[Bug 2155660] Re: Noble update: upstream stable patchset 2026-06-05

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2155660 Title: Noble update: upstream stable patchset 2026-06-05 Status in linux package in Ubuntu: Invalid Status in linux source package in Noble: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-06-05 Ported from the following upstream stable releases: v6.6.131, v6.12.78, v6.12.79, v6.12.80 from git://git.kernel.org/ perf: Extract a few helpers perf: Make sure to use pmu_ctx->pmu for groups cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled hwmon: (axi-fan-control) Use device firmware agnostic API hwmon: (axi-fan-control) Make use of dev_err_probe() hwmon: axi-fan: don't use driver_override as IRQ name sh: platform_early: remove pdev->driver_override check bpf: Release module BTF IDR before module unload bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN HID: asus: avoid memory leak in asus_report_fixup() platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list nvme-pci: cap queue creation to used queues nvme-fabrics: use kfree_sensitive() for DHCHAP secrets platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 nvme-pci: ensure we're polling a polled queue HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 HID: magicmouse: avoid memory leak in magicmouse_report_fixup() net: usb: r8152: add TRENDnet TUC-ET2G HID: mcp2221: cancel last I2C command on read error HID: asus: add xg mobile 2023 external hardware support module: Fix kernel panic when a symbol st_shndx is out of bounds ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() dma-buf: Include ioctl.h in UAPI header HID: apple: avoid memory leak in apple_report_fixup() btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 objtool: Handle Clang RSP musical chairs usb: core: new quirk to handle devices with zero configurations spi: intel-pci: Add support for Nova Lake mobile SPI flash xfrm: call xdo_dev_state_delete during state update xfrm: Fix the usage of skb->sk esp: fix skb leak with espintcp and async crypto af_key: validate families in pfkey_send_migrate() dma: swiotlb: add KMSAN annotations to swiotlb_bounce() can: statistics: add missing atomic access in hot path Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold Bluetooth: hci_ll: Fix firmware leak on error path Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb pinctrl: mediatek: common: Fix probe failure for devices without EINT ionic: fix persistent MAC address override on PF nfc: nci: fix circular locking dependency in nci_close_device net: openvswitch: Avoid releasing netdev before teardown completes openvswitch: defer tunnel netdev_put to RCU release openvswitch: validate MPLS set/set_masked payload length net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen ice: use ice_update_eth_stats() for representor stats ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. tcp: optimize inet_use_bhash2_on_bind() udp: Fix wildcard bind conflict check when using hash2 net: enetc: fix the output issue of 'ethtool --show-ring' dma-mapping: add missing `inline` for `dma_free_attrs` Bluetooth: L2CAP: Fix send LE flow credits in ACL link Bluetooth: Remove 3 repeated macro definitions Bluetooth: hci_sync: Remove remaining dependencies of hci_request Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop Bluetooth: btusb: clamp SCO altsetting table indices tls: Purge async_hold in tls_decrypt_async_wait() netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() netfilter: nf_conntrack_expect: skip expectations in other netns via proc netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp netfilter: ctnetlink: use netlink policy range checks net: macb: use the current queue number for stats regmap: Synchronize cache for the page selector RDMA/rw: Fall back to direct SGE on MR pool exhaustion RDMA/irdma: Initialize free_qp completion before using it RDMA/irdma: Update ibqp state to error if QP is already in error state RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() RDMA/irdma: Clean up unnecessary dereference of event->cm_node RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() RDMA/irdma: Fix deadlock during netdev reset with active connections RDMA/irdma: Return EINVAL for invalid arp index error scsi: scsi_transport_sas: Fix the maximum channel scanning issue x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size drm/i915/gmbus: fix spurious timeout on 512-byte burst reads PM: hibernate: Don't ignore return from set_memory_ro() PM: hibernate: Drain trailing zero pages on userspace restore spi: sn-f-ospi: Fix resource leak in f_ospi_probe() ASoC: Intel: catpt: Fix the device initialization ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib hwmon: (adm1177) fix sysfs ABI violation and current unit conversion sysctl: fix uninitialized variable in proc_do_large_bitmap ASoC: adau1372: Fix unchecked clk_prepare_enable() return value ASoC: adau1372: Fix clock leak on PLL lock failure spi: spi-fsl-lpspi: fix teardown order issue (UAF) s390/syscalls: Add spectre boundary for syscall dispatch table s390/barrier: Make array_index_mask_nospec() __always_inline ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() ksmbd: