Public bug reported:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2025-08-18
Ported from the following upstream stable releases:
v6.12.35, v6.15.4
from git://git.kernel.org/
configfs: Do not override creating attribute file failure in populate_attrs()
crypto: marvell/cesa - Do not chain submitted requests
gfs2: move msleep to sleepable context
crypto: qat - add shutdown handler to qat_c3xxx
crypto: qat - add shutdown handler to qat_420xx
crypto: qat - add shutdown handler to qat_4xxx
crypto: qat - add shutdown handler to qat_c62x
crypto: qat - add shutdown handler to qat_dh895xcc
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
io_uring: account drain memory to cgroup
io_uring/kbuf: account ring io_buffer_list memory
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
regulator: max20086: Fix MAX200086 chip id
regulator: max20086: Change enable gpio to optional
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
wifi: mt76: mt7925: fix host interrupt register initialization
wifi: ath11k: fix rx completion meta data corruption
wifi: rtw88: usb: Upload the firmware in bigger chunks
Revert "UBUNTU: SAUCE: wifi: ath11k: fix ring-buffer corruption"
wifi: ath11k: fix ring-buffer corruption
NFSD: unregister filesystem in case genl_register_family() fails
NFSD: fix race between nfsd registration and exports_proc
NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
NFSv4: Don't check for OPEN feature support in v4.1
fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
Revert "UBUNTU: SAUCE: wifi: ath12k: fix ring-buffer corruption"
wifi: ath12k: fix ring-buffer corruption
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
svcrdma: Unregister the device if svc_rdma_accept() fails
wifi: rtw88: usb: Reduce control message timeout to 500 ms
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
media: ov8856: suppress probe deferral errors
media: ov5675: suppress probe deferral errors
media: imx335: Use correct register width for HNUM
media: nxp: imx8-isi: better handle the m2m usage_count
media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
media: cxusb: no longer judge rbuf when the write fails
media: davinci: vpif: Fix memory leak in probe error path
media: gspca: Add error handling for stv06xx_read_sensor()
media: i2c: imx335: Fix frame size enumeration
media: imagination: fix a potential memory leak in e5010_probe()
media: intel/ipu6: Fix dma mask for non-secure mode
media: ipu6: Remove workaround for Meteor Lake ES2
media: mediatek: vcodec: Correct vsi_core framebuffer size
media: omap3isp: use sgtable-based scatterlist wrappers
media: v4l2-dev: fix error handling in __video_register_device()
media: venus: Fix probe error handling
media: videobuf2: use sgtable-based scatterlist wrappers
media: vidtv: Terminating the subsequent process of initialization failure
media: vivid: Change the siize of the composing
media: imx-jpeg: Drop the first error frames
media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
media: imx-jpeg: Reset slot data pointers when freed
media: imx-jpeg: Cleanup after an allocation error
media: uvcvideo: Return the number of processed controls
media: uvcvideo: Send control events for partial succeeds
media: uvcvideo: Fix deferred probing error
arm64/mm: Close theoretical race where stale TLB entry remains valid
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
ASoC: codecs: wcd9375: Fix double free of regulator supplies
ASoC: codecs: wcd937x: Drop unused buck_supply
block: use plug request list tail for one-shot backmerge attempt
block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
bus: mhi: ep: Update read pointer only after buffer is written
bus: mhi: host: Fix conflict between power_up and SYSERR
can: kvaser_pciefd: refine error prone echo_skb_max handling logic
can: tcan4x5x: fix power regulator retrieval during probe
ceph: avoid kernel BUG for encrypted inode with unaligned file size
ceph: set superblock s_magic for IMA fsmagic matching
cgroup,freezer: fix incomplete freezing when attaching tasks
bus: firewall: Fix missing static inline annotations for stubs
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
ata: ahci: Disallow LPM for Asus B550-F motherboard
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
bus: fsl-mc: fix GET/SET_TAILDROP command ids
ext4: inline: fix len overflow in ext4_prepare_inline_data
ext4: fix calculation of credits for extent tree modification
ext4: factor out ext4_get_maxbytes()
ext4: ensure i_size is smaller than maxbytes
ext4: only dirty folios when data journaling regular files
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
f2fs: fix to do sanity check on ino and xnid
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
f2fs: fix to do sanity check on sit_bitmap_size
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
NFC: nci: uart: Set tty->disc_data only in success path
net/sched: fix use-after-free in taprio_dev_notifier
net: ftgmac100: select FIXED_PHY
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
EDAC/altera: Use correct write width with the INTTEST register
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
parisc/unaligned: Fix hex output to show 8 hex chars
vgacon: Add check for vc_origin address range in vgacon_scroll()
parisc: fix building with gcc-15
clk: meson-g12a: add missing fclk_div2 to spicc
ipc: fix to protect IPCS lookups using RCU
watchdog: fix watchdog may detect false positive of softlockup
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
mm: fix ratelimit_pages update error in dirty_ratio_handler()
soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
configfs-tsm-report: Fix NULL dereference of tsm_ops
firmware: arm_scmi: Ensure that the message-id supports fastchannel
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
KVM: VMX: Flush shadow VMCS on emergency reboot
dm-mirror: fix a tiny race condition
dm-verity: fix a memory leak if some arguments are specified multiple times
mtd: rawnand: qcom: Fix read len for onfi param page
ftrace: Fix UAF when lookup kallsym after ftrace disabled
dm: lock limits when reading them
phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
net: ch9200: fix uninitialised access during mii_nway_restart
KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
sysfb: Fix screen_info type check for VGA
video: screen_info: Relocate framebuffers behind PCI bridges
pwm: axi-pwmgen: fix missing separate external clock
staging: iio: ad5933: Correct settling cycles encoding per datasheet
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
ovl: Fix nested backing file paths
regulator: max14577: Add error check for max14577_read_reg()
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
remoteproc: k3-m4: Don't assert reset in detach routine
cifs: reset connections for all channels when reconnect requested
cifs: update dstaddr whenever channel iface is updated
cifs: dns resolution is needed only for primary channel
smb: client: add NULL check in automount_fullpath
Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
uio_hv_generic: Use correct size for interrupt and monitor pages
uio_hv_generic: Align ring size to system page
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
PCI: dwc: ep: Correct PBA offset in .set_msix() callback
PCI: Add ACS quirk for Loongson PCIe
PCI: Fix lock symmetry in pci_slot_unlock()
PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
iio: accel: fxls8962af: Fix temperature scan element sign
accel/ivpu: Improve buffer object logging
accel/ivpu: Use firmware names from upstream repo
accel/ivpu: Use dma_resv_lock() instead of a custom mutex
accel/ivpu: Fix warning in ivpu_gem_bo_free()
dummycon: Trigger redraw when switching consoles with deferred takeover
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
iio: imu: inv_icm42600: Fix temperature calculation
iio: adc: ad7944: mask high bits on direct read
iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
iio: adc: ad7606_spi: fix reg write value mask
ACPICA: fix acpi operand cache leak in dswstate.c
ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
power: supply: collie: Fix wakeup source leaks on device unbind
mmc: Add quirk to disable DDR50 tuning
ACPICA: Avoid sequence overread in call to strncmp()
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init()
ACPI: bus: Bail out if acpi_kobj registration fails
ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
ACPICA: fix acpi parse and parseext cache leaks
ACPICA: Apply pack(1) to union aml_resource
ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
power: supply: bq27xxx: Retrieve again when busy
pmdomain: core: Reset genpd->states to avoid freeing invalid data
ACPICA: utilities: Fix overflow check in vsnprintf()
platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all()
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
Make 'cc-option' work correctly for the -Wno-xyzzy pattern
gpiolib: of: Add polarity quirk for s5m8767
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
power: supply: max17040: adjust thermal channel scaling
net: macb: Check return value of dma_set_mask_and_coherent()
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
tipc: use kfree_sensitive() for aead cleanup
f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
i2c: designware: Invoke runtime suspend on quick slave re-registration
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
emulex/benet: correct command version selection in be_cmd_get_stats()
Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
wifi: mt76: mt7925: introduce thermal protection
wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
sctp: Do not wake readers in __sctp_write_space()
libbpf/btf: Fix string handling to support multi-split BTF
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
i2c: tegra: check msg length in SMBUS block read
i2c: npcm: Add clock toggle recovery
clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
net: dlink: add synchronization for stats update
wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
wifi: ath12k: fix a possible dead lock caused by ab->base_lock
wifi: ath11k: Fix QMI memory reuse logic
wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
tcp: remove zero TCP TS samples for autotuning
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
tcp: add receive queue awareness in tcp_rcv_space_adjust()
x86/sgx: Prevent attempts to reclaim poisoned pages
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
net: page_pool: Don't recycle into cache on PREEMPT_RT
xfrm: validate assignment of maximal possible SEQ number
net: atlantic: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
bpf: Pass the same orig_call value to trampoline functions
net: stmmac: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
libbpf: Check bpf_map_skeleton link for NULL
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
wifi: mac80211: do not offer a mesh path if forwarding is disabled
clk: rockchip: rk3036: mark ddrphy as critical
hid-asus: check ROG Ally MCU version and warn
wifi: iwlwifi: mvm: fix beacon CCK flag
f2fs: fix to bail out in get_new_segment()
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
scsi: smartpqi: Add new PCI IDs
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
wifi: iwlwifi: pcie: make sure to lock rxq->read
wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
netdevsim: Mark NAPI ID on skb in nsim_rcv
bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
wifi: mac80211: VLAN traffic in multicast path
Revert "mac80211: Dynamically set CoDel parameters per station"
wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
net: bridge: mcast: update multicast contex when vlan state is changed
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
vxlan: Do not treat dst cache initialization errors as fatal
bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
wifi: ath12k: using msdu end descriptor to check for rx multicast packets
net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
software node: Correct a OOB check in software_node_get_reference_args()
isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
pinctrl: mcp23s08: Reset all pins to input at probe
wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
scsi: lpfc: Use memcpy() for BIOS version
sock: Correct error checking condition for (assign|release)_proto_idx()
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
ixgbe: Fix unreachable retry logic in combined and byte I2C write functions
RDMA/hns: initialize db in update_srq_db()
ice: fix check for existing switch rule
usbnet: asix AX88772: leave the carrier control to phylink
f2fs: fix to set atomic write status more clear
bpf, sockmap: Fix data lost during EAGAIN retries
net: ethernet: cortina: Use TOE/TSO on all TCP
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
wifi: ath11k: determine PM policy based on machine model
wifi: ath12k: fix link valid field initialization in the monitor Rx
wifi: ath12k: fix incorrect CE addresses
wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
fbcon: Make sure modelist not set on unregistered console
watchdog: da9052_wdt: respect TWDMIN
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
tee: Prevent size calculation wraparound on 32-bit kernels
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
fs/xattr.c: fix simple_xattr_list()
platform/x86/amd: pmc: Clear metrics table at start of cycle
platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
platform/x86: dell_rbu: Fix list usage
platform/x86: dell_rbu: Stop overwriting data buffer
powerpc/vdso: Fix build of VDSO32 with pcrel
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
io_uring: fix task leak issue in io_wq_create()
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
platform/loongarch: laptop: Get brightness setting from EC on probe
platform/loongarch: laptop: Unregister generic_sub_drivers on exit
platform/loongarch: laptop: Add backlight power control support
LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
jffs2: check that raw node were preallocated before writing summary
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
cifs: deal with the channel loading lag while picking channels
cifs: serialize other channels when query server interfaces is pending
cifs: do not disable interface polling on failure
smb: improve directory cache reuse for readdir operations
scsi: storvsc: Increase the timeouts to storvsc_timeout
scsi: s390: zfcp: Ensure synchronous unit_add
nvme: always punt polled uring_cmd end_io work to task_work
net_sched: sch_sfq: reject invalid perturb period
net: clear the dst when changing skb protocol
mm: close theoretical race where stale TLB entries could linger
udmabuf: use sgtable-based scatterlist wrappers
x86/virt/tdx: Avoid indirect calls to TDX assembly functions
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
ksmbd: fix null pointer dereference in destroy_previous_session
platform/x86: ideapad-laptop: use usleep_range() for EC polling
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
Input: sparcspkr - avoid unannotated fall-through
arm64: Restrict pagetable teardown to avoid false warning
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/realtek: Add quirk for Asus GU605C
mm/hugetlb: unshare page tables during VMA split, not before
kbuild: rust: add rustc-min-version support function
erofs: remove unused trace event erofs_destroy_inode
nfsd: use threads array as-is in netlink interface
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
Kunit to check the longest symbol length
x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
ipv6: replace ipcm6_init calls with ipcm6_init_sk
smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
drm/msm/disp: Correct porch timing for SDM845
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
drm/ssd130x: fix ssd132x_clear_screen() columns
ionic: Prevent driver/fw getting out of sync on devcmd(s)
drm/nouveau/bl: increase buffer size to avoid truncate warning
drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
hwmon: (occ) Rework attribute registration for stack usage
hwmon: (occ) fix unaligned accesses
hwmon: (ltc4282) avoid repeated register write
pldmfw: Select CRC32 when PLDMFW is selected
aoe: clean device rq_list in aoedev_downdev()
io_uring/sqpoll: don't put task_struct on tctx setup failure
net: ice: Perform accurate aRFS flow match
ice: fix eswitch code memory leak in reset scenario
workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
ksmbd: add free_transport ops in ksmbd connection
net: netmem: fix skb_ensure_writable with unreadable skbs
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
bnxt_en: Add a helper function to configure MRU and RSS
bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
ptp: fix breakage after ptp_vclock_in_use() rework
ptp: allow reading of currently dialed frequency to succeed on free-running clocks
wifi: carl9170: do not ping device which has failed to load firmware
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
tcp: fix passive TFO socket having invalid NAPI ID
eth: fbnic: avoid double free when failing to DMA-map FW msg
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
ublk: santizize the arguments from userspace when adding a device
drm/xe/bmg: Update Wa_16023588340
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
net: atm: add lec_mutex
net: atm: fix /proc/net/atm/lec handling
EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
smb: Log an error when close_all_cached_dirs fails
smb: client: fix first command failure during re-negotiation
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
perf: Fix sample vs do_exit()
perf: Fix cgroup state vs ERROR
perf/core: Fix WARN in perf_cgroup_switch()
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
gpio: pca953x: fix wrong error probe return value
perf evsel: Missed close() when probing hybrid core PMUs
perf test: Directory file descriptor leak
gpio: mlxbf3: only get IRQ for device instance 0
cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
bpftool: Fix cgroup command to only show cgroup bpf programs
alloc_tag: handle module codetag load errors as module load failures
sched/rt: Fix race in push_rt_task
sched/fair: Adhere to place_entity() constraints
firmware: cs_dsp: Fix OOB memory read access in KUnit test
ASoC: amd: amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
powerpc64/ftrace: fix clobbered r15 during livepatching
powerpc/bpf: fix JIT code size calculation of bpf trampoline
s390/pci: Fix __pcilg_mio_inuser() inline assembly
anon_inode: raise SB_I_NODEV and SB_I_NOEXEC
fs: add S_ANON_INODE
nfsd: fix access checking for NLM under XPRTSEC policies
NFS: always probe for LOCALIO support asynchronously
media: ov08x40: Extend sleep after reset to 5 ms
media: rcar-vin: Fix RAW10
firmware: ti_sci: Convert CPU latency constraint from us to ms
iommu: Allow attaching static domains in iommu_attach_device_pasid()
mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits
iio: accel: fxls8962af: Fix temperature calculation
io_uring/net: only consider msg_inq if larger than 1
iio: adc: ad7173: fix compiling without gpiolib
iio: adc: ad7606: fix raw read for 18-bit chips
power: supply: gpio-charger: Fix wakeup source leaks on device unbind
EDAC/igen6: Skip absent memory controllers
ALSA: hda/realtek: Add support for Acer Helios Laptops using CS35L41 HDA
drm/amd/display: disable DPP RCG before DPP CLK enable
drm/bridge: select DRM_KMS_HELPER for AUX_BRIDGE
drm/amdgpu/gfx6: fix CSIB handling
media: imx-jpeg: Check decoding is ongoing for motion-jpeg
drm/rockchip: inno-hdmi: Fix video timing HSYNC/VSYNC polarity setting for rk3036
drm/dp: add option to disable zero sized address only transactions.
