[Bug 2167950] Re: Resolute update: upstream stable patchset 2026-09-22

** Tags added: kernel-daily-bug -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2167950 Title: Resolute update: upstream stable patchset 2026-09-22 Status in linux package in Ubuntu: Invalid Status in linux source package in Resolute: Fix Committed Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-09-22 Ported from the following upstream stable releases: v6.18.51, v7.2.5 from git://git.kernel.org/ net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() drm/xe: Don't hand out the flat CCS storage as usable VRAM drm/amd/display: fix division by zero in get_estimated_bw() usb: image: mdc800: change kmalloc() to kzalloc() ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset media: usbtv: keep device alive while ALSA card exists usb-storage: ene_ub6250: fix race between scan work and probe usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() usb: dwc3: clear forceRM when issuing EndTransfer usb: storage: realtek_cr: fix use-after-free on disconnect usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails usb: typec: qcom-pmic: cancel reset_work on stop usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x usb: typec: ucsi: displayport: Fix OOB altmode array index usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs usb: gadget: f_midi2: fix use-after-free in string attribute show path usb: gadget: f_midi: initialize work in f_midi_alloc() USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() usb: gadget: fix null pointer dereference in usb_put_function_instance() staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() xhci: fix lost bounce buffers on TDs spanning several ring segments thermal/drivers/imx: Disable clock on runtime resume failure thermal/drivers/qoriq: Disable clock on resume failure userfaultfd: reset err to be 0 when move_pages_ptes succeeded ublk: clear VM_MAYWRITE on read-only ublk char device mmap soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size spi: bcm63xx-hsspi: disable clocks on resume failure spi: bcm63xx: disable clock on resume failure spi: bcmbca-hsspi: disable clocks on resume failure spi: Fix DMA mapping ownership on partial map failure scsi: target: iscsi: Reserve a terminator byte for the login payload scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame scsi: pm8001: Use rollback index when freeing MSI-X vectors mm/damon/vaddr-kunit: check region count in three_regions test samples/damon/mtier: handle damon_start() failure samples/damon/mtier: handle damon_stop() failure samples/damon/prcl: handle damon_start() failure samples/damon/prcl: stop and free damon ctx when damon_call() fails samples/damon/wsse: handle damon_start() failure samples/damon/wsse: stop and free damon ctx when damon_call() fails mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs mm/damon/sysfs-schemes: kobject_del() scheme dirs mm/damon/sysfs-schemes: kobject_del() scheme filter dirs mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs mm/damon/sysfs-schemes: kobject_del() scheme region dirs mm/damon/sysfs: kobject_del() region and target (error) dirs mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs mm/damon/core-kunit: check region count before testing in split_at() futex: Prevent rcuwait use-after-free during requeue PI ftrace: Synchronize the initialization of ftrace_ops HID: bpf: serialize device reference release in struct_ops destroy path HID: rmi: fix OOB access with undersized RMI reports HID: wacom: validate report length in wacom_intuos_pro2_bt_irq dm: fix race when loading and unloading a table dm: fix resume-vs-remove race dma-direct: return struct page from dma_direct_alloc_from_pool() dmaengine: fsl-edma: tracing: no ptr dereference during log output dmaengine: dw-edma: Fix HDMA channel status register access dmaengine: dw-edma: Complete descriptors before pausing dmaengine: dw-edma: Initialize IRQ data before requesting IRQs cpuidle: dt_idle_genpd: kfree() the original name allocation cpuidle: psci: Fix support for probe deferral by dropping the faux device block: flag zoned disks with GENHD_FL_NO_PART bpf: Fix infinite loop in pcpu_freelist push with one possible CPU ceph: lock mutex in ceph_mds_check_access() ata: ahci: work around lost interrupts on Marvell 88SE61xx ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout kprobes: Protect kprobe_blacklist with RCU mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() Input: aiptek - validate raw macro indices before updating state memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done memcg: make the v1 soft limit knob inert rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt rtc: rzn1: Fix weekday underflow when alarm crosses