 2026-08-26 (27048) 28.7kB classic 16.04/stable: 7.4.0-dev135 2026-08-24 (26718) 28.7kB classic 16.04/candidate: ↑ 16.04/beta: 7.4.0-dev135 2026-08-16 (26718) 28.7kB classic 16.04/edge: 7.5.0-dev29 2026-08-26 (27039) 28.7kB classic master@master-VMware20-1:/srv/mirrors/cloud$ snap info maas | grep installed installed: 3.7.3-18030-g.9122eee68 (42453) 229MB - To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165291/+subscriptions

[Bug 2165201] Re: GT216GLM display hangs when changing Nouveau pstate during an active graphics workload

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165201 Title: GT216GLM display hangs when changing Nouveau pstate during an active graphics workload Status in linux package in Ubuntu: New Bug description: I encountered a complete display freeze while manually selecting Nouveau performance states through the debugfs pstate interface on an NVIDIA GT216GLM (Quadro FX 880M). The freeze occurred during a repeated-transition test with glxgears active and required a forced powerdown. Hardware and software: - Lenovo ThinkPad W510 - NVIDIA GT216GLM / Quadro FX 880M, PCI ID 10de:0a3c, revision A2 - GPU subsystem ID 17aa:2145 - GPU VBIOS 70.16.5f.00.0d - Linux Mint 22.2, based on Ubuntu 24.04 Noble - Kernel 7.0.0-30-generic #30~24.04.1-Ubuntu - Kernel version signature Ubuntu 7.0.0-30.30~24.04.1-generic 7.0.12 - Mesa 25.2.8-0ubuntu0.24.04.2 - libdrm 2.4.125-1ubuntu0.1~24.04.2 - Xorg server 21.1.12-1ubuntu1.6 - xf86-video-nouveau 1.0.17-2ubuntu0.1 Only Nouveau was loaded for the GPU. The proprietary NVIDIA driver, nvidiafb, and rivafb were not loaded. Nouveau exposes the following states through /sys/kernel/debug/dri/0000:01:00.0/pstate: 03 core 135 MHz, shader 270 MHz, memory 135 MHz 07 core 405 MHz, shader 810 MHz, memory 324 MHz 0f core 550 MHz, shader 1210 MHz, memory 790 MHz A small experimental userspace governor selected 03 after ten seconds of inactivity and 0f after detecting graphics activity. It changed states by writing the two-character hexadecimal state followed by a newline to the debugfs pstate file. Write attempts were limited to no more than one per second and were made only when the requested state differed from the last retained state. Several isolated pstate transitions and complete 03 to 0f to 03 cycles completed without visible display problems. A hardware VDPAU decoding test also completed a full 03 to 0f to 03 transition successfully. For the failing test, the governor was left running while glxgears was started and stopped repeatedly to exercise multiple LOW-to-HIGH-to-LOW transitions. The display froze during the third graphics-workload cycle. Expected result: Nouveau should either complete a supported manual pstate transition safely or reject or defer the request without hanging PGRAPH and the display server. Actual result: The kernel log first reported an illegal graphics method from glxgears and a trapped PGRAPH write from Xorg. Two seconds later, the Nouveau pstate worker timed out in gt215_clk_pre(). Nouveau then repeatedly reported PGRAPH TLB flush idle timeout fail, and Xorg eventually failed to idle its channel. The initial failure sequence was: nouveau 0000:01:00.0: gr: DATA_ERROR 0000000c [INVALID_BITFIELD] nouveau 0000:01:00.0: gr: TRAP DISPATCH_QUERY nouveau 0000:01:00.0: gr: no stuck command? nouveau 0000:01:00.0: gr: 00300010 [ILLEGAL_MTHD] ch 8 [003efdc000 glxgears[41630]] subc 3 class 8597 mthd 15e0 data a9a80000 nouveau 0000:01:00.0: fb: trapped write at 0000000000 on channel 2 [3fa90000 Xorg[1130]] engine 00 [PGRAPH] client 03 [DISPATCH] subclient 02 [QUERY] reason 00000006 [NULL_DMAOBJ] nouveau 0000:01:00.0: gr: PGRAPH TLB flush idle timeout fail nouveau 0000:01:00.0: gr: PGRAPH_STATUS 0007ff13 [BUSY DISPATCH UNK4 CTXPROG VFETCH CCACHE_PREGEOM STRMOUT_VATTR_POSTGEOM VCLIP RATTR_APLANE TRAST CLIPID ZCULL ENG2D RMASK] nouveau 0000:01:00.0: timeout WARNING: drivers/gpu/drm/nouveau/nvkm/subdev/clk/gt215.c:331 at gt215_clk_pre+0x270/0x280 [nouveau] Workqueue: events nvkm_pstate_work [nouveau] Call Trace: gt215_clk_prog+0x38/0x230 [nouveau] nvkm_cstate_prog.constprop.0+0x260/0x280 [nouveau] nvkm_pstate_work+0x1a3/0x280 [nouveau] The PGRAPH TLB flush idle timeout fail message repeated approximately every two seconds until shutdown. The last relevant message was: nouveau 0000:01:00.0: Xorg[1130]: failed to idle channel 8 [Xorg[1130]] I have not attempted to reproduce this again because it risks another forced powerdown. A similar gt215_clk_pre() timeout followed by PGRAPH TLB-flush failures was reported when reclocking a GT218 during an active WebGL workload in 2016: https://www.mail-archive.com/dri-devel%40lists.freedesktop.org/msg153861.html Older GT215 reports also show the same repeated PGRAPH TLB-flush failure pattern: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-nouveau/+bug/977588 Regression status is unknown. I have not repeated this hazardous test using another kernel. I would particularly like to know whether manual GT216 pstate selection is expected to be safe while graphics channels are active, whether there is a known fix for this gt215_clk_pre() timeout, and whether the driver can reject or defer reclocking when PGRAPH cannot become idle. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165201/+subscriptions

[Bug 2165247] Re: dma-iommu.c kernel crash

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165247 Title: dma-iommu.c kernel crash Status in linux package in Ubuntu: New Bug description: Ubuntu kernel 7.0.0-30-generic repeatedly crashes during sustained NVIDIA CUDA/AI training workload. full log is available in the dmesg logs.txt file The crash contains: UBSAN: array-index-out-of-bounds in drivers/iommu/dma-iommu.c:193:25 index -1523926064 is out of range for type 'long unsigned int [8192]' BUG: unable to handle page fault for address: fffffffcd2dccf60 Oops: Oops: 0000 [#1] SMP NOPTI RIP: fq_flush_timeout+0x57/0x120 CPU: 3 UID: 1000 PID: 12348 Comm: python Hardware: MSI PRO Z890-P WIFI (MS-7E34) NVIDIA GPU PCI ID 10de:2684 NVIDIA open kernel module 580.173.02 The failure is reproducible under AI training load and has caused multiple unclean reboots. A kdump from the latest occurrence is available at: /var/crash/202608271339/ ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-30-generic 7.0.0-30.30 ProcVersionSignature: Ubuntu 7.0.0-30.30-generic 7.0.12 Uname: Linux 7.0.0-30-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/controlC1', '/dev/snd/hwC1D2', '/dev/snd/hwC1D0', '/dev/snd/pcmC1D9p', '/dev/snd/pcmC1D8p', '/dev/snd/pcmC1D7p', '/dev/snd/pcmC1D3p', '/dev/snd/pcmC1D2c', '/dev/snd/pcmC1D0c', '/dev/snd/pcmC1D0p', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D9p', '/dev/snd/pcmC0D8p', '/dev/snd/pcmC0D7p', '/dev/snd/pcmC0D3p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1: CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Thu Aug 27 13:46:04 2026 InstallationDate: Installed on 2026-02-24 (184 days ago) InstallationMedia: Ubuntu 25.10 "Questing Quokka" - Release amd64 (20251007) MachineType: Micro-Star International Co., Ltd. MS-7E34 ProcEnviron:  LANG=en_US.UTF-8  PATH=(custom, no user)  SHELL=/bin/bash  TERM=xterm-256color  XDG_RUNTIME_DIR=<set> ProcFB: ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-30-generic root=UUID=2559f3ff-5281-4fdf-ac70-83f5c8203c91 ro quiet splash crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: Upgraded to resolute on 2026-08-03 (24 days ago) dmi.bios.date: 03/05/2026 dmi.bios.release: 5.32 dmi.bios.vendor: American Megatrends International, LLC. dmi.bios.version: 1.AC1 dmi.board.asset.tag: Default string dmi.board.name: PRO Z890-P WIFI (MS-7E34) dmi.board.vendor: Micro-Star International Co., Ltd. dmi.board.version: 1.0 dmi.chassis.asset.tag: Default string dmi.chassis.type: 3 dmi.chassis.vendor: Micro-Star International Co., Ltd. dmi.chassis.version: 1.0 dmi.modalias: dmi:bvnAmericanMegatrendsInternational,LLC.:bvr1.AC1:bd03/05/2026:br5.32:svnMicro-StarInternationalCo.,Ltd.:pnMS-7E34:pvr1.0:rvnMicro-StarInternationalCo.,Ltd.:rnPROZ890-PWIFI(MS-7E34):rvr1.0:cvnMicro-StarInternationalCo.,Ltd.:ct3:cvr1.0:skuDefaultstring:pfaDefaultstring: dmi.product.family: Default string dmi.product.name: MS-7E34 dmi.product.sku: Default string dmi.product.version: 1.0 dmi.sys.vendor: Micro-Star International Co., Ltd. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165247/+subscriptions

[Bug 2165430] [NEW] 8/24/26 daily current live ubuntu-mate provides no network connection.

Public bug reported: I booted up the live iso of ubuntu-mate 26.10 to check it out for possible installation, GUI loads OK, but when I got Firefox launched there was an error showing "can't connect to server" and the network applet showed one of its legs with an "x" rather than a "connection" . . . with an ethernet connection that I am using now to type this bug report. I tried to click "enable networking" . . . but that did nothing to provide a connection. I tried to run "ping google.com" which failed to show any pings. As there was no internet connection provided in the live session I couldn't file the bug report from the system, had to reboot out of it. Today filing from another OS I have installed on the machine. Two posts on different sub-forums of the ubuntu pre-release sub-forum were filed and the best advice provided was to file a bug report on it, "probably a missing driver" . . . and it probably is. ** Affects: linux (Ubuntu) Importance: Undecided Status: New ** Tags: kernel-daily-bug ** Attachment added: "20260825_163311.jpg" https://bugs.launchpad.net/bugs/2165430/+attachment/5996017/+files/20260825_163311.jpg -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165430 Title: 8/24/26 daily current live ubuntu-mate provides no network connection. Status in linux package in Ubuntu: New Bug description: I booted up the live iso of ubuntu-mate 26.10 to check it out for possible installation, GUI loads OK, but when I got Firefox launched there was an error showing "can't connect to server" and the network applet showed one of its legs with an "x" rather than a "connection" . . . with an ethernet connection that I am using now to type this bug report. I tried to click "enable networking" . . . but that did nothing to provide a connection. I tried to run "ping google.com" which failed to show any pings. As there was no internet connection provided in the live session I couldn't file the bug report from the system, had to reboot out of it. Today filing from another OS I have installed on the machine. Two posts on different sub-forums of the ubuntu pre-release sub-forum were filed and the best advice provided was to file a bug report on it, "probably a missing driver" . . . and it probably is. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165430/+subscriptions

[Bug 1786013] Autopkgtest regression report (linux-meta-oracle-7.0/7.0.0-1011.11~24.04.1)