sunrpc: update nextcheck time when adding new cache entries
drm/amdgpu: Fix API status offset for MES queue reset
drm/amd/display: DCN32 null data check
drm/xe: Fix CFI violation when accessing sysfs files
drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
workqueue: Fix race condition in wq->stats incrementation
drm/panel/sharp-ls043t1le01: Use _multi variants
exfat: fix double free in delayed_free
drm/bridge: anx7625: enable HPD interrupts
drm/panthor: Don't update MMU_INT_MASK in panthor_mmu_irq_handler()
drm/bridge: anx7625: change the gpiod_set_value API
exfat: do not clear volume dirty flag during sync
drm/amdkfd: Drop workaround for GC v9.4.3 revID 0
drm/amdgpu/gfx11: fix CSIB handling
media: nuvoton: npcm-video: Fix stuck due to no video signal error
drm/nouveau: fix hibernate on disabled GPU
media: i2c: imx334: Enable runtime PM before sub-device registration
drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
drm/nouveau/gsp: fix rm shutdown wait condition
drm/msm/hdmi: add runtime PM calls to DDC transfer function
media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
media: verisilicon: Enable wide 4K in AV1 decoder
drm/amd/display: Skip to enable dsc if it has been off
drm/amdgpu: Add basic validation for RAS header
dlm: use SHUT_RDWR for SCTP shutdown
drm/msm/a6xx: Increase HFI response timeout
drm/amd/display: Do Not Consider DSC if Valid Config Not Found
media: i2c: imx334: Fix runtime PM handling in remove function
drm/amdgpu/gfx10: fix CSIB handling
drm: panel-orientation-quirks: Add ZOTAC Gaming Zone
media: ccs-pll: Better validate VT PLL branch
media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition
drm/amd/display: fix zero value for APU watermark_c
drm/ttm/tests: fix incorrect assert in ttm_bo_unreserve_bulk()
drm/amdgpu/gfx7: fix CSIB handling
ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space()
jfs: fix array-index-out-of-bounds read in add_missing_indices
media: ti: cal: Fix wrong goto on error path
drm/xe/vf: Fix guc_info debugfs for VFs
drm/amd/display: Correct SSC enable detection for DCN351
drm/amd/display: Fix Vertical Interrupt definitions for dcn32, dcn401
media: cec: extron-da-hd-4k-plus: Fix Wformat-truncation
media: rkvdec: Initialize the m2m context before the controls
drm/amdgpu: fix MES GFX mask
drm/amdgpu: Disallow partition query during reset
sunrpc: fix race in cache cleanup causing stale nextcheck time
ext4: prevent stale extent cache entries caused by concurrent get es_cache
drm/amdgpu/gfx8: fix CSIB handling
drm/amdgpu/gfx9: fix CSIB handling
drm/amd/display: Fix VUpdate offset calculations for dcn401
jfs: Fix null-ptr-deref in jfs_ioc_trim
drm/amd/pm: Reset SMU v13.0.x custom settings
drm/amd/display: Correct prefetch calculation
drm/amd/display: Restructure DMI quirks
media: renesas: vsp1: Fix media bus code setup on RWPF source pad
drm/msm/dpu: don't select single flush for active CTL blocks
drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
media: tc358743: ignore video while HPD is low
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
media: i2c: imx334: update mode_3840x2160_regs array
nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
media: rcar-vin: Fix stride setting for RAW8 formats
drm/amdgpu: Add indirect L1_TLB_CNTL reg programming for VFs
drm/xe/uc: Remove static from loop variable
media: qcom: venus: Fix uninitialized variable warning
drm/panel: simple: Add POWERTIP PH128800T004-ZZA01 panel entry
Bluetooth: btusb: Add RTL8851BE device 0x0bda:0xb850
Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind
Bluetooth: btmtksdio: Fix wakeup source leaks on device unbind
i2c: pasemi: Enable the unjam machine
i2c: pasemi: Add registers bits and switch to BIT()
clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750
net: phy: mediatek: do not require syscon compatible for pio property
net/mlx5: HWS, fix counting of rules in the matcher
wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM
ipmi:ssif: Fix a shutdown race
rtla: Define __NR_sched_setattr for LoongArch
wifi: iwlwifi: dvm: pair transport op-mode enter/leave
net/mlx5: HWS, Fix IP version decision
vxlan: Add RCU read-side critical sections in the Tx path
wifi: ath12k: correctly handle mcast packets for clients
wifi: ath12k: make assoc link associate first
wifi: rtw88: Set AMPDU factor to hardware for RTL8814A
wifi: ath12k: Fix incorrect rates sent to firmware
wifi: ath12k: Fix the enabling of REO queue lookup table feature
wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
net/mlx5: HWS, Harden IP version definer checks
watchdog: stm32: Fix wakeup source leaks on device unbind
i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler()
platform/x86/amd: pmf: Use device managed allocations
io_uring/rsrc: validate buffer count with offset for cloning
firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
tracing: Fix regression of filter waiting a long time on RCU synchronization
x86/its: move its_pages array to struct mod_arch_specific
io_uring/net: always use current transfer count for buffer put
drm/msm/dp: Disable wide bus support for SDM845
Octeontx2-pf: Fix Backpresure configuration
tools: ynl: parse extack for sub-messages
tools: ynl: fix mixing ops and notifications on one socket
KVM: arm64: VHE: Synchronize restore of host debug registers
perf/x86/intel: Fix crash in icl_update_topdown_event()
EDAC/igen6: Fix NULL pointer dereference
dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lock
tracing: Do not free "head" on error path of filter_free_subsystem_filters()
mtd: spinand: Use more specific naming for the (single) read from cache ops
mtd: spinand: Use more specific naming for the (dual output) read from cache ops
mtd: spinand: Use more specific naming for the (dual IO) read from cache ops
mtd: spinand: Use more specific naming for the (quad output) read from cache ops
mtd: spinand: Use more specific naming for the (quad IO) read from cache ops
mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants
PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC
Revert "drm/amd/display: Fix VUpdate offset calculations for dcn401"
drm/i915: fix build error some more
bridge: mcast: Fix use-after-free during router port configuration
perf/core: Fix the WARN_ON_ONCE is out of lock protected region
kallsyms: fix build without execinfo
ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk
smb: client: fix warning when reconnecting channel
tools/hv: fcopy: Fix irregularities with size of ring buffer
UBUNTU: Upstream stable to v6.12.35, v6.15.4
** Affects: linux (Ubuntu)
Importance: Undecided
Status: Invalid
** Affects: linux (Ubuntu Plucky)
Importance: Medium
Assignee: Noah Wager (nwager)
Status: In Progress
** Tags: kernel-stable-tracking-bug
** Changed in: linux (Ubuntu)
Status: New => Confirmed
** Tags added: kernel-stable-tracking-bug
** Also affects: linux (Ubuntu Plucky)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: Confirmed => Invalid
** Changed in: linux (Ubuntu Plucky)
Importance: Undecided => Medium
** Changed in: linux (Ubuntu Plucky)
Status: New => In Progress
** Changed in: linux (Ubuntu Plucky)
Assignee: (unassigned) => Noah Wager (nwager)
** Description changed:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2025-08-18
+
+ Ported from the following upstream stable releases:
+ v6.12.35, v6.15.4
+
from git://git.kernel.org/
+
+ configfs: Do not override creating attribute file failure in populate_attrs()
+ crypto: marvell/cesa - Do not chain submitted requests
+ gfs2: move msleep to sleepable context
+ crypto: qat - add shutdown handler to qat_c3xxx
+ crypto: qat - add shutdown handler to qat_420xx
+ crypto: qat - add shutdown handler to qat_4xxx
+ crypto: qat - add shutdown handler to qat_c62x
+ crypto: qat - add shutdown handler to qat_dh895xcc
+ ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
+ ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
+ ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
+ io_uring: account drain memory to cgroup
+ io_uring/kbuf: account ring io_buffer_list memory
+ powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
+ regulator: max20086: Fix MAX200086 chip id
+ regulator: max20086: Change enable gpio to optional
+ net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
+ net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
+ wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
+ wifi: mt76: mt7925: fix host interrupt register initialization
+ wifi: ath11k: fix rx completion meta data corruption
+ wifi: rtw88: usb: Upload the firmware in bigger chunks
+ Revert "UBUNTU: SAUCE: wifi: ath11k: fix ring-buffer corruption"
+ wifi: ath11k: fix ring-buffer corruption
+ NFSD: unregister filesystem in case genl_register_family() fails
+ NFSD: fix race between nfsd registration and exports_proc
+ NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
+ nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
+ nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
+ SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
+ NFSv4: Don't check for OPEN feature support in v4.1
+ fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
+ Revert "UBUNTU: SAUCE: wifi: ath12k: fix ring-buffer corruption"
+ wifi: ath12k: fix ring-buffer corruption
+ jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
+ svcrdma: Unregister the device if svc_rdma_accept() fails
+ wifi: rtw88: usb: Reduce control message timeout to 500 ms
+ wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
+ media: ov8856: suppress probe deferral errors
+ media: ov5675: suppress probe deferral errors
+ media: imx335: Use correct register width for HNUM
+ media: nxp: imx8-isi: better handle the m2m usage_count
+ media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
+ media: ccs-pll: Start VT pre-PLL multiplier search from correct value
+ media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
+ media: ccs-pll: Start OP pre-PLL multiplier search from correct value
+ media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
+ media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
+ media: cxusb: no longer judge rbuf when the write fails
+ media: davinci: vpif: Fix memory leak in probe error path
+ media: gspca: Add error handling for stv06xx_read_sensor()
+ media: i2c: imx335: Fix frame size enumeration
+ media: imagination: fix a potential memory leak in e5010_probe()
+ media: intel/ipu6: Fix dma mask for non-secure mode
+ media: ipu6: Remove workaround for Meteor Lake ES2
+ media: mediatek: vcodec: Correct vsi_core framebuffer size
+ media: omap3isp: use sgtable-based scatterlist wrappers
+ media: v4l2-dev: fix error handling in __video_register_device()
+ media: venus: Fix probe error handling
+ media: videobuf2: use sgtable-based scatterlist wrappers
+ media: vidtv: Terminating the subsequent process of initialization failure
+ media: vivid: Change the siize of the composing
+ media: imx-jpeg: Drop the first error frames
+ media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
+ media: imx-jpeg: Reset slot data pointers when freed
+ media: imx-jpeg: Cleanup after an allocation error
+ media: uvcvideo: Return the number of processed controls
+ media: uvcvideo: Send control events for partial succeeds
+ media: uvcvideo: Fix deferred probing error
+ arm64/mm: Close theoretical race where stale TLB entry remains valid
+ ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
+ ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
+ ASoC: codecs: wcd9375: Fix double free of regulator supplies
+ ASoC: codecs: wcd937x: Drop unused buck_supply
+ block: use plug request list tail for one-shot backmerge attempt
+ block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
+ bus: mhi: ep: Update read pointer only after buffer is written
+ bus: mhi: host: Fix conflict between power_up and SYSERR
+ can: kvaser_pciefd: refine error prone echo_skb_max handling logic
+ can: tcan4x5x: fix power regulator retrieval during probe
+ ceph: avoid kernel BUG for encrypted inode with unaligned file size
+ ceph: set superblock s_magic for IMA fsmagic matching
+ cgroup,freezer: fix incomplete freezing when attaching tasks
+ bus: firewall: Fix missing static inline annotations for stubs
+ ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
+ ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
+ ata: ahci: Disallow LPM for Asus B550-F motherboard
+ bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
+ bus: fsl-mc: fix GET/SET_TAILDROP command ids
+ ext4: inline: fix len overflow in ext4_prepare_inline_data
+ ext4: fix calculation of credits for extent tree modification
+ ext4: factor out ext4_get_maxbytes()
+ ext4: ensure i_size is smaller than maxbytes