month boundary rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers perf/x86/intel: Fix kernel address leakages in LBR stack perf trace: Factor out BPF loop body perf trace: Refactor augmented_raw_syscalls using bpf_for perf hisi-ptt: Fix PTT trace TLP header parsing i2c: designware: Enable interrupt mask workaround for HJMC3001 i2c: qcom-geni: update frequency table to fix timing parameters i2c: core: fix debugfs UAF on adapter removal i2c: mux: Fix channel node leak on adapter add failure arm64: mm: Fix the lockless page-table walk in show_pte() arm64: errata: pass REVIDR when matching target implementation CPUs ALSA: rawmidi: Return the error from snd_rawmidi_input_params() ALSA: harmony: initialize locks before requesting IRQ ALSA: pcm: Fix race between non-atomic ops and trigger-start nvme-fabrics: fix DHCHAP secret leak on parse failure nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails nvme-tcp: check the data direction of a C2HData PDU nvme: add missing SRCU grace period in error path nvmet-auth: Synchronize timeout work during SQ teardown nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet-tcp: reject unsolicited H2CData PDUs pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig Revert "irqchip/mbigen: Fix mbigen node address layout" mm/hugetlb: fix missing migratable flag on same-node hugetlb migration mm/hugetlb: keep max_huge_pages when dissolving surplus folios mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON() nvdimm/btt: reject an arena whose nfree is below the lane count parisc: eisa: Fix infinite loop when parsing invalid IRQ value parisc: Fix alignment of asm statements in head.S powerpc/kexec_file: Fix null-ptr-def in extra size calculation powerpc/kexec_file: Prevent kexec range truncation powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population powerpc/pseries: Handle and log pseries-wdt registration failures powerpc/pseries: Move H_WATCHDOG definitions to a common header powerpc/crash: stop watchdogs before booting kdump kernel s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects s390/vfio-ap: Fix NULL deref in status_show() during queue probe s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object mtd: afs: validate v2 image info bounds mtd: mtdoops: free page bitmap when the backing MTD is removed mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() mtd: rawnand: validate ONFI extended parameter page sections batman-adv: fix stale receive device on merged fragments batman-adv: mcast: ensure unshared skb for multicast packets batman-adv: mcast: linearize skbuff for packet generation batman-adv: dat: avoid unaligned fault in IP extraction batman-adv: bla: fix freeing of claims on meshif deletion batman-adv: bla: prevent CRC corruptions after claim flush clk: clocking-wizard: fix integer overflow in rate calculation clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen clk: meson: align gxbb_32k_clk_sel number of parents with actual count clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure ASoC: cs35l33: drain threaded IRQ before runtime suspend ASoC: cs35l34: drain threaded IRQ before runtime suspend ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division ASoC: hdac_hda: Fix hlink refcount leak on component registration failure AsoC: intel: sst: fix PCI device reference leak on probe failure ASoC: loongson: Fix error handling in ACPI property parsing ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get iio: adc: adi-axi-adc: add data size support for AD408X backend iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig iio: adc: pac1921: fix wrong channel used in trigger handler read iio: buffer: Fix potential use-after-free in anonymous buffer release iio: buffer: Make IIO DMA fence release RCU-safe iio: buffer: Tie IIO dma fence lock lifetime to the fence iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: chemical: sgp30: Handle IAQ thread creation failure iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show iio: dac: m62332: Fix regulator reference count imbalance iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: light: cm32181: return zero after writing calibscale iio: light: gp2ap002: Disable regulators on resume failure iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe iio: pressure: mpl115: Fix runtime PM cleanup iio: srf04: fix pm_runtime handling on probe error path iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() iio: ti-ads7138: Disable STATS_EN bit while reading conversion results iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode KVM: nVMX: Always flush vpid02 on first use KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit KVM: nVMX: Service local TLB flushes on failed nested VM-Enter KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock KVM: x86: Serialize writes to disabled_quirks using kvm->lock KVM: x86: Ensure runtime reads of disabled_quirks are resolved once KVM: s390: Fix length check __import_wp_info() KVM: s390: Fix memory leak in guest debug handling KVM: s390: Fix old_data leak in guest debug error path KVM: s390: Free guest debug data on vcpu destroy KVM: s390: Take srcu when importing watchpoint data KVM: s390: Zero initialize irq in reinject_machine_check KVM: s390: Fix memory corruption by not reinjecting CK machine checks KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP KVM: s390: Restore sigset on error path KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation KVM: arm64: Correctly handle end of VA space TLBI invalidation KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry KVM: arm64: Sign-extend VA for range-based TLBI invalidation KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables KVM: arm64: vgic: Fix detection of MI on no pending LR KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save KVM: arm64: Correctly cap TLBI Range to the architural limit LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path LoongArch: KVM: Fix TOCTOU race on pv_features LoongArch: KVM: Free init resources if kvm_init() fails LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY LoongArch: Add DIRECT_MAP_PHYSMEM_END definition LoongArch: BPF: Optimize redundant TCC loads in epilogue LoongArch: BPF: Refactor jump offset calculation in tail call LoongArch: Fix acpi_package_ids[] array overflow LoongArch: Do not select HAVE_RUST when KASAN is enabled LoongArch: Do not save/restore percpu base register in rethook trampoline LoongArch: Avoid preempt count underflow without probe rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref media: amphion: Remove obsolete frame_count check in venc_start_session media: cec: disable delayed work before freeing an interrupted transmit media: cec: extron-da-hd-4k-plus: add sanity check media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash media: cec: Serialize exclusive follower delivery media: cedrus: fix memory leak in cedrus_init_ctrls() media: cobalt: Avoid freeing ALSA private data twice media: cx231xx: reject geometry changes while the VBI queue is busy media: cx23885: cancel NetUP CI work before teardown media: em28xx: defer audio-only extension registration media: em28xx: fix use-after-free of dev_next->devlist on disconnect media: go7007: defer the ALSA v4l2 put until card release media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure media: i2c: imx415: Release runtime PM reference on VBLANK error media: i2c: imx415: Return test pattern write errors media: i2c: ov02a10: fix endpoint parsing use-after-free media: i2c: ov7740: fix use-after-destroy in remove media: imx355: Avoid calling imx355_power_off twice in error path media: intel/ipu6: fix async notifier cleanup leak on parse error media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common media: platform: mtk-mdp3: Fix SCP device refcounting media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing media: nxp: imx8-isi: Correct color map between V4L2 and ISI media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks media: rc: sunxi-cir: Unregister rc device on probe failure media: rkvdec: Propagate platform_get_irq() errors media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement media: s2255: bound JPEG frame size before copying into the buffer media: s2255: check firmware size before reading trailing marker media: saa7164: fix cleanup on resource allocation failure media: tda18250: fix possible integer overflow media: v4l2-async: avoid deleting unlinked ASC entry on link error media: v4l2-ctrls: Allow unknown HDR10 white point and luminance media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() media: venus: fix payload size calculation in parse_raw_formats() media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure media: vimc: fix pixel format lookup in enum_framesizes media: zoran: Avoid freeing a registered video_device twice media: qcom: iris: fix state-change debug log printing stale value media: qcom: iris: use disable_irq() during power-off media: chips-media: wave5: Guard bit depth check with initial_info_obtained media: chips-media: wave5: Set inst->std during default format initialization scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers scsi: qla2xxx: Bound i2c->length in I2C bsg handlers scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() scsi: qla2xxx: Initialize NVMe abort_work once at submission scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation scsi: qla2xxx: Serialize flash version read in reset handler scsi: qla2xxx: Fix cs84xx use-after-free on host teardown scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() scsi: qla2xxx: Fix FCE trace enable parsing in debugfs scsi: qla2xxx: Don't query firmware state while chip is down scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() scsi: qla2xxx: Quiesce response IRQ before freeing request queue scsi: qla2xxx: Avoid double completion in async IOCB timeout scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort scsi: qla2xxx: Drop vport reference under lock in report ID acquisition scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started f2fs: return symlink writeback errors f2fs: reject overlapping move range after len expansion f2fs: only redirty pinned folios in redirty_blocks f2fs: fix to avoid move_range and defragment on device_alias file f2fs: dirty directory inodes on mtime/ctime update f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() f2fs: return writeback error from collapse range f2fs: fix to avoid potential section-unaligned pinfile f2fs: fix dentry folio leak in find_in_level f2fs: avoid NULL checkpoint thread access in sysfs f2fs: fix to migrate all curseg types during free_segment_range f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() f2fs: fix i_size when pinned fallocate partially fails f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() f2fs: fix to clear dirty flag on folio in error path f2fs: fix valid block count leak on data block allocation failure f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() f2fs: fix to zero post-EOF data when extending file size drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() drm/xe/vram: report FLAT_CCS base misalignment drm/panthor: harden firmware build-info bounds checks drm/panthor: fix firmware control interface bounds checks drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure drm/panel-edp: fix i2c adapter leak on probe failure drm: fix race between partial drm_dev_register() failure and ioctl drm/i915: Guard against NULL driver_data in i915_pci_probe() drm/ssd130x: fix column and row end address in partial updates for ssd132x drm/sun4i: fix refcount leak in sun4i_backend_init_sat() drm/ssd130x: fix column and row end address in partial updates in ssd133x drm/nouveau/disp/r535: Add scanline position support + head state support drm/hibmc: Fix list of formats on the primary plane drm/hibmc: Use drm_atomic_helper_check_plane_state() drm/amd/display: avoid divide-by-zero in __is_lut_linear() drm/amd/display: fix dc_lock leak on GPU reset error paths drm/amd/display: validate plane degamma LUT size for private color prop drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check drm/gud: NUL-terminate TV mode names read from the device drm/gud: validate TV mode names before creating enum property drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used drm/amdgpu: check thunderbolt before switcheroo registration drm/amdgpu: clamp the isolation index for rings outside a partition drm/amdgpu: Disable runtime PM for externally attached dGPUs drm/amdgpu: fix autosuspend cleanup during removal drm/amdgpu: Skip accessing psp rum time db for APUs drm/amdgpu: update the fw version for gfx11 userqueues drm/amdgpu: update the fw version for gfx12 userqueues drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT drm/amdkfd: Add TLB flush after MES queue eviction/suspension drm/amdkfd: Fix error path at svm_migrate_copy_to_ram drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore drm/amdkfd: Reject zero-sized AQL queue allocations after size halving drm/sysfb: simpledrm: Improve framebuffer-size validation drm/sysfb: simpledrm: Improve panel-size validation drm/sysfb: simpledrm: Improve stride validation drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware drm/nouveau: unsubscribe the channel-kill event before the fence context drm/nouveau: Use write-combined maps for coherent drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks drm/nouveau/disp: fix HDMI vendor infoframes on GB20x drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x drm/nouveau/disp: fix head state readback on GB20x drm/nouveau/gsp: fix vblank interrupts on GB20x ksmbd: fix use-after-free in oplock break notification fuse: split off fuse_args and related definitions into a separate header fuse: remove fm arg of args->end callback crypto: atmel-ecc - replace min_t with min mm/hugetlb: defer vmemmap population for bootmem hugepages mm/hugetlb: refactor code around vmemmap_walk mm/page_alloc: don't spin_trylock() in NMI on UP USB: gadget: ffs: fix mm lifetime handling usb: gadget: f_fs: Fix Use-After-Free in AIO error path NFSD: Guard admin state-revocation walks with NFSD_NET_UP ceph: properly decrypt filenames in