All autopkgtests for the newly accepted linux-meta-oracle-7.0 (7.0.0-1011.11~24.04.1) for noble have finished running. The following regressions have been reported in tests triggered by the package: backport-iwlwifi-dkms/unknown (arm64) fwts/unknown (arm64) lxc/unknown (arm64) systemd/unknown (arm64) Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1]. https://ubuntu-archive-team.ubuntu.com/proposed- migration/noble/update_excuses.html#linux-meta-oracle-7.0 [1] https://documentation.ubuntu.com/project/SRU/howto/autopkgtest- failure/ Thank you! -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/1786013 Title: Packaging resync Status in linux package in Ubuntu: Fix Released Status in linux-azure package in Ubuntu: Fix Released Status in linux-azure-edge package in Ubuntu: Fix Released Status in linux source package in Precise: Fix Released Status in linux-azure source package in Precise: Won't Fix Status in linux-azure-edge source package in Precise: Won't Fix Status in linux source package in Trusty: Fix Released Status in linux-azure source package in Trusty: Fix Released Status in linux-azure-edge source package in Trusty: Won't Fix Status in linux source package in Xenial: Fix Released Status in linux-azure source package in Xenial: Fix Released Status in linux-azure-edge source package in Xenial: Fix Released Status in linux source package in Bionic: Fix Released Status in linux-azure source package in Bionic: Fix Released Status in linux-azure-edge source package in Bionic: Fix Released Status in linux source package in Cosmic: Fix Released Status in linux-azure source package in Cosmic: Fix Released Status in linux-azure-edge source package in Cosmic: Won't Fix Status in linux source package in Disco: Fix Released Status in linux-azure source package in Disco: Fix Released Status in linux-azure-edge source package in Disco: Won't Fix Bug description: Ongoing packaging resyncs. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1786013/+subscriptions

Re: [Bug 2161309] Re: Backlight regression

yes, no dice On August 27, 2026 10:41:34 AM PDT, Daniel Letzeisen <2161309@bugs.launchpad.net> wrote: >@Craig: >Di you try the -31 kernel without any extra parameters (i.e. get rid of i915.enable_dpcd_backlight=0 ) ? > >-- >You received this bug notification because you are subscribed to a >duplicate bug report (2163518). >https://bugs.launchpad.net/bugs/2161309 > >Title: > Backlight regression > >Status in linux package in Ubuntu: > Fix Committed >Status in linux-hwe-7.0 package in Ubuntu: > Fix Committed >Status in linux source package in Noble: > Invalid >Status in linux-hwe-7.0 source package in Noble: > Fix Committed >Status in linux source package in Resolute: > Fix Committed >Status in linux-hwe-7.0 source package in Resolute: > Invalid > >Bug description: > ----------------------------- > > Possible workaround until 7.0.0-31 kernel is released > Boot with i915.enable_dpcd_backlight=0 parameter > > ----------------------------- > > ThinkPad T480 > Intel UHD 620 > brightness works on 7.0.0-27 > brightness fails on 7.0.0-28 > /sys/class/backlight/intel_backlight changes but panel does not > > ProblemType: Bug > DistroRelease: Ubuntu 26.04 > Package: linux-image-7.0.0-27-generic 7.0.0-27.27 > ProcVersionSignature: Ubuntu 7.0.0-27.27-generic 7.0.6 > Uname: Linux 7.0.0-27-generic x86_64 > ApportVersion: 2.34.0-0ubuntu2 > Architecture: amd64 > AudioDevicesInUse: >  USER PID ACCESS COMMAND >  /dev/snd/controlC0: neal 3608 F.... wireplumber >  /dev/snd/seq: neal 3589 F.... pipewire > CasperMD5CheckResult: unknown > CurrentDesktop: ubuntu:GNOME > Date: Mon Jul 20 12:47:12 2026 > InstallationDate: Installed on 2026-07-12 (8 days ago) > InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) > MachineType: LENOVO 20L6S6L601 > ProcFB: 0 i915drmfb > ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-27-generic root=UUID=1cea3fcd-0665-4cb4-a85a-4ebc58d5aed0 ro quiet splash acpi_backlight=native crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M > SourcePackage: linux > UpgradeStatus: No upgrade log present (probably fresh install) > dmi.bios.date: 09/06/2025 > dmi.bios.release: 1.56 > dmi.bios.vendor: LENOVO > dmi.bios.version: N24ET81W (1.56 ) > dmi.board.asset.tag: Not Available > dmi.board.name: 20L6S6L601 > dmi.board.vendor: LENOVO > dmi.board.version: SDK0J40697 WIN > dmi.chassis.asset.tag: No Asset Information > dmi.chassis.type: 10 > dmi.chassis.vendor: LENOVO > dmi.chassis.version: None > dmi.ec.firmware.release: 1.22 > dmi.modalias: dmi:bvnLENOVO:bvrN24ET81W(1.56):bd09/06/2025:br1.56:efr1.22:svnLENOVO:pn20L6S6L601:pvrThinkPadT480:rvnLENOVO:rn20L6S6L601:rvrSDK0J40697WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_20L6_BU_Think_FM_ThinkPadT480:pfaThinkPadT480: > dmi.product.family: ThinkPad T480 > dmi.product.name: 20L6S6L601 > dmi.product.sku: LENOVO_MT_20L6_BU_Think_FM_ThinkPad T480 > dmi.product.version: ThinkPad T480 > dmi.sys.vendor: LENOVO > >To manage notifications about this bug go to: >https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161309/+subscriptions > -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2161309 Title: Backlight regression Status in linux package in Ubuntu: Fix Committed Status in linux-hwe-7.0 package in Ubuntu: Fix Committed Status in linux source package in Noble: Invalid Status in linux-hwe-7.0 source package in Noble: Fix Committed Status in linux source package in Resolute: Fix Committed Status in linux-hwe-7.0 source package in Resolute: Invalid Bug description: ----------------------------- Possible workaround until 7.0.0-31 kernel is released Boot with i915.enable_dpcd_backlight=0 parameter ----------------------------- ThinkPad T480 Intel UHD 620 brightness works on 7.0.0-27 brightness fails on 7.0.0-28 /sys/class/backlight/intel_backlight changes but panel does not ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: linux-image-7.0.0-27-generic 7.0.0-27.27 ProcVersionSignature: Ubuntu 7.0.0-27.27-generic 7.0.6 Uname: Linux 7.0.0-27-generic x86_64 ApportVersion: 2.34.0-0ubuntu2 Architecture: amd64 AudioDevicesInUse:  USER PID ACCESS COMMAND  /dev/snd/controlC0: neal 3608 F.... wireplumber  /dev/snd/seq: neal 3589 F.... pipewire CasperMD5CheckResult: unknown CurrentDesktop: ubuntu:GNOME Date: Mon Jul 20 12:47:12 2026 InstallationDate: Installed on 2026-07-12 (8 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: LENOVO 20L6S6L601 ProcFB: 0 i915drmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-27-generic root=UUID=1cea3fcd-0665-4cb4-a85a-4ebc58d5aed0 ro quiet splash acpi_backlight=native crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M SourcePackage: linux UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 09/06/2025 dmi.bios.release: 1.56 dmi.bios.vendor: LENOVO dmi.bios.version: N24ET81W (1.56 ) dmi.board.asset.tag: Not Available dmi.board.name: 20L6S6L601 dmi.board.vendor: LENOVO dmi.board.version: SDK0J40697 WIN dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: None dmi.ec.firmware.release: 1.22 dmi.modalias: dmi:bvnLENOVO:bvrN24ET81W(1.56):bd09/06/2025:br1.56:efr1.22:svnLENOVO:pn20L6S6L601:pvrThinkPadT480:rvnLENOVO:rn20L6S6L601:rvrSDK0J40697WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_20L6_BU_Think_FM_ThinkPadT480:pfaThinkPadT480: dmi.product.family: ThinkPad T480 dmi.product.name: 20L6S6L601 dmi.product.sku: LENOVO_MT_20L6_BU_Think_FM_ThinkPad T480 dmi.product.version: ThinkPad T480 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161309/+subscriptions

[Bug 2163247] Re: Ubuntu 26.04 LTS -- Realtek ALC3347 on Lenovo Yoga 7 Pro 15IPH11 Output Device Marked as "Dummy Output"

** Changed in: sound-2.6 Status: Unknown => New -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2163247 Title: Ubuntu 26.04 LTS -- Realtek ALC3347 on Lenovo Yoga 7 Pro 15IPH11 Output Device Marked as "Dummy Output" Status in sound-2.6 (alsa-kernel): New Status in alsa-driver package in Ubuntu: Invalid Status in linux package in Ubuntu: Triaged Bug description: No sound coming from laptop speakers. Audio output marked as Dummy Output, microphone not recognized. Alsa does not initialize the codec. I searched around on the internet and it seems to be new. Probably a driver is needed for that codec. Bluetooth audio works as expected. Tried the common internet tricks and scripts, nothing. Tried multiple flavours of Debian-based, Fedora-based and Arch based distros, problem persists. Tried kernel 7.0.0-22-generic, still nothing out of desperation I installed latest stable mainline kernel from kernel.ubuntu.com - v7.1.5-generic, problem still persists Ubuntu Release: 26.04 LTS Linux Release: 7.0.0-29-generic What is expected to happen: Sound is supported by Alsa drivers, sound output from speakers normal. What happened instead: No sound coming from laptop speakers, Alsa does not initialize or recognize the codec. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: alsa-base 1.0.25+dfsg-0ubuntu9 ProcVersionSignature: Ubuntu 7.0.0-29.29-generic 7.0.12 Uname: Linux 7.0.0-29-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: omar 4317 F.... wireplumber /dev/snd/seq: omar 4311 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Tue Aug 11 16:01:35 2026 InstallationDate: Installed on 2026-08-11 (0 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: LENOVO 83SN PackageArchitecture: all ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> SourcePackage: alsa-driver UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 05/14/2026 dmi.bios.release: 1.37 dmi.bios.vendor: LENOVO dmi.bios.version: TNCN37WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Yoga Pro 7 15IPH11 dmi.ec.firmware.release: 1.37 dmi.modalias: dmi:bvnLENOVO:bvrTNCN37WW:bd05/14/2026:br1.37:efr1.37:svnLENOVO:pn83SN:pvrYogaPro715IPH11:rvnLENOVO:rnLNVNB161216:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrYogaPro715IPH11:skuLENOVO_MT_83SN_BU_idea_FM_YogaPro715IPH11:pfaYogaPro715IPH11: dmi.product.family: Yoga Pro 7 15IPH11 dmi.product.name: 83SN dmi.product.sku: LENOVO_MT_83SN_BU_idea_FM_Yoga Pro 7 15IPH11 dmi.product.version: Yoga Pro 7 15IPH11 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/sound-2.6/+bug/2163247/+subscriptions

[Bug 2163247] Re: Ubuntu 26.04 LTS -- Realtek ALC3347 on Lenovo Yoga 7 Pro 15IPH11 Output Device Marked as "Dummy Output"