+ ext4: only dirty folios when data journaling regular files
+ Input: ims-pcu - check record size in ims_pcu_flash_firmware()
+ Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
+ f2fs: fix to do sanity check on ino and xnid
+ f2fs: prevent kernel warning due to negative i_nlink from corrupted image
+ f2fs: fix to do sanity check on sit_bitmap_size
+ hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
+ NFC: nci: uart: Set tty->disc_data only in success path
+ net/sched: fix use-after-free in taprio_dev_notifier
+ net: ftgmac100: select FIXED_PHY
+ fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
+ EDAC/altera: Use correct write width with the INTTEST register
+ fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
+ parisc/unaligned: Fix hex output to show 8 hex chars
+ vgacon: Add check for vc_origin address range in vgacon_scroll()
+ parisc: fix building with gcc-15
+ clk: meson-g12a: add missing fclk_div2 to spicc
+ ipc: fix to protect IPCS lookups using RCU
+ watchdog: fix watchdog may detect false positive of softlockup
+ RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
+ mm: fix ratelimit_pages update error in dirty_ratio_handler()
+ soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
+ configfs-tsm-report: Fix NULL dereference of tsm_ops
+ firmware: arm_scmi: Ensure that the message-id supports fastchannel
+ mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
+ mtd: nand: sunxi: Add randomizer configuration before randomizer enable
+ KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
+ KVM: VMX: Flush shadow VMCS on emergency reboot
+ dm-mirror: fix a tiny race condition
+ dm-verity: fix a memory leak if some arguments are specified multiple times
+ mtd: rawnand: qcom: Fix read len for onfi param page
+ ftrace: Fix UAF when lookup kallsym after ftrace disabled
+ dm: lock limits when reading them
+ phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
+ net: ch9200: fix uninitialised access during mii_nway_restart
+ KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
+ sysfb: Fix screen_info type check for VGA
+ video: screen_info: Relocate framebuffers behind PCI bridges
+ pwm: axi-pwmgen: fix missing separate external clock
+ staging: iio: ad5933: Correct settling cycles encoding per datasheet
+ mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
+ ovl: Fix nested backing file paths
+ regulator: max14577: Add error check for max14577_read_reg()
+ remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
+ remoteproc: core: Release rproc->clean_table after rproc_attach() fails
+ remoteproc: k3-m4: Don't assert reset in detach routine
+ cifs: reset connections for all channels when reconnect requested
+ cifs: update dstaddr whenever channel iface is updated
+ cifs: dns resolution is needed only for primary channel
+ smb: client: add NULL check in automount_fullpath
+ Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
+ uio_hv_generic: Use correct size for interrupt and monitor pages
+ uio_hv_generic: Align ring size to system page
+ PCI: cadence-ep: Correct PBA offset in .set_msix() callback
+ PCI: dwc: ep: Correct PBA offset in .set_msix() callback
+ PCI: Add ACS quirk for Loongson PCIe
+ PCI: Fix lock symmetry in pci_slot_unlock()
+ PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
+ PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
+ iio: accel: fxls8962af: Fix temperature scan element sign
+ accel/ivpu: Improve buffer object logging
+ accel/ivpu: Use firmware names from upstream repo
+ accel/ivpu: Use dma_resv_lock() instead of a custom mutex
+ accel/ivpu: Fix warning in ivpu_gem_bo_free()
+ dummycon: Trigger redraw when switching consoles with deferred takeover
+ mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
+ iio: imu: inv_icm42600: Fix temperature calculation
+ iio: adc: ad7944: mask high bits on direct read
+ iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
+ iio: adc: ad7606_spi: fix reg write value mask
+ ACPICA: fix acpi operand cache leak in dswstate.c
+ ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
+ clocksource: Fix the CPUs' choice in the watchdog per CPU verification
+ power: supply: collie: Fix wakeup source leaks on device unbind
+ mmc: Add quirk to disable DDR50 tuning
+ ACPICA: Avoid sequence overread in call to strncmp()
+ ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
+ ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init()
+ ACPI: bus: Bail out if acpi_kobj registration fails
+ ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
+ ACPICA: fix acpi parse and parseext cache leaks
+ ACPICA: Apply pack(1) to union aml_resource
+ ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
+ power: supply: bq27xxx: Retrieve again when busy
+ pmdomain: core: Reset genpd->states to avoid freeing invalid data
+ ACPICA: utilities: Fix overflow check in vsnprintf()
+ platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all()
+ ASoC: tegra210_ahub: Add check to of_device_get_match_data()
+ Make 'cc-option' work correctly for the -Wno-xyzzy pattern
+ gpiolib: of: Add polarity quirk for s5m8767
+ PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
+ power: supply: max17040: adjust thermal channel scaling
+ net: macb: Check return value of dma_set_mask_and_coherent()
+ net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
+ tipc: use kfree_sensitive() for aead cleanup
+ f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
+ bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
+ Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
+ i2c: designware: Invoke runtime suspend on quick slave re-registration
+ wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
+ emulex/benet: correct command version selection in be_cmd_get_stats()
+ Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
+ wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
+ wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
+ wifi: mt76: mt7925: introduce thermal protection
+ wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
+ sctp: Do not wake readers in __sctp_write_space()
+ libbpf/btf: Fix string handling to support multi-split BTF
+ cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
+ i2c: tegra: check msg length in SMBUS block read
+ i2c: npcm: Add clock toggle recovery
+ clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
+ net: dlink: add synchronization for stats update
+ wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
+ wifi: ath12k: fix a possible dead lock caused by ab->base_lock
+ wifi: ath11k: Fix QMI memory reuse logic
+ wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
+ tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
+ tcp: remove zero TCP TS samples for autotuning
+ tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
+ tcp: add receive queue awareness in tcp_rcv_space_adjust()
+ x86/sgx: Prevent attempts to reclaim poisoned pages
+ ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
+ net: page_pool: Don't recycle into cache on PREEMPT_RT
+ xfrm: validate assignment of maximal possible SEQ number
+ net: atlantic: generate software timestamp just before the doorbell
+ pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
+ pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
+ bpf: Pass the same orig_call value to trampoline functions
+ net: stmmac: generate software timestamp just before the doorbell
+ pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
+ libbpf: Check bpf_map_skeleton link for NULL
+ pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
+ net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
+ net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
+ wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
+ wifi: mac80211: do not offer a mesh path if forwarding is disabled
+ clk: rockchip: rk3036: mark ddrphy as critical
+ hid-asus: check ROG Ally MCU version and warn
+ wifi: iwlwifi: mvm: fix beacon CCK flag
+ f2fs: fix to bail out in get_new_segment()
+ netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
+ libbpf: Add identical pointer detection to btf_dedup_is_equiv()
+ scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
+ scsi: smartpqi: Add new PCI IDs
+ iommu/amd: Ensure GA log notifier callbacks finish running before module unload
+ wifi: iwlwifi: pcie: make sure to lock rxq->read
+ wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
+ wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
+ netdevsim: Mark NAPI ID on skb in nsim_rcv
+ bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
+ wifi: mac80211: VLAN traffic in multicast path
+ Revert "mac80211: Dynamically set CoDel parameters per station"
+ wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
+ net: bridge: mcast: update multicast contex when vlan state is changed
+ net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
+ vxlan: Do not treat dst cache initialization errors as fatal
+ bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
+ wifi: ath12k: using msdu end descriptor to check for rx multicast packets
+ net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
+ software node: Correct a OOB check in software_node_get_reference_args()
+ isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
+ pinctrl: mcp23s08: Reset all pins to input at probe
+ wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
+ scsi: lpfc: Use memcpy() for BIOS version
+ sock: Correct error checking condition for (assign|release)_proto_idx()
+ i40e: fix MMIO write access to an invalid page in i40e_clear_hw
+ ixgbe: Fix unreachable retry logic in combined and byte I2C write functions
+ RDMA/hns: initialize db in update_srq_db()
+ ice: fix check for existing switch rule
+ usbnet: asix AX88772: leave the carrier control to phylink
+ f2fs: fix to set atomic write status more clear
+ bpf, sockmap: Fix data lost during EAGAIN retries
+ net: ethernet: cortina: Use TOE/TSO on all TCP
+ octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
+ wifi: ath11k: determine PM policy based on machine model
+ wifi: ath12k: fix link valid field initialization in the monitor Rx
+ wifi: ath12k: fix incorrect CE addresses
+ wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
+ fbcon: Make sure modelist not set on unregistered console
+ watchdog: da9052_wdt: respect TWDMIN
+ bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
+ ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
+ tee: Prevent size calculation wraparound on 32-bit kernels
+ Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
+ fs/xattr.c: fix simple_xattr_list()
+ platform/x86/amd: pmc: Clear metrics table at start of cycle
+ platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
+ platform/x86: dell_rbu: Fix list usage
+ platform/x86: dell_rbu: Stop overwriting data buffer
+ powerpc/vdso: Fix build of VDSO32 with pcrel
+ powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
+ io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
+ io_uring: fix task leak issue in io_wq_create()
+ drivers/rapidio/rio_cm.c: prevent possible heap overwrite
+ platform/loongarch: laptop: Get brightness setting from EC on probe
+ platform/loongarch: laptop: Unregister generic_sub_drivers on exit
+ platform/loongarch: laptop: Add backlight power control support
+ LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
+ LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
+ LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
+ jffs2: check that raw node were preallocated before writing summary
+ jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
+ cifs: deal with the channel loading lag while picking channels
+ cifs: serialize other channels when query server interfaces is pending
+ cifs: do not disable interface polling on failure
+ smb: improve directory cache reuse for readdir operations
+ scsi: storvsc: Increase the timeouts to storvsc_timeout
+ scsi: s390: zfcp: Ensure synchronous unit_add
+ nvme: always punt polled uring_cmd end_io work to task_work
+ net_sched: sch_sfq: reject invalid perturb period
+ net: clear the dst when changing skb protocol
+ mm: close theoretical race where stale TLB entries could linger
+ udmabuf: use sgtable-based scatterlist wrappers
+ x86/virt/tdx: Avoid indirect calls to TDX assembly functions
+ selftests/x86: Add a test to detect infinite SIGTRAP handler loop
+ ksmbd: fix null pointer dereference in destroy_previous_session
+ platform/x86: ideapad-laptop: use usleep_range() for EC polling
+ selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
+ platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
+ sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
+ atm: Revert atm_account_tx() if copy_from_iter_full() fails.