vmalloc() buffers HID: sony: use guard() and scoped_guard() HID: sony: clean up device list on probe failure ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ ACPI: x86: cmos_rtc: Create a CMOS RTC platform device ACPI: TAD: Rearrange RT data validation checking ACPI: TAD: Add locking around AML evaluations bpf: Factor stackid_init function from __bpf_get_stackid bpf: Factor stackid_fastpath function from __bpf_get_stackid bpf: Factor stackid_new_bucket from __bpf_get_stackid bpf: Use stack id functions instead of __bpf_get_stackid bpf: Disable preemption in bpf_get_stackid rpcrdma: arm rn_done before publishing the notification sched: Add assert_balance_callbacks_empty helper sched: Rework prev_balance() to avoid stale prev references sched/core: Make core-sched flips wait for in-flight selections remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check NFSD: Consolidate the revocation-path client unpin NFSD: Prevent client use-after-free during blocked-lock reaping NFSD: Prevent client use-after-free during close_lru reaping mm: rework compound_head() for power-of-2 sizeof(struct page) hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU Docs/ABI/damon: fix typo in intervals_goal sysfs path power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() power: supply: ab8500_fg: fix use-after-free on remove mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() mm/damon/vaddr: drop last same folio access check optimization mm/damon/paddr: drop last same folio access check reuse optimization mm/damon/ops-common: use nr_accesses moving sum for quota score mm/damon/core: skip aging from repeated aggressive merging mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs() mm/damon/core-kunit: handle region split failure in filter_out() mm/damon/core: initialize damos->last_applied mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback ksmbd: zero pipe read compound padding zram: move lockmap to be per-zram instead per table zram: fix slot lock bit position on big-endian 64-bit ACPI: battery: Use kstrtoul() over sscanf("%lu\n") ACPI: battery: Protect all properties with a separated mutex KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped NFSD: Annotate caller preconditions for the state-table walkers usb: cdnsp: fix wakeup from S3 after controller context loss usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES usb: typec: hd3ss3220: track VBUS enable state per consumer usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member tracing: Have show_event_filters/triggers files take trace array ref tracing: Remove the backup instance automatically after read tracing: Take trace_array reference when opening options file soc: fsl: qe: Add chained_irq_{enter,exit}() calls in cascade handler mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs() mm/damon/core-kunit: skip wrong dest walk in commit_dests_for() mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals() mm/damon/core-kunit: skip wrong region walk in commit_target_regions() mm/secretmem: properly account locked pages futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling ftrace: Take trace_array reference before accessing its ftrace_ops dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds bpf, riscv: Make arena support depend on ZACAS misc: fastrpc: don't publish fd before copy_to_user() succeeds mm/huge_memory: transfer the pmd dirty bit to the folio on zap perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities perf build: Add clang and rust target flags for LoongArch perf/core: Fix deadlock in perf_mmap() failure path perf: Fix use-after-free when perf mmap() revival races with the last munmap() i2c: qcom-cci: Do not check return value of cci_init() i2c: qcom-cci: Remove overcautious disable_irq() calls i2c: qcom-cci: fix autosuspend cleanup arm64: Don't read GMID_EL1 when MTE is disabled ring-buffer: Show persistent buffer dropped events in trace_pipe file ring-buffer: Allow splice reads on static buffers accel/amdxdna: return early from a zero-length flush accel/ethosu: check MMIO mapping errors in probe dma-buf: add dma_fence_was_initialized function v2 accel/ethosu: fix job completion fence cleanup nvme: fold nvme_config_discard() into nvme_update_disk_info() nvme: skip the zoned limits update if the zone info query failed Revert "once: don't use a work queue to reset sleepable static key" mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs mm/migrate_device: avoid out-of-bounds writes for compound folios mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses mtd: rawnand: sunxi: group controller delay tables mtd: rawnand: sunxi: describe tADL and tWHR delays mtd: rawnand: sunxi: fix H6/H616 controller timings batman-adv: fix TX priority