[Bug 2167609] Re: Resolute update: upstream stable patchset 2026-09-17

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2167609 Title: Resolute update: upstream stable patchset 2026-09-17 Status in linux package in Ubuntu: Invalid Status in linux source package in Resolute: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-09-17 Ported from the following upstream stable releases: v6.18.49, v6.18.50, v7.2.2, v7.2.3, v7.2.4 from git://git.kernel.org/ fuse: fix race between interrupt and resend fuse: fix missing barrier when checking io-uring readiness fuse: publish io-uring queues with release semantics fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free vlan: fix skb_under_panic and races when toggling HW VLAN offload crypto: sun8i-ce - Remove crypto_rng interface UBUNTU: [Config] Remove CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG crypto: sun8i-ss - Remove crypto_rng interface UBUNTU: [Config] Remove CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG ASoC: tegra210_i2s: sort the register default table ASoC: tegra210_i2s: sort the Tegra264 register default table ASoC: tegra210_mixer: sort the register default table ASoC: tegra: Fix the I2S enable default value ASoC: tegra: Fix the MIXER enable default value ASoC: tegra: Sort ADMAIF register defaults ASoC: tegra: Sort MBDRC register defaults ring-buffer: Fix subbuf resize race with ring buffer readers drm/amd/display: hide Apple Studio Display secondary tile drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally rust: time: fix as_micros_ceil() rounding near i64::MAX alpha: don't leak hardware-fabricated FP exception bits to user space clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path clocksource/drivers/timer-sun4i: Advertise a real minimum delta fs: fix user path of nested backing files ovl: fix double end_creating() on the casefold-mismatch path pidfd: hold exec_update_lock around namespace ioctl powerpc/pseries/iommu: switch to Default DMA window during kdump rust: fmt: fix {:p} printing stack addresses timers/itimer: Zero-init old itimerval before copy to userspace objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 rust: bug: skip arch-specific asm in `testlib` builds rust: bug: fix warn_on macro build error on UML rust: bug: prevent dead_code warning from warn_on!'s flags constant rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 rust: kernel: list: fix incorrect pop_back example comment objtool/rust: add one more `noreturn` Rust function rust: num: restrict bool conversion to unsigned Bounded rust: cfi: disable function merging if CFI is enabled KEYS: trusted: Fix TPM teardown ordering apparmor: fix cred UAF caused by begin_current_label_crit_section() apparmor: fix out-of-bounds write when null terminating a label vec include/linux/list.h: mark list_add and __list_add as __always_inline mm, swap: ratelimit bad swap entry reports mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd mm/huge_memory: use folio's memcg inside __folio_split() mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() mm/kmemleak: avoid soft lockup when scanning task stacks mm/madvise: skip device-private PMDs in cold and pageout walks mm/mempolicy: skip non-present PMDs when queueing folios mm/mglru: use the common routine for dirty/writeback reactivation mm/mglru: fix and remove redundant unevictable folio handling mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() mm/migrate: use huge_ptep_get() in remove_migration_pte() mm/migrate_device: clear stale mapping after freeing swapcache mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() mm/page_vma_mapped: use huge_ptep_get() for hugetlb mm/pagewalk: fix stale walk->action escaping walk_pmd_range() mm/rmap: use huge_ptep_get() in try_to_unmap_one() mm/rmap: use huge_ptep_get() in try_to_migrate_one() mm/slub: fix missing debugfs entries for caches created before sysfs init mm/slub: prevent pfmemalloc objects from entering the barn mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() mm/zswap: fix global shrinker when memory cgroup is disabled mm: compaction: support non-movable compaction for pageblock requests mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings mm: memcg-v1: fix memsw and TCP failcnt accounting mm: memcg: stop reclaim when a limit update is superseded mm: memcontrol: update state_local when flushing NMI stats mm: mempolicy: fix automatic numa balancing for shmem mm: page_alloc: __GFP_FS lockdep annotation for direct compaction mm: page_alloc: move capture_control