+ Input: sparcspkr - avoid unannotated fall-through
+ arm64: Restrict pagetable teardown to avoid false warning
+ ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
+ ALSA: hda/intel: Add Thinkpad E15 to PM deny list
+ ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
+ ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
+ ALSA: hda/realtek: Add quirk for Asus GU605C
+ mm/hugetlb: unshare page tables during VMA split, not before
+ kbuild: rust: add rustc-min-version support function
+ erofs: remove unused trace event erofs_destroy_inode
+ nfsd: use threads array as-is in netlink interface
+ sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
+ drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
+ Kunit to check the longest symbol length
+ x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
+ ipv6: replace ipcm6_init calls with ipcm6_init_sk
+ smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
+ drm/msm/disp: Correct porch timing for SDM845
+ drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
+ drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
+ drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
+ drm/ssd130x: fix ssd132x_clear_screen() columns
+ ionic: Prevent driver/fw getting out of sync on devcmd(s)
+ drm/nouveau/bl: increase buffer size to avoid truncate warning
+ drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
+ hwmon: (occ) Rework attribute registration for stack usage
+ hwmon: (occ) fix unaligned accesses
+ hwmon: (ltc4282) avoid repeated register write
+ pldmfw: Select CRC32 when PLDMFW is selected
+ aoe: clean device rq_list in aoedev_downdev()
+ io_uring/sqpoll: don't put task_struct on tctx setup failure
+ net: ice: Perform accurate aRFS flow match
+ ice: fix eswitch code memory leak in reset scenario
+ workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
+ ksmbd: add free_transport ops in ksmbd connection
+ net: netmem: fix skb_ensure_writable with unreadable skbs
+ bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
+ bnxt_en: Add a helper function to configure MRU and RSS
+ bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
+ ptp: fix breakage after ptp_vclock_in_use() rework
+ ptp: allow reading of currently dialed frequency to succeed on free-running clocks
+ wifi: carl9170: do not ping device which has failed to load firmware
+ mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
+ atm: atmtcp: Free invalid length skb in atmtcp_c_send().
+ tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
+ tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
+ tcp: fix passive TFO socket having invalid NAPI ID
+ eth: fbnic: avoid double free when failing to DMA-map FW msg
+ net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
+ ublk: santizize the arguments from userspace when adding a device
+ drm/xe/bmg: Update Wa_16023588340
+ calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
+ mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
+ net: atm: add lec_mutex
+ net: atm: fix /proc/net/atm/lec handling
+ EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
+ dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
+ smb: Log an error when close_all_cached_dirs fails
+ smb: client: fix first command failure during re-negotiation
+ smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
+ perf: Fix sample vs do_exit()
+ perf: Fix cgroup state vs ERROR
+ perf/core: Fix WARN in perf_cgroup_switch()
+ arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
+ scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
+ RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
+ RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
+ gpio: pca953x: fix wrong error probe return value
+ perf evsel: Missed close() when probing hybrid core PMUs
+ perf test: Directory file descriptor leak
+ gpio: mlxbf3: only get IRQ for device instance 0
+ cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
+ bpftool: Fix cgroup command to only show cgroup bpf programs
+ alloc_tag: handle module codetag load errors as module load failures
+ sched/rt: Fix race in push_rt_task
+ sched/fair: Adhere to place_entity() constraints
+ firmware: cs_dsp: Fix OOB memory read access in KUnit test
+ ASoC: amd: amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
+ powerpc64/ftrace: fix clobbered r15 during livepatching
+ powerpc/bpf: fix JIT code size calculation of bpf trampoline
+ s390/pci: Fix __pcilg_mio_inuser() inline assembly
+ anon_inode: raise SB_I_NODEV and SB_I_NOEXEC
+ fs: add S_ANON_INODE
+ nfsd: fix access checking for NLM under XPRTSEC policies
+ NFS: always probe for LOCALIO support asynchronously
+ media: ov08x40: Extend sleep after reset to 5 ms
+ media: rcar-vin: Fix RAW10
+ firmware: ti_sci: Convert CPU latency constraint from us to ms
+ iommu: Allow attaching static domains in iommu_attach_device_pasid()
+ mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
+ dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits
+ iio: accel: fxls8962af: Fix temperature calculation
+ io_uring/net: only consider msg_inq if larger than 1
+ iio: adc: ad7173: fix compiling without gpiolib
+ iio: adc: ad7606: fix raw read for 18-bit chips
+ power: supply: gpio-charger: Fix wakeup source leaks on device unbind
+ EDAC/igen6: Skip absent memory controllers
+ ALSA: hda/realtek: Add support for Acer Helios Laptops using CS35L41 HDA
+ drm/amd/display: disable DPP RCG before DPP CLK enable
+ drm/bridge: select DRM_KMS_HELPER for AUX_BRIDGE
+ drm/amdgpu/gfx6: fix CSIB handling
+ media: imx-jpeg: Check decoding is ongoing for motion-jpeg
+ drm/rockchip: inno-hdmi: Fix video timing HSYNC/VSYNC polarity setting for rk3036
+ drm/dp: add option to disable zero sized address only transactions.
+ sunrpc: update nextcheck time when adding new cache entries
+ drm/amdgpu: Fix API status offset for MES queue reset
+ drm/amd/display: DCN32 null data check
+ drm/xe: Fix CFI violation when accessing sysfs files
+ drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
+ workqueue: Fix race condition in wq->stats incrementation
+ drm/panel/sharp-ls043t1le01: Use _multi variants
+ exfat: fix double free in delayed_free
+ drm/bridge: anx7625: enable HPD interrupts
+ drm/panthor: Don't update MMU_INT_MASK in panthor_mmu_irq_handler()
+ drm/bridge: anx7625: change the gpiod_set_value API
+ exfat: do not clear volume dirty flag during sync
+ drm/amdkfd: Drop workaround for GC v9.4.3 revID 0
+ drm/amdgpu/gfx11: fix CSIB handling
+ media: nuvoton: npcm-video: Fix stuck due to no video signal error
+ drm/nouveau: fix hibernate on disabled GPU
+ media: i2c: imx334: Enable runtime PM before sub-device registration
+ drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
+ drm/nouveau/gsp: fix rm shutdown wait condition
+ drm/msm/hdmi: add runtime PM calls to DDC transfer function
+ media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
+ drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
+ media: verisilicon: Enable wide 4K in AV1 decoder
+ drm/amd/display: Skip to enable dsc if it has been off
+ drm/amdgpu: Add basic validation for RAS header
+ dlm: use SHUT_RDWR for SCTP shutdown
+ drm/msm/a6xx: Increase HFI response timeout
+ drm/amd/display: Do Not Consider DSC if Valid Config Not Found
+ media: i2c: imx334: Fix runtime PM handling in remove function
+ drm/amdgpu/gfx10: fix CSIB handling
+ drm: panel-orientation-quirks: Add ZOTAC Gaming Zone
+ media: ccs-pll: Better validate VT PLL branch
+ media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition
+ drm/amd/display: fix zero value for APU watermark_c
+ drm/ttm/tests: fix incorrect assert in ttm_bo_unreserve_bulk()
+ drm/amdgpu/gfx7: fix CSIB handling
+ ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space()
+ jfs: fix array-index-out-of-bounds read in add_missing_indices
+ media: ti: cal: Fix wrong goto on error path
+ drm/xe/vf: Fix guc_info debugfs for VFs
+ drm/amd/display: Correct SSC enable detection for DCN351
+ drm/amd/display: Fix Vertical Interrupt definitions for dcn32, dcn401
+ media: cec: extron-da-hd-4k-plus: Fix Wformat-truncation
+ media: rkvdec: Initialize the m2m context before the controls
+ drm/amdgpu: fix MES GFX mask
+ drm/amdgpu: Disallow partition query during reset
+ sunrpc: fix race in cache cleanup causing stale nextcheck time
+ ext4: prevent stale extent cache entries caused by concurrent get es_cache
+ drm/amdgpu/gfx8: fix CSIB handling
+ drm/amdgpu/gfx9: fix CSIB handling
+ drm/amd/display: Fix VUpdate offset calculations for dcn401
+ jfs: Fix null-ptr-deref in jfs_ioc_trim
+ drm/amd/pm: Reset SMU v13.0.x custom settings
+ drm/amd/display: Correct prefetch calculation
+ drm/amd/display: Restructure DMI quirks
+ media: renesas: vsp1: Fix media bus code setup on RWPF source pad
+ drm/msm/dpu: don't select single flush for active CTL blocks
+ drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
+ media: tc358743: ignore video while HPD is low
+ media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
+ media: i2c: imx334: update mode_3840x2160_regs array
+ nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
+ media: rcar-vin: Fix stride setting for RAW8 formats
+ drm/amdgpu: Add indirect L1_TLB_CNTL reg programming for VFs
+ drm/xe/uc: Remove static from loop variable
+ media: qcom: venus: Fix uninitialized variable warning
+ drm/panel: simple: Add POWERTIP PH128800T004-ZZA01 panel entry
+ Bluetooth: btusb: Add RTL8851BE device 0x0bda:0xb850
+ Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind
+ Bluetooth: btmtksdio: Fix wakeup source leaks on device unbind
+ i2c: pasemi: Enable the unjam machine
+ i2c: pasemi: Add registers bits and switch to BIT()
+ clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750
+ net: phy: mediatek: do not require syscon compatible for pio property
+ net/mlx5: HWS, fix counting of rules in the matcher
+ wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM
+ ipmi:ssif: Fix a shutdown race
+ rtla: Define __NR_sched_setattr for LoongArch
+ wifi: iwlwifi: dvm: pair transport op-mode enter/leave
+ net/mlx5: HWS, Fix IP version decision
+ vxlan: Add RCU read-side critical sections in the Tx path
+ wifi: ath12k: correctly handle mcast packets for clients
+ wifi: ath12k: make assoc link associate first
+ wifi: rtw88: Set AMPDU factor to hardware for RTL8814A
+ wifi: ath12k: Fix incorrect rates sent to firmware
+ wifi: ath12k: Fix the enabling of REO queue lookup table feature
+ wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
+ net/mlx5: HWS, Harden IP version definer checks
+ watchdog: stm32: Fix wakeup source leaks on device unbind
+ i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler()
+ platform/x86/amd: pmf: Use device managed allocations
+ io_uring/rsrc: validate buffer count with offset for cloning
+ firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
+ firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
+ tracing: Fix regression of filter waiting a long time on RCU synchronization
+ x86/its: move its_pages array to struct mod_arch_specific
+ io_uring/net: always use current transfer count for buffer put
+ drm/msm/dp: Disable wide bus support for SDM845
+ Octeontx2-pf: Fix Backpresure configuration
+ tools: ynl: parse extack for sub-messages
+ tools: ynl: fix mixing ops and notifications on one socket
+ KVM: arm64: VHE: Synchronize restore of host debug registers
+ perf/x86/intel: Fix crash in icl_update_topdown_event()
+ EDAC/igen6: Fix NULL pointer dereference
+ dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lock
+ tracing: Do not free "head" on error path of filter_free_subsystem_filters()
+ mtd: spinand: Use more specific naming for the (single) read from cache ops
+ mtd: spinand: Use more specific naming for the (dual output) read from cache ops
+ mtd: spinand: Use more specific naming for the (dual IO) read from cache ops
+ mtd: spinand: Use more specific naming for the (quad output) read from cache ops
+ mtd: spinand: Use more specific naming for the (quad IO) read from cache ops
+ mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants
+ PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC
+ Revert "drm/amd/display: Fix VUpdate offset calculations for dcn401"
+ drm/i915: fix build error some more
+ bridge: mcast: Fix use-after-free during router port configuration
+ perf/core: Fix the WARN_ON_ONCE is out of lock protected region
+ kallsyms: fix build without execinfo
+ ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk
+ smb: client: fix warning when reconnecting channel
+ tools/hv: fcopy: Fix irregularities with size of ring buffer
+ UBUNTU: Upstream stable to v6.12.35, v6.15.4
--
You received this bug notification because you are subscribed to linux
in Ubuntu.
Matching subscriptions: Bgg, Bmail, Nb
https://bugs.launchpad.net/bugs/2120812
Title:
Plucky update: upstream stable patchset 2025-08-18
Status in linux package in Ubuntu:
Invalid
Status in linux source package in Plucky:
In Progress
Bug description:
SRU Justification
Impact:
The upstream process for stable tree updates is quite similar
in scope to the Ubuntu SRU process, e.g., each patch has to
demonstrably fix a bug, and each patch is vetted by upstream
by originating either directly from a mainline/stable Linux tree or
a minimally backported form of that patch. The following upstream
stable patches should be included in the Ubuntu kernel:
upstream stable patchset 2025-08-18
Ported from the following upstream stable releases:
v6.12.35, v6.15.4
from git://git.kernel.org/
configfs: Do not override creating attribute file failure in populate_attrs()
crypto: marvell/cesa - Do not chain submitted requests
gfs2: move msleep to sleepable context
crypto: qat - add shutdown handler to qat_c3xxx
crypto: qat - add shutdown handler to qat_420xx
crypto: qat - add shutdown handler to qat_4xxx
crypto: qat - add shutdown handler to qat_c62x
crypto: qat - add shutdown handler to qat_dh895xcc
ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
io_uring: account drain memory to cgroup
io_uring/kbuf: account ring io_buffer_list memory
powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
regulator: max20086: Fix MAX200086 chip id
regulator: max20086: Change enable gpio to optional
net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
wifi: mt76: mt7925: fix host interrupt register initialization
wifi: ath11k: fix rx completion meta data corruption
wifi: rtw88: usb: Upload the firmware in bigger chunks
Revert "UBUNTU: SAUCE: wifi: ath11k: fix ring-buffer corruption"
wifi: ath11k: fix ring-buffer corruption
NFSD: unregister filesystem in case genl_register_family() fails
NFSD: fix race between nfsd registration and exports_proc
NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
NFSv4: Don't check for OPEN feature support in v4.1
fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
Revert "UBUNTU: SAUCE: wifi: ath12k: fix ring-buffer corruption"
wifi: ath12k: fix ring-buffer corruption
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
svcrdma: Unregister the device if svc_rdma_accept() fails
wifi: rtw88: usb: Reduce control message timeout to 500 ms
wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
media: ov8856: suppress probe deferral errors
media: ov5675: suppress probe deferral errors
media: imx335: Use correct register width for HNUM
media: nxp: imx8-isi: better handle the m2m usage_count
media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
media: ccs-pll: Start VT pre-PLL multiplier search from correct value
media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
media: ccs-pll: Start OP pre-PLL multiplier search from correct value
media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
media: cxusb: no longer judge rbuf when the write fails
media: davinci: vpif: Fix memory leak in probe error path
media: gspca: Add error handling for stv06xx_read_sensor()
media: i2c: imx335: Fix frame size enumeration
media: imagination: fix a potential memory leak in e5010_probe()
media: intel/ipu6: Fix dma mask for non-secure mode
media: ipu6: Remove workaround for Meteor Lake ES2
media: mediatek: vcodec: Correct vsi_core framebuffer size
media: omap3isp: use sgtable-based scatterlist wrappers
media: v4l2-dev: fix error handling in __video_register_device()
media: venus: Fix probe error handling
media: videobuf2: use sgtable-based scatterlist wrappers
media: vidtv: Terminating the subsequent process of initialization failure
media: vivid: Change the siize of the composing
media: imx-jpeg: Drop the first error frames
media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
media: imx-jpeg: Reset slot data pointers when freed
media: imx-jpeg: Cleanup after an allocation error
media: uvcvideo: Return the number of processed controls
media: uvcvideo: Send control events for partial succeeds
media: uvcvideo: Fix deferred probing error
arm64/mm: Close theoretical race where stale TLB entry remains valid
ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
ASoC: codecs: wcd9375: Fix double free of regulator supplies
ASoC: codecs: wcd937x: Drop unused buck_supply
block: use plug request list tail for one-shot backmerge attempt
block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
bus: mhi: ep: Update read pointer only after buffer is written
bus: mhi: host: Fix conflict between power_up and SYSERR
can: kvaser_pciefd: refine error prone echo_skb_max handling logic
can: tcan4x5x: fix power regulator retrieval during probe
ceph: avoid kernel BUG for encrypted inode with unaligned file size
ceph: set superblock s_magic for IMA fsmagic matching
cgroup,freezer: fix incomplete freezing when attaching tasks
bus: firewall: Fix missing static inline annotations for stubs
ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
ata: ahci: Disallow LPM for Asus B550-F motherboard
bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
bus: fsl-mc: fix GET/SET_TAILDROP command ids
ext4: inline: fix len overflow in ext4_prepare_inline_data
ext4: fix calculation of credits for extent tree modification
ext4: factor out ext4_get_maxbytes()
ext4: ensure i_size is smaller than maxbytes
ext4: only dirty folios when data journaling regular files
Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
f2fs: fix to do sanity check on ino and xnid
f2fs: prevent kernel warning due to negative i_nlink from corrupted image
f2fs: fix to do sanity check on sit_bitmap_size
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
NFC: nci: uart: Set tty->disc_data only in success path
net/sched: fix use-after-free in taprio_dev_notifier
net: ftgmac100: select FIXED_PHY
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
EDAC/altera: Use correct write width with the INTTEST register
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
parisc/unaligned: Fix hex output to show 8 hex chars
vgacon: Add check for vc_origin address range in vgacon_scroll()
parisc: fix building with gcc-15
clk: meson-g12a: add missing fclk_div2 to spicc
ipc: fix to protect IPCS lookups using RCU
watchdog: fix watchdog may detect false positive of softlockup
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
mm: fix ratelimit_pages update error in dirty_ratio_handler()
soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
configfs-tsm-report: Fix NULL dereference of tsm_ops
firmware: arm_scmi: Ensure that the message-id supports fastchannel
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
KVM: VMX: Flush shadow VMCS on emergency reboot
dm-mirror: fix a tiny race condition
dm-verity: fix a memory leak if some arguments are specified multiple times
mtd: rawnand: qcom: Fix read len for onfi param page
ftrace: Fix UAF when lookup kallsym after ftrace disabled
dm: lock limits when reading them
phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
net: ch9200: fix uninitialised access during mii_nway_restart
KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
sysfb: Fix screen_info type check for VGA
video: screen_info: Relocate framebuffers behind PCI bridges
pwm: axi-pwmgen: fix missing separate external clock
staging: iio: ad5933: Correct settling cycles encoding per datasheet
mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
ovl: Fix nested backing file paths
regulator: max14577: Add error check for max14577_read_reg()
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
remoteproc: core: Release rproc->clean_table after rproc_attach() fails
remoteproc: k3-m4: Don't assert reset in detach routine
cifs: reset connections for all channels when reconnect requested
cifs: update dstaddr whenever channel iface is updated
cifs: dns resolution is needed only for primary channel
smb: client: add NULL check in automount_fullpath
Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
uio_hv_generic: Use correct size for interrupt and monitor pages
uio_hv_generic: Align ring size to system page
PCI: cadence-ep: Correct PBA offset in .set_msix() callback