** Bug watch added: github.com/thesofproject/linux/issues #5884 https://github.com/thesofproject/linux/issues/5884 ** Also affects: sound-2.6 via https://github.com/thesofproject/linux/issues/5884 Importance: Unknown Status: Unknown ** Changed in: alsa-driver (Ubuntu) Status: New => Triaged ** Also affects: linux (Ubuntu) Importance: Undecided Status: New ** Changed in: alsa-driver (Ubuntu) Status: Triaged => Invalid ** Changed in: linux (Ubuntu) Status: New => Triaged -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2163247 Title: Ubuntu 26.04 LTS -- Realtek ALC3347 on Lenovo Yoga 7 Pro 15IPH11 Output Device Marked as "Dummy Output" Status in sound-2.6 (alsa-kernel): Unknown Status in alsa-driver package in Ubuntu: Invalid Status in linux package in Ubuntu: Triaged Bug description: No sound coming from laptop speakers. Audio output marked as Dummy Output, microphone not recognized. Alsa does not initialize the codec. I searched around on the internet and it seems to be new. Probably a driver is needed for that codec. Bluetooth audio works as expected. Tried the common internet tricks and scripts, nothing. Tried multiple flavours of Debian-based, Fedora-based and Arch based distros, problem persists. Tried kernel 7.0.0-22-generic, still nothing out of desperation I installed latest stable mainline kernel from kernel.ubuntu.com - v7.1.5-generic, problem still persists Ubuntu Release: 26.04 LTS Linux Release: 7.0.0-29-generic What is expected to happen: Sound is supported by Alsa drivers, sound output from speakers normal. What happened instead: No sound coming from laptop speakers, Alsa does not initialize or recognize the codec. ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: alsa-base 1.0.25+dfsg-0ubuntu9 ProcVersionSignature: Ubuntu 7.0.0-29.29-generic 7.0.12 Uname: Linux 7.0.0-29-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: omar 4317 F.... wireplumber /dev/snd/seq: omar 4311 F.... pipewire CasperMD5CheckResult: pass CurrentDesktop: ubuntu:GNOME Date: Tue Aug 11 16:01:35 2026 InstallationDate: Installed on 2026-08-11 (0 days ago) InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1) MachineType: LENOVO 83SN PackageArchitecture: all ProcEnviron: LANG=en_US.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm-256color XDG_RUNTIME_DIR=<set> SourcePackage: alsa-driver UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 05/14/2026 dmi.bios.release: 1.37 dmi.bios.vendor: LENOVO dmi.bios.version: TNCN37WW dmi.board.asset.tag: NO Asset Tag dmi.board.name: LNVNB161216 dmi.board.vendor: LENOVO dmi.board.version: SDK0T76576 WIN dmi.chassis.asset.tag: NO Asset Tag dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Yoga Pro 7 15IPH11 dmi.ec.firmware.release: 1.37 dmi.modalias: dmi:bvnLENOVO:bvrTNCN37WW:bd05/14/2026:br1.37:efr1.37:svnLENOVO:pn83SN:pvrYogaPro715IPH11:rvnLENOVO:rnLNVNB161216:rvrSDK0T76576WIN:cvnLENOVO:ct10:cvrYogaPro715IPH11:skuLENOVO_MT_83SN_BU_idea_FM_YogaPro715IPH11:pfaYogaPro715IPH11: dmi.product.family: Yoga Pro 7 15IPH11 dmi.product.name: 83SN dmi.product.sku: LENOVO_MT_83SN_BU_idea_FM_Yoga Pro 7 15IPH11 dmi.product.version: Yoga Pro 7 15IPH11 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/sound-2.6/+bug/2163247/+subscriptions

[Bug 2165172] Re: can not update from kernel 7.0.0-28-generic to 7.0.0-29-generic due to broken package

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165172 Title: can not update from kernel 7.0.0-28-generic to 7.0.0-29-generic due to broken package Status in linux package in Ubuntu: Invalid Bug description: can not update from kernal 7.0.0-28-generic to 7.0.0-29-generic due to broken package To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165172/+subscriptions

