[Bug 2129861] Re: udpgro.sh from ubuntu_kselftests_net failed with J-5.15 (udpgso_bench_rx: recv: bad packet len)

This bug was fixed in the package linux - 5.15.0-202.212 --------------- linux (5.15.0-202.212) jammy; urgency=medium * jammy/linux: 5.15.0-202.212 -proposed tracker (LP: #2170970) * Jammy update: v5.15.222 upstream stable release (LP: #2169603) - bus: fsl-mc: wait for the MC firmware to complete its boot - ALSA: usb-audio: Propagate write errors in generic mixer put callbacks - ima: return error early if file xattr cannot be changed - tee: optee: Allow MT_NORMAL_TAGGED shared memory - PCI: Stop setting cached power state to 'unknown' on unbind - hfsplus: fix issue of direct writes beyond end-of-file - wifi: mac80211: always allow transmitting null-data on TXQs - kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() - bridge: Do not suppress ARP probes and DAD NS unconditionally - soundwire: validate DT compatible before parsing it - media: rc: mceusb: Add support for 04eb:e033 - s390/cio: Purge based on the cdev's online status - thunderbolt: Keep the domain reference while processing hotplug - net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family - net: dsa: mv88e6xxx: define .pot_clear() for 6321 - net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family - media: em28xx-video: fix missing res_free() on init_usb_xfer failure - clk: renesas: cpg-mssr: Add number of clock cells check - ASoC: ti: omap3pandora: update board check to use DT compatible - mmc: core: Add validation for host-provided max_segs - drm/amd/display: Fix CRC open failure during active rendering - hfsplus: rework hfsplus_readdir() logic - drm/gud: Add RCade Display Adapter VID/PID pair - integrity: Check for NULL returned by asymmetric_key_public_key - scsi: pm8001: Reject firmware update in fatal error state - scsi: pm8001: Reject non-fatal dump when controller is crashed - crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y - crypto: atmel-ecc - add support for atecc608b - media: imon: Add iMON VFD HID OEM v1.2 key mappings - RDMA/mlx5: Use QP port when decoding responder CQEs - mailbox: Make mbox_send_message() return error code when tx fails - ALSA: usx2y: Drain pending US-428 pipe-4 output commands - 9p: invalidate readdir buffer on seek - arm64/daifflags: Make local_daif_*() helpers __always_inline - firmware: arm_scmi: Validate SENSOR_UPDATE payload size - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size - bitfield: wire __bf_shf to __builtin_ctzll - net: usb: qmi_wwan: add MeiG SRM813Q - net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() - net/sched: sch_drr: make cl->quantum lockless - befs: handle set_blocksize failures - minix: handle set_blocksize failures - isofs: handle set_blocksize failures - usb: host: add ARCH_AIROHA in XHCI MTK dependency - char/nvram: Remove redundant nvram_mutex - netlabel: fix IPv6 unlabeled address add error handling - rds: annotate data-race around rs_seen_congestion - s390/zcore: Removed unused variables - clk: socfpga: agilex: implement l3_main_free_clk - drm/panel: simple: Add AM-1280800W8TZQW-T00H - mips: cps: Assemble jr.hb with an R2 ISA level - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind - irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed - ALSA: usb-audio: Add quirk for Novation Mininova - drm/amd/pm/si: Fix updating clock limits from power states - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() - hfs: rework hfsplus_readdir() logic - host1x: bus: Fix missing ops null check in error teardown - scripts: modpost: detect and report truncated buf_printf() output - ASoC: Intel: catpt: Complete coredump handling - soundwire: only handle alert events when the peripheral is attached - mmc: davinci: fix mmc_add_host order in probe - mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC - mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC - iio: accel: mma8452: switch to non-devm request_threaded_irq() - libbpf: Also reset {insn,data}_cur on realloc failure - net: ibm: emac: Reserve VLAN header in MJS limit - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive - ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach - iommu/rockchip: disable fetch dte time limit - ASoC: codecs: rk3328: Use managed GPIO and clock helpers - ALSA: seq: oss: Reject reads that cannot fit the next event - dpaa2-switch: fix the error path in dpaa2_switch_rx() - clk: keystone: don't cache clock rate - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP - ipmi: si: Use platform_get_irq_optional() to retrieve interrupt - wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications - RDMA/mlx5: Fix state and counter desync on loopback enable failure - net: cpsw_new: unregister devlink on port registration failure - xprtrdma: Add request-pool slack for delayed recycling - configfs_depend_prep(): pass configfs_dirent instead of dentry - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table - wifi: mt76: transform aspm_conf for pci_disable_link_state - btrfs: protect sb_write_pointer() with invalidate lock - hwmon: (adt7462) Add of_match_table to support devicetree - ata: libata-pmp: add JMicron JMS562 quirk - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table - sctp: Unwind address notifier registration on failure - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems - dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure - sparc64: uprobes: add missing break - ptp: ocp: add shutdown callback - vsock: use sk_acceptq_is_full() helper in all transports - e1000e: limit endianness conversion to boundary words - net/sched: act_csum: don't mangle UDP tunnel GSO packets - i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA - sparc: Disable compat support with LLD - fuse: set ff->flock only on success - scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() - gpio: pisosr: Read "ngpios" as u32 - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 - leds: uleds: Return -EFAULT on copy_to_user() failure - leds: pca9532: Don't stop blinking for non-zero brightness - mfd: rsmu: Add 8a34002 support - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 - md/raid5: account discard IO - md/raid5: let stripe batch bm_seq comparison wrap-safe - rtc: aspeed: add AST2700 compatible - ksmbd: use connection ClientGUID for lease lookup - ksmbd: treat unnamed DATA stream as base file - ksmbd: apply create security descriptor first - ksmbd: break RH leases before delete-on-close - PCI/sysfs: Use kstrtobool() to parse the ROM attribute input - rtc: bq32000: add delay between RTC reads - fbdev: pm2fb: unwind WC setup on probe failure - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend - netfilter: nf_conntrack_expect: zero at allocation time - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers - ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr - xen/front-pgdir-shbuf: free grant reference head on errors - freevxfs: don't BUG() on unknown typed-extent type - xen/gntalloc: validate grant count before allocation - ksmbd: fix credit charge calculation for SMB2 QUERY_INFO - wifi: ralink: RT2X00: init EEPROM properly - wifi: mac80211: validate deauth frame length before reason access - wifi: libertas: reject short monitor TX frames - ksmbd: find bound sessions during reauthentication - ksmbd: mark invalid session responses as signed - ksmbd: validate SID namespace before mapping IDs - gpio: dwapb: Mask interrupts at hardware initialization - netfilter: ipset: mark the rcu locked areas properly - btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() - wifi: iwlwifi: mvm: fix sched scan IE sizing - arm64: fixmap: Allow 256K early_ioremap() at any offset - arm64: kprobes: Allow reentering kprobes while single-stepping - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless - wifi: mwifiex: replace one-element arrays with flexible array members - regulator: core: clamp voltage constraints before applying apply_uV - wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO - drm/gma500: return errors from Oaktrail HDMI I2C reads - phonet: check register_netdevice_notifier() error in phonet_device_init() - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx - ice: pass the return value of skb_checksum_help() - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) - ASoC: rt5645: Perform the initial jack detect at probe - clk: at91: pmc: #undef field_{get,prep}() before definition - Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" - Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" - ARM: 9484/1: enable interrupts when unhandled user faults are triggered - EDAC/igen6: Fix interleave boundary condition - EDAC/igen6: Fix channel selection hash - EDAC/igen6: Fix channel address decode for non-hash mode - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() - selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter - net/sched: act_api: budget all shared attributes in notify skbs - net/sched: act_api: size the RTM_GETACTION reply from the actions - smb: client: transport: Fix debug printing in __release_mid() - net: amd-xgbe: discard rx packets with bad FCS - OPP: of: Fix potential multiplication overflow when calculating freq - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() - ASoC: ab8500: Reset the audio block before configuring it - ASoC: ab8500: Repair the DAPM capture graph - ASoC: ab8500: Update to modern clocking terminology - ASoC: ab8500: Correct digital interface format setup - ASoC: ab8500: Validate and program TDM slots correctly - tty: make tty_ldisc_ops::hangup return void - ppp: ppp_async: simplify tty disc_data access - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits - btrfs: consolidate device_list_mutex in prepare_sprout to its parent - scsi: mpt3sas: Use irq_set_affinity_and_hint() - perf/core: Skip empty AUX records with only format flags - locking/lockdep: Introduce lock_sync() - locking/lockdep: Improve the deadlock scenario print for sync and read lock - lockdep: Add lock_set_cmp_fn() annotation - locking/lockdep: Invalidate stale class_cache entries for zapped classes - ASoC: ux500: Fix MSP stream lifecycle handling - ASoC: ux500: remove platform_data support - ASoC: ux500: Propagate MSP setup errors - ASoC: ux500: Correct MSP frame and bit clock setup - ASoC: ux500: Validate MSP DAI configuration - ASoC: ux500: remove stedma40 references - ASoC: ux500: Request the MSP MMIO resource - ASoC: ux500: Program the MSP FIFO watermarks - net/rds: use clear_bit_unlock() in release_refill() - net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown - net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset - bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() - net/mlx5e: Fix setting RS FEC after remapping - net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% - net_sched: sch_fq_pie: implement lockless fq_pie_dump() - net/sched: pie: clamp psched_mtu in pie_drop_early - ASoC: bcm: bcm63xx: Publish the OF module aliases - ASoC: Intel: SST: Publish the PCI module aliases - netfilter: ip6_tables: set F_PROTO when proto value is nonzero - ASoC: mt6351: Publish the OF module alias - virtio-console: call scheduler when we free unused buffs - vdpa_sim_blk: use dev_dbg() to print errors - vdpa_sim_blk: make vdpasim_blk_check_range usable by other requests - virtio-pci: return IRQ_HANDLED after non-zero ISR - net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward - net: ethernet: cortina: Finish RX updates before NAPI completion - net: ethernet: cortina: No mapping is a dropped rx - net: ethernet: cortina: Count RX drops once per frame - net: ethernet: cortina: Count RX descriptors for freeq refill - watchdog: fix hrtimer start when pretimeout is zero - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors - net: stmmac: optimize locking around PTP clock reads - net: sun4i-emac: fix missing of_node_put() for phy_node - octeontx2-af: fix PF/CGX debugfs PCI bus lookup - net/rds: Pass a pointer to virt_to_page() - scsi: target: iscsi: Handle abort for WRITE_PENDING cmds - Revert "scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches." - Revert "scsi: smartpqi: Fix BUILD_BUG_ON() statements" - Revert "scsi: core: Register sysfs attributes earlier" - Revert "scsi: smartpqi: Capture controller reason codes" - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough - dm/amdgpu: fix malformed link_settings debugfs output - watchdog: sunxi_wdt: preserve boot-enabled watchdog - tunnels: Drop stale dst when building an ICMP error for PMTUD - exec: do_close_on_exec() before taking exec_update_lock - net: hso: fix TIOCMIWAIT race - netfilter: report NLM_F_DUMP_FILTERED when all is filtered out - KVM: PPC: Book3S HV: Set irqfd->producer only on success - s390/qeth: allow bridgeport queries despite OS_MISMATCH - hwmon: (applesmc) fix key backlight workqueue leak on register failure - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS - media: hevc: add bounded tile-count helpers - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison - mptcp: options: handle MPC data + csum reqd + no csum - Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems" - [Config] remove CRYPTO_DEV_SUN8I_CE_PRNG - [Config] remove CRYPTO_DEV_SUN8I_SS_PRNG - netfilter: nft_set_pipapo_avx2: add missing vzeroupper - ARM: fix hash_name() fault - ARM: fix branch predictor hardening - ARM: ensure interrupts are enabled in __do_user_fault() - Bluetooth: L2CAP: Fix deadlock - Revert "alpha: don't leak hardware-fabricated FP exception bits to user space" - Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally" - selftests/landlock: Add tests for whiteout object creation - sunvdc: fix -EIO issue due to lack of retries - Revert "perf cs-etm: Avoid truncating AUX buffer sizes to int" - Revert "perf cs-etm: Flush thread stacks after decoder reset" - media: video-i2c: fix buffer queue ordering - ipv6: Select best matching nexthop object in fib6_table_lookup() - ipv6: Honor oif when choosing nexthop for locally generated traffic - xfrm: propagate extack to all netlink doit handlers - xfrm: add extack to verify_sec_ctx_len - xfrm: add extack support to verify_newsa_info - xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead - xfrm: avoid RCU warnings around the per-netns netlink socket - xfrm: fix compat ALLOCSPI request use-after-free - xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() - ARM: socfpga: select the PL310 erratum 753970 workaround - RDMA/siw: Introduce siw_cep_set_free_and_put - RDMA/siw: Cleanup siw_accept - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate - IB/iser: Align coding style across driver - IB/iser: Remove iser_reg_data_sg helper function - IB/iser: Use iser_fr_desc as registration context - IB/iser: reject a remote invalidation of an unregistered direction - scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd - IB/isert: wait for deferred control PDU completions before releasing the connection - RDMA/mad: Fix receive buffer leak when PKey enforcement fails - RDMA/irdma: Enforce local fence for IB_WR_REG_MR - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted - dmaengine: sprd: Fix runtime PM reference leak in probe - wifi: virt_wifi: free skb when disconnected - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path - wifi: libipw: reject too-short beacon and probe responses - wifi: libipw: reject too-short association responses - IB/IPoIB: Avoid restoring OPER_UP after multicast flush - wifi: cfg80211: check IP header size in cfg80211_classify8021d() - soundwire: cadence_master: wait and cancel cdns->work before clock stop - MIPS: Octeon: apply USB FDT fixups also when USB is modular - dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask - dma-coherent: report a failed reserved memory assignment - dmaengine: Fix device kref underflow in dma_chan_put() - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() - dmaengine: wait for RCU readers before releasing dma_device - wifi: cfg80211: only group hidden BSSes with beacon entries - wifi: cfg80211: don't filter by BSS type when removing stale entries - wifi: mac80211: suppress chanctx warning for debugfs reset - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set - wifi: mac80211: don't access the TSF of a down interface - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA - RDMA/siw: Bound fragmented