to the page allocator mm: page_alloc: fix non-movable reclaim storm in defrag_mode mm: vmscan: fix node reclaim ignoring swappiness parameter tools/compiler: match glibc 2.42 definition of __attribute_const__ x86/locking: Use sfence for wmb() if SSE is available x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() x86/tdx: Fix off-by-one in port I/O handling x86/tdx: Fix zero-extension for 32-bit port I/O x86/xen: fix init of balloon stats again hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() tracing/user_events: Clear copied tracing state before fork duplication tracing: Fix crash passing ERR_PTR to kthread_stop() tracing: Fix logged instance name on creation failure tracing: Fix use-after-free in trace_pipe read on sub-buffer order change tracing: Fix use-after-free with same-name named triggers cdx: Fix double free when sysfs file creation fails debugfs: Fix lockdown check for mmap_prepare device property: fix infinite loop in fwnode_for_each_child_node() misc: nsm: bound the device-reported response length powerpc/powermac: fix OF node refcount rapidio: mport_cdev: fix use-after-free in dma_req_free() Revert "media: v4l2-dev: fix error handling in __video_register_device()" serial: imx: serialize imx_uart_ports[] lifetime staging: greybus: hid: fix SET_REPORT return value usb: dwc2: gadget: Exit partial power down state when changing USB pull-up usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed USB: phy: fsl-usb: fix missing static keywords usb: typec: hd3ss3220: fix VBUS regulator error message usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() usb: typec: thunderbolt: Disable work before freeing tbt on remove usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion usb: gadget: u_audio: Fix use-after-free on sound card disconnect usb: gadget: snps_udc_plat: clean up PHY on probe deferral usb: gadget: midi2: remove default configfs groups on teardown usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() usb: gadget: f_fs: Prevent deadlock during ep0 read loop cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature i3c: renesas: Fix out-of-bounds access for newdevs mask KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() media: cec: stm32: prevent out-of-bounds write on RX overflow media: vicodec: fix out-of-bounds write in FWHT encoder nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation of: fix out-of-bounds read in of_alias_scan() stem parser PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() phy: rockchip-samsung-dcphy: fix out-of-range max_register ubifs: fix out-of-bounds read in signature length check zram: fix out-of-bounds access in read_block_state() zram: fix out-of-bounds access in writeback_store() zram: set default primary compressor in zram_destroy_comps() zram: validate deflate params zsmalloc: account for handle size in class lookup NFS/localio: fix ref leak on nfs_uuid_add_file failure NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails NFSD: check truncate permission under inode lock NFSD: Encode only the status in NFS-ACL v2 GETACL error replies NFSD: Fix off-by-one in DRC bucket pruning limit NFSD: fix up error returned by write_threads() NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check nfsd: guard nfsd_serv deref in nfsd_file_net_dispose NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path pNFS: Fix EBUSY check in pnfs_layout_need_return lockd, nfsd: RCU-protect nlmsvc_ops dispatch nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown nfsd: release path refs on follow_down() error nfsd: Reset write verifier when async COPY writeback fails nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types nfsd: sample writeback error cursor before async COPY loop nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd: size fh_verify server sockaddr slot by xpt_locallen nfsd: validate nseconds in TIME_DELEG decode paths nfsd: validate sockaddr length per family in listener_set nfsd: validate symlink target length in NFSv4 CREATE nfsd: move struct nfsd_genl_rqstp to nfsctl.c nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() nfsd: add filehandle match check to nfsd4_delegreturn() nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref nfsd: cap decoded POSIX ACL count to bound sort cost nfsd: check client ownership when cancelling a copy-notify stateid nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() nfsd: clear CALLBACK_RUNNING on failed delegation recall queue nfsd: clear opcnt on compound arg release to prevent