fix potencial OOB in get_file_all_info() for compound requests ksmbd: do not expire session on binding failure ALSA: firewire-lib: fix uninitialized local variable ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload can: gw: fix OOB heap access in cgw_csum_crc8_rel() can: isotp: fix tx.buf use-after-free in isotp_sendmsg() cpufreq: conservative: Reset requested_freq on limits change platform/x86: ISST: Correct locked bit width KVM: arm64: Discard PC update state on vcpu reset hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false s390/entry: Scrub r12 register on kernel entry erofs: add GFP_NOIO in the bio completion if needed alarmtimer: Fix argument order in alarm_timer_forward() scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() scsi: ses: Handle positive SCSI error from ses_recv_diag() net: macb: Use dev_consume_skb_any() to free TX SKBs KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE jbd2: gracefully abort on checkpointing state corruptions irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment dmaengine: sh: rz-dmac: Protect the driver specific lists dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock LoongArch: Workaround LS2K/LS7A GPU DMA hang bug xfs: stop reclaim before pushing AIL during unmount xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 ext4: fix journal credit check when setting fscrypt context ext4: convert inline data to extents when truncate exceeds inline size ext4: fix fsync(2) for nojournal mode ext4: make recently_deleted() properly work with lazy itable initialization ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio ext4: avoid infinite loops caused by residual data ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() ext4: reject mount if bigalloc with s_first_data_block != 0 ext4: fix use-after-free in update_super_work when racing with umount ext4: fix the might_sleep() warnings in kvfree() ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths ext4: always drain queued discard work in ext4_mb_release() arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off powerpc64/bpf: do not increment tailcall count when prog is NULL ksmbd: fix memory leaks and NULL deref in smb2_lock() tracing: Switch trace_osnoise.c code over to use guard() and __free() tracing: Fix potential deadlock in cpu hotplug with osnoise mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode libbpf: Fix -Wdiscarded-qualifiers under C23 mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] xfs: avoid dereferencing log items after push callbacks xfs: save ailp before dropping the AIL lock in push callbacks dmaengine: idxd: Fix not releasing workqueue on .release() dmaengine: idxd: Fix memory leak when a wq is reset phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. dmaengine: xilinx: xdma: Fix regmap init error handling dmaengine: xilinx: xilinx_dma: Fix dma_device directions dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA btrfs: fix super block offset in error message in btrfs_validate_super() btrfs: fix leak of kobject name for sub-group space_info btrfs: fix lost error when running device stats on multiple devices fs dmaengine: idxd: Fix freeing the allocated ida too late futex: Clear stale exiting pointer in futex_lock_pi() retry path ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter kexec: Consolidate machine_kexec_mask_interrupts() implementation UBUNTU: [Config] Enable GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD by default. kexec: Include kernel-end even without crashkernel powerpc/kexec/core: use big-endian types for crash variables drm/msm/dsi: fix hdisplay calculation when programming dsi registers perf disasm: Fix off-by-one bug in outside check net/mlx5: Fix crash when moving to switchdev mode bonding: add ESP offload features when slaves support bonding: Correctly support GSO ESP offload net: add a common function to compute features for upper devices bonding: use common function to compute the features bonding: fix type confusion in bond_setup_by_slave() xdp: allow attaching already registered memory model to xdp_rxq_info net: add generic percpu page_pool allocator net: do not consume a cacheline for system_page_pool xdp: register system page pool as an XDP memory model net: add xmit recursion limit to tunnel xmit functions netfilter: nf_tables: always walk all pending catchall elements net: prevent NULL deref in ip[6]tunnel_xmit() ata: libata-core: Add BRIDGE_OK quirk for QEMU drives usb: typec: altmode/displayport: set displayport signaling rate in configure message rust: kbuild: allow `unused_features` ceph: add a bunch of missing ceph_path_info initializers net/tcp-ao: Fix MAC comparison to be constant-time drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x tracing: Fix enabling multiple events on the kernel command line and bootconfig qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size xfs: fix returned valued from xfs_defer_can_append iio: imu: inv_icm42600: add support of ICM-42686-P iio: imu: inv_icm42600: fix odr switch when turning buffer off perf/x86/intel/uncore: Support more units on Granite Rapids perf/x86/intel/uncore: Add