header copies by the remaining length - netfilter: nft_nat: fully initialise new_addr in netmap setup - netfilter: flowtable: hold reference on ct until flow is released - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr - keys: fix lost wakeup when reaping a dead key type - ALSA: pcm: set timer->private_data before registering the PCM timer - Input: trackpoint - fix the inertia attribute name in the ABI document - wifi: virt_wifi: don't transfer operstate before register - ALSA: hda: trace PCM open only after assigning a stream - btrfs: tree-checker: print dev extent offset in error message - drm/msm/dsi: correct byte intf clock rate for 14nm DSI PHY - drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation - net: fddi: skfp: fix NULL deref when setting the MAC address while down - wifi: brcmfmac: fix lost 802.1x TX completion wakeup - tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). - tcp: do not let tcp_rmem be set below 4096 - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup - pppoatm: ensure a writable skb header and linear data - drop_monitor: synchronize tracepoint unregistration on error path - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() - KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure - powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments - ASoC: hdmi-codec: Report a change when the channel status moves - net: netsec: fix device_node reference leak on phy_np - net: lock the socket in sock_gettstamp() - net: ethernet: cortina: Ack RX overrun interrupt correctly - net: mvpp2: prevent buffer overflow in page_pool allocation - Input: eeti_ts - publish the OF module alias - Input: xpad - add support for Victrix Pro BFG Controller - Input: xpad - add support for Azeron devices - Input: xpad - fix PDP Marvel Xbox 360 controller - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY - rds: ib: use rds_conn_drop() on protocol version mismatch - tcp: exclude old ACKs from tcp fast path - RDMA/ucma: Serialize join and leave on copy_to_user failure - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() - openvswitch: avoid reallocating confirmed conntrack labels - net: xfrm: reject unrepresentable espintcp transport headers - kselftest/arm64: Fix size of thread_data values for pthread_join() - arm64: percpu: Fix this_cpu_write() casting - arm64: percpu: Fix this_cpu_and() mask generation - Bluetooth: btusb: fix NXP IW610 composite device handling - dmaengine: sun6i: fix non-atomic read of DMA position registers - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() - ipv6: xfrm: use full sockets in local error paths - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value - net/sched: hhf: cap hh_flows_limit at change time - net/packet: clear RX owner on VNET header error - net/packet: avoid truncating TPACKET_V3 private size - keys: translate request_key_auth pid for the reading procfs instance - KEYS: trusted: Fix tpm2_load_cmd() boundary check - i2c: at91: release DMA channels on remove and probe error - i2c: imx: release DMA channels on probe error - IB/mlx4: Fix use-after-free on pkey sysfs registration failure - selinux: always fill AVC decision in avc_has_perm_noaudit() - mmc: core: Fix OF node reference leak on card add failure - mmc: mxcmmc: cancel data work and watchdog on remove - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources - mmc: sdio_uart: fix xmit_fifo leak when the port table is full - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt - mmc: spi: reset bytes_xfered before retrying CRC failures - mmc: sdhci_am654: Reset command and data lines on failed tuning - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 - Input: evdev - zero absinfo before partial copy in EVIOCSABS - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() - Input: soc_button_array - fix MS Surface Pro 11 probe failure - Input: soc_button_array - check btns_desc->package.count - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound - Input: zero ff_effect before compat copy in input_ff_effect_from_user - hwmon: (pmbus/core) increase number of phases and add new mask - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove - hwmon: (w83793) release probe data through kref - watchdog: digicolor: Avoid division by zero - watchdog: msc313e: Fix premature reset during timeout update - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() - wifi: brcmsmac: fix UAF in brcms_free_timer() - wifi: iwlegacy: fix broadcast stations deallocation - wifi: libertas_tf: fix UAF in lbtf_free_adapter() - wifi: rsi: fix heap OOB write on key removal - wifi: wlcore: release runtime PM ref on regdomain config failure - wifi: wilc1000: fix out-of-bounds read in P2P public action frames - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() - wifi: p54: validate curve data length in the calibration curve converters - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length - wifi: mwifiex: validate scan response extents - wifi: mwifiex: validate action frame fixed fields - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver - drm/gud: fix out-of-bounds write in gud_plane_atomic_check() - drm/msm/adreno: fix autosuspend cleanup during teardown - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure - HID: logitech-hidpp: fix race condition when accessing stale stack pointer - spi: spi-zynqmp-gqspi: stop the controller on shutdown - spi: zynqmp-gqspi: Use devm_spi_alloc_host() - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - HID: hyperv: streamline driver probe to avoid devres issues - bpf: Fix bpf_skb_change_tail wrt csum partial skbs - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL - bpf: support access variable length array of integer type - bpf: Fix divide-by-zero in btf_struct_walk() - HID: elecom: fix bus type for M-XGL20DLBK - bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() - bpf: Fix out-of-bounds read of rtt_min in sock_ops - HID: amd_sfh: Move common macros and structures - HID: amd_sfh: Validate PCI BAR size before mapping - squashfs: Add dictionary size range check to prevent shift-out-of-bounds - Bluetooth: SMP: reject Security Request over BR/EDR - Documentation: s390: correct spelling - docs: s390/pci: Improve and update PCI documentation - s390/pci/docs: Fix sriov_numvfs attribute name - s390/cio: Fix cio_update_schib() to not cache invalid schib - s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points - xsk: Use a 32-bit compare in xsk_map_gen_lookup - libbpf: Fix an error in 64bit relocation value computation - bpf: Restrict CO-RE poisoning to relocatable instructions - netfilter: flowtable: allow unidirectional rules - netfilter: flowtable: publish HW_DEAD after worker is done - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier - netfilter: nft_synproxy: use the family-aware checksum helper - ipvs: revalidate ihl before icmp_send - ocfs2: make ocfs2_calc_xattr_init() return void - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure - net: gue: reject invalid REMCSUM offsets - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). - sctp: avoid livelock while updating retransmit path - net: usb: catc: bound the RX packet length in catc_rx_done() - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget - drm/virtio: fix object leak when drm_gem_handle_create() fails - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() - net: usb: sr9700: include receive overhead in the length check - tg3: clean up PHYLIB resources on probe failure - s390/debug: Do not register views for failed static debug areas - s390/debug: Fix NULL pointer dereference in debug_info_copy() - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error - bpf: Fix bpf_sock context code generation - bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc - sctp: hold asoc or transport before mod_timer() in timer handlers - net: stmmac: selftests: Support running selftests on DSA conduits - net: stmmac: selftests: Check the dev->features for S-TAG offload testing - net: stmmac: selftests: Capture all packets for vlan checks - net: stmmac: Remove some unnecessary void pointers - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K - nfc: nfcmrvl: validate helper command length before pull - nfc: st21nfca: remove redundant assignment to variable i - nfc: st21nfca: validate received frame size - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() - selftests: nci: Correct pthread_create return value check - nfc: llcp: Fix race condition in accept_queue lifecycle - selftests: nci: Fix uninitialized family ID on missing attribute - selftests/nci: Fix out-of-bounds store on thread join - nfc: virtual_ncidev: Add missing ioctl compat handler - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure - nfc: st21nfca: validate ISO15693 inventory length - nfc: llcp: fix -ENOMEM on connect with zero-length service name - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() - nfc: llcp: fix slab-out-of-bounds reads when logging service names - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() - veth: manage XDP program pointers during channel resize - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() - vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets - net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr - ip_gre: Reject enabling collect metadata through changelink - net: xps: reject an out of range traffic class - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() - net/smc: fix UAF on lgr list traversal in smcr_port_err() - tipc: Fix a data race on mon->peer_cnt in mon_timeout() - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure - bridge: check llc_mac_hdr_init() return value in br_send_bpdu() - net/sched: sch_teql: fix shadowed err in __teql_resolve() - vlan: ensure sufficient headroom in vlan_dev_hard_header() - autofs: fix sbi->pipe file reference leak in autofs_kill_sb() - rculist: add list_splice_rcu() for private lists - KVM: x86/mmu: Use a bool for direct - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() - KVM: MMU: update comment on the number of page role combinations - KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct - KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes - KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction - KVM: x86/mmu: Derive shadow MMU page role from parent - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes - SAUCE: Revert "KVM: x86: Fix shadow paging use-after-free due to unexpected role" - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() - KVM: x86: Fix shadow paging use-after-free due to unexpected role - x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow - sctp: discard the rest of the packet on a stale-cookie error - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT - workqueue: Fix NULL current_pwq deref in flush dependency check - writeback: report a Tasks-RCU quiescent state per cgwb drain pass - fsl/fman: Fix clk reference leak in read_dts_node() - ipv6: do not let ipv6_find_hdr() return an offset past the packet end - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() - gpio: zynq: fix runtime PM leak on request error path - llc: reserve device headroom for allocated frames - rds: ib: Clear the sg list when mapping an MR fails - drm/nouveau: fix autosuspend cleanup during teardown - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() - drm/nouveau: fix double-free in nvif_vmm_dtor - drm/nouveau: Fix gem reference leak in validate_init() - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() - HID: alps: fix use-after-free on input2 registration failure - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() - net/sched: reject IDR error pointers when deleting actions - net: arp: terminate device name before lookup - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read - net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry - net: atl1c: fix soft lockup on out-of-range tpd_cons read - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist - netfilter: ip6t_rpfilter: reject routes without inet6_dev - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read - nfc: fix use-after-free in nfc_get_local_general_bytes - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() - nfc: port100: reject frames whose declared length exceeds the received data - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU - pinctrl: single: free the IRQ on domain creation failure - s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() - Bluetooth: hci_sock: validate event length before filtering - Bluetooth: hci_sock: reject out-of-range OCF values - Bluetooth: L2CAP: validate frame length before control and FCS access - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO - xfs: fix blockgc group quota scanning when usrquota isn't enforced - net: tls: fix silent data drop under pipe back-pressure - file: add fput() cleanup helper - eventpoll: use hlist_is_singular_node() in __ep_remove() - eventpoll: split __ep_remove() - eventpoll: kill __ep_remove() - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: move epi_fget() up - perf test: Change all remaining #!/bin/sh to #!/bin/bash - tools/thermal/tmon: Fix compilation warning for wrong format - lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected - lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected - Linux 5.15.222 * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2025-68190 - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-46242 - eventpoll: fix ep_remove struct eventpoll / struct file UAF * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2025-38349 - eventpoll: don't decrement ep refcount while still holding the ep mutex * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2025-37964 -- to the 6.1, 6.6 and 6.12 trees ended up with two - x86/mm: Fix check/use ordering in switch_mm_irqs_off() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-80726 - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-46113 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-52988 - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2023-53231 - erofs: Fix detection of atomic context * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2023-53707 - drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2024-49568 - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-89560 - landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2024-41062 - bluetooth/l2cap: sync sock recv cb and release * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2022-50406 - iomap: iomap: fix memory corruption when recording errors during writeback * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97523 - mptcp: close race between scheduler and state change * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97524 - mptcp: avoid unneeded actions on subflow reset * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-80833 - crypto: sun8i-ss - Remove crypto_rng interface * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-80834 - crypto: sun8i-ce - Remove crypto_rng interface * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-74496 - fou: Fix use-after-free in fou_create() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93286 - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93287 - i2c: smbus: reject oversized block transfers in the common path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97568 - mptcp: syncookies: remember the request backup flag * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97572 - bnxt_en: Propagate RX ring init failures in bnxt_init_nic() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97573 - bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97576 - media: v4l2-ctrls: validate HEVC tile counts * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97582 - hwmon: (gpio-fan) Fix use-after-free in alarm work * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97592 - s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97596 - ipvs: reject invalid states in connection template sync records * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97598 - ipv4: fib: bound automatic table ID allocation * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97601 - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97604 - fbdev: vfb: defer cleanup until the last reference * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97608 - netfilter: nf_log: unregister loggers before per-net teardown * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97611 - net: openvswitch: fix use-after-free of the flow table mask array * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97612 - net: mpls: clear inner_protocol when the last label is popped * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97899 - drm/i915: Fix memory leak in query_perf_config_list() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97904 - cpufreq: initialize policy rwsem before sysfs publication * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97905 - cpufreq: zero-initialize policy cpumask before sysfs publication * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97909 - ASoC: sti: initialize IRQ lock before requesting IRQ * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97910 - ASoC: sprd: validate compress buffer sizes against fixed allocations * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97923 - tracing: Free histogram the var ref when its initialization fails * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97926 - ufs: validate cylinder group metadata before caching it * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97927 - ufs: create the root dentry after loading cylinder metadata * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97930 - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97940 - ipv6: fix fib6 walker UAF on seq stop * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97948 - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-74743 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-89792 - ksmbd: prevent out-of-bounds reads in share config responses * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97951 - scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-68236 - drm/amd/display: set new_stream to NULL after release * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97952 - sunvdc: unmap LDC cookies when the descriptor send fails * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97954 - net/rds: fix tcp stream corruption with large pages * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97957 - net: hinic: fix mailbox segment buffer overflow * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97958 - net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97959 - net/sched: cls_route: free emptied bucket on filter move * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97963 - net: stmmac: initialize ptp_lock at probe time * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97964 - ppp_synctty: ensure a writeable skb header * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97969 - watchdog: msc313e: Fix clock leak and spurious timer in settimeout() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97970 - watchdog: msc313e: Avoid division by zero * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97981 - net: ethernet: cortina: Count dropped frames as NAPI work * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97982 - net: ethernet: cortina: Fix budget accounting * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97991 - vdpa_sim_blk: reject out-of-range sector starts * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97993 - vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97995 - virtio_console: do not free control-out buffers on remove * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97998 - netfilter: nfnetlink_log: cope with concurrent instance destruction * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98006 - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98009 - net/sched: ets: clamp quantum in parse and fallback paths * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98010 - net/sched: drr: clamp quantum in change class * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98011 - net/sched: hhf: clamp quantum in change and init paths * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98012 - net/sched: sfq: clamp quantum in change path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98013 - net/sched: fq_pie: clamp quantum in change path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98014 - net/mlx5: E-Switch, prevent mc_list repopulation during vport disable * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98015 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98016 - net/mlx5e: Fix use-after-free race in sample_restore_put() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98022 - net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98023 - vxlan: reject dynamic fdb entries that reference a nexthop id * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98025 - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98027 - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98030 - net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98031 - nexthop: Initialize extack in remove_nh_grp_entry() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98063 - bpf: Fix NULL-ptr-deref in btf_var_show() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98064 - bpf: Fix NULL-ptr-deref when showing a void BTF type * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98066 - ALSA: caiaq: Fix potential double-free at error path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98068 - net/rds: don't let rds_conn_shutdown() consume a concurrent drop * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98069 - net/rds: acquire the fastpath locks in rds_conn_shutdown() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98070 - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98071 - net/rds: clear cp_flags bits individually in rds_conn_path_reset() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98072 - net/rds: use wq_has_sleeper() in release_in_xmit() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98074 - bonding: do not clear curr_active_slave prematurely when releasing all slaves * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98075 - bpf: reject BPF_PSEUDO_FUNC reference to the main program * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98076 - tracing/probes: Fix use-after-free on field name/type of events with multiple probes * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98077 - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98078 - ipvs: fix reversed sequence option serialization * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98080 - btrfs: do not force reloc root creation during qgroup_account_snapshot() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98088 - scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98090 - btrfs: restore active device pointers after failed sprout * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98091 - btrfs: detach failed sprout device from transaction update list * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98094 - staging: fbtft: make dirty_lock IRQ-safe * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98095 - af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98096 - ipv6: sr: restore network header before routing and forwarding * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98098 - tipc: fix NULL deref in tipc_named_node_up() on empty publication list * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98108 - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98113 - ksmbd: rate limit unmapped SID errors * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98116 - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98121 - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98123 - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98130 - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98154 - nvme-rdma: fix -EIO cleanup order in queue_rq * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98157 - EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-89796 - mm/damon/core: avoid infinite kdamond_merge_regions() internal loop * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98158 - ppp_async: drop the errored frame instead of resetting its headroom * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93288 - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93782 - vhost-scsi: flush backend after device ioctls * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93783 - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93784 - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93785 - cifs: validate idmap key payload length * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93789 - wifi: iwlwifi: bound aligned TLV advance in FW parser * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93795 - blk-cgroup: fix leaks and online flag on radix_tree_insert failure * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93797 - wifi: iwlwifi: mvm: fix an off-by-1 boundary check * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93798 - btrfs: fix reloc root cleanup in merge_reloc_roots() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93800 - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93802 - wifi: rsi: validate beacon length before fixed buffer copy * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93803 - wifi: libipw: fix key index receive bound checks * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93805 - wifi: cfg80211: validate rx/tx MLME callback frame lengths before access * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93807 - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93808 - ALSA: usb-audio: caiaq: validate EP1 reply lengths * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93811 - ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93812 - ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93813 - btrfs: tree-checker: validate INODE_REF's namelen * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93815 - net: au1000: move free_irq out of the close-time spinlocked section * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93816 - f2fs: validate inline dentry name lengths before conversion * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93819 - PCI: mediatek: Protect root bus removal with rescan lock * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93820 - PCI: rockchip: Protect root bus removal with rescan lock * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93821 - PCI: altera: Protect root bus removal with rescan lock * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93822 - PCI: iproc: Protect root bus removal with rescan lock * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93825 - spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93830 - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97407 - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97408 - Bluetooth: L2CAP: validate connectionless PSM length * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97411 - net: ibm: emac: mal: fix potential system hang in mal_remove() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97413 - RDMA/rtrs-srv: Fix integer underflow in process_read and process_write * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97416 - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97417 - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97418 - ALSA: es18xx: check control allocation before private data setup * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97419 - hsr: broadcast netlink notifications in the device's net namespace * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97420 - bpf: NUL-terminate replaced sysctl value * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97421 - RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97430 - xhci: Prevent queuing new commands if xhci is inaccessible * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97434 - dpaa2-switch: fix handling of NAPI on the remove path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97435 - net: dsa: sja1105: flower: reject cross-chip redirect * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97436 - dpaa2-switch: rework FDB management on the bridge leave path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97437 - ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97438 - fs/ntfs3: validate index entry key bounds * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97439 - fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97440 - net: qrtr: fix node refcount leak on ctrl packet alloc failure * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97441 - ata: ahci: fail probe if BAR too small for claimed ports * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97443 - perf/ftrace: Fix WARNING in __unregister_ftrace_function * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97444 - ACPICA: add boundary checks in two places * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97445 - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97446 - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97448 - ACPICA: Add validation for node in acpi_ns_build_normalized_path() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97449 - ACPICA: Add package limit checks in parser functions * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97450 - ACPICA: validate handler object type in two places * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97451 - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97452 - ACPICA: Prevent adding invalid references * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97453 - ACPICA: validate byte_count in acpi_ps_get_next_package_length() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97454 - ACPICA: add boundary checks in acpi_ps_get_next_field() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97455 - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97456 - ACPICA: Fix condition check in acpi_ps_parse_loop() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97472 - ipv6: addrconf: fix temp address generation after prefix deprecation * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97475 - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97476 - rds: filter RDS_INFO_* getsockopt by caller's netns * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97481 - serial: 8250: fix possible ISR soft lockup * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97482 - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97483 - usb: core: hcd: fix possible deadlock in rh control transfers * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97484 - usbip: vhci_hcd: fix NULL deref in status_show_vhci * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97485 - omfs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97486 - hpfs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97487 - jfs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97488 - qnx4: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97489 - bfs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97490 - affs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97491 - net/rds: Don't sleep inside rds_ib_conn_path_shutdown * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97492 - wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97502 - mmc: davinci: avoid NULL deref of host->data in IRQ handler * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97506 - crypto: ixp4xx - fix buffer chain unwind on allocation failure * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97507 - media: dm1105: fix missing error check for dma_alloc_coherent * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97508 - thunderbolt: Set tb->root_switch to NULL when domain is stopped * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97510 - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) - alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally - alpha: don't leak hardware-fabricated FP exception bits to user space - include/linux/list.h: mark list_add and __list_add as __always_inline - tools/compiler: match glibc 2.42 definition of __attribute_const__ - x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() - powerpc/powermac: fix OF node refcount - staging: greybus: hid: fix SET_REPORT return value - usb: dwc2: gadget: Exit partial power down state when changing USB pull- up - USB: phy: fsl-usb: fix missing static keywords - usb: gadget: snps_udc_plat: clean up PHY on probe deferral - NFSD: Encode only the status in