OOB read nfsd: convert nfsd_net boolean flags to unsigned long flags word nfsd: dedup nfs4_client_to_reclaim inserts nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper nfsd: defer vfree of compound ops to fix rpc_status UAF nfsd: don't free session slots that are still in use nfsd: drop the stateid, not the stateowner, on seqid_op replay retry nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd: fix clock domain mismatch in clients_still_reclaiming() nfsd: fix cpntf publish race in nfs4_init_cp_state nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd: fix FL_SLEEP being set unconditionally for all LOCK types nfsd: fix netlink dumpit error handling for rpc_status_get nfsd: fix nfsd_file leak on inter-server COPY setup failure nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs nfsd: fix partial-write detection in nfsd_direct_write nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure nfsd: fix reply size estimate for GET_DIR_DELEGATION nfsd: fix stale s2s_cp_stateids IDR entry for async COPY nfsd: fix UAF in async copy cancel and shutdown nfsd: fix version mismatch loops in nfsd_acl_init_request() nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd: gate nfs2 setacl by argp->mask nfsd: gate nfs3 setacl by argp->mask nfsd: hold rcu across localio cmpxchg retry nfsd: initialize copy-notify stateid before publishing it nfsd: initialize DRC hash table before registering shrinker nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE nfsd: reject reclaim LOCK after RECLAIM_COMPLETE nfsd: release OPEN-decoded posix ACLs via op_release nfsd: revoke copy-notify stateids before dropping their reference NFSD: Prevent lock owner use-after-free during client teardown NFSD: Prevent post-shutdown use-after-free in unlock_filesystem NFSD: Prevent client use-after-free during admin state revocation nfsd: convert global state_lock to per-net deleg_lock NFSD: Prevent client use-after-free during delegation revoke NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update libceph: validate OSD extent maps before cursor advance libceph: reject buckets with mismatched CRUSH ids ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock ceph: fix UAF in check_new_map() on session freed during unlock ceph: force a cap message when a deferred revoke can't be acked immediately ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode ceph: bound copied dentry name length in NFS export get_name ceph: bound MDSCapAuth path and fs_name decode in handle_session() ceph: bound num_export_targets array for mds info v2/v3 ceph: bound xattr value length in __build_xattrs() ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph: do not repeat ceph_trim_dentries() if no progress possible ceph: fix leaked inode reference on writeback abort at umount btrfs: drop recovered reloc root refs on recovery failure btrfs: fix extent map leak in NOCOW direct I/O write btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag audit: avoid dropping live tree ref on fsnotify rule autoremove smb: move some definitions from common/smb2pdu.h into common/fscc.h smb/client: reduce fallocate zero buffer allocation smb/client: emulate small EOF-extending mode 0 fallocate ranges cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem smb/client: do not account EOF extension as allocation cifs: call pagecache_isize_extended() in cifs_setsize() when extending cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 smb: client: clear ce->tgthint in free_tgts() smb: client: fix ALIGN() overflow in symlink_data() error context loop smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() smb: client: harden DFS cache against invalid target hints smb: client: reject a tree connect response whose byte count is too small smb: client: restore the data_offset bound in is_valid_oplock_break() HID: apple: preserve keyboard backlight across T2 resume HID: corsair-void: Check size of status and firmware events before reading them HID: picolcd: clamp eeprom debugfs read to bytes actually received HID: roccat: free buffered reports when destroying device HID: sensor: custom: Fix field sysfs group cleanup on failure HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind HID: universal-pidff: stop the device when force-feedback init fails HID: mcp2221: stop device IO before hid_hw_stop HID: mcp2221: fix OOB write in mcp2221_raw_event() HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes HID: mcp2221: validate report size in mcp2221_raw_event() HID: intel-thc-hid: intel-quickspi: validate report size before copy HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown eventfs: Initialize ei->children and ei->list in init_ei() fs/ntfs3: validate dirty page table on log replay fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() fs/ntfs3: bound page_lcns[] index by the log record eCryptfs: bound the packet-length peek to the user buffer ecryptfs: fix tag 11 packet exact-fit size check ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs: pass packet set buffer size to parser ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet ecryptfs: reject too-small tag 70 packets ecryptfs: release message context on send failure ecryptfs: show filename encryption options efivarfs: Rate limit statfs() handler entry: Fix seccomp bypass after ptrace with TSYNC erofs: skip sufficiently large global buffers when resizing ext2: Fix lost inode updates for IS_SYNC inodes fanotify: fix use-after-free of file range info fat: restore original value when fat_ent_write failed fbdev: omapfb: panel-dsi-cm: initialize lock before registering display fbdev: pvr2fb: correct user pointer annotation and sentinel initializer fbdev: ssd1307fb: defer I2C transfers from damage callbacks fbdev: uvesafb: unregister connector callback on init failure forcedeth: fix off-by-one when saving/restoring non-PCI config space fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration fsnotify: Fix stale object mask after concurrent mark updates hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device hugetlb: only adjust reservation during unmapping if mapcount is 0 accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() accel/rocket: initialize job domain before cleanup paths accel/rocket: Fix error path handling in rocket_job_run() acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks ACPI: APEI: Fix ERST timeout unit conversion ACPI: APEI: GHES: fix ARM section length accounting after header ACPI: pfr_update: fix stack buffer overflow in query_capability() ACPI: scan: Avoid registering platform devices with resource overlaps alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() alpha: marvel: Fix irq_set_status_flags to use correct IRQ number alpha: marvel: Fix lock ordering in init_io7_irqs() ARM: 9477/1: Disable broken eBPF JIT on the Risc PC ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes auxdisplay: charlcd: cancel backlight work on registration failure backlight: aw99706: Fix DT property names to match binding backlight: aw99706: Honor the core blank state in update_status() block: validate user space vectors during extraction block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 Bluetooth: eir: Fix OOB read in eir_get_service_data() bnx2x: fix double free in bnx2x_init_firmware() error path bnxt_en: Write doorbell when linearizing skb fails bpf, x86: Fix per-CPU address resolution into an extended register bpf: Disable preemption in __bpf_get_stack buffer: avoid tail commit walk for uptodate folios bpf: Harden bloom filter sizing and indexing on 32-bit kernels dm-io: clone the source bio instead of copying its biovec dm-io: report non-retryable errors separatedly dm-era: fix shadowed superblock leak on take-snap failure dm raid1: reserve space for NUL-terminator in build_constructor_string() dm array: validate array block headers on read dm array: reject an array block whose value size is not the caller's coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior cpufreq: apple-soc: Fix OPP table cleanup cpufreq: schedutil: Fix rate limit overflow cxl/features: bound fwctl command payload to the input buffer dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding cxl/region: Add helper to check Soft Reserved containment by CXL regions cxl/mce: Make the MCE notifier per-region cxl/pmem: Format the nvdimm serial number as unsigned decimal cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready Bluetooth: RFCOMM: serialize security confirmation handling Bluetooth: hci_conn: re-enable advertising only for peripheral role Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request kasan: fix cache shrink race with CPU hotplug jbd2: bound shrinker scans by examined checkpoint buffers jbd2: check need_resched() when skipping busy checkpoint buffers ipip: fix skb leak in collect_md mode when metadata_dst allocation fails ip: orphan prefetched skbs before multicast forwarding ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_gre: fix hardware header length for NBMA tunnels ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6: use RCU iterator to dump route exceptions landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation libnvdimm/labels: Prevent integer overflow in __nd_label_validate() mailbox: qcom-ipcc: fix duplicate channel allocation across holes md/raid10: fix still_degraded being inverted in raid10_sync_request() md: do overflow check for sb->bblog_shift in super_1_load() module: validate string table section types mpls: reload header after pskb_may_pull() mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction module/kallsyms: fix nextval for data symbol lookup nouveau/gem: reserve the bo in the info ioctl around the vma lookup params: fix charp corruption on allocation failure phy: fsl-imx8mq-usb: fix typec switch leak on probe error path SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry SUNRPC: svcauth_gss: enforce krb5 token minimum length sunrpc: route to a populated pool in svc_pool_for_cpu() SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode SUNRPC: always drain cache_cleaner before destroying a cache_detail SUNRPC: Check svc pool percpu counter allocation SUNRPC: close backchannel before destroying callback service sunrpc: defer rq_argp and rq_resp free until after RCU grace period SUNRPC: fix gssx_dec_option_array error path bugs sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat SUNRPC: harden gss_krb5_unwrap_v2 against short tokens SUNRPC: harden gss_unwrap_resp_priv length checks sunrpc: init gssp_lock before publishing proc entry SUNRPC: reject duplicate CREDS_VALUE options SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 SUNRPC: wait for in-flight client TLS handshake callback svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails svcrdma: Fix offset arithmetic in read_chunk_range svcrdma: Fix pcl_for_each_segment for empty chunks svcrdma: Fix unmatched rn_unregister on failed accept svcrdma: Reject connection when transport allocation fails svcrdma: Reject inline replies that overflow the pull-up buffer svcrdma: Reject oversized Read segments at decode time svcrdma: Reject Read lists that exceed the page budget svcrdma: Reject Write/Reply chunks with segcount 0 svcrdma: Use svc_xprt_put to free listener on create failure svcrdma: Validate Read chunk positions before reconstruction udf: reject VAT indexes equal to the entry count wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets wifi: mt76: mt7925: cancel pending mlo_pm_work staging: media: tegra-video: fix of_node_put() on VIP parse errors staging: media: tegra-video: vi: fix probe failure on skipped last port media: staging/ipu7: fix async notifier UAF on probe error path sched/core: Handle pick_task() releasing the rq lock sched_ext: Fix exit_task leak on fork failure during enable sched_ext: Fix inverted ops.core_sched_before() invocation sched_ext: Keep kick_sync waiting on the rq's own CPU scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock rpmsg: glink: smem: order FIFO read after availability check Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck arm64: dts: rockchip: fix emmc reset polarity on px30-cobra arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio arm64: dts: rockchip: Fix rk3588s-roc-pc audio description riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage RISC-V: KVM: Fix PMU event info array size overflow riscv: acpi: Handle LPI architectural context loss flags riscv: unaligned: stop using kthread for check_vector_unaligned_access() remoteproc: scp: Fix device reference leak on failed lookup ptp: vmclock: prevent read-only mappings from becoming writable qede: Fix NULL pointer dereference in TPA fragment processing RDMA/cxgb4: Cancel reg_work before freeing device on remove RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget RDMA/ionic: Embed counter driver data in rdma_counter allocation RDMA/ucma: Lock the handler in ucma_set_ib_path() RDMA/ucma: Lock the handler in ucma_write_cm_event() RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata regulator: qcom-refgen: correct the regulator type to CURRENT ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring-buffer: Free cpu_buffer::free_page with subbuf_order ring-buffer: Hold cpu_buffer::lock when resizing a subbuf ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page PM: sleep: Unblock runtime PM when device prepare fails orangefs: fix double-free of trailer_buf on readdir copy failure orangefs: skip leading spaces before parsing client debug masks ocfs2: always run deallocs on copy-on-write