[Bug 2165192] [NEW] Jammy update: v5.15.216 upstream stable release

Public bug reported: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.216 upstream stable release from git://git.kernel.org/ nvmet-tcp: Fix potential UAF when ddgst mismatch futex: Prevent lockup in requeue-PI during signal/ timeout wakeup macsec: don't read an unset MAC header in macsec_encrypt() KVM: nVMX: Hide shadow VMCS right after VMCLEAR KVM: x86/mmu: Fix use-after-free on vendor module reload can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: serialize TX state transitions under so->rx_lock dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Input: ims-pcu - fix logic error in packet reset KVM: VMX: Make vmread_error_trampoline() uncallable from C code IB/mad: Drop unmatched RMPP responses before reassembly mtd: mtdswap: remove debugfs stats file on teardown mtd: nand: mtk-ecc: stop on ECC idle timeouts btrfs: reject free space cache with more entries than pages btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() RDMA/hns: Fix potential integer overflow in mhop hem cleanup RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp RDMA/siw: publish QP after initialization RDMA/irdma: Prevent overflows in memory contiguity checks xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert wifi: cfg80211: cancel sched scan results work on unregister wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() wifi: mac80211_hwsim: clamp virtio RX length before skb_put wifi: libertas: fix memory leak in helper_firmware_cb() wifi: p54: validate RX frame length in p54_rx_eeprom_readback() wifi: cfg80211: validate PMSR measurement type data wifi: cfg80211: validate PMSR FTM preamble range wifi: cfg80211: reject unsupported PMSR FTM location requests wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock wifi: brcmfmac: initialize SDIO data work before cleanup wifi: cfg80211: bound element ID read when checking non-inheritance ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF ipv4: fib: free fib_alias with kfree_rcu() on insert error path net/iucv: take a reference on the socket found in afiucv_hs_rcv() ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts ata: sata_dwc_460ex: remove variable num_processed ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Bluetooth: qca: fix NVM tag length underflow in TLV parser smb/client: handle overlapping allocated ranges in fallocate drm/i915/gt: use correct selftest config symbol powerpc/time: Fix sparse warnings powerpc: remove the last remnants of cputime_t sched/vtime: Get rid of generic vtime_task_switch() implementation powerpc/time: Prepare to stop elapsing in dynticks-idle powerpc/vtime: Initialize starttime at boot for native accounting can: j1939: fix lockless local-destination check ksmbd: validate compound request size before reading StructureSize2 drm/i915/selftests: Fix GT PM sort comparators net/sched: act_tunnel_key: Defer dst_release to RCU callback sctp: fix auth_hmacs array size in struct sctp_cookie mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() USB: storage: add NO_ATA_1X quirk for Longmai USB Key usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: printer: fix infinite loop in printer_read() USB: gadget: snps-udc: fix device name leak on probe failure USB: gadget: fsl-udc: fix device name leak on probe failure usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: io_edgeport: cap received transmit credits USB: serial: keyspan_pda: fix data loss on receive throttling USB: serial: option: add TDTECH MT5710-CN crypto: rsa-pkcs1pad: Don't WARN on an empty digest bpf: Fix ld_{abs,ind} failure path analysis in subprogs usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() firewire: net: Fix fragmented datagram reassembly wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler wifi: ath6kl: fix OOB read from firmware IE lengths in connect event wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read wifi: carl9170: fix OOB read from off-by-two in TX status handler wifi: carl9170: fix buffer overflow in rx_stream failover path btrfs: free mapping node on duplicate reloc root insert ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status hwmon: (occ) Add sysfs entry for OCC mode hwmon: (occ) Add sysfs entries for additional extended status bits hwmon: (occ) Delay hwmon registration until user request hwmon: occ: validate poll response sensor blocks net/packet: avoid fanout hook re-registration after unregister rds: drop incoming messages that cross network namespace boundaries dpaa2-switch: put MAC endpoint device on disconnect net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call dpaa2-eth: put MAC endpoint device on disconnect nfp: Check resource mutex allocation wan: wanxl: Only reset hardware after BAR mapping wifi: mwifiex: bound uAP association event IEs to the event buffer iommu/amd: Bound the early ACPI HID map iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() wifi: mac80211: recalculate TIM when a station enters power save amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp: validate stream count in sctp_process_strreset_inreq() nexthop: initialize extack in nh_res_bucket_migrate() tipc: fix infinite loop in __tipc_nl_compat_dumpit wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() wifi: brcmfmac: fix 802.1X-SHA256 call trace warning net: bridge: vlan: fix vlan range dumps starting with pvid net: hsr: fix memory leak on slave unregistration by removing synced VLANs sctp: auth: verify auth requirement when auth_chunk is NULL vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets tipc: fix u16 MTU truncation in media and bearer MTU validation net: stmmac: add tc flower filter for EtherType matching net: stmmac: fix l3l4 filter rejecting unsupported offload requests net: stmmac: reset residual action in L3L4 filters on delete octeontx2-vf: set TC flower flag on MCAM entry allocation ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup hinic: remove unused ethtool RSS user configuration buffers net: qrtr: restrict socket creation to the initial network namespace net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule net/mlx5e: Report zero bandwidth for non-ETS traffic classes net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation raw: use more conventional iterators net: ipv6: fix dif and sdif mismatch in raw6_icmp_error bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF can: bcm: add locking when updating filter and timer values can: bcm: fix CAN frame rx/tx statistics can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: add missing device refcount for CAN filter removal can: bcm: fix stale rx/tx ops after device removal can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: track a single source interface for ANYDEV timeout/throttle ops drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() drm/radeon: fix r100_copy_blit for large BOs drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() drm/i915: Return NULL on error in active_instance drm/i915/gem: Do not leak siblings[] on proto context error drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU drm/amdgpu: Fix VFCT bus number matching with soft filter drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved drm/vmwgfx: Validate vmw_surface_metadata::array_size media: airspy: Return queued buffers on start_streaming() failure media: cec: seco: unregister adapter on IR probe failure media: cedrus: clean up media device on probe failure media: cedrus: Fix missing cleanup in error path media: cedrus: skip invalid H.264 reference list entries media: cx231xx: fix devres lifetime media: cx23885: add ioremap return check and cleanup media: meson: vdec: Fix memory leak in error path of vdec_open media: msi2500: Return queued buffers on start_streaming() failure media: pci: dm1105: Free allocated workqueue media: pwc: Drain fill_buf on start_streaming() failure media: pwc: Return queued buffers on start_streaming() failure media: radio-si476x: Unregister v4l2_device on probe failure media: rtl2832: fix use-after-free in rtl2832_remove() media: rtl2832_sdr: Return queued buffers on start_streaming() failure media: saa7134: Fix a possible memory leak in saa7134_video_init1 media: sun4i-csi: Return queued buffers on start_streaming() failure media: tegra-video: vi: fix invalid u32 return value in format lookup media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() media: vb2: use ssize_t for vb2_read/vb2_write media: vidtv: fix reference leak on failed device registration media: vimc: fix reference leak on failed device registration media: vivid: check for vb2_is_busy() when toggling caps wifi: ath6kl: fix OOB access from firmware ADDBA window size wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper wifi: wilc1000: validate assoc response length before subtracting header wifi: brcmfmac: make release_scratchbuffers idempotent staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset Bluetooth: RFCOMM: Fix session UAF in set_termios exec: fix unsigned loop counter wrap in transfer_args_to_stack() binfmt_misc: set have_execfd only once the interpreter is opened cdrom: fix stack out-of-bounds read in CDROMVOLCTRL x86/boot/compressed: Disable jump tables comedi: comedi_parport: deal with premature interrupt intel_th: fix MSC output device reference leak tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix resource leak on mmiotrace trace_pipe close tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() tracing/probes: Fix potential underflow in LEN_OR_ZERO macro tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" mptcp: only set DATA_FIN when a mapping is present sctp: don't free the ASCONF's own transport in DEL-IP processing ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() libceph: bound get_version reply decode to front len libceph: Fix multiplication overflow in decode_new_up_state_weight() libceph: guard missing CRUSH type name lookup libceph: refresh auth->authorizer_buf{,_len} after authorizer update libceph: Reject monmaps advertising zero monitors libceph: reject zero bucket types in crush_decode libceph: remove debugfs files before client teardown binfmt_elf_fdpic: only honour the first PT_INTERP iommu/vt-d: Disallow SVA if page walk is not coherent phonet: pep: fix use-after-free in pep_get_sb() vxlan: require CAP_NET_ADMIN in the device netns for changelink net: slip: serialize receive against buffer reallocation geneve: require CAP_NET_ADMIN in the device netns for changelink net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() net/iucv: fix use-after-free of a severed iucv_path net/x25: fix use-after-free in x25_kill_by_neigh() net: hip04: fix RX buffer leak on build_skb failure proc: Fix broken error paths for namespace links rbd: Reset positive result codes to zero in object map update path ice: use READ_ONCE() to access cached PHC time ila: reload IPv6 header after pskb_may_pull in checksum adjust mac802154: llsec: reject frames shorter than the authentication tag pppoe: reload header pointer after dev_hard_header() tipc: clear sock->sk on the failed-insert path in tipc_sk_create() drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() drm/amdgpu/gfx8: drop unecessary BUG_ON() drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() drm/amdgpu: fix division by zero with invalid uvd dimensions drm/amdgpu: invoke pm_genpd_remove() before freeing genpd tipc: fix use-after-free of the discoverer in tipc_disc_rcv() wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses openvswitch: fix GSO userspace truncation underflow raw: remove unused variables from raw6_icmp_error() raw: fix a typo in raw_icmp_error() net: mpls: initialize rtm_tos in mpls_getroute() media: uvcvideo: Implement dual stream quirk to fix loss of usb packets media: uvcvideo: Fix sequence number when no EOF gve: fix Rx queue stall on alloc failure HID: logitech-dj: Standardise hid_report_enum variable nomenclature HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report net: qrtr: ns: Limit the maximum server registration per node net: qrtr: ns: Raise node count limit to 512 dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup phy: zynqmp: Allow variation in refclk rate phy-zynqmp: Postpone getting clock rate until actually needed phy: zynqmp: fix clock error handling in xpsgtr_phy_init() phy: zynqmp: fix runtime PM leak on probe allocation failure netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() drm/mediatek: Check CRTC state before freeing keys: fix out-of-bounds read in keyring_get_key_chunk() keys: make keyring key-chunk byte order agree with keyring_diff_objects() assoc_array: trim the final shortcut word using the current chunk end netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH netfilter: nft_payload: fix mask build for partial field offload rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer smb: client: fix buffer leaks in SMB1 read and write hwmon: (nct6775-core) Prevent access to unsupported weight registers net: bridge: mrp: fix Option TLV length in MRP_Test frames forcedeth: fix UAF of txrx_stats in nv_remove hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors hwmon: (adt7470) Fix cache updated before hardware write on I2C error hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks hwmon: (adt7470) Use cached PWM frequency value hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read hwmon: (adt7470) Fix PWM auto temp state array and bounds check powerpc/boot: Fix simpleboot CPU node lookup check powerpc/boot: Fix treeboot-currituck CPU node lookup check powerpc/boot: Fix treeboot-akebono CPU node lookup check wifi: mac80211: validate individual TWT params before driver setup hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp net: phylink: put link_gpio if phylink_create fails scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req net: sxgbe: free TX rings on RX allocation failure net: sxgbe: check descriptor ring allocation failures can: isotp: check register_netdevice_notifier() error in module init tracing/mmiotrace: Reset dropped_count in mmio_reset_data() octeontx2-pf: Set correct sequence for carrier off and tx queue stop qede: sync udp_tunnel ports outside qede_lock in the recovery path rhashtable: clear stale iter->p on table restart pinctrl: devicetree: don't free uninitialized dev_name on error path pinctrl: bm1880: add missing select GENERIC_PINCONF mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() mm/hugetlb: fix list corruption in allocate_file_region_entries() sctp: validate Adaptation Indication parameter length audit: fix potential integer overflow in audit_log_n_string() audit: fix potential use-after-free in audit_del_rule() Bluetooth: HIDP: reject frames without a transaction header Bluetooth: HIDP: validate numbered report payloads bpf: lwt: Fix dst reference leak on reroute failure ALSA: 6fire: Fix UAF at error handling during probe ALSA: lx6464es: fix period byte count for 16-bit streams ALSA: pcm: wake linked drain waiters on unlink ASoC: tas2562: fix DVC coefficient write order ASoC: tas2562: fix broken entries in the volume lookup table ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set ALSA: usb-audio: Clamp frame size in implicit-feedback mode dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ e1000: fix memory leak in e1000_probe() igbvf: Fix leak in TX DMA error cleanup ipvs: do not propagate one-packet flag to synced conns net/smc: fix socket use-after-free during link group termination netfilter: ipset: do not update comments from kernel-side hash adds tipc: avoid use-after-free in poll trace queue dumps wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames binfmt_misc: reject a flag character as the field delimiter mm/page_reporting: use system_freezable_wq to fix UAF during suspend net: bridge: stop fast-leave after deleting a port group net: ipv6: clear suppressed fib6 rule result powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() um: vector: fix use-after-free in vector_mmsg_rx() vxlan: re-fetch eth header after route_shortcircuit() vxlan: unclone skb head before modifying eth header in route_shortcircuit() vxlan: use neigh_ha_snapshot() in route_shortcircuit() vxlan: use pskb_network_may_pull() in route_shortcircuit() tracing: Check return value of __register_event() in trace_module_add_events() tracing/filters: Fix false positive match in regex_match_full() selftests/clone3: fix wild pointer access of getline due to missing init sctp: reject stale cookies with mismatched verification tags sctp: prevent peer transport count