NFS-ACL v2 GETACL error replies - NFSD: Fix off-by-one in DRC bucket pruning limit - nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types - nfsd: add filehandle match check to nfsd4_delegreturn() - nfsd: fix version mismatch loops in nfsd_acl_init_request() - nfsd: reject reclaim LOCK after RECLAIM_COMPLETE - eCryptfs: bound the packet-length peek to the user buffer - ecryptfs: fix tag 11 packet exact-fit size check - ecryptfs: show filename encryption options - fat: restore original value when fat_ent_write failed - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration - alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() - alpha: marvel: Fix irq_set_status_flags to use correct IRQ number - alpha: marvel: Fix lock ordering in init_io7_irqs() - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU - cpufreq: schedutil: Fix rate limit overflow - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection - Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative - SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat - staging: media: tegra-video: vi: fix probe failure on skipped last port - rpmsg: glink: smem: order FIFO read after availability check - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata - ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item - ocfs2: cluster: fix o2hb_dependent_users leak on pin failure - hwmon: (max6621) fix negative temperature offset and crit readings - hwmon: (max6621) fix temperature clamp range - nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path - sctp: distinguish sequence zero from wildcard in reconf lookup - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk - PCI: meson: Fix GPIO state while requesting PERST# - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses - iommu/vt-d: Fix no_iommu to disable platform opt-in - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition - net: openvswitch: fix nf_connlabels leak in ovs_ct_init - NTB: ntb_transport: Recycle TX entries before client callbacks - net: ntb_netdev: Avoid double-accounting netif_rx() drops - net: ntb_netdev: Count packets dropped on RX refill failure - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip - arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() - dm-switch: use WRITE_ONCE() in switch_region_table_write() - wifi: rtl818x: initialize eeprom_93cx6 struct to zero - taskstats: fix cpumask parsing cutting off the last character - timer: Keep debugobjects state consistent in migrate_timer_list() - udf: Fix i_lenExtents truncation on 32-bit kernels - platform/chrome: sensorhub: Fix dropped timestamp events and log spam - net: openvswitch: fix kernel-doc warnings in internal headers - selinux: avoid implicit conversions in services code - ALSA: seq: Fix port lock leak in deliver_to_subscribers() - net: ntb_netdev: Fix TX busy and drop handling - tracing/mmiotrace: Remove reference to unused per CPU data pointer - clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() - thermal/drivers/imx: Disable clock on runtime resume failure - thermal/drivers/qoriq: Disable clock on resume failure - dmaengine: dw-edma: Complete descriptors before pausing - block: flag zoned disks with GENHD_FL_NO_PART - ata: ahci: work around lost interrupts on Marvell 88SE61xx - Input: aiptek - validate raw macro indices before updating state - Input: aiptek - switch to using dev_groups for driver-specific attributes - Revert "irqchip/mbigen: Fix mbigen node address layout" - parisc: Fix alignment of asm statements in head.S - batman-adv: bla: prevent CRC corruptions after claim flush - clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src - clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src - clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk - clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure - AsoC: intel: sst: fix PCI device reference leak on probe failure - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get - iio: gyro: mpu3050: fix sign of raw angular velocity readings - iio: light: cm32181: return zero after writing calibscale - iio: light: gp2ap002: Disable regulators on resume failure - iio: srf04: fix pm_runtime handling on probe error path - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() - KVM: s390: Zero initialize irq in reinject_machine_check - KVM: s390: Restore sigset on error path - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash - media: v4l2-ctrls: Allow unknown HDR10 white point and luminance - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() - media: venus: fix payload size calculation in parse_raw_formats() - media: vimc: fix pixel format lookup in enum_framesizes - scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters - scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() - scsi: qla2xxx: Drop vport reference under lock in report ID acquisition - scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics - f2fs: return symlink writeback errors - f2fs: reject overlapping move range after len expansion - f2fs: return writeback error from collapse range - f2fs: fix i_size when pinned fallocate partially fails - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() - drm/hibmc: Fix list of formats on the primary plane - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT - drm/nouveau: Use write-combined maps for coherent - mm/damon/core-kunit: check region count before testing in split_at() - mm/damon/vaddr: drop last same folio access check optimization - mm/damon/vaddr-kunit: check region count in three_regions test - mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() - firmware: stratix10-svc: Add mutex in stratix10 memory management - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure - Smack: fix W=1 build warnings - smack: simplify write handlers of sysfs entries - smack: deduplicate smackfs/{direct,mapped} file_operations - smack: restrict smackfs/{direct,mapped} values to 0-255 - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() - media: cec-pin: Fix event FIFO ordering - clk: moxart: remove unused variables, fix refcount leak - clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller - ARM: imx: fix device_node refcount leak in imx_src_init() - ARM: imx: fix device_node refcount leaks in imx7_src_init() - clk: imx: scu: drop redundant init.ops variable assignment - perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define - perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning - perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test - perf test bpf-counters: Add test for BPF event modifier - perf test stat_bpf_counter.sh: Stabilize the test results - perf test: Use sqrtloop workload to test bperf event - perf test: Fix perf stat --bpf-counters on hybrid machines - perf tests: Fix flakiness in BPF counters test on hybrid systems - bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls - bpftool: Use libbpf_get_error() to check error - bpftool: Fix pretty print dump for maps without BTF loaded - tools/bpf/bpftool: Reset vmlinux BTF after map commands - bpftool: remove duplicate free_btf_vmlinux() definition - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure - selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check - crypto: atmel-ecc - replace min_t with min - crypto: atmel-ecc - clean up and improve ECDH comments - crypto: sa2ul - Use the defined variable to clean code - nvmet-rdma: avoid circular locking dependency on install_queue() - nvmet-rdma: use sbitmap to replace rsp free list - nvmet-rdma: factor out response resource cleanup - bus: ti-sysc: Fix /chosen node reference leak - PM: sleep: Fix off-by-one in wakelocks number limit check - staging: greybus: audio: correct sscanf() return value check - staging: sm750fb: gate dualview dataflow using g_dualview - staging: fbtft: Use sysfs_emit_at() to print to sysfs file - netdev: reshuffle netif_napi_add() APIs to allow dropping weight - staging: switch to netif_napi_add_weight() - staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown - staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions - staging: octeon: replace pr_warn with dev_warn in fill and rx paths - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() - selftests/bpf: Fix memory leak in msg_alloc_iov error path - selftests/bpf: Fix memory leak in msg_alloc_iov - irqchip/gic-v3-its: Fix memleak in its_probe_one() - selftests: timers: leap-a-day: Fix -w option and update usage comment - clocksource: Unregister subsystem on device registration failure - y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 - timekeeping: Account for monotonicity adjustment in ntp_error - clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status - clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains - clk: qcom: gdsc: enable optional power domain support - clk: qcom: gdsc: Release pm subdomains in reverse add order - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code - efi: fix stale reference to efi_recover_from_page_fault() - iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX - iommu/msm: Return -ENOMEM on memory allocation failure in probe - iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors - iommu/amd: Add support for Hygon family 18h model 4h IOAPIC - iommu/amd: Fix false positive in SB IOAPIC IVRS validation - leds: pca9532: Fix inverted GPIO output polarity - hwspinlock: propagate errno when registering single lock - usb: mtu3: allow system suspend during active gadget connection - usb: renesas_usbhs: Fix power-off ordering on unbind - drm/panel: samsung-s6d16d0: Power off on prepare failure - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE - RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage - RDMA/mlx4: Avoid flush_scheduled_work() usage - RDMA/mlx: Calling qp event handler in workqueue context - hwrng: ks-sa - access private data via struct hwrng - hwrng: ks-sa - Fix runtime PM cleanup on registration failure - ALSA: hpi: Check transport errors during HPI6000 adapter initialization - pmdomain: bcm: bcm2835: handle genpd provider registration errors - misc: rtsx_usb: avoid USB I/O in runtime autosuspend - RDMA/hfi1: Remove redundant PCI device ID validation - RDMA/hfi1: Create workqueues before device initialization - RDMA/hfi1: Stop flushing the global IB workqueue - RDMA/hfi1: Initialize debugfs after probe completes - fs/isofs: replace kmap() with kmap_local_page() - rpmsg: glink: Remove the rpmsg dev in close_ack - rpmsg: glink: remove duplicate code for rpmsg device remove - libnvdimm/labels: Bound the on-media label size before the shift - cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() - irqdomain: Introduce irq_domain_free() - irqdomain: Introduce irq_domain_instantiate() - irqdomain: Handle additional domain flags in irq_domain_instantiate() - genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips() - cpufreq: intel_pstate: Fix setting minimum P-state at init time - cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev - arm64: dts: qcom: sm8250: Use QMP property to control load state - arm64: dts: qcom: sm8250: remove mmcx regulator - arm64: dts: qcom: sm8250: Add camcc DT node - gpu: host1x: Fix offset calculation in trace_write_gather - crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping - ACPI: move from strlcpy() with unused retval to strscpy() - ACPI: processor: idle: Expand _LPI package sanity checks - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() - misc: rtsx: add missing write register handling - misc: ad525x_dpot: Make ad_dpot_remove() return void - ppdev: prevent overflow when setting port timeout - char: xilinx_hwicap: unregister class on init errors - perf ui hists: Fix uninitialized stack memory free on pstack allocation failure - driver core: soc: remove layering violation for the soc_bus - driver core: soc: Unregister bus on early device registration failure - dmaengine: dw-edma: Clear stale requests on termination - arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters - RDMA/srpt: Pass the mapped task attribute to target_init_cmd() - RDMA/nldev: Split nldev_stat_set_mode_doit out of nldev_stat_set_doit - RDMA/restrack: Fix typos in the comments - RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() - iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe - iommu/qcom: Remove sysfs device on probe failure path - iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() - thermal: int340x_thermal: Consolidate priv->data_vault checks - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request - ath11k: add trace log support - ARM: dts: allwinner: a10: Fix PMU interrupt - perf cs-etm: Flush thread stacks after decoder reset - perf cs-etm: Avoid truncating AUX buffer sizes to int - leds: pca9532: Fix phantom device registration on missing hardware - drm/tve200: add OF module alias for autoloading - netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet - arm64: dts: rockchip: Add gru-scarlet-dumo board - arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru - arm64: dts: rockchip: Fix Gru WLAN sideband interrupt - ARM: lpc32xx: only run SoC init on LPC32xx hardware - power: supply: sbs-battery: Use a per-device serial number buffer - crypto: keembay - publish OF module alias for OCS AES/SM4 - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() - remoteproc: Use unbounded workqueue for recovery work - remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() - staging: rtl8723bs: use kfree_sensitive() for key material - arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix - clk: tegra: tegra124-emc: put EMC node on register failure - clk: palmas: Manage external-control prepare with devm - clk/x86: pmc_atom: add kasprintf return value check - scsi: core: Register sysfs attributes earlier - scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. - RDMA/mlx5: Send cong param changes to the resolved port mdev - bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET - selftests/zram: fix kernel_gte() for POSIX sh - power: supply: sc2731_charger: Convert to platform remove callback returning void - clk: qcom: Return expected ENOMEM error on dynamic allocation failure - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() - fanotify: report full event length for FIONREAD - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields - perf: arm_spe: Make wakeup range check overflow safe - perf machine: Guard against NULL strlist in machines__findnew() - perf machine: Use snprintf() for guestmount path construction - perf machine: Check snprintf truncation in machines__findnew() - perf machine: Don't abort guest map creation on first inaccessible dir - perf machine: Reset errno before strtol in guest kernel map creation - perf machine: Free scandir entries in guest kernel map creation - perf machine: Check snprintf truncation for guest kallsyms path - iommu/arm-smmu-v3: Convert to use atomic poll timeout - wifi: mac80211: send TWT teardown to peer after setup TX failure - wifi: zd1211rw: reject secondary interfaces to prevent conflicts - wifi: mac80211: skip unused probe response countdown offsets - firmware: google: Add bounds checks in coreboot_table_populate() - powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL - serial: amba-pl011: unprepare console clock on unregister - HID: split apart hid_device_probe to make logic more apparent - HID: ensure timely release of driver-allocated resources - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails - HID: lg4ff: validate report length before fixed offsets - perf thread-stack: Fix heap buffer overflow on branch stack wrap copy - perf auxtrace: Fix queue grow overflow and old array leak - perf intel-pt: Fix off-by-one in auxtrace_info minimum size check - perf intel-bts: Fix off-by-one in auxtrace_info minimum size check - iio: light: tsl2772: fix ALS calibscale readback - iio: light: isl29028: return zero in write_raw() on success - iio: light: tsl2583: return zero in write_raw() on success - block/blk-stat: drain per-cpu callback stats over possible CPUs - block/blk-iocost: collect per-cpu latency stats over possible CPUs - block/kyber-iosched: flush per-cpu latency buckets over possible CPUs - lib/string: fix memchr_inv() for large ranges - pps: don't try to wait for negative timeouts in PPS_FETCH - pps: clients: gpio: Bypass edge's direction check