extraction for BATADV_FORW_MCAST clk: microchip: mpfs: fix regmap_update_bits() mask/val order ASoC: adau1761: sort the register default table ASoC: cx2072x: sort the register default table ASoC: fsl_easrc: sort the register default table ASoC: max9860: sort the register default table ASoC: ml26124: sort the register default table ASoC: pcm512x: sort the register default table ASoC: pm4125-sdw: sort the register default table ASoC: rt1017-sdca-sdw: sort the register default table ASoC: rt1316-sdw: sort the register default table ASoC: rt1318-sdw: sort the register default table ASoC: rt1318: sort the register default table ASoC: rt274: sort the register default table ASoC: rt286: sort the register default table ASoC: rt298: sort the register default table ASoC: rt700: drop duplicate reg_default entry ASoC: rt700: sort the register default table ASoC: rt711-sdca: sort the register default tables ASoC: rt711: sort the register default table ASoC: rt712-sdca-dmic: sort the register default table ASoC: rt712-sdca-sdw: sort the register default table ASoC: rt715-sdca: drop duplicate reg_default entries ASoC: rt715-sdca: sort the register default tables ASoC: rt715: sort the register default table ASoC: rt721-sdca-sdw: sort the register default table ASoC: sgtl5000: sort the register default table ASoC: sti-sas: sort the register default table ASoC: tas2552: sort the register default table ASoC: tas2764: sort the register default table ASoC: tas2780: sort the register default table ASoC: tas2783-sdw: drop duplicate reg_default entry ASoC: tas2783-sdw: sort the register default table iio: adc: ad4080: configure backend data size iio: adc: max14001: add missing 'select REGMAP' to Kconfig iio: dac: ad5446: fix OF module device table iio: dac: mcp47feb02: add missing 'select REGMAP_I2C' to Kconfig iio: light: apds9306: fix PM reference leak in apds9306_read_data() KVM: x86: Move some EFER bits enablement to common code KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup KVM: s390: Zero initialize data structures for inject_pfault_token KVM: s390: keyop: use mmu_lock to read gmap->asce KVM: arm64: nv: Fully update VNCR fixmap state in kvm_translate_vncr() KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping KVM: arm64: Remove VM-wide VNCR mapping counter LoongArch: Expand module virtual address space to 2GB LoongArch: BPF: Move arena register slot below TCC context LoongArch: BPF: Fix off-by-one error for insn_is_cast_user() media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP media: i2c: vd55g1: Fix manual digital gain on color variant media: i2c: vd55g1: Fix media bus code initialization media: mali-c55: fix dropped last AEC histogram zone weight media: mali-c55: Fix clock leak on reset deassert failure media: mali-c55: Fix AEXP IHIST disable bit shift media: mali-c55: Fix scaler factor overflow for large crop sizes media: rkvdec: hevc: tighten EXT SPS RPS control dimensions media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow media: ti: vpe: quiesce overflow recovery before freeing streams media: v4l2-ctrls: validate HEVC EXT SPS RPS counts media: chips-media: wave5: avoid skipping device_run while VPU has work media: chips-media: wave5: Add timeout while stop_streaming media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued media: chips-media: wave5: Fix pipeline stall when queuing fails media: chips-media: wave5: Resume device before setting EOS flag scsi: qla2xxx: Fix BSG job leak on validate flash image error path scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak f2fs: validate MOVE_RANGE destination size f2fs: limit recovery filename logging to stored length f2fs: embed f2fs_gc_kthread in f2fs_sb_info f2fs: fix folio_nr_pages() race after put in large folio invalidate f2fs: fix to return -EFSCORRUPTED in f2fs_get_node_info() correctly f2fs: protect critical_task_priority updates with s_umount f2fs: fix to reclaim space in f2fs_allocate_pinning_section() drm/amdgpu: avoid force-completing uninitialized UVD rings drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 drm/ttm: Drop tt->restore after successful restore drm/amdgpu: force complete the KIQ ring fences on reset drm/amdgpu: force complete the MES ring fences on reset drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds drm/nouveau/dmem: fix callocated underflow on large folio split drm/nouveau/dmem: fix mismatched DMA unmap size for large folios mm/damon/core: avoid infinite kdamond_merge_regions() internal loop PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value PCI: Allow per function PCI slots to fix slot reset on s390 UBUNTU: Upstream stable to v6.18.51, v7.2.5 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167950/+subscriptions