overflow hwmon: (npcm750-pwm-fan): stop fan timer on device detach i2c: amd-mp2: Unregister callback on adapter add failure cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() s390/qeth: Check CAP_NET_ADMIN for private ioctls s390/dasd: Fix potential NULL pointer dereference s390/zcrypt: Validate length for CCA AES cipher key requests s390/zcrypt: Validate length for CCA ECC private key requests phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask phy: zynqmp: use read-modify-write for SERDES scrambler bypass phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB net: openvswitch: fix potential UAF on meter attach failure net: openvswitch: fix skb leak on flow key update failure during ct i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock i2c: imx: Cancel hrtimer before clearing slave pointer can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured can: ems_usb: validate CPC message lengths can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents can: softing: fw_parse(): validate firmware record spans can: peak_usb: add bounds check for USB channel index can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error can: peak_usb: validate uCAN receive record lengths drm/vc4: Zero the tile state data array before each BIN job drm/amdgpu: restore UMD profile pstate after runtime resume drm/amdgpu: cap GTT size to physical RAM on APUs drm/vmwgfx: validate DRAW_PRIMITIVES header size before division drm/vmwgfx: bound DMA command body size against suffix pointer HID: logitech-dj: Fix maxfield check in DJ short report validation mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios net: openvswitch: fix skb leak on flow key update failure during recirculation firmware: stratix10-svc: fix memory leaks and list corruption bugs gpio: pch: use raw_spinlock_t for the register lock mount: honour SB_NOUSER in the new mount API s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() nfs4: take a reference on the nfs_client when running FREE_STATEID NFS: Pin the 'struct nfs_server' during a FREE_STATEID call ARM: npcm: Fix OF node refcount leaks in SMP setup bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bpf: Preserve pointer state for commuted arithmetic net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() net/sched: cls_route: fix fastmap use-after-free on filter net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete net/mlx5: fw_tracer, return NULL on create error counter: microchip-tcb-capture: Fix DT channel validation vhost/vdpa: reject overflowing PA map page counts on 32-bit udp: fix potential use-after-free in tunnel segmentation net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter net/openvswitch: check Ethernet header length in key_extract() selftests/ftrace: Add test case for GRP/ only input selftests/ftrace: refactor eprobes test to fix argument checks bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips bnxt_en: Disable EOP for TPA on all chips to prevent data corruption bnxt_en: Fix PTP PPS setting bug sctp: fix addip_serial increment on ASCONF_ACK allocation failure tcp: fix TFO max_qlen accounting across reuseport migration net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length net: prestera: validate firmware header length net: remove WARN_ON_ONCE() from sk_mc_loop() net/smc: fix TOCTOU race between smc_listen_out() and listener close net: qrtr: ns: Raise lookup limit to 128 net: thunderbolt: Tear down DMA paths before stopping the rings ata: pata_sl82c105: fix bridge revision use-after-free sctp: clear control chunk transport if it is being removed tls: don't abort the connection on signal-interrupted sends hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Input: evdev - sanitize event type index when fetching event masks ALSA: usb-audio: fix OOB write on Type II inbound URBs usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() thunderbolt: icm: Preserve USB4 proxy data-valid bit usb: cdnsp: fix incorrect endian conversions for APB timeout register usb: gadget: f_ncm: Use unsigned int for ndp_index ima: fix out-of-bounds read in xattr_verify() ipvs: add totalconns for dest ipvs: properly update the overload flag on dest edit ipvs: clear IPv4 options after rebasing tunnel ICMP errors net/packet: reset the MAC header on the packet-socket transmit path net: openvswitch: reallocate update replies for mismatched IDs net: octeontx2-pf: Fix UB in shift operation net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header netfilter: ebt_nflog: pin the NFLOG backend net: bridge: mrp: fix uninitialised bytes on the wire vt: add permission check for KDSKBMETA ioctl vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Input: evdev - fix information leak in evdev_pass_values() Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev futex: Prevent robust futex exit race some more pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP RDMA/rxe: Fix a use-after-free problem in rxe_mmap fscrypt: Replace mk_users keyring with simple list ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops ipv4: fix use-after-free in fib_nhc_update_mtu() serial: 8250_dma: Clear stale RX state on shutdown staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() staging: rtl8723bs: fix OOB read in WMM_param_handler() staging: rtl8723bs: fix missing shared-key auth challenge length check staging: rtl8723bs: validate monitor transmit frame lengths misc: fastrpc: fix channel ctx ref leak when session alloc fails misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free ALSA: usx2y: bound the hwdep mmap fault offset tracing: Fix race between update_event_fields and, event_define_fields fbdev: bitblit: bound-check glyph index in bit_cursor() ipv6: prevent in6_dev_get() from resurrecting inet6_dev netfilter: bridge: release template ct on non-IP path net: atlantic: free RX pages of consumed but not refilled buffers net/sched: act_gact, act_police: range check the fallback control action xdp: reject clones that overrun skb_shared_info tailroom vxlan: do not arm the ageing timer on a device that is down vsock/virtio: read virtqueues under worker locks vsock/virtio: avoid refilling the RX queue after teardown vhost: reset the vring metadata cache on vring reconfiguration tipc: read le->link under the node lock in tipc_node_link_down() Revert "thermal/drivers/hwmon: Cleanup coding style a bit" ipv6: fix Route Information option length validation ip6_tunnel: clear skb2->cb[] in ip6ip6_err() bpf, sockmap: Fix sk_redir use-after-free in send verdict scsi: scsi_debug: Negate wrapped memcmp() result sctp: keep chunk->transport in step with the list it is queued on sctp: fix use-after-free of cached ASCONF chunk sctp: clear new_transport when removing a peer thunderbolt: Bound the DROM dual link port number before indexing sw->ports Linux 5.15.216 UBUNTU: Upstream stable to v5.15.216 ** Affects: linux (Ubuntu) Importance: Undecided Status: Invalid ** Affects: linux (Ubuntu Jammy) Importance: Medium Assignee: Vinicius Peixoto (vpeixoto) Status: In Progress ** Tags: kernel-stable-tracking-bug ** Changed in: linux (Ubuntu) Status: New => Confirmed ** Also affects: linux (Ubuntu Jammy) Importance: Undecided Status: New ** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Changed in: linux (Ubuntu Jammy) Importance: Undecided => Medium ** Changed in: linux (Ubuntu Jammy) Status: New => In Progress ** Changed in: linux (Ubuntu Jammy) Assignee: (unassigned) => Vinicius Peixoto (vpeixoto) ** Description changed: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.216 upstream stable release from git://git.kernel.org/ - + nvmet-tcp: Fix potential UAF when ddgst mismatch + futex: Prevent lockup in requeue-PI during signal/ timeout wakeup + macsec: don't read an unset MAC header in macsec_encrypt() + KVM: nVMX: Hide shadow VMCS right after VMCLEAR + KVM: x86/mmu: Fix use-after-free on vendor module reload + can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER + can: isotp: serialize TX state transitions under so->rx_lock + dmaengine: sh: rz-dmac: Move interrupt request after everything is set up + Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() + Input: ims-pcu - fix logic error in packet reset + KVM: VMX: Make vmread_error_trampoline() uncallable from C code + IB/mad: Drop unmatched RMPP responses before reassembly + mtd: mtdswap: remove debugfs stats file on teardown + mtd: nand: mtk-ecc: stop on ECC idle timeouts + btrfs: reject free space cache with more entries than pages + btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() + firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() + RDMA/hns: Fix potential integer overflow in mhop hem cleanup + RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp + RDMA/siw: publish QP after initialization + RDMA/irdma: Prevent overflows in memory contiguity checks + xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert + wifi: cfg80211: cancel sched scan results work on unregister + wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() + wifi: mac80211_hwsim: clamp virtio RX length before skb_put + wifi: libertas: fix memory leak in helper_firmware_cb() + wifi: p54: validate RX frame length in p54_rx_eeprom_readback() + wifi: cfg80211: validate PMSR measurement type data + wifi: cfg80211: validate PMSR FTM preamble range + wifi: cfg80211: reject unsupported PMSR FTM location requests + wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock + wifi: brcmfmac: initialize SDIO data work before cleanup + wifi: cfg80211: bound element ID read when checking non-inheritance + ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop + ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup + firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context + ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF + ipv4: fib: free fib_alias with kfree_rcu() on insert error path + net/iucv: take a reference on the socket found in afiucv_hs_rcv() + ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered + ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts + ata: sata_dwc_460ex: remove variable num_processed + ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning + ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC + Bluetooth: qca: fix NVM tag length underflow in TLV parser + smb/client: handle overlapping allocated ranges in fallocate + drm/i915/gt: use correct selftest config symbol + powerpc/time: Fix sparse warnings + powerpc: remove the last remnants of cputime_t + sched/vtime: Get rid of generic vtime_task_switch() implementation + powerpc/time: Prepare to stop elapsing in dynticks-idle + powerpc/vtime: Initialize starttime at boot for native accounting + can: j1939: fix lockless local-destination check + ksmbd: validate compound request size before reading StructureSize2 + drm/i915/selftests: Fix GT PM sort comparators + net/sched: act_tunnel_key: Defer dst_release to RCU callback + sctp: fix auth_hmacs array size in struct sctp_cookie + mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n + wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() + USB: storage: add NO_ATA_1X quirk for Longmai USB Key + usb: chipidea: fix usage_count leak when autosuspend_delay is negative + usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback + usb: gadget: f_midi: cancel pending IN work before freeing the midi object + usb: gadget: printer: fix infinite loop in printer_read() + USB: gadget: snps-udc: fix device name leak on probe failure + USB: gadget: fsl-udc: fix device name leak on probe failure + usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() + usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown + usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer + USB: serial: ftdi_sio: add support for E+H FXA291 + USB: serial: io_edgeport: cap received transmit credits + USB: serial: keyspan_pda: fix data loss on receive throttling + USB: serial: option: add TDTECH MT5710-CN + crypto: rsa-pkcs1pad: Don't WARN on an empty digest + bpf: Fix ld_{abs,ind} failure path analysis in subprogs + usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits + wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request + hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop + hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop + watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() + wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() + firewire: net: Fix fragmented datagram reassembly + wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler + wifi: ath6kl: fix OOB read from firmware IE lengths in connect event + wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read + wifi: carl9170: fix OOB read from off-by-two in TX status handler + wifi: carl9170: fix buffer overflow in rx_stream failover path + btrfs: free mapping node on duplicate reloc root insert + ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint + ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI + usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect + hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status + hwmon: (occ) Add sysfs entry for OCC mode + hwmon: (occ) Add sysfs entries for additional extended status bits + hwmon: (occ) Delay hwmon registration until user request + hwmon: occ: validate poll response sensor blocks + net/packet: avoid fanout hook re-registration after unregister + rds: drop incoming messages that cross network namespace boundaries + dpaa2-switch: put MAC endpoint device on disconnect + net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call + dpaa2-eth: put MAC endpoint device on disconnect + nfp: Check resource mutex allocation + wan: wanxl: Only reset hardware after BAR mapping + wifi: mwifiex: bound uAP association event IEs to the event buffer + iommu/amd: Bound the early ACPI HID map + iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() + wifi: mac80211: recalculate TIM when a station enters power save + amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN + sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid + sctp: validate stream count in sctp_process_strreset_inreq() + nexthop: initialize extack in nh_res_bucket_migrate() + tipc: fix infinite loop in __tipc_nl_compat_dumpit + wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() + wifi: brcmfmac: fix 802.1X-SHA256 call trace warning + net: bridge: vlan: fix vlan range dumps starting with pvid + net: hsr: fix memory leak on slave unregistration by removing synced VLANs + sctp: auth: verify auth requirement when auth_chunk is NULL + vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets + tipc: fix u16 MTU truncation in media and bearer MTU validation + net: stmmac: add tc flower filter for EtherType matching + net: stmmac: fix l3l4 filter rejecting unsupported offload requests + net: stmmac: reset residual action in L3L4 filters on delete + octeontx2-vf: set TC flower flag on MCAM entry allocation + ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup + hinic: remove unused ethtool RSS user configuration buffers + net: qrtr: restrict socket creation to the initial network namespace + net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule + net/mlx5e: Report zero bandwidth for non-ETS traffic classes + net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation + raw: use more conventional iterators + net: ipv6: fix dif and sdif mismatch in raw6_icmp_error + bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() + can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF + can: bcm: add locking when updating filter and timer values + can: bcm: fix CAN frame rx/tx statistics + can: bcm: extend bcm_tx_lock usage for data and timer updates + can: bcm: validate frame length in bcm_rx_setup() for RTR replies + can: bcm: add missing device refcount for CAN filter removal + can: bcm: fix stale rx/tx ops after device removal + can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() + can: bcm: track a single source interface for ANYDEV timeout/throttle ops + drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() + drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() + drm/radeon: fix r100_copy_blit for large BOs + drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() + drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() + drm/i915: Return NULL on error in active_instance + drm/i915/gem: Do not leak siblings[] on proto context error + drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU + drm/amdgpu: Fix VFCT bus number matching with soft filter + drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) + drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved + drm/vmwgfx: Validate vmw_surface_metadata::array_size + media: airspy: Return queued buffers on start_streaming() failure + media: cec: seco: unregister adapter on IR probe failure + media: cedrus: clean up media device on probe failure + media: cedrus: Fix missing cleanup in error path + media: cedrus: skip invalid H.264 reference list entries + media: cx231xx: fix devres lifetime + media: cx23885: add ioremap return check and cleanup + media: meson: vdec: Fix memory leak in error path of vdec_open + media: msi2500: Return queued buffers on start_streaming() failure + media: pci: dm1105: Free allocated workqueue + media: pwc: Drain fill_buf on start_streaming() failure + media: pwc: Return queued buffers on start_streaming() failure + media: radio-si476x: Unregister v4l2_device on probe failure + media: rtl2832: fix use-after-free in rtl2832_remove() + media: rtl2832_sdr: Return queued buffers on start_streaming() failure + media: saa7134: Fix a possible memory leak in saa7134_video_init1 + media: sun4i-csi: Return queued buffers on start_streaming() failure + media: tegra-video: vi: fix invalid u32 return value in format lookup + media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() + media: vb2: use ssize_t for vb2_read/vb2_write + media: vidtv: fix reference leak on failed device registration + media: vimc: fix reference leak on failed device registration + media: vivid: check for vb2_is_busy() when toggling caps + wifi: ath6kl: fix OOB access from firmware ADDBA window size + wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper + wifi: wilc1000: validate assoc response length before subtracting header + wifi: brcmfmac: make release_scratchbuffers idempotent + staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() + staging: rtl8723bs: fix inverted HT40 secondary channel offset + Bluetooth: RFCOMM: Fix session UAF in set_termios + exec: fix unsigned loop counter wrap in transfer_args_to_stack() + binfmt_misc: set have_execfd only once the interpreter is opened + cdrom: fix stack out-of-bounds read in CDROMVOLCTRL + x86/boot/compressed: Disable jump tables + comedi: comedi_parport: deal with premature interrupt + intel_th: fix MSC output device reference leak + tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev + tracing: Fix resource leak on mmiotrace trace_pipe close + tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() + tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() + tracing/probes: Fix potential underflow in LEN_OR_ZERO macro + tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() + arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates + Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" + mptcp: only set DATA_FIN when a mapping is present + sctp: don't free the ASCONF's own transport in DEL-IP processing + ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() + libceph: bound get_version reply decode to front len + libceph: Fix multiplication overflow in decode_new_up_state_weight() + libceph: guard missing CRUSH type name lookup + libceph: refresh auth->authorizer_buf{,_len} after authorizer update + libceph: Reject monmaps advertising zero monitors + libceph: reject zero bucket types in crush_decode + libceph: remove debugfs files before client teardown + binfmt_elf_fdpic: only honour the first PT_INTERP + iommu/vt-d: Disallow SVA if page walk is not coherent + phonet: pep: fix use-after-free in pep_get_sb() + vxlan: require CAP_NET_ADMIN in the device netns for changelink + net: slip: serialize receive against buffer reallocation + geneve: require CAP_NET_ADMIN in the device netns for changelink + net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() + net/iucv: fix use-after-free of a severed iucv_path + net/x25: fix use-after-free in x25_kill_by_neigh() + net: hip04: fix RX buffer leak on build_skb failure + proc: Fix broken error paths for namespace links + rbd: Reset positive result codes to zero in object map update path + ice: use READ_ONCE() to access cached PHC time + ila: reload IPv6 header after pskb_may_pull in checksum adjust + mac802154: llsec: reject frames shorter than the authentication tag + pppoe: reload header pointer after dev_hard_header() + tipc: clear sock->sk on the failed-insert path in tipc_sk_create() + drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() + drm/amdgpu/gfx8: drop unecessary BUG_ON() + drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() + drm/amdgpu: fix division by zero with invalid uvd dimensions + drm/amdgpu: invoke pm_genpd_remove() before freeing genpd + tipc: fix use-after-free of the discoverer in tipc_disc_rcv() + wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses + openvswitch: fix GSO userspace truncation underflow + raw: remove unused variables from raw6_icmp_error() + raw: fix a typo in raw_icmp_error() + net: mpls: initialize rtm_tos in mpls_getroute() + media: uvcvideo: Implement dual stream quirk to fix loss of usb packets + media: uvcvideo: Fix sequence number when no EOF + gve: fix Rx queue stall on alloc failure + HID: logitech-dj: Standardise hid_report_enum variable nomenclature + HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write + HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report + net: qrtr: ns: Limit the maximum server registration per node + net: qrtr: ns: Raise node count limit to 512 + dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA + ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup + ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup + phy: zynqmp: Allow variation in refclk rate + phy-zynqmp: Postpone getting clock rate until actually needed + phy: zynqmp: fix clock error handling in xpsgtr_phy_init() + phy: zynqmp: fix runtime PM leak on probe allocation failure + netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() + drm/mediatek: Check CRTC state before freeing + keys: fix out-of-bounds read in keyring_get_key_chunk() + keys: make keyring key-chunk byte order agree with keyring_diff_objects() + assoc_array: trim the final shortcut word using the current chunk end + netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH + netfilter: nft_payload: fix mask build for partial field offload + rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled + rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() + scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer + scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer + smb: client: fix buffer leaks in SMB1 read and write + hwmon: (nct6775-core) Prevent access to unsupported weight registers + net: bridge: mrp: fix Option TLV length in MRP_Test frames + forcedeth: fix UAF of txrx_stats in nv_remove + hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors + hwmon: (adt7470) Fix cache updated before hardware write on I2C error + hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread + hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() + hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks + hwmon: (adt7470) Use cached PWM frequency value + hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read + hwmon: (adt7470) Fix PWM auto temp state array and bounds check + powerpc/boot: Fix simpleboot CPU node lookup check + powerpc/boot: Fix treeboot-currituck CPU node lookup check + powerpc/boot: Fix treeboot-akebono CPU node lookup check + wifi: mac80211: validate individual TWT params before driver setup + hwmon: (pmbus) Fix return value from pmbus_update_byte_data() + Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp + net: phylink: put link_gpio if phylink_create fails + scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req + net: sxgbe: free TX rings on RX allocation failure + net: sxgbe: check descriptor ring allocation failures + can: isotp: check register_netdevice_notifier() error in module init + tracing/mmiotrace: Reset dropped_count in mmio_reset_data() + octeontx2-pf: Set correct sequence for carrier off and tx queue stop + qede: sync udp_tunnel ports outside qede_lock in the recovery path + rhashtable: clear stale iter->p on table restart + pinctrl: devicetree: don't free uninitialized dev_name on error path + pinctrl: bm1880: add missing select GENERIC_PINCONF + mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() + mm/hugetlb: fix list corruption in allocate_file_region_entries() + sctp: validate Adaptation Indication parameter length + audit: fix potential integer overflow in audit_log_n_string() + audit: fix potential use-after-free in audit_del_rule() + Bluetooth: HIDP: reject frames without a transaction header + Bluetooth: HIDP: validate numbered report payloads + bpf: lwt: Fix dst reference leak on reroute failure + ALSA: 6fire: Fix UAF at error handling during probe + ALSA: lx6464es: fix period byte count for 16-bit streams + ALSA: pcm: wake linked drain waiters on unlink + ASoC: tas2562: fix DVC coefficient write order + ASoC: tas2562: fix broken entries in the volume lookup table + ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() + ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set + ALSA: usb-audio: Clamp frame size in implicit-feedback mode + dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ + e1000: fix memory leak in e1000_probe() + igbvf: Fix leak in TX DMA error cleanup + ipvs: do not propagate one-packet flag to synced conns + net/smc: fix socket use-after-free during link group termination + netfilter: ipset: do not update comments from kernel-side hash adds + tipc: avoid use-after-free in poll trace queue dumps + wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames + binfmt_misc: reject a flag character as the field delimiter + mm/page_reporting: use system_freezable_wq to fix UAF during suspend + net: bridge: stop fast-leave after deleting a port group + net: ipv6: clear suppressed fib6 rule result + powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() + um: vector: fix use-after-free in vector_mmsg_rx() + vxlan: re-fetch eth header after route_shortcircuit() + vxlan: unclone skb head before modifying eth header in route_shortcircuit() + vxlan: use neigh_ha_snapshot() in route_shortcircuit() + vxlan: use pskb_network_may_pull() in route_shortcircuit() + tracing: Check return value of __register_event() in trace_module_add_events() + tracing/filters: Fix false positive match in regex_match_full() + selftests/clone3: fix wild pointer access of getline due to missing init + sctp: reject stale cookies with mismatched verification tags + sctp: prevent peer transport count overflow + hwmon: (npcm750-pwm-fan): stop fan timer on device detach + i2c: amd-mp2: Unregister callback on adapter add failure + cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() + s390/qeth: Check CAP_NET_ADMIN for private ioctls + s390/dasd: Fix potential NULL pointer dereference + s390/zcrypt: Validate length for CCA AES cipher key requests + s390/zcrypt: Validate length for CCA ECC private key requests + phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask + phy: zynqmp: use read-modify-write for SERDES scrambler bypass + phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB + net: openvswitch: fix potential UAF on meter attach failure + net: openvswitch: fix skb leak on flow key update failure during ct + i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock + i2c: imx: Cancel hrtimer before clearing slave pointer + can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured + can: ems_usb: validate CPC message lengths + can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure + can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer + can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() + can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents + can: softing: fw_parse(): validate firmware record spans + can: peak_usb: add bounds check for USB channel index + can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error + can: peak_usb: validate uCAN receive record lengths + drm/vc4: Zero the tile state data array before each BIN job + drm/amdgpu: restore UMD profile pstate after runtime resume + drm/amdgpu: cap GTT size to physical RAM on APUs + drm/vmwgfx: validate DRAW_PRIMITIVES header size before division + drm/vmwgfx: bound DMA command body size against suffix pointer + HID: logitech-dj: Fix maxfield check in DJ short report validation + mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios + net: openvswitch: fix skb leak on flow key update failure during recirculation + firmware: stratix10-svc: fix memory leaks and list corruption bugs + gpio: pch: use raw_spinlock_t for the register lock + mount: honour SB_NOUSER in the new mount API + s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() + nfs4: take a reference on the nfs_client when running FREE_STATEID + NFS: Pin the 'struct nfs_server' during a FREE_STATEID call + ARM: npcm: Fix OF node refcount leaks in SMP setup + bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor + bpf: Preserve pointer state for commuted arithmetic + net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() + net/sched: cls_route: fix fastmap use-after-free on filter + net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete + net/mlx5: fw_tracer, return NULL on create error + counter: microchip-tcb-capture: Fix DT channel validation + vhost/vdpa: reject overflowing PA map page counts on 32-bit + udp: fix potential use-after-free in tunnel segmentation + net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter + net/openvswitch: check Ethernet header length in key_extract() + selftests/ftrace: Add test case for GRP/ only input + selftests/ftrace: refactor eprobes test to fix argument checks + bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips + bnxt_en: Disable EOP for TPA on all chips to prevent data corruption + bnxt_en: Fix PTP PPS setting bug + sctp: fix addip_serial increment on ASCONF_ACK allocation failure + tcp: fix TFO max_qlen accounting across reuseport migration + net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length + net: prestera: validate firmware header length + net: remove WARN_ON_ONCE() from sk_mc_loop() + net/smc: fix TOCTOU race between smc_listen_out() and listener close + net: qrtr: ns: Raise lookup limit to 128 + net: thunderbolt: Tear down DMA paths before stopping the rings + ata: pata_sl82c105: fix bridge revision use-after-free + sctp: clear control chunk transport if it is being removed + tls: don't abort the connection on signal-interrupted sends + hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination + spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers + Input: evdev - sanitize event type index when fetching event masks + ALSA: usb-audio: fix OOB write on Type II inbound URBs + usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() + thunderbolt: icm: Preserve USB4 proxy data-valid bit + usb: cdnsp: fix incorrect endian conversions for APB timeout register + usb: gadget: f_ncm: Use unsigned int for ndp_index + ima: fix out-of-bounds read in xattr_verify() + ipvs: add totalconns for dest + ipvs: properly update the overload flag on dest edit + ipvs: clear IPv4 options after rebasing tunnel ICMP errors + net/packet: reset the MAC header on the packet-socket transmit path + net: openvswitch: reallocate update replies for mismatched IDs + net: octeontx2-pf: Fix UB in shift operation + net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header + netfilter: ebt_nflog: pin the NFLOG backend + net: bridge: mrp: fix uninitialised bytes on the wire + vt: add permission check for KDSKBMETA ioctl + vt: stabilize tty reference in kbd_keycode with tty_port_tty_get + Input: evdev - fix information leak in evdev_pass_values() + Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref + Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev + futex: Prevent robust futex exit race some more + pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP + RDMA/rxe: Fix a use-after-free problem in rxe_mmap + fscrypt: Replace mk_users keyring with simple list + ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops + ipv4: fix use-after-free in fib_nhc_update_mtu() + serial: 8250_dma: Clear stale RX state on shutdown + staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() + staging: rtl8723bs: fix OOB read in WMM_param_handler() + staging: rtl8723bs: fix missing shared-key auth challenge length check + staging: rtl8723bs: validate monitor transmit frame lengths + misc: fastrpc: fix channel ctx ref leak when session alloc fails + misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free + ALSA: usx2y: bound the hwdep mmap fault offset + tracing: Fix race between update_event_fields and, event_define_fields + fbdev: bitblit: bound-check glyph index in bit_cursor() + ipv6: prevent in6_dev_get() from resurrecting inet6_dev + netfilter: bridge: release template ct on non-IP path + net: atlantic: free RX pages of consumed but not refilled buffers + net/sched: act_gact, act_police: range check the fallback control action + xdp: reject clones that overrun skb_shared_info tailroom + vxlan: do not arm the ageing timer on a device that is down + vsock/virtio: read virtqueues under worker locks + vsock/virtio: avoid refilling the RX queue after teardown + vhost: reset the vring metadata cache on vring reconfiguration + tipc: read le->link under the node lock in tipc_node_link_down() + Revert "thermal/drivers/hwmon: Cleanup coding style a bit" + ipv6: fix Route Information option length validation + ip6_tunnel: clear skb2->cb[] in ip6ip6_err() + bpf, sockmap: Fix sk_redir use-after-free in send verdict + scsi: scsi_debug: Negate wrapped memcmp() result + sctp: keep chunk->transport in step with the list it is queued on + sctp: fix use-after-free of cached ASCONF chunk + sctp: clear new_transport when removing a peer + thunderbolt: Bound the DROM dual link port number before indexing sw->ports Linux 5.15.216 - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - sctp: clear new_transport when removing a peer - sctp: fix use-after-free of cached ASCONF chunk - sctp: keep chunk->transport in step with the list it is queued on - scsi: scsi_debug: Negate wrapped memcmp() result - bpf, sockmap: Fix sk_redir use-after-free in send verdict - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - ipv6: fix Route Information option length validation - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - tipc: read le->link under the node lock in tipc_node_link_down() - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - vsock/virtio: read virtqueues under worker locks - vxlan: do not arm the ageing timer on a device that is down - xdp: reject clones that overrun skb_shared_info tailroom - net/sched: act_gact, act_police: range check the fallback control action - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - fbdev: bitblit: bound-check glyph index in bit_cursor() - tracing: Fix race between update_event_fields and, event_define_fields - ALSA: usx2y: bound the hwdep mmap fault offset - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - ipv4: fix use-after-free in fib_nhc_update_mtu() - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - fscrypt: Replace mk_users keyring with simple list - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - futex: Prevent robust futex exit race some more - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Input: evdev - fix information leak in evdev_pass_values() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: bridge: mrp: fix uninitialised bytes on the wire - netfilter: ebt_nflog: pin the NFLOG backend - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - net: octeontx2-pf: Fix UB in shift operation - net: openvswitch: reallocate update replies for mismatched IDs - net/packet: reset the MAC header on the packet-socket transmit path - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - Input: evdev - sanitize event type index when fetching event masks - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - sctp: clear control chunk transport if it is being removed - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net: qrtr: ns: Raise lookup limit to 128 - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - tcp: fix TFO max_qlen accounting across reuseport migration - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - selftests/ftrace: Add test case for GRP/ only input - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - udp: fix potential use-after-free in tunnel segmentation - vhost/vdpa: reject overflowing PA map page counts on 32-bit - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - bpf: Preserve pointer state for commuted arithmetic - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - ARM: npcm: Fix OF node refcount leaks in SMP setup - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - nfs4: take a reference on the nfs_client when running FREE_STATEID - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - mount: honour SB_NOUSER in the new mount API - gpio: pch: use raw_spinlock_t for the register lock - firmware: stratix10-svc: fix memory leaks and list corruption bugs - net: openvswitch: fix skb leak on flow key update failure during recirculation - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - HID: logitech-dj: Fix maxfield check in DJ short report validation - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/vc4: Zero the tile state data array before each BIN job - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - selftests/clone3: fix wild pointer access of getline due to missing init - tracing/filters: Fix false positive match in regex_match_full() - tracing: Check return value of __register_event() in trace_module_add_events() - vxlan: use pskb_network_may_pull() in route_shortcircuit() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - net: ipv6: clear suppressed fib6 rule result - net: bridge: stop fast-leave after deleting a port group - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - igbvf: Fix leak in TX DMA error cleanup - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - pinctrl: devicetree: don't free uninitialized dev_name on error path - rhashtable: clear stale iter->p on table restart - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - net: phylink: put link_gpio if phylink_create fails - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - smb: client: fix buffer leaks in SMB1 read and write - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - phy: zynqmp: Allow variation in refclk rate - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - tls: separate no-async decryption request handling from async - net: qrtr: ns: Raise node count limit to 512 - net: qrtr: ns: Limit the maximum server registration per node - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Implement dual stream quirk to fix loss of usb packets - net: mpls: initialize rtm_tos in mpls_getroute() - raw: fix a typo in raw_icmp_error() - raw: remove unused variables from raw6_icmp_error() - openvswitch: fix GSO userspace truncation underflow - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mac802154: llsec: reject frames shorter than the authentication tag - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - rbd: Reset positive result codes to zero in object map update path - proc: Fix broken error paths for namespace links - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: reject zero bucket types in crush_decode - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - binfmt_misc: set have_execfd only once the interpreter is opened - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - media: vivid: check for vb2_is_busy() when toggling caps - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - raw: use more conventional iterators - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - hinic: remove unused ethtool RSS user configuration buffers - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - net: stmmac: add tc flower filter for EtherType matching - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - sctp: validate stream count in sctp_process_strreset_inreq() - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - dpaa2-eth: put MAC endpoint device on disconnect - net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - net/packet: avoid fanout hook re-registration after unregister - hwmon: occ: validate poll response sensor blocks - hwmon: (occ) Delay hwmon registration until user request - hwmon: (occ) Add sysfs entries for additional extended status bits - hwmon: (occ) Add sysfs entry for OCC mode - hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint - btrfs: free mapping node on duplicate reloc root insert - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - firewire: net: Fix fragmented datagram reassembly - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: io_edgeport: cap received transmit credits - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - sctp: fix auth_hmacs array size in struct sctp_cookie - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - can: j1939: fix lockless local-destination check - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - powerpc: remove the last remnants of cputime_t - powerpc/time: Fix sparse warnings - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: remove variable num_processed - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - RDMA/irdma: Prevent overflows in memory contiguity checks - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - KVM: VMX: Make vmread_error_trampoline() uncallable from C code - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - KVM: x86/mmu: Fix use-after-free on vendor module reload - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - macsec: don't read an unset MAC header in macsec_encrypt() - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - nvmet-tcp: Fix potential UAF when ddgst mismatch + UBUNTU: Upstream stable to v5.15.216 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2165192 Title: Jammy update: v5.15.216 upstream stable release Status in linux package in Ubuntu: Invalid Status in linux source package in Jammy: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: v5.15.216 upstream stable release from git://git.kernel.org/ nvmet-tcp: Fix potential UAF when ddgst mismatch futex: Prevent lockup in requeue-PI during signal/ timeout wakeup macsec: don't read an unset MAC header in macsec_encrypt() KVM: nVMX: Hide shadow VMCS right after VMCLEAR KVM: x86/mmu: Fix use-after-free on vendor module reload can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: serialize TX state transitions under so->rx_lock dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Input: ims-pcu - fix logic error in packet reset KVM: VMX: Make vmread_error_trampoline() uncallable from C code IB/mad: Drop unmatched RMPP responses before reassembly mtd: mtdswap: remove debugfs stats file on teardown mtd: nand: mtk-ecc: stop on ECC idle timeouts btrfs: reject free space cache with more entries than pages btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() RDMA/hns: Fix potential integer overflow in mhop hem cleanup RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp RDMA/siw: publish QP after initialization RDMA/irdma: Prevent overflows in memory contiguity checks xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert wifi: cfg80211: cancel sched scan results work on unregister wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() wifi: mac80211_hwsim: clamp virtio RX length before skb_put wifi: libertas: fix memory leak in helper_firmware_cb() wifi: p54: validate RX frame length in p54_rx_eeprom_readback() wifi: cfg80211: validate PMSR measurement type data wifi: cfg80211: validate PMSR FTM preamble range wifi: cfg80211: reject unsupported PMSR FTM location requests wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock wifi: brcmfmac: initialize SDIO data work before cleanup wifi: cfg80211: bound element ID read when checking non-inheritance ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF ipv4: fib: free fib_alias with kfree_rcu() on insert error path net/iucv: take a reference on the socket found in afiucv_hs_rcv() ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts ata: sata_dwc_460ex: remove variable num_processed ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC Bluetooth: qca: fix NVM tag length underflow in TLV parser smb/client: handle overlapping allocated ranges in fallocate drm/i915/gt: use correct selftest config symbol powerpc/time: Fix sparse warnings powerpc: remove the last remnants of cputime_t sched/vtime: Get rid of generic vtime_task_switch() implementation powerpc/time: Prepare to stop elapsing in dynticks-idle powerpc/vtime: Initialize starttime at boot for native accounting can: j1939: fix lockless local-destination check ksmbd: validate compound request size before reading StructureSize2 drm/i915/selftests: Fix GT PM sort comparators net/sched: act_tunnel_key: Defer dst_release to RCU callback sctp: fix auth_hmacs array size in struct sctp_cookie mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() USB: storage: add NO_ATA_1X quirk for Longmai USB Key usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: printer: fix infinite loop in printer_read() USB: gadget: snps-udc: fix device name leak on probe failure USB: gadget: fsl-udc: fix device name leak on probe failure usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: io_edgeport: cap received transmit credits USB: serial: keyspan_pda: fix data loss on receive throttling USB: serial: option: add TDTECH MT5710-CN crypto: rsa-pkcs1pad: Don't WARN on an empty digest bpf: Fix ld_{abs,ind} failure path analysis in subprogs usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() firewire: net: Fix fragmented datagram reassembly wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler wifi: ath6kl: fix OOB read from firmware IE lengths in connect event wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read wifi: carl9170: fix OOB read from off-by-two in TX status handler wifi: carl9170: fix buffer overflow in rx_stream failover path btrfs: free mapping node on duplicate reloc root insert ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect hwmon: (occ) Add sysfs entry for IPS (Idle Power Saver) status hwmon: (occ) Add sysfs entry for OCC mode hwmon: (occ) Add sysfs entries for additional extended status bits hwmon: (occ) Delay hwmon registration until user request hwmon: occ: validate poll response sensor blocks net/packet: avoid fanout hook re-registration after unregister rds: drop incoming messages that cross network namespace boundaries dpaa2-switch: put MAC endpoint device on disconnect net: dpaa2-eth: assign priv->mac after dpaa2_mac_connect() call dpaa2-eth: put MAC endpoint device on disconnect nfp: Check resource mutex allocation wan: wanxl: Only reset hardware after BAR mapping wifi: mwifiex: bound uAP association event IEs to the event buffer iommu/amd: Bound the early ACPI HID map iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() wifi: mac80211: recalculate TIM when a station enters power save amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp: validate stream count in sctp_process_strreset_inreq() nexthop: initialize extack in nh_res_bucket_migrate() tipc: fix infinite loop in __tipc_nl_compat_dumpit wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() wifi: brcmfmac: fix 802.1X-SHA256 call trace warning net: bridge: vlan: fix vlan range dumps starting with pvid net: hsr: fix memory leak on slave unregistration by removing synced VLANs sctp: auth: verify auth requirement when auth_chunk is NULL vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets tipc: fix u16 MTU truncation in media and bearer MTU validation net: stmmac: add tc flower filter for EtherType matching net: stmmac: fix l3l4 filter rejecting unsupported offload requests net: stmmac: reset residual action in L3L4 filters on delete octeontx2-vf: set TC flower flag on MCAM entry allocation ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup hinic: remove unused ethtool RSS user configuration buffers net: qrtr: restrict socket creation to the initial network namespace net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule net/mlx5e: Report zero bandwidth for non-ETS traffic classes net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation raw: use more conventional iterators net: ipv6: fix dif and sdif mismatch in raw6_icmp_error bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF can: bcm: add locking when updating filter and timer values can: bcm: fix CAN frame rx/tx statistics can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: add missing device refcount for CAN filter removal can: bcm: fix stale rx/tx ops after device removal can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: track a single source interface for ANYDEV timeout/throttle ops drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() drm/radeon: fix r100_copy_blit for large BOs drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() drm/i915: Return NULL on error in