PCI: dwc: ep: Correct PBA offset in .set_msix() callback
PCI: Add ACS quirk for Loongson PCIe
PCI: Fix lock symmetry in pci_slot_unlock()
PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from rockchip_pcie_link_up()
PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
iio: accel: fxls8962af: Fix temperature scan element sign
accel/ivpu: Improve buffer object logging
accel/ivpu: Use firmware names from upstream repo
accel/ivpu: Use dma_resv_lock() instead of a custom mutex
accel/ivpu: Fix warning in ivpu_gem_bo_free()
dummycon: Trigger redraw when switching consoles with deferred takeover
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
iio: imu: inv_icm42600: Fix temperature calculation
iio: adc: ad7944: mask high bits on direct read
iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
iio: adc: ad7606_spi: fix reg write value mask
ACPICA: fix acpi operand cache leak in dswstate.c
ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
clocksource: Fix the CPUs' choice in the watchdog per CPU verification
power: supply: collie: Fix wakeup source leaks on device unbind
mmc: Add quirk to disable DDR50 tuning
ACPICA: Avoid sequence overread in call to strncmp()
ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
ASoC: intel/sdw_utils: Assign initial value in asoc_sdw_rt_amp_spk_rtd_init()
ACPI: bus: Bail out if acpi_kobj registration fails
ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
ACPICA: fix acpi parse and parseext cache leaks
ACPICA: Apply pack(1) to union aml_resource
ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios laptops
power: supply: bq27xxx: Retrieve again when busy
pmdomain: core: Reset genpd->states to avoid freeing invalid data
ACPICA: utilities: Fix overflow check in vsnprintf()
platform-msi: Add msi_remove_device_irq_domain() in platform_device_msi_free_irqs_all()
ASoC: tegra210_ahub: Add check to of_device_get_match_data()
Make 'cc-option' work correctly for the -Wno-xyzzy pattern
gpiolib: of: Add polarity quirk for s5m8767
PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
power: supply: max17040: adjust thermal channel scaling
net: macb: Check return value of dma_set_mask_and_coherent()
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
tipc: use kfree_sensitive() for aead cleanup
f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
i2c: designware: Invoke runtime suspend on quick slave re-registration
wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
emulex/benet: correct command version selection in be_cmd_get_stats()
Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
wifi: mt76: mt7925: introduce thermal protection
wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
sctp: Do not wake readers in __sctp_write_space()
libbpf/btf: Fix string handling to support multi-split BTF
cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
i2c: tegra: check msg length in SMBUS block read
i2c: npcm: Add clock toggle recovery
clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
net: dlink: add synchronization for stats update
wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
wifi: ath12k: fix a possible dead lock caused by ab->base_lock
wifi: ath11k: Fix QMI memory reuse logic
wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
tcp: remove zero TCP TS samples for autotuning
tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
tcp: add receive queue awareness in tcp_rcv_space_adjust()
x86/sgx: Prevent attempts to reclaim poisoned pages
ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
net: page_pool: Don't recycle into cache on PREEMPT_RT
xfrm: validate assignment of maximal possible SEQ number
net: atlantic: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
bpf: Pass the same orig_call value to trampoline functions
net: stmmac: generate software timestamp just before the doorbell
pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
libbpf: Check bpf_map_skeleton link for NULL
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
wifi: mac80211: do not offer a mesh path if forwarding is disabled
clk: rockchip: rk3036: mark ddrphy as critical
hid-asus: check ROG Ally MCU version and warn
wifi: iwlwifi: mvm: fix beacon CCK flag
f2fs: fix to bail out in get_new_segment()
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
libbpf: Add identical pointer detection to btf_dedup_is_equiv()
scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
scsi: smartpqi: Add new PCI IDs
iommu/amd: Ensure GA log notifier callbacks finish running before module unload
wifi: iwlwifi: pcie: make sure to lock rxq->read
wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
netdevsim: Mark NAPI ID on skb in nsim_rcv
bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
wifi: mac80211: VLAN traffic in multicast path
Revert "mac80211: Dynamically set CoDel parameters per station"
wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
net: bridge: mcast: update multicast contex when vlan state is changed
net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
vxlan: Do not treat dst cache initialization errors as fatal
bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
wifi: ath12k: using msdu end descriptor to check for rx multicast packets
net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
software node: Correct a OOB check in software_node_get_reference_args()
isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
pinctrl: mcp23s08: Reset all pins to input at probe
wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
scsi: lpfc: Use memcpy() for BIOS version
sock: Correct error checking condition for (assign|release)_proto_idx()
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
ixgbe: Fix unreachable retry logic in combined and byte I2C write functions
RDMA/hns: initialize db in update_srq_db()
ice: fix check for existing switch rule
usbnet: asix AX88772: leave the carrier control to phylink
f2fs: fix to set atomic write status more clear
bpf, sockmap: Fix data lost during EAGAIN retries
net: ethernet: cortina: Use TOE/TSO on all TCP
octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
wifi: ath11k: determine PM policy based on machine model
wifi: ath12k: fix link valid field initialization in the monitor Rx
wifi: ath12k: fix incorrect CE addresses
wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
fbcon: Make sure modelist not set on unregistered console
watchdog: da9052_wdt: respect TWDMIN
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
tee: Prevent size calculation wraparound on 32-bit kernels
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
fs/xattr.c: fix simple_xattr_list()
platform/x86/amd: pmc: Clear metrics table at start of cycle
platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
platform/x86: dell_rbu: Fix list usage
platform/x86: dell_rbu: Stop overwriting data buffer
powerpc/vdso: Fix build of VDSO32 with pcrel
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
io_uring: fix task leak issue in io_wq_create()
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
platform/loongarch: laptop: Get brightness setting from EC on probe
platform/loongarch: laptop: Unregister generic_sub_drivers on exit
platform/loongarch: laptop: Add backlight power control support
LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
jffs2: check that raw node were preallocated before writing summary
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
cifs: deal with the channel loading lag while picking channels
cifs: serialize other channels when query server interfaces is pending
cifs: do not disable interface polling on failure
smb: improve directory cache reuse for readdir operations
scsi: storvsc: Increase the timeouts to storvsc_timeout
scsi: s390: zfcp: Ensure synchronous unit_add
nvme: always punt polled uring_cmd end_io work to task_work
net_sched: sch_sfq: reject invalid perturb period
net: clear the dst when changing skb protocol
mm: close theoretical race where stale TLB entries could linger
udmabuf: use sgtable-based scatterlist wrappers
x86/virt/tdx: Avoid indirect calls to TDX assembly functions
selftests/x86: Add a test to detect infinite SIGTRAP handler loop
ksmbd: fix null pointer dereference in destroy_previous_session
platform/x86: ideapad-laptop: use usleep_range() for EC polling
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()
atm: Revert atm_account_tx() if copy_from_iter_full() fails.
Input: sparcspkr - avoid unannotated fall-through
arm64: Restrict pagetable teardown to avoid false warning
ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP Victus 15-fa1xxx
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/realtek: Add quirk for Asus GU605C
mm/hugetlb: unshare page tables during VMA split, not before
kbuild: rust: add rustc-min-version support function
erofs: remove unused trace event erofs_destroy_inode
nfsd: use threads array as-is in netlink interface
sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
Kunit to check the longest symbol length
x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
ipv6: replace ipcm6_init calls with ipcm6_init_sk
smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
drm/msm/disp: Correct porch timing for SDM845
drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
drm/ssd130x: fix ssd132x_clear_screen() columns
ionic: Prevent driver/fw getting out of sync on devcmd(s)
drm/nouveau/bl: increase buffer size to avoid truncate warning
drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
hwmon: (occ) Rework attribute registration for stack usage
hwmon: (occ) fix unaligned accesses
hwmon: (ltc4282) avoid repeated register write
pldmfw: Select CRC32 when PLDMFW is selected
aoe: clean device rq_list in aoedev_downdev()
io_uring/sqpoll: don't put task_struct on tctx setup failure
net: ice: Perform accurate aRFS flow match
ice: fix eswitch code memory leak in reset scenario
workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
ksmbd: add free_transport ops in ksmbd connection
net: netmem: fix skb_ensure_writable with unreadable skbs
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
bnxt_en: Add a helper function to configure MRU and RSS
bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
ptp: fix breakage after ptp_vclock_in_use() rework
ptp: allow reading of currently dialed frequency to succeed on free-running clocks
wifi: carl9170: do not ping device which has failed to load firmware
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
atm: atmtcp: Free invalid length skb in atmtcp_c_send().