completion ocfs2: bound namelen in dlm_migrate_request_handler ocfs2: validate lengths in dlm_mig_lockres_handler ocfs2: validate rl_used against rl_count in refcount block validator ocfs2: validate dx_root extent list fields during block read ocfs2: validate directory-index entry counts when reading metadata ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item ocfs2: cluster: fix o2hb_dependent_users leak on pin failure ocfs2: fix cached cluster count after suballocator reclaim ocfs2: fix readdir position truncation on 32-bit kernels openrisc: fix arbitrary kernel memory access via or1k_atomic syscall openvswitch: Fix CT limit teardown use-after-free openvswitch: only skb_tx_error() a packet we are about to drop ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion arm64: compat: Fix decrementing LDM/STM alignment emulation arm64: proton-pack: Restore the nospectre_bhb command-line option ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC ASoC: codecs: aw88261: reduce log spam ASoC: codecs: aw88261: only check PLL and clock state at power-up hwmon: (max6621) fix negative temperature offset and crit readings hwmon: (max6621) fix temperature clamp range i2c: mxs: fix DMA channel leak on probe error ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() lockd: pin next file across nlm_inspect_file lock-drop lockd: fix NULL dereference on lockowner allocation failure lockd: fix swapped arguments in nlmsvc_match_ip() nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path nvme: zero the discard fallback page nvme-pci: disable controller on admin queue IRQ setup failure nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone nvme-tcp: fix host memory disclosure on R2T for a read command nvme-tcp: reject a read that transferred too few bytes sctp: stop processing a packet once its association is deleted sctp: drop a chunk if its transport was removed sctp: fix NULL deref on untransmitted RECONF completion sctp: distinguish sequence zero from wildcard in reconf lookup sctp: fix stream->outcnt underflow on duplicate RECONF responses power: supply: bq24257: fix use-after-free on remove power: supply: bq256xx: drain usb_work before freeing the charger power: supply: bq25890: Fix power_supply reference leak power: supply: charger-manager: register regulators before exposing sysfs power: supply: cros_usbpd-charger: bound the EC-reported port count power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS power: supply: lp8727: fix use-after-free in lp8727_release_irq() power: supply: lp8788-charger: fix use-after-free on remove power: supply: pf1550: enable charging when battery profile exists power: supply: qcom_battmgr: fix use-after-free power: supply: qcom_battmgr: terminate the strings from firmware power: supply: rt9455: quiesce delayed work before teardown power: supply: twl4030_charger: cancel workers via devm power: supply: ucs1002: fix use-after-free on remove power: supply: max17040: propagate register read errors power: supply: max17040: drop incorrect I2C functionality check power: supply: max17040: synchronize work cancellation on suspend s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks s390/dasd: Do not complete a failed ESE read as successful s390/dasd: Guard sysfs discipline callbacks against unallocated private data s390/dasd: Propagate partial completion length across ERP recovery PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk PCI: meson: Fix GPIO state while requesting PERST# PCI: starfive: Fix resource leaks on error paths in host_init() PCI: plda: Fix use-after-free of event IRQs during teardown PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] PCI/sysfs: Fix read byte order in pci_read_legacy_io() PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses PCI/AER: Emit TLP Log only for unmasked errors PCI/AER: Fix mapping of errors to agent & layer PCI/ASPM: Avoid L0s for Realtek RTS525A PCI/MSI: Enable memory decoding before restoring MSI-X messages PCI/proc: Avoid spurious runtime PM wakeup on config space accesses PCI/proc: Use file_ns_capable() when checking config space read access PCI/proc: Warn on writes to kernel-exclusive config space regions iommu/amd: Put PCI device after handling PPR faults iommu/msm: Unwind probe state on registration failure iommu/sva: Set handle->dev before the SVA handle is visible iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field iommu/arm-smmu-v3: Add HAFT support for SVA iommu/arm-smmu-v3: Manage teardown with devm iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add iommu/vt-d: Fix no_iommu to disable platform opt-in iommu/vt-d: Force requesting ACS when tboot is enabled iommupt: Return zero for invalid iova_to_phys() ranges iommufd: Avoid locking internal accesses during unmap iommufd: Release current IOAS on xa_store() failure iommufd: Fix UAF in selftest IOPF reporting platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer platform/x86: ISST: Validate level in perf mask ioctls platform/x86: ISST: Validate socket ID in clos_assoc ioctl mmc: via-sdmmc: cancel card-detect work on remove mmc: via-sdmmc: stop card-detect handling on probe failure platform/x86: ISST: Add a NULL check for sst_inst[] platform/x86: ISST: Just allow 2 bits for SST feature enable platform/x86: ISST: Use PP level enable mask platform/x86: ISST: Validate logical CPU id and clos id platform/x86: ISST: Validate max level for set feature platform/x86: ISST: Validate parameter for core power state platform/x86: ISST: Validate parameter for frequency and priority platform/x86: ISST: Return error during profile addition platform/x86: int1092: Fix potential memory leak in sar_probe() platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response platform/x86: think-lmi: Fix certificate thumbprint sysfs output platform/x86: think-lmi: Free system certificate signatures platform/x86: think-lmi: Fix current password length check platform/chrome: sensorhub: Bound the EC-reported sensor number platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths platform/x86/amd/pmc: Propagate SMU errors and validate S2D address platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2() platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS platform/x86: hp-bioscfg: advance elem past consumed array elements platform/x86: hp-bioscfg: bound ordered-list parsing by the package count platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() platform/x86: hp-bioscfg: fix heap OOB read on empty password write platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed platform/x86: hp-bioscfg: pass validated element count to package parsers platform/x86: hp-bioscfg: warn on element type mismatch instead of failing io_uring/waitid: honor task_work cancellation io_uring/waitid: avoid siginfo copy during ring teardown io_uring/query: cap user size passed to copy_struct_to_user interconnect: Fix use after free in icc_get() and of_icc_get_by_index() ipmi: ipmb: validate write message length ipmi: Remove all sysfs files on registration failure ipmi: si: Fix NULL pointer dereference after failed registration ipmi:msghandler: Cancel work cleanly on an error net/iucv: filter frames in afiucv_hs_rcv() by ingress device xdp: fix zero-copy frame layout slip: fix use-after-free in sl_sync() net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition net: tun: bound receive headroom net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO net: ibm: emac: mal: fix NAPI locking net: ipa: fix stalled modem TX queue after runtime resume net: l2tp: do not propagate multicast notification errors net: openvswitch: fix flow mask use-after-free on flow deletion net: openvswitch: fix nf_connlabels leak in ovs_ct_init net: phylink: correctly validate returned PCS in phylink_inband_caps net: ravb: avoid dereferencing an invalid PTP clock net: ravb: serialize PTP clock teardown net: thunderbolt: Release the Rx HopID that was handed out on mismatch net: thunderbolt: Mark the connection down when bringing it up fails NTB: ntb_transport: Recycle TX entries before client callbacks NTB: ntb_transport: Fail TX enqueue when the QP link is down NTB: ntb_transport: Reject oversized TX buffers net: ntb_netdev: Fix TX busy and drop handling net: ntb_netdev: Avoid double-accounting netif_rx() drops net: ntb_netdev: Count packets dropped on RX refill failure net/mlx5e: SHAMPO, Always calculate page size net/mlx5e: do not HW-GRO coalesce small frames net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry net/smc: do not dereference an unset send buffer on the SMC-D teardown path net/smc: fix socket refcount leak in smc_switch_conns() net/smc: fix use-after-free in smc_rx_pipe_buf_release() net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() net/smc: stop killed, freed and out_of_sync sharing a byte net/smc: unregister the connection before draining the rx tasklet net: cap advertised IP tunnel headroom net: fix spurious TX timeout after dev_activate() net: skbuff: don't touch shared zerocopy state in skb_tx_error() seg6: reset IP6CB