per-scheduler IMC CAS count events cleanup: Provide retain_and_null_ptr() usb: gadget: f_ncm: Fix net_device lifecycle with device_move KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration KVM: x86: do not allow re-enabling quirks KVM: x86: Allow vendor code to disable quirks KVM: x86: Introduce supported_quirks to block disabling quirks KVM: x86: Remove VMX support for virtualizing guest MTRR memtypes KVM: VMX: Drop support for forcing UC memory when guest CR0.CD=1 KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM drm/xe/sync: Cleanup partially initialized sync on parse failure ice: fix devlink reload call trace io_uring/uring_cmd: fix too strict requirement on ioctl erofs: fix inline data read failure for ztailpacking pclusters mm: merge folio_is_secretmem() and folio_fast_pin_allowed() into gup_fast_folio_allowed() mm: thp: deny THP for files on anonymous inodes sched/fair: Fix zero_vruntime tracking mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations drm/i915/dsc: Add Selective Update register definitions drm/imagination: Fix deadlock in soft reset sequence ata: libata-scsi: Return residual for emulated SCSI commands ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in() soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap() Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers nf_tables: nft_dynset: fix possible stateful expression memleak in error path bonding: prevent potential infinite loop in bond_header_parse() drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state perf/x86/intel: Add missing branch counters constraint apply Revert "LoongArch: Add machine_kexec_mask_interrupts() implementation" cxl/port: Fix use after free of parent_port in cxl_detach_ep() driver core: generalize driver_override in struct device driver core: platform: use generic driver_override infrastructure bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list kbuild: install-extmod-build: Package resolve_btfids if necessary nvmet: move async event work off nvmet-wq ALSA: hda/realtek: add quirk for ASUS UM6702RC i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi xfrm: fix the condition on x->pcpu_num in xfrm_sa_len xfrm: prevent policy_hthresh.work from racing with netns teardown Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete net: bcmasp: remove eee_enabled/eee_active in bcmasp_get_eee() net: bcm: asp2: fix LPI timer handling net: bcm: asp2: remove tx_lpi_enabled net: bcmasp: Add support for ASP 2.2 net: bcm: asp2: convert to phylib managed EEE net: bcmasp: Remove support for asp-v2.0 net: bcmasp: streamline early exit in probe net: bcmasp: fix double free of WoL irq net: bcmasp: Add support for asp-v3.0 net: bcmasp: fix double disable of clk platform/x86: intel-hid: disable wakeup_mode during hibernation iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() team: fix header_ops type confusion with non-Ethernet ports ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter spi: meson-spicc: Fix double-put in remove path drm/amd/display: Do not skip unrelated mode changes in DSC validation spi: Group CS related fields in struct spi_device spi: use generic driver_override infrastructure hwmon: (pmbus/core) Fix various coding style issues hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only hwmon: (pmbus) Introduce the concept of "write-only" attributes x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() ovl: fix wrong detection of 32bit inode numbers net: macb: Move devm_{free,request}_irq() out of spin lock area dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() dmaengine: fsl-edma: fix channel parameter config for fixed channel requests LoongArch: Fix missing NULL checks for kstrdup() xfs: scrub: unlock dquot before early return in quota scrub ext4: validate p_idx bounds in ext4_ext_correct_indexes LoongArch: vDSO: Emit GNU_EH_FRAME correctly spi: tegra210-quad: Protect curr_xfer check in IRQ handler media: nxp: imx8-isi: Fix streaming cleanup on release rust: pin-init: internal: init: document load-bearing fact of field accessors ovl: Use str_on_off() helper in ovl_show_options() ovl: make fsync after metadata copy-up opt-in mount option virt: tdx-guest: Fix handling of host controlled 'quote' buffer length net: add proper RCU protection to /proc/net/ptype landlock: Optimize file path walks and prepare for audit support landlock: Fix handling of disconnected directories idpf: check error for register_netdev() on init idpf: detach and close netdevs while handling a reset idpf: Fix RSS LUT NULL pointer crash on early ethtool operations idpf: Fix RSS LUT NULL ptr issue after soft reset ASoC: ak4458: Convert to RUNTIME_PM_OPS() & co netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() xen/privcmd: unregister xenstore notifier on module exit futex: Require sys_futex_requeue() to have identical flags dmaengine: idxd: Fix leaking event log memory net: bcmasp: Restore programming of TX map vector register net: bcmasp: Fix network filter wake for asp-3.0 idpf: nullify pointers after they are freed UBUNTU: Upstream stable to v6.6.131, v6.12.78, v6.12.79, v6.12.80 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2155660/+subscriptions