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
tcp: fix passive TFO socket having invalid NAPI ID
eth: fbnic: avoid double free when failing to DMA-map FW msg
net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
ublk: santizize the arguments from userspace when adding a device
drm/xe/bmg: Update Wa_16023588340
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
net: atm: add lec_mutex
net: atm: fix /proc/net/atm/lec handling
EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
smb: Log an error when close_all_cached_dirs fails
smb: client: fix first command failure during re-negotiation
smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
perf: Fix sample vs do_exit()
perf: Fix cgroup state vs ERROR
perf/core: Fix WARN in perf_cgroup_switch()
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
gpio: pca953x: fix wrong error probe return value
perf evsel: Missed close() when probing hybrid core PMUs
perf test: Directory file descriptor leak
gpio: mlxbf3: only get IRQ for device instance 0
cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
bpftool: Fix cgroup command to only show cgroup bpf programs
alloc_tag: handle module codetag load errors as module load failures
sched/rt: Fix race in push_rt_task
sched/fair: Adhere to place_entity() constraints
firmware: cs_dsp: Fix OOB memory read access in KUnit test
ASoC: amd: amd_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks()
powerpc64/ftrace: fix clobbered r15 during livepatching
powerpc/bpf: fix JIT code size calculation of bpf trampoline
s390/pci: Fix __pcilg_mio_inuser() inline assembly
anon_inode: raise SB_I_NODEV and SB_I_NOEXEC
fs: add S_ANON_INODE
nfsd: fix access checking for NLM under XPRTSEC policies
NFS: always probe for LOCALIO support asynchronously
media: ov08x40: Extend sleep after reset to 5 ms
media: rcar-vin: Fix RAW10
firmware: ti_sci: Convert CPU latency constraint from us to ms
iommu: Allow attaching static domains in iommu_attach_device_pasid()
mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits
iio: accel: fxls8962af: Fix temperature calculation
io_uring/net: only consider msg_inq if larger than 1
iio: adc: ad7173: fix compiling without gpiolib
iio: adc: ad7606: fix raw read for 18-bit chips
power: supply: gpio-charger: Fix wakeup source leaks on device unbind
EDAC/igen6: Skip absent memory controllers
ALSA: hda/realtek: Add support for Acer Helios Laptops using CS35L41 HDA
drm/amd/display: disable DPP RCG before DPP CLK enable
drm/bridge: select DRM_KMS_HELPER for AUX_BRIDGE
drm/amdgpu/gfx6: fix CSIB handling
media: imx-jpeg: Check decoding is ongoing for motion-jpeg
drm/rockchip: inno-hdmi: Fix video timing HSYNC/VSYNC polarity setting for rk3036
drm/dp: add option to disable zero sized address only transactions.
sunrpc: update nextcheck time when adding new cache entries
drm/amdgpu: Fix API status offset for MES queue reset
drm/amd/display: DCN32 null data check
drm/xe: Fix CFI violation when accessing sysfs files
drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
workqueue: Fix race condition in wq->stats incrementation
drm/panel/sharp-ls043t1le01: Use _multi variants
exfat: fix double free in delayed_free
drm/bridge: anx7625: enable HPD interrupts
drm/panthor: Don't update MMU_INT_MASK in panthor_mmu_irq_handler()
drm/bridge: anx7625: change the gpiod_set_value API
exfat: do not clear volume dirty flag during sync
drm/amdkfd: Drop workaround for GC v9.4.3 revID 0
drm/amdgpu/gfx11: fix CSIB handling
media: nuvoton: npcm-video: Fix stuck due to no video signal error
drm/nouveau: fix hibernate on disabled GPU
media: i2c: imx334: Enable runtime PM before sub-device registration
drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
drm/nouveau/gsp: fix rm shutdown wait condition
drm/msm/hdmi: add runtime PM calls to DDC transfer function
media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
media: verisilicon: Enable wide 4K in AV1 decoder
drm/amd/display: Skip to enable dsc if it has been off
drm/amdgpu: Add basic validation for RAS header
dlm: use SHUT_RDWR for SCTP shutdown
drm/msm/a6xx: Increase HFI response timeout
drm/amd/display: Do Not Consider DSC if Valid Config Not Found
media: i2c: imx334: Fix runtime PM handling in remove function
drm/amdgpu/gfx10: fix CSIB handling
drm: panel-orientation-quirks: Add ZOTAC Gaming Zone
media: ccs-pll: Better validate VT PLL branch
media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition
drm/amd/display: fix zero value for APU watermark_c
drm/ttm/tests: fix incorrect assert in ttm_bo_unreserve_bulk()
drm/amdgpu/gfx7: fix CSIB handling
ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space()
jfs: fix array-index-out-of-bounds read in add_missing_indices
media: ti: cal: Fix wrong goto on error path
drm/xe/vf: Fix guc_info debugfs for VFs
drm/amd/display: Correct SSC enable detection for DCN351
drm/amd/display: Fix Vertical Interrupt definitions for dcn32, dcn401
media: cec: extron-da-hd-4k-plus: Fix Wformat-truncation
media: rkvdec: Initialize the m2m context before the controls
drm/amdgpu: fix MES GFX mask
drm/amdgpu: Disallow partition query during reset
sunrpc: fix race in cache cleanup causing stale nextcheck time
ext4: prevent stale extent cache entries caused by concurrent get es_cache
drm/amdgpu/gfx8: fix CSIB handling
drm/amdgpu/gfx9: fix CSIB handling
drm/amd/display: Fix VUpdate offset calculations for dcn401
jfs: Fix null-ptr-deref in jfs_ioc_trim
drm/amd/pm: Reset SMU v13.0.x custom settings
drm/amd/display: Correct prefetch calculation
drm/amd/display: Restructure DMI quirks
media: renesas: vsp1: Fix media bus code setup on RWPF source pad
drm/msm/dpu: don't select single flush for active CTL blocks
drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
media: tc358743: ignore video while HPD is low
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
media: i2c: imx334: update mode_3840x2160_regs array
nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
media: rcar-vin: Fix stride setting for RAW8 formats
drm/amdgpu: Add indirect L1_TLB_CNTL reg programming for VFs
drm/xe/uc: Remove static from loop variable
media: qcom: venus: Fix uninitialized variable warning
drm/panel: simple: Add POWERTIP PH128800T004-ZZA01 panel entry
Bluetooth: btusb: Add RTL8851BE device 0x0bda:0xb850
Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind
Bluetooth: btmtksdio: Fix wakeup source leaks on device unbind
i2c: pasemi: Enable the unjam machine
i2c: pasemi: Add registers bits and switch to BIT()
clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750
net: phy: mediatek: do not require syscon compatible for pio property
net/mlx5: HWS, fix counting of rules in the matcher
wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM
ipmi:ssif: Fix a shutdown race
rtla: Define __NR_sched_setattr for LoongArch
wifi: iwlwifi: dvm: pair transport op-mode enter/leave
net/mlx5: HWS, Fix IP version decision
vxlan: Add RCU read-side critical sections in the Tx path
wifi: ath12k: correctly handle mcast packets for clients
wifi: ath12k: make assoc link associate first
wifi: rtw88: Set AMPDU factor to hardware for RTL8814A
wifi: ath12k: Fix incorrect rates sent to firmware
wifi: ath12k: Fix the enabling of REO queue lookup table feature
wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
net/mlx5: HWS, Harden IP version definer checks
watchdog: stm32: Fix wakeup source leaks on device unbind
i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler()
platform/x86/amd: pmf: Use device managed allocations
io_uring/rsrc: validate buffer count with offset for cloning
firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
tracing: Fix regression of filter waiting a long time on RCU synchronization
x86/its: move its_pages array to struct mod_arch_specific
io_uring/net: always use current transfer count for buffer put
drm/msm/dp: Disable wide bus support for SDM845
Octeontx2-pf: Fix Backpresure configuration
tools: ynl: parse extack for sub-messages
tools: ynl: fix mixing ops and notifications on one socket
KVM: arm64: VHE: Synchronize restore of host debug registers
perf/x86/intel: Fix crash in icl_update_topdown_event()
EDAC/igen6: Fix NULL pointer dereference
dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lock
tracing: Do not free "head" on error path of filter_free_subsystem_filters()
mtd: spinand: Use more specific naming for the (single) read from cache ops
mtd: spinand: Use more specific naming for the (dual output) read from cache ops
mtd: spinand: Use more specific naming for the (dual IO) read from cache ops
mtd: spinand: Use more specific naming for the (quad output) read from cache ops
mtd: spinand: Use more specific naming for the (quad IO) read from cache ops
mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants
PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC
Revert "drm/amd/display: Fix VUpdate offset calculations for dcn401"
drm/i915: fix build error some more
bridge: mcast: Fix use-after-free during router port configuration
perf/core: Fix the WARN_ON_ONCE is out of lock protected region
kallsyms: fix build without execinfo
ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk
smb: client: fix warning when reconnecting channel
tools/hv: fcopy: Fix irregularities with size of ring buffer
UBUNTU: Upstream stable to v6.12.35, v6.15.4
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2120812/+subscriptions
Комментариев нет:
Отправить комментарий