after IPv6 decapsulation hwrng: stm32 - Fix runtime PM cleanup on registration failure mfd: cgbc: Fix teardown ordering in cgbc_remove() mfd: qnap-mcu: keep the reply buffer alive past a command timeout mfd: sm501: Fix potential memory leaks during remove ALSA: 6fire: bound the MIDI event length from the device ALSA: aloop: Check card index validity at probe ALSA: bcd2000: clear the URB pointers on disconnect ALSA: FCP: do not copy out an uninitialised init response ALSA: hda/ext: preserve PPLCCTL bits when clearing reset ALSA: mpu401: Check card index validity at probe ALSA: mts64: Check card index validity at probe ALSA: pcxhr: initialize mutexes before requesting threaded IRQ ALSA: portman2x4: Check card index validity at probe ALSA: serial-u16550: Check card index validity at probe ALSA: virmidi: Check card index validity at probe ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() dm-stats: fix a crash if allocation of per-cpu data fails dm-switch: use WRITE_ONCE() in switch_region_table_write() dm-pcache: validate geometry fields from on-disk cache_info dm-pcache: validate kset key_num and intra-segment bounds dm-pcache: validate on-media seg_num against the cache device size dm-pcache: bound the persisted tail-position offset dm-pcache: clamp the tail kset read to the segment data region dm-pcache: detect a cycle in the last-kset chain during replay dm-pcache: only hand out initialized cache segments dm-pcache: fix implicit u8 truncation of gc_percent in message handler dm-pcache: fix use-after-free and invalid seg operations in kset_replay() i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() i3c: master: adi: initialize the lock before enabling interrupts i3c: master: Fix info leak and UAF in device unregister path i3c: master: svc: bound IBI payload to the requested max_payload_len i3c: renesas: Check that the transfer is valid before accessing it i3c: renesas: Clean DATBAS register on detach i3c: renesas: Follow the reset deassert order used in probe i3c: renesas: Reconfigure the DATBAS register on re-attach i3c: renesas: Reset the controller on resume i3c: renesas: Restore STDBR and EXTBR registers on resume i3c: renesas: Perform Dynamic Address Assignment on resume wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop fuse-uring: refactor io-uring header copying to ring fuse-uring: refactor io-uring header copying from ring fuse-uring: use enum types for header copying fuse-uring: refactor setting up copy state for payload copying fuse-uring: use named constants for io-uring iovec indices fuse: copy request headers via a stack buffer for io-uring crypto: iaa - unmap dst before software fallback on decompress crypto: atmel-ecc - clean up and improve ECDH comments crypto: atmel-ecc - avoid stale fallback key after set_secret failure mm/kmemleak: stop the task stack scan early when interrupted mm/kmemleak: report RCU-tasks quiescent states during the scan wifi: mwifiex: Detach sync cmd buffer on interrupted wait wifi: rtl818x: initialize eeprom_93cx6 struct to zero wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() wifi: rtw88: pci: fix resource leak on failed NAPI setup wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy wifi: mt76: mt7925: cancel mlo_pm_work on stop wifi: mt76: add external EEPROM support for mt799x chipsets wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames wifi: mt76: mt7996: validate default EEPROM firmware size vsock/virtio: flush works in dependency order w1: ds28e17: reject an oversize length on an I2C block read xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() zloop: truncate finished zones to zone capacity tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] sticon/parisc: Detect default STI graphics card for console output signal: avoid shared siginfo namespace rewrites smack: fix cred UAF in smack_file_send_sigiotask() taskstats: fix cpumask parsing cutting off the last character timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() timer: Keep debugobjects state consistent in migrate_timer_list() udf: Fix i_lenExtents truncation on 32-bit kernels selftests/mm: fix on-fault-limit false failure under sudo-rs resource: Add __resource_contains_unbound() for internal contains checks ACPI: scan: Do not combine resources that overlap completely platform/chrome: sensorhub: Fix dropped timestamp events and log spam UBUNTU: Upstream stable to v6.18.49, v6.18.50, v7.2.2, v7.2.3, v7.2.4 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167609/+subscriptions