active_instance drm/i915/gem: Do not leak siblings[] on proto context error drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU drm/amdgpu: Fix VFCT bus number matching with soft filter drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved drm/vmwgfx: Validate vmw_surface_metadata::array_size media: airspy: Return queued buffers on start_streaming() failure media: cec: seco: unregister adapter on IR probe failure media: cedrus: clean up media device on probe failure media: cedrus: Fix missing cleanup in error path media: cedrus: skip invalid H.264 reference list entries media: cx231xx: fix devres lifetime media: cx23885: add ioremap return check and cleanup media: meson: vdec: Fix memory leak in error path of vdec_open media: msi2500: Return queued buffers on start_streaming() failure media: pci: dm1105: Free allocated workqueue media: pwc: Drain fill_buf on start_streaming() failure media: pwc: Return queued buffers on start_streaming() failure media: radio-si476x: Unregister v4l2_device on probe failure media: rtl2832: fix use-after-free in rtl2832_remove() media: rtl2832_sdr: Return queued buffers on start_streaming() failure media: saa7134: Fix a possible memory leak in saa7134_video_init1 media: sun4i-csi: Return queued buffers on start_streaming() failure media: tegra-video: vi: fix invalid u32 return value in format lookup media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() media: vb2: use ssize_t for vb2_read/vb2_write media: vidtv: fix reference leak on failed device registration media: vimc: fix reference leak on failed device registration media: vivid: check for vb2_is_busy() when toggling caps wifi: ath6kl: fix OOB access from firmware ADDBA window size wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper wifi: wilc1000: validate assoc response length before subtracting header wifi: brcmfmac: make release_scratchbuffers idempotent staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset Bluetooth: RFCOMM: Fix session UAF in set_termios exec: fix unsigned loop counter wrap in transfer_args_to_stack() binfmt_misc: set have_execfd only once the interpreter is opened cdrom: fix stack out-of-bounds read in CDROMVOLCTRL x86/boot/compressed: Disable jump tables comedi: comedi_parport: deal with premature interrupt intel_th: fix MSC output device reference leak tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix resource leak on mmiotrace trace_pipe close tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() tracing/probes: Fix potential underflow in LEN_OR_ZERO macro tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" mptcp: only set DATA_FIN when a mapping is present sctp: don't free the ASCONF's own transport in DEL-IP processing ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() libceph: bound get_version reply decode to front len libceph: Fix multiplication overflow in decode_new_up_state_weight() libceph: guard missing CRUSH type name lookup libceph: refresh auth->authorizer_buf{,_len} after authorizer update libceph: Reject monmaps advertising zero monitors libceph: reject zero bucket types in crush_decode libceph: remove debugfs files before client teardown binfmt_elf_fdpic: only honour the first PT_INTERP iommu/vt-d: Disallow SVA if page walk is not coherent phonet: pep: fix use-after-free in pep_get_sb() vxlan: require CAP_NET_ADMIN in the device netns for changelink net: slip: serialize receive against buffer reallocation geneve: require CAP_NET_ADMIN in the device netns for changelink net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() net/iucv: fix use-after-free of a severed iucv_path net/x25: fix use-after-free in x25_kill_by_neigh() net: hip04: fix RX buffer leak on build_skb failure proc: Fix broken error paths for namespace links rbd: Reset positive result codes to zero in object map update path ice: use READ_ONCE() to access cached PHC time ila: reload IPv6 header after pskb_may_pull in checksum adjust mac802154: llsec: reject frames shorter than the authentication tag pppoe: reload header pointer after dev_hard_header() tipc: clear sock->sk on the failed-insert path in tipc_sk_create() drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() drm/amdgpu/gfx8: drop unecessary BUG_ON() drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() drm/amdgpu: fix division by zero with invalid uvd dimensions drm/amdgpu: invoke pm_genpd_remove() before freeing genpd tipc: fix use-after-free of the discoverer in tipc_disc_rcv() wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses openvswitch: fix GSO userspace truncation underflow raw: remove unused variables from raw6_icmp_error() raw: fix a typo in raw_icmp_error() net: mpls: initialize rtm_tos in mpls_getroute() media: uvcvideo: Implement dual stream quirk to fix loss of usb packets media: uvcvideo: Fix sequence number when no EOF gve: fix Rx queue stall on alloc failure HID: logitech-dj: Standardise hid_report_enum variable nomenclature HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report net: qrtr: ns: Limit the maximum server registration per node net: qrtr: ns: Raise node count limit to 512 dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup phy: zynqmp: Allow variation in refclk rate phy-zynqmp: Postpone getting clock rate until actually needed phy: zynqmp: fix clock error handling in xpsgtr_phy_init() phy: zynqmp: fix runtime PM leak on probe allocation failure netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() drm/mediatek: Check CRTC state before freeing keys: fix out-of-bounds read in keyring_get_key_chunk() keys: make keyring key-chunk byte order agree with keyring_diff_objects() assoc_array: trim the final shortcut word using the current chunk end netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH netfilter: nft_payload: fix mask build for partial field offload rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer smb: client: fix buffer leaks in SMB1 read and write hwmon: (nct6775-core) Prevent access to unsupported weight registers net: bridge: mrp: fix Option TLV length in MRP_Test frames forcedeth: fix UAF of txrx_stats in nv_remove hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors hwmon: (adt7470) Fix cache updated before hardware write on I2C error hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks hwmon: (adt7470) Use cached PWM frequency value hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read hwmon: (adt7470) Fix PWM auto temp state array and bounds check powerpc/boot: Fix simpleboot CPU node lookup check powerpc/boot: Fix treeboot-currituck CPU node lookup check powerpc/boot: Fix treeboot-akebono CPU node lookup check wifi: mac80211: validate individual TWT params before driver setup hwmon: (pmbus) Fix return value from pmbus_update_byte_data() Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp net: phylink: put link_gpio if phylink_create fails scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req net: sxgbe: free TX rings on RX allocation failure net: sxgbe: check descriptor ring allocation failures can: isotp: check register_netdevice_notifier() error in module init tracing/mmiotrace: Reset dropped_count in mmio_reset_data() octeontx2-pf: Set correct sequence for carrier off and tx queue stop qede: sync udp_tunnel ports outside qede_lock in the recovery path rhashtable: clear stale iter->p on table restart pinctrl: devicetree: don't free uninitialized dev_name on error path pinctrl: bm1880: add missing select GENERIC_PINCONF mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() mm/hugetlb: fix list corruption in allocate_file_region_entries() sctp: validate Adaptation Indication parameter length audit: fix potential integer overflow in audit_log_n_string() audit: fix potential use-after-free in audit_del_rule() Bluetooth: HIDP: reject frames without a transaction header Bluetooth: HIDP: validate numbered report payloads bpf: lwt: Fix dst reference leak on reroute failure ALSA: 6fire: Fix UAF at error handling during probe ALSA: lx6464es: fix period byte count for 16-bit streams ALSA: pcm: wake linked drain waiters on unlink ASoC: tas2562: fix DVC coefficient write order ASoC: tas2562: fix broken entries in the volume lookup table ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set ALSA: usb-audio: Clamp frame size in implicit-feedback mode dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ e1000: fix memory leak in e1000_probe() igbvf: Fix leak in TX DMA error cleanup ipvs: do not propagate one-packet flag to synced conns net/smc: fix socket use-after-free during link group termination netfilter: ipset: do not update comments from kernel-side hash adds tipc: avoid use-after-free in poll trace queue dumps wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames binfmt_misc: reject a flag character as the field delimiter mm/page_reporting: use system_freezable_wq to fix UAF during suspend net: bridge: stop fast-leave after deleting a port group net: ipv6: clear suppressed fib6 rule result powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() um: vector: fix use-after-free in vector_mmsg_rx() vxlan: re-fetch eth header after route_shortcircuit() vxlan: unclone skb head before modifying eth header in route_shortcircuit() vxlan: use neigh_ha_snapshot() in route_shortcircuit() vxlan: use pskb_network_may_pull() in route_shortcircuit() tracing: Check return value of __register_event() in trace_module_add_events() tracing/filters: Fix false positive match in regex_match_full() selftests/clone3: fix wild pointer access of getline due to missing init sctp: reject stale cookies with mismatched verification tags sctp: prevent peer transport count overflow hwmon: (npcm750-pwm-fan): stop fan timer on device detach i2c: amd-mp2: Unregister callback on adapter add failure cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() s390/qeth: Check CAP_NET_ADMIN for private ioctls s390/dasd: Fix potential NULL pointer dereference s390/zcrypt: Validate length for CCA AES cipher key requests s390/zcrypt: Validate length for CCA ECC private key requests phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask phy: zynqmp: use read-modify-write for SERDES scrambler bypass phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB net: openvswitch: fix potential UAF on meter attach failure net: openvswitch: fix skb leak on flow key update failure during ct i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock i2c: imx: Cancel hrtimer before clearing slave pointer can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured can: ems_usb: validate CPC message lengths can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents can: softing: fw_parse(): validate firmware record spans can: peak_usb: add bounds check for USB channel index can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error can: peak_usb: validate uCAN receive record lengths drm/vc4: Zero the tile state data array before each BIN job drm/amdgpu: restore UMD profile pstate after runtime resume drm/amdgpu: cap GTT size to physical RAM on APUs drm/vmwgfx: validate DRAW_PRIMITIVES header size before division drm/vmwgfx: bound DMA command body size against suffix pointer HID: logitech-dj: Fix maxfield check in DJ short report validation mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios net: openvswitch: fix skb leak on flow key update failure during recirculation firmware: stratix10-svc: fix memory leaks and list corruption bugs gpio: pch: use raw_spinlock_t for the register lock mount: honour SB_NOUSER in the new mount API s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() nfs4: take a reference on the nfs_client when running FREE_STATEID NFS: Pin the 'struct nfs_server' during a FREE_STATEID call ARM: npcm: Fix OF node refcount leaks in SMP setup bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bpf: Preserve pointer state for commuted arithmetic net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() net/sched: cls_route: fix fastmap use-after-free on filter net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete net/mlx5: fw_tracer, return NULL on create error counter: microchip-tcb-capture: Fix DT channel validation vhost/vdpa: reject overflowing PA map page counts on 32-bit udp: fix potential use-after-free in tunnel segmentation net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter net/openvswitch: check Ethernet header length in key_extract() selftests/ftrace: Add test case for GRP/ only input selftests/ftrace: refactor eprobes test to fix argument checks bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips bnxt_en: Disable EOP for TPA on all chips to prevent data corruption bnxt_en: Fix PTP PPS setting bug sctp: fix addip_serial increment on ASCONF_ACK allocation failure tcp: fix TFO max_qlen accounting across reuseport migration net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length net: prestera: validate firmware header length net: remove WARN_ON_ONCE() from sk_mc_loop() net/smc: fix TOCTOU race between smc_listen_out() and listener close net: qrtr: ns: Raise lookup limit to 128 net: thunderbolt: Tear down DMA paths before stopping the rings ata: pata_sl82c105: fix bridge revision use-after-free sctp: clear control chunk transport if it is being removed tls: don't abort the connection on signal-interrupted sends hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Input: evdev - sanitize event type index when fetching event masks ALSA: usb-audio: fix OOB write on Type II inbound URBs usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() thunderbolt: icm: Preserve USB4 proxy data-valid bit usb: cdnsp: fix incorrect endian conversions for APB timeout register usb: gadget: f_ncm: Use unsigned int for ndp_index ima: fix out-of-bounds read in xattr_verify() ipvs: add totalconns for dest ipvs: properly update the overload flag on dest edit ipvs: clear IPv4 options after rebasing tunnel ICMP errors net/packet: reset the MAC header on the packet-socket transmit path net: openvswitch: reallocate update replies for mismatched IDs net: octeontx2-pf: Fix UB in shift operation net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header netfilter: ebt_nflog: pin the NFLOG backend net: bridge: mrp: fix uninitialised bytes on the wire vt: add permission check for KDSKBMETA ioctl vt: stabilize tty reference in kbd_keycode with tty_port_tty_get Input: evdev - fix information leak in evdev_pass_values() Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev futex: Prevent robust futex exit race some more pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP RDMA/rxe: Fix a use-after-free problem in rxe_mmap fscrypt: Replace mk_users keyring with simple list ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops ipv4: fix use-after-free in fib_nhc_update_mtu() serial: 8250_dma: Clear stale RX state on shutdown staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() staging: rtl8723bs: fix OOB read in WMM_param_handler() staging: rtl8723bs: fix missing shared-key auth challenge length check staging: rtl8723bs: validate monitor transmit frame lengths misc: fastrpc: fix channel ctx ref leak when session alloc fails misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free ALSA: usx2y: bound the hwdep mmap fault offset tracing: Fix race between update_event_fields and, event_define_fields fbdev: bitblit: bound-check glyph index in bit_cursor() ipv6: prevent in6_dev_get() from resurrecting inet6_dev netfilter: bridge: release template ct on non-IP path net: atlantic: free RX pages of consumed but not refilled buffers net/sched: act_gact, act_police: range check the fallback control action xdp: reject clones that overrun skb_shared_info tailroom vxlan: do not arm the ageing timer on a device that is down vsock/virtio: read virtqueues under worker locks vsock/virtio: avoid refilling the RX queue after teardown vhost: reset the vring metadata cache on vring reconfiguration tipc: read le->link under the node lock in tipc_node_link_down() Revert "thermal/drivers/hwmon: Cleanup coding style a bit" ipv6: fix Route Information option length validation ip6_tunnel: clear skb2->cb[] in ip6ip6_err() bpf, sockmap: Fix sk_redir use-after-free in send verdict scsi: scsi_debug: Negate wrapped memcmp() result sctp: keep chunk->transport in step with the list it is queued on sctp: fix use-after-free of cached ASCONF chunk sctp: clear new_transport when removing a peer thunderbolt: Bound the DROM dual link port number before indexing sw->ports Linux 5.15.216 UBUNTU: Upstream stable to v5.15.216 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2165192/+subscriptions