when not needed - pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler - pps-gpio: remove dead capture_clear code - PCI/sysfs: Add static PCI resource attribute macros - remoteproc: Move resource table data structure to its own header - remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() - scripts/tags.sh: improve compiled sources generation - scripts/tags.sh: Prevent binary files appearing in cscope.files - ocfs2: use bitmap API in fill_node_map - drm/sun4i: vi scaler: Fix coefficient selection - of: property: add missing kerneldoc for of_graph_get_endpoint_count() - of: property: use unsigned int return on of_graph_get_endpoint_count() - bitfield: Add less-checking __FIELD_{GET,PREP}() - bitfield: Add non-constant field_{prep,get}() helpers - drm/sun4i: tcon: Drop remote endpoint reference - drm/sun4i: dw-hdmi: Drop TCON TOP port reference - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz - RDMA/siw: Introduce siw_free_cm_id - mfd: rave-sp: validate received frame payload lengths - mfd: iqs62x: Reject zero-length firmware records - drm/amdgpu/gfx6: Fixup emit_cntxcntl() - ext4: fix spurious message about orphan cleanup on RO fs - phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table - perf trace-event: Fix buffer overflow in read_string() - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets - firmware_loader: Check fw_state_is_done in loading_store - pinctrl: rockchip: Reset the pin count when recalculating SoC data - soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() - coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() - coresight: etm4x: Cleanup TRCIDR2 register accesses - coresight: etm4x: Cleanup TRCIDR3 register accesses - coresight: etm4x: Cleanup TRCIDR4 register accesses - coresight: etm4x: Cleanup TRCIDR5 register accesses - coresight: Change syncfreq to be a u8 - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling - sched/fair: Check CPU capacity before comparing group types during load balance - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() - perf trace-event: Fix integer truncation in do_read() and skip() - scsi: sd: Fix sd_done() sense handling condition - iio: light: gp2ap002: re-enable irq if runtime suspend fails - flow_offload: rename offload functions with offload instead of flow - arm64: dts: turris-mox: fix usb3 phys - ARM: dts: helios4: add vcc-supply to EEPROM - ARM: dts: helios4: add vcc-supply to GPIO expander - ARM: dts: helios4: add SATA regulator supplies - perf stat: Clear screen only if output file is a tty - perf stat: Fix evsel_list leak in cmd_stat - perf synthetic-events: Fix uninitialized pthread_join - perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads - iommu/vt-d: Fix UCTP context table slot when copying root entries - m68k: Fix backtraces for non-running tasks - powerpc/configs: enable CONFIG_RAS to fix EDAC support - spi: sprd-adi: Fix probe succeeding without registering the controller - nfc: digital: Do not dump a NULL response in command completion - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal - ASoC: pxa: Use devm_clk_get_optional() for extclk clock - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready - ubi: Fix repeated words in comments - ubi: fastmap: Use the bitmap API to allocate bitmaps - ubi: fastmap: Fix missed ec updating after erasing old fastmap data block - ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash - ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap - ubi: Replace erase_block() with sync_erase() - UBI: Preserve torture flag when rescheduling failed erasures - UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs - ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl - ubi: fastmap: Add fastmap control support for module parameter - ubi: Simplify bool conversion - ubi: fastmap: Wait until there are enough free PEBs before filling pools - ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs - ubi: fastmap: Add module parameter to control reserving filling pool PEBs - UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC - selfetests/bpf: Update vmtest.sh defaults - selfetests/bpf: Adapt vmtest.sh to s390 libbpf CI changes - bpf/docs: Update list of architectures supported. - selftests/bpf: Fix vmtest.sh getopts optstring - selftests/bpf: Limit URLS parsing logic to actual scope in vmtest - selftests/bpf: Support local rootfs image for vmtest - selftests/bpf: Add description for running vmtest on RV64 - selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM - spi: img-spfi: don't disable runtime PM on DMA deferred probe - power: supply: bd99954: Drop bad register fields - power: supply: bq27xxx: bq27520g4: fix REG_TTES address - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address - xenbus: Unregister reboot notifier on init failure - clocksource/drivers/clps711x: Do not unmap clocksource MMIO - clocksource/drivers/armada: Unwind timer clock on init failure - x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported - bpftool: Fix double close in map dump - tracing: Remove "__attribute__()" from the type field of event format - tracing: Have trace_event_update_all() only handle module that is loading - bpf: Fix pending_pos walk on 32-bit ring position wrap - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() - perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() - mailbox: rockchip: disable pclk on probe failure and unbind - hwmon: (emc1403) Add support for EMC1442 - smb/server: preserve error status in smb2_handle_negotiate() - nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper - nfs: refactor pNFS functions using clear_and_wake_up_bit - pppox: drain queued packets on channel handoff - hsr: Use a single struct for self_node. - net: hsr: Use full string description when opening HSR network device - net: bridge: vlan: fix inverted default vlan notification - ALSA: hda: Fix connection list comparison in proc output - 8139cp: fix Rx and Tx not being disabled in cp_suspend - platform/x86: dell-wmi-sysman: Fix instance ID bounds - vsock: use sock_error() to consume sk_err after a failed connect - bonding: initialize err for empty target lists - i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 - i3c: mipi-i3c-hci: Quieten initialization messages - i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() - i3c: mipi-i3c-hci: Refactor PIO register initialization - i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode - virtio_balloon: disable indirect descriptors - prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator - ALSA: control: Use automatic cleanup of kfree() - RDMA/ucma: Allow path records to exactly fit the output buffer - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes - forcedeth: stop the tx_timeout register dump past the requested window - net: ipa: report when the driver has been removed - net: ipa: Convert to platform remove callback returning void - net: ipa: balance runtime PM reference on remove error - nfs: move the nfs4_data_server_cache into struct nfs_net - scsi: qla2xxx: Fix an loop timeout test - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX - octeontx2-af: Fix TL3/TL2 link config ENA clearing - cifs: fix clearing stats for fastest execution of each smb2 command - net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() - net_sched: sch_fq: struct sched_data reorg - net_sched: sch_fq: change how @inactive is tracked - net_sched: export pfifo_fast prio2band[] - net/sched: sch_codel: clamp default mtu to avoid disabling CoDel - tpm: st33zp24: Validate locality read result - apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init - net: ethernet: sun4i-emac: Fix IRQ error handling - net: stmmac: selftests: Pass the IP proto mask in the TC selftest - netfilter: xt_cgroup: Make it independent from net_cls - netfilter: xt_HL: add pr_fmt and checkentry validation - netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() - selftests: arm64: add hugetlb mte tests - selftests/arm64: Print missing MTE TAP headers - selftests/arm64: Treat KSM merge_across_nodes as optional - net: stmmac: selftests: Check multiple MMC counters - net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering - net: stmmac: dwmac4: Account for the primary MAC address for UC filtering - net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering - net: stmmac: selftests: Account for the UC filter list for filtering tests - nvme: target: rdma: fix ndev refcount leak on queue connect - clk: qcom: Drop mmcx gdsc supply for dispcc and videocc - RDMA/nldev: Check stat attribute before accessing it - HID: fix an error code in hid_check_device_match() - ALSA: control: Fix unannotated kfree() cleanup - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings - kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c - nvmet-rdma: fix queue leak when connect backlog is exceeded - clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled - Linux 5.15.221 - SAUCE: Revert "bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls" * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90053 - net/sched: sch_htb: limit htb_classify inner-class filter hops * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90054 - tcp: fix corruption of urgent data on multi-segment retransmit * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90056 - net: fec: only stop PTP if it was initialized * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90062 - netfilter: nf_tables: move hardware offload step after building the chain blob * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90063 - virtio-net: Ensure that TCP packets don't overflow gso_segs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90067 - libceph: validate banner payload length * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90068 - ASoC: dapm: Fix off-by-one check on the second enum channel * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93245 - apparmor: policy_int make sure list heads are initialized before fail path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90071 - net/sched: sch_teql: restore skb->dev on the slave failure path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90072 - net/sched: sfq: clamp quantum to avoid signed overflow soft lockup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90074 - net/sched: fq_pie: clamp default quantum to avoid signed overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90075 - net/sched: fq_codel: clamp default quantum and mtu * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90078 - net/sched: act_skbmod: fix length calculations and avoid invalid header warnings * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90081 - net/rds: use wq_has_sleeper() in rds_cong_map_updated() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89780 - net: qualcomm: rmnet: restore skb->dev on deaggregated frames * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89789 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use- after-free * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90102 - NFSv4/pnfs: key the data server cache on the NFS version * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90107 - net/smc: free pending qentry in smc_llc_flow_stop() before memset * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90114 - net: bridge: Reject descending VLAN tunnel ranges * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90126 - rtc: pcf8563: fix clock provider leak on unbind * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90128 - vdpa/mlx5: fix wrong list iterated in add_direct_chain error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89779 - fs/ntfs3: validate ef->size covers the record's name and value * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89781 - fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90140 - cuse: wait for pending RCU callbacks on module exit * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90143 - net: kcm: Hold RCU read lock while running BPF parser * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90151 - NFSv4: remove callback IDR entry on client allocation failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90157 - bpf: Reject negative optlen in cgroup getsockopt hook * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90160 - lwt_bpf: Restore reserved headroom after xmit program * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90198 - ALSA: core: Fix use-after-free in snd_card_do_free() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90202 - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90203 - Squashfs: check block offset is not negative * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93252 - ocfs2: fix circular locking dependency in ocfs2_init_acl() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90209 - s390/debug: Fix deadlock during unregister * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90214 - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90218 - RDMA/cma: Fix WARNING in res_to_rt * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90219 - RDMA/cxgb4: Free debugfs on registration failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90221 - nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90222 - nfc: pn533: hold a reference to the request skb during send_frame * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90224 - nfc: nci: fix double completion race in nci_data_exchange_complete * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90228 - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89784 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90248 - net/sched: cls_api: fix teardown of an adopted proto on insert-race loss * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90249 - iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90251 - Bluetooth: MSFT: validate evt_prefix_len against the response length * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90257 - Bluetooth: virtio_bt: avoid OOB read of build info string * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90274 - coresight: etm4x: fix underflow for usage of (nrseqstate - 1) * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90281 - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90284 - firmware_loader: do not queue completed sysfs fallback requests * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90285 - scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90286 - drm/amdgpu/gfx6: Use PFP on the compute queues too * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90290 - arm64: hibernate: Restore DAIF state on error * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93256 - arm64: hibernate: mask DAIF before restoring hibernated kernel * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90292 - RDMA/siw: Fix use-after-free in siw_accept() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90293 - IB/isert: post the full-feature receive buffers after session registration * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90294 - IB/isert: delay the final Login Response until the session is registered * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90295 - cpufreq: imx6q: fix out-of-bounds write when probed more than once * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90296 - cpufreq: imx6q: fix devres accumulation across driver rebind * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90297 - drm/sun4i: crtc: Propagate layer initialization error * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90298 - drm/sun4i: tcon: Drop TCON TOP device reference * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90302 - ocfs2: synchronize heartbeat callbacks with o2net teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90303 - ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90314 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90316 - drm/omap: dsi: Do not copy isr table * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90318 - fat: release buffer head after rebuilding parent * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90319 - rapidio: clear mport->net when rio_add_net() fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90329 - HID: synchronize input before cleaning up a failed probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90341 - firmware: coreboot: Validate table bounds * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90348 - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90360 - regulator: core: use system_freezable_wq for init complete work * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90361 - wifi: ath11k: fix leak in ath11k_service_ready_ext_event() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90362 - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90372 - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90378 - wifi: mt76: mt792x: Fix memory leak in SDIO TX path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90382 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93261 - locking/lockdep: Fix NULL pointer dereference in __lock_set_class() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93283 - i3c: master: Fix device_register() error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90386 - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90388 - iommu/dma: Check atomic pool allocation result directly * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90391 - lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90393 - bpf: Fix potential UAF in bpf_netns_link_update_prog * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90394 - power: supply: sc2731_charger: cancel work on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93262 - md/raid5-ppl: fix use-after-free in ppl_do_flush() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90403 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90411 - nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90413 - IB/isert: reject login PDUs declaring more data than was received * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90416 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90420 - nilfs2: fix infinite loop in nilfs_clean_segments() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93264 - RDMA/efa: Fix PBL chunk length computation * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89782 - fs/ntfs3: reject restart table growth beyond U16_MAX entries * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90431 - remoteproc: Prevent crash handling to race with rproc_del() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90434 - isofs: release zisofs block pointer buffer head * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90435 - RDMA/mlx5: Fix integer overflow of user QP buffer size * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92476 - crypto: keembay - Initialize completion before requesting IRQ * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89785 - fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89787 - ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92494 - ext4: fix buffer_head leak in ext4_init_orphan_info * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92496 - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92501 - ext4: drain in-flight DIO before buffered write fallback * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92504 - thermal: intel: int3400: clean up ODVP on probe failures * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92508 - RDMA/core: Fix potential use after free in ib_free_cq() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93268 - ext4: skip extra isize expansion during mount to prevent deadlock * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89786 - ext4: fix out-of-bounds read in ext4_read_inline_dir() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92524 - irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93037 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93039 - ASoC: meson: Keep link pointers valid on realloc failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93040 - dmaengine: dw-edma: Serialize channel state checks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93041 - dmaengine: dw-edma: Serialize abort state updates * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93046 - software node: Fix software_node_get_reference_args() with index -1 * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93049 - mtd: mtdswap: Avoid freeing registered blktrans device twice * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89777 - vfio/pci: clear vdev->msi_perm after freeing it on init failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93051 - misc: ad525x_dpot: use driver core groups for sysfs files * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93052 - misc: bcm-vk: Use acquire/release for msgq_inited * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93054 - uio: Fix stale info pointer in failed registration path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93055 - UDF symlink pathComponent header OOB read * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93056 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93061 - gpu: host1x: Avoid stack over-read in debug output helpers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93067 - drm/bridge: tc358767: clamp the reported AUX read size to the request * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93271 - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93095 - hfsplus: validate thread record before delete key rebuild * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93098 - rpmsg: glink: fix deadlock in endpoint destroy during driver detach * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89778 - isofs: fix out-of-bounds page array access on empty zisofs block * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93102 - RDMA/hfi1: Free RX data on late probe failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93103 - RDMA/hfi1: Preserve unit 0 on allocation failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89783 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93109 - RDMA/mlx5: Drain RCU callbacks during module teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93110 - RDMA/core: Wait for RCU callbacks before unloading ib_core * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93114 - platform/surface: acpi-notify: Check ACPI companion before use * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93115 - platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93120 - usb: gadget: configfs: fix out-of-bounds read of qw_sign * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93130 - platform/x86: dell-wmi-base: Fix resource leak on module load failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93131 - platform/x86: dell-privacy: Fix race condition * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93138 - bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93140 - udf: Mark LVID buffer as uptodate before marking it dirty * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93145 - clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93278 - staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93279 - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93280 - greybus: audio: bound the topology section sizes against the fetched size * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93151 - nvmet-rdma: fix response resource leak on queue teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93158 - crypto: sa2ul - stop probe if context pool creation fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93159 - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93160 - crypto: atmel-ecc - reject hardware ECDH without a public key * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93161 - crypto: qat - clear AES key schedule from stack * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93165 - platform/chrome: sensorhub: Fix memory overread in ring handler * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93167 - csky: Fix a4/a5 restoration in syscall trace path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93170 - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93177 - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93178 - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93274 - pinctrl: bcm2835: Don't remove an unregistered GPIO chip * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93183 - drm/lima: call drm_mm_init() with a valid allocation range * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93185 - ASoC: rt700-sdw: always drain jack work on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93188 - HID: roccat: bound device-supplied profile index * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93191 - smack: fix incorrect task context in smack_msg_queue_msgrcv * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-40123 - bpf: Enforce expected_attach_type for tailcall compatibility * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89947 - clk: meson: align gxbb_32k_clk_sel number of parents with actual count * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80671 - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93203 - batman-adv: bla: avoid CRC corruption due to parallel claim add * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93204 - batman-adv: dat: atomically update mac addresses * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-52944 - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-22039 - ksmbd: fix overflow in dacloffset bounds check * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-21651 - net: hns3: don't auto enable misc vector * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-53078 - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-43088 - net: af_key: zero aligned sockaddr tail in PF_KEY exports * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-31420 - bridge: mrp: reject zero test interval to avoid OOM panic * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-22103 - net: fix NULL pointer dereference in l3mdev_l3_rcv * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-21649 - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2023-52676 - bpf: Guard stack limits against 32bit overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2024-50017 - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-74268 - tcp: clear sock_ops cb flags before force-closing a child socket * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90015 - xhci: fix lost bounce buffers on TDs spanning several ring segments * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89816 - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93234 - drm/gud: validate TV mode names before creating enum property * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89817 - drm/gud: NUL-terminate TV mode names read from the device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89821 - drm/amd/display: avoid divide-by-zero in __is_lut_linear() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89823 - drm: fix race between partial drm_dev_register() failure and ioctl * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89847 - scsi: qla2xxx: Avoid double completion in async IOCB timeout * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93242 - scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89849 - scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89850 - scsi: qla2xxx: Don't query firmware state while chip is down * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89851 - scsi: qla2xxx: Fix FCE trace enable parsing in debugfs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89853 - scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89855 - scsi: qla2xxx: Serialize flash version read in reset handler * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89856 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89861 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89863 - scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89871 - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89872 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89876 - media: tda18250: fix possible integer overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89879 - media: s2255: bound JPEG frame size before copying into the buffer * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89880 - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89881 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89883 - media: rc: sunxi-cir: Unregister rc device on probe failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93236 - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89887 - media: i2c: ov7740: fix use-after-destroy in remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89888 - media: i2c: ov02a10: fix endpoint parsing use-after-free * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89891 - media: em28xx: fix use-after-free of dev_next->devlist on disconnect * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89892 - media: em28xx: defer audio-only extension registration * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89894 - media: cx231xx: reject geometry changes while the VBI queue is busy * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89896 - media: cedrus: fix memory leak in cedrus_init_ctrls() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89897 - media: cec: Serialize exclusive follower delivery * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89901 - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89923 - KVM: s390: Free guest debug data on vcpu destroy * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89924 - KVM: s390: Fix old_data leak in guest debug error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89925 - KVM: s390: Fix memory leak in guest debug handling * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89926 - KVM: s390: Fix length check __import_wp_info() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89927 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89930 - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89932 - KVM: nVMX: Always flush vpid02 on first use * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89937 - iio: chemical: sgp30: Handle IAQ thread creation failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89939 - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89945 - ASoC: cs35l34: drain threaded IRQ before runtime suspend * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89946 - ASoC: cs35l33: drain threaded IRQ before runtime suspend * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89954 - mtd: afs: validate v2 image info bounds * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89964 - parisc: eisa: Fix infinite loop when parsing invalid IRQ value * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89968 - nvmet-tcp: reject unsolicited H2CData PDUs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89969 - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89973 - nvme-tcp: check the data direction of a C2HData PDU * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89979 - ALSA: pcm: Fix race between non-atomic ops and trigger-start * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89980 - ALSA: harmony: initialize locks before requesting IRQ * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89983 - i2c: core: fix debugfs UAF on adapter removal * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89984 - perf/x86/intel: Fix kernel address leakages in LBR stack * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89989 - ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89993 - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89997 - dm: fix resume-vs-remove race * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89999 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90007 - scsi: pm8001: Use rollback index when freeing MSI-X vectors * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90017 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90018 - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90025 - usb: typec: ucsi: displayport: Fix OOB altmode array index * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-38097 - espintcp: remove encap socket caching to avoid reference leak * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89515 - scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80689 - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80888 - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80912 - selinux: reject an unclaimed class value in security_get_classes() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89595 - fsnotify: Fix stale object mask after concurrent mark updates * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89603 - entry: Fix seccomp bypass after ptrace with TSYNC * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-74378 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89488 - openvswitch: Fix CT limit teardown use-after-free * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80977 - net: skbuff: don't touch shared zerocopy state in skb_tx_error() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80928 - smack: fix cred UAF in smack_file_send_sigiotask() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93222 - signal: avoid shared siginfo namespace rewrites * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80930 - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80931 - w1: ds28e17: reject an oversize length on an I2C block read * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80932 - vsock/virtio: flush works in dependency order * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80938 - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80941 - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80944 - wifi: mwifiex: Detach sync cmd buffer on interrupted wait * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80949 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80951 - i3c: master: svc: bound IBI payload to the requested max_payload_len * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80952 - i3c: master: Fix info leak and UAF in device unregister path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80963 - dm-stats: fix a crash if allocation of per-cpu data fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80964 - ALSA: virmidi: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80965 - ALSA: serial-u16550: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80966 - ALSA: portman2x4: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80967 - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80968 - ALSA: mts64: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80969 - ALSA: mpu401: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80971 - ALSA: bcd2000: clear the URB pointers on disconnect * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80972 - ALSA: aloop: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80973 - ALSA: 6fire: bound the MIDI event length from the device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80976 - seg6: reset IP6CB after IPv6 decapsulation * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80978 - net: cap advertised IP tunnel headroom * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80983 - net/smc: fix socket refcount leak in smc_switch_conns() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80987 - NTB: ntb_transport: Reject oversized TX buffers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80988 - NTB: ntb_transport: Fail TX enqueue when the QP link is down * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80994 - net: openvswitch: fix flow mask use-after-free on flow deletion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81000 - net: tun: bound receive headroom * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81001 - slip: fix use-after-free in sl_sync() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81002 - xdp: fix zero-copy frame layout * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81003 - net/iucv: filter frames in afiucv_hs_rcv() by ingress device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81005 - ipmi: si: Fix NULL pointer dereference after failed registration * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81007 - ipmi: ipmb: validate write message length * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81008 - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81017 - platform/chrome: sensorhub: Bound the EC-reported sensor number * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89440 - mmc: via-sdmmc: stop card-detect handling on probe failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89444 - platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93206 - PCI/proc: Use file_ns_capable() when checking config space read access * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89456 - s390/dasd: Propagate partial completion length across ERP recovery * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89457 - s390/dasd: Guard sysfs discipline callbacks against unallocated private data * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89458 - s390/dasd: Do not complete a failed ESE read as successful * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89461 - power: supply: max17040: synchronize work cancellation on suspend * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89463 - power: supply: ucs1002: fix use-after-free on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89464 - power: supply: twl4030_charger: cancel workers via devm * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89469 - power: supply: lp8727: fix use-after-free in lp8727_release_irq() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89470 - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89471 - power: supply: cros_usbpd-charger: bound the EC-reported port count * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89474 - power: supply: bq256xx: drain usb_work before freeing the charger * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89475 - power: supply: bq24257: fix use-after-free on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89476 - sctp: fix stream->outcnt underflow on duplicate RECONF responses * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89477 - sctp: fix NULL deref on untransmitted RECONF completion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89478 - sctp: drop a chunk if its transport was removed * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89479 - sctp: stop processing a packet once its association is deleted * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89480 - nvme-tcp: reject a read that transferred too few bytes * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89482 - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89483 - nvme: zero the discard fallback page * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89485 - lockd: pin next file across nlm_inspect_file lock-drop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89489 - openrisc: fix arbitrary kernel memory access via or1k_atomic syscall * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89490 - ocfs2: fix readdir position truncation on 32-bit kernels * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89491 - ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89493 - ocfs2: validate rl_used against rl_count in refcount block validator * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89496 - ocfs2: always run deallocs on copy-on-write completion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89497 - orangefs: skip leading spaces before parsing client debug masks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89498 - orangefs: fix double-free of trailer_buf on readdir copy failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89504 - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89508 - RDMA/ucma: Lock the handler in ucma_set_ib_path() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89510 - RDMA/cxgb4: Cancel reg_work before freeing device on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89511 - qede: Fix NULL pointer dereference in TPA fragment processing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89512 - remoteproc: scp: Fix device reference leak on failed lookup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89524 - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89525 - udf: reject VAT indexes equal to the entry count * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89532 - svcrdma: Fix pcl_for_each_segment for empty chunks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89533 - svcrdma: Fix offset arithmetic in read_chunk_range * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89538 - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89540 - sunrpc: init gssp_lock before publishing proc entry * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89541 - SUNRPC: harden gss_unwrap_resp_priv length checks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89542 - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89551 - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89554 - mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89555 - mpls: reload header after pskb_may_pull() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89557 - md: do overflow check for sb->bblog_shift in super_1_load() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89559 - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93226 - ipv6: use RCU iterator to dump route exceptions * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89562 - ip6_gre: fix hardware header length for NBMA tunnels * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89563 - ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89569 - Bluetooth: RFCOMM: serialize security confirmation handling * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89573 - dm array: reject an array block whose value size is not the caller's * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89576 - dm-era: fix shadowed superblock leak on take-snap failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89582 - bnx2x: fix double free in bnx2x_init_firmware() error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89585 - auxdisplay: charlcd: cancel backlight work on registration failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89586 - ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89594 - hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89596 - forcedeth: fix off-by-one when saving/restoring non-PCI config space * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89597 - fbdev: uvesafb: unregister connector callback on init failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89599 - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89605 - ecryptfs: release message context on send failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89606 - ecryptfs: reject too-small tag 70 packets * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89608 - ecryptfs: pass packet set buffer size to parser * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89609 - ecryptfs: hold msg ctx list lock when cleaning daemon queue * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89615 - fs/ntfs3: bound page_lcns[] index by the log record * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89616 - fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89617 - fs/ntfs3: validate dirty page table on log replay * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89621 - HID: mcp2221: validate report size in mcp2221_raw_event() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89626 - HID: sensor: custom: Fix field sysfs group cleanup on failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89627 - HID: roccat: free buffered reports when destroying device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89628 - HID: picolcd: clamp eeprom debugfs read to bytes actually received * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89643 - audit: avoid dropping live tree ref on fsnotify rule autoremove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89649 - ceph: bound xattr value length in __build_xattrs() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89650 - ceph: bound num_export_targets array for mds info v2/v3 * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89653 - ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89655 - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89656 - libceph: reject buckets with mismatched CRUSH ids * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89662 - NFSD: Prevent lock owner use-after-free during client teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89663 - nfsd: revoke copy-notify stateids before dropping their reference * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89665 - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89669 - nfsd: initialize copy-notify stateid before publishing it * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89673 - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89674 - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89684 - nfsd: fix cpntf publish race in nfs4_init_cp_state * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89694 - nfsd: check client ownership when cancelling a copy-notify stateid * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89696 - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89697 - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89704 - nfsd: sample writeback error cursor before async COPY loop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89706 - nfsd: Reset write verifier when async COPY writeback fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89710 - NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89711 - NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89712 - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89720 - ubifs: fix out-of-bounds read in signature length check * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93213 - of: fix out-of-bounds read in of_alias_scan() stem parser * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89723 - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89724 - media: vicodec: fix out-of-bounds write in FWHT encoder * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89725 - media: cec: stm32: prevent out-of-bounds write on RX overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89726 - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89729 - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89730 - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89732 - usb: gadget: f_fs: Prevent deadlock during ep0 read loop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93214 - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89736 - usb: gadget: u_audio: Fix use-after-free on sound card disconnect * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89741 - Revert "media: v4l2-dev: fix error handling in __video_register_device()" * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89742 - rapidio: mport_cdev: fix use-after-free in dma_req_free() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89749 - tracing: Fix crash passing ERR_PTR to kthread_stop() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89752 - mm: memcg: stop reclaim when a limit update is superseded * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89753 - mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89765 - timers/itimer: Zero-init old itimerval before copy to userspace * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93219 - clocksource/drivers/timer-sun4i: Advertise a real minimum delta * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-23191 - ALSA: aloop: Fix racy access at PCM trigger * Jammy update: v5.15.220 upstream stable release (LP: #2168586) - io_uring/io-wq: fix worker accounting when canceling creation callbacks - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler - can: j1939: make j1939_sk_bind() fail if device is no longer registered - Revert "PM: sleep: Use complete() in device_pm_sleep_init()" - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). - selinux: switch two allocations to use kzalloc_objs() - ALSA: pcm: fix wait_time calculations - ASoC: tegra: Fix Master Volume Control - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - kcov: replace local_irq_save() with a local_lock_t - ext4: propagate errors from fast commit range replay - nilfs2: correct return value kernel-doc descriptions for ioctl functions - nvme: rename CDR/MORE/DNR to NVME_STATUS_* - HID: ft260: fix i2c probing for hwmon devices - HID: ft260: improve i2c write performance - HID: ft260: improve i2c large reads performance - HID: ft260: skip unexpected HID input reports - HID: ft260: wake up device from power saving mode - HID: ft260: missed NACK from busy device - HID: ft260: validate i2c input report length - HID: input: read battery capacity from its actual report offset - fpga: dfl: fme: add error handling - accessibility: speakup: unregister tty ldisc on later init failures - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure - usb: usbtest: disable dynamic ID support - mm/swap: reject swapon() on filesystem-level encrypted files - crypto: atmel-tdes - use scatterlist length before DMA mapping - crypto: qce - Remove unsafe/deprecated algorithms - usb: core: Strengthen error handling in hub_hub_status() - USB: serial: spcp8x5: drop broken carrier detect support - Linux 5.15.220 * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80824 - usb: usbfs: fix use-after-free of usb_device in usbdev_release() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80826 - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80827 - USB: serial: option: fix slab OOB read in interrupt URB callback * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80828 - ALSA: usb-audio: Complete cleanup after system-resume errors * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80829 - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80830 - usb: core: Add lock to usb_wakeup_notification() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80921 - KVM: s390: vsie: zero stale crypto bits * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80831 - crypto: mxs-dcp - fix source scatterlist length access * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80832 - crypto: qce - fix CCM AAD buffer underallocation * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80840 - ipv6: seg6: clear IPv4 control block on IPIP decapsulation * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80842 - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80843 - xfrm: fix xfrm_state_construct() auth-trunc leak * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80844 - xfrm: ah6: validate routing header segments_left * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80846 - xfrm: drop ESP-in-TCP packets with no ingress device * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80848 - xfrm: espintcp: fix UAF during close * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80854 - usb: gadget: f_tcm: keep port count until LUN teardown completes * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80855 - fuse: fix invalidate lock leak on open O_TRUNC DAX failure * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80856 - fuse: fix invalidate lock leak on setattr writeback failure * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80923 - xhci: dbgtty: Fix unregister on tty_register_driver() failure * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80768 - HID: ft260: fix stack-use-after-return write in I2C read race * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80766 - HID: uclogic: fix use-after-free of inrange_timer on remove * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80789 - nvmet-tcp: bound SGL data length before allocating command buffers * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80783 - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80796 - nfc: nci: add data_len bound checks to activation parameter extractors * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80807 - nilfs2: reject invalid block index in GC ioctl * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80916 - kcov: fix data corruption and race conditions on PREEMPT_RT * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-72323 - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-43437 - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-53089 - bpf: Fix use-after-free in offloaded map/prog info fill * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2025-40102 - KVM: arm64: Prevent access to vCPU events before init * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2025-39925 - can: j1939: implement NETDEV_UNREGISTER notification handler * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2024-58095 - jfs: add check read-only before txBeginAnon() call * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2024-58094 - jfs: add check read-only before truncation in jfs_truncate_nolock() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2024-46754 - bpf: Remove tst_run from lwt_seg6local_prog_ops. * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-68476 - ipvs: reload ip header after head reallocation * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80806 - ext4: don't enable DAX on new encrypted files * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80863 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() * Jammy update: v5.15.219 upstream stable release (LP: #2168549) - Linux 5.15.219 * Jammy update: v5.15.219 upstream stable release (LP: #2168549) // CVE-2026-80590 - inet: frags: strip GSO state from fragments before reassembly * Jammy update: v5.15.218 upstream stable release (LP: #2168525) - null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows - ext4: clear error before retrying inode xattr space fallback - misc: fastrpc: separate fastrpc device from channel context - misc: fastrpc: Rework fastrpc_req_munmap - perf/core: Fix child_total_time_enabled accounting bug at task exit - perf: Fix cgroup state vs ERROR - perf: Fix dangling cgroup pointer in cpuctx - nfc: nci: free destination parameters when closing a connection - drm/amdgpu: check ASPM on the dGPU host link - KVM: x86/mmu: Retry page fault if root is invalidated by memslot update - KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs - KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() - KVM: Rename mmu_notifier_* to mmu_invalidate_* - KVM: x86/mmu: Split out TDP MMU page fault handling - KVM: x86/mmu: Rename __direct_map() to direct_map() - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - KVM: x86: Retry page fault if MMU reload is pending and root has no sp - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard - Input: atkbd - skip deactivate for HONOR ZQC-P - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: fix data race in add_addr timer callback - can: use skb hash instead of private variable in headroom - Revert "ALSA: aoa: Use guard() for mutex locks" - Linux 5.15.218 * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80765 - HID: hyperv: validate initial device info bounds * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80767 - HID: sensor: custom: Fix use-after-free in enable_sensor * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80918 - HID: core: fix number/pointer type confusion on long items * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80889 - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-46170 - mptcp: pm: ADD_ADDR rtx: free sk if last * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-46158 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80555 - s390/vfio_ccw: Free all memory if cp_init() fails * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2025-68794 - iomap: adjust read range correctly for non-block-aligned positions * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-64581 - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80781 - HID: core: fix OOB read of field->usage in hid_set_field() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80782 - HID: magicmouse: do not keep a stale msc->input if no input is claimed * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-64561 - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80583 - ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80587 - mptcp: avoid combining some incoming suboptions * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80547 - s390/vfio_ccw: Implement a crw lock * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80548 - s390/vfio_ccw: Selectively expand io_mutex * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80552 - s390/vfio_ccw: Ensure index for read/write regions are within range * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80788 - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80790 - nvmet-fc: fix invalid free in LS IOD error path * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80792 - ipv6: fix use-after-free in ip6_finish_output2() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80793 - ipv4: reject undersized MTUs in ip_do_fragment() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80557 - libceph: fix OOB read in decode_watchers() via missing bounds check * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80794 - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80795 - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80823 - nfc: st21nfca: validate ATR_REQ length against the received frame * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80797 - nfc: pn533: purge fragmented skbs during cleanup * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80798 - nfc: llcp: reject PDUs shorter than the LLCP header * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80799 - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80800 - nfc: llcp: bound the connect_sn TLV walk to the skb * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80801 - nfc: microread: validate target discovery payload lengths * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80802 - nfc: fdp: bound the device-reported read length and fix an skb leak * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80803 - nfc: digital: clamp SENSF_RES length to the destination buffer * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80536 - xfs: bounds-check buffer log item's dirty bitmap * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80553 - s390/vfio_ccw: Cancel existing workqueues * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74662 - inet: frags: publish queues before arming timer * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74666 - packet: synchronize pressure clearing with ring reconfiguration * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74663 - net/sched: reject overly deep qdisc hierarchies * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74668 - packet: use consistent hard_header_len in TX_RING send path * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74582 - packet: use consistent hard_header_len in non-ring send paths * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80737 - serial: amba-pl011: synchronize DMA teardown * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74626 - NTB: ntb_netdev: Preserve RX queue depth on allocation failure * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74647 - misc: fastrpc: Remove buffer from list prior to unmap operation * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74632 - mm/huge_memory: fix huge_zero_pfn race * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80562 - gpio: ml-ioh: use raw_spinlock_t for the register lock * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80805 - xfs: validate attr entry pointer before field access * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80808 - ext4: stop retrying saturated xattr cache entries * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80809 - ocfs2: fix missing metadata reservation for large xattrs * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80812 - ALSA: dummy: Check card index validity at probe * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80814 - rndis_host: add overflow check in rndis_rx_fixup() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80819 - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80917 - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems * Jammy update: v5.15.217 upstream stable release (LP: #2168510) - f2fs: fix UAF issue in f2fs_merge_page_bio() - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ipvs: separate destination availability state - selinux: require every boolean value to be defined - selinux: reject a class permission count below its inherited common - selinux: do not cancel a policy conversion that never started - mptcp: options: reset DSS fields in case of unexpected size - s390/qeth: validate user buffer length in SNMP and ARP query ioctls - ASoC: cs4265: sort the register default table - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses - powerpc/pseries: pci - logic bug - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet - Input: psxpad-spi - set driver data before use - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard - Input: iforce - validate input packet lengths - powerpc/pseries: lparcfg - fix kbuf[] underflow - Input: synaptics-rmi4 - zero report size on F54 work error - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer - Input: synaptics-rmi4 - block s_input when F54 queue is busy - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue - crypto: qce - fix error path in devm_qce_register_algs - libceph: fix multiple unsafe decodes in decode_locker() - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() - openrisc: signal: do not restore privileged SR bits on sigreturn - Input: sur40 - fix input device registration ordering - Input: sur40 - fix V4L error path cleanup - libceph: Avoid using invalid osd indices from primary_temp - ceph: fix MDS random selection readiness predicate - libceph: tolerate addrvecs with multiple entries of the same type - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit - mmc: sdhci: unmap the bounce buffer before device release - mmc: sdhci: make tuning_err a signed int - drm/radeon: fix autosuspend cleanup during teardown - s390/vfio_ccw: Fix out of bounds check on CCW array - drm/amdgpu: Reject UVD message with invalid number of h265 refs - drm/amdgpu: validate GEM_CREATE domain combinations - drm/amdgpu: Reject UVD message with dimensions above 4096 - drm/amdgpu: Implement insert_end for VCE 3 - drm/amdgpu: Fix UVD decode image min size calculation - xfs: fix ilock leak on error in xfs_dq_get_next_id - xfs: check v5 superblock features early - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - mm: do file ownership checks with the proper mount idmap - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - udmabuf: Do not create malformed scatterlists - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - Input: mms114 - fix touch indexing for MMS134S and MMS136 - i2c: davinci: Unregister cpufreq notifier on probe failure - Input: mms114 - reject an oversized device packet size - ALSA: hda: conexant: Remove mic bias threshold override - VFS/audit: introduce kern_path_parent() for audit - audit: widen ino fields to u64 - audit: use 'unsigned int' instead of 'unsigned' - audit: fix recursive locking deadlock in audit_dupe_exe() - ALSA: hda: Fix cached processing coefficient verbs - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: max310x: implement gpio_chip::get_direction() - rxrpc: serialize kernel accept preallocation with socket teardown - fbcon: Rename struct fbcon_ops to struct fbcon_par - fbcon: Use correct type for vc_resize() return value - tipc: restrict socket queue dumps in enqueue tracepoints - mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - vduse: Use fixed 4KB bounce pages for non-4KB page size - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: take out allocations from vduse_dev_alloc_coherent - VDUSE: avoid leaking information to userspace - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - ASoC: mediatek: mt8183: Check runtime resume during probe - tcp: convert to dev_net_rcu() - net: dst: annotate data-races around dst->input - net: dst: annotate data-races around dst->output - net: dst: add four helpers to annotate data-races around dst->dev - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: mt8192: Check runtime resume during probe - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - remoteproc: qcom: replace kstrdup with kstrndup - remoteproc: qcom: fix sparse warnings - remoteproc: qcom: pas: Adjust the phys addr wrt the mem region - remoteproc: qcom: Fix leak when custom dump_segments addition fails - lsm: use default hook return value in call_int_hook() - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - fs/ntfs3: Make ntfs_update_mftmirr return void - fs/ntfs3: Undo critial modificatins to keep directory consistency - ntfs3: validate split-point offset in indx_insert_into_buffer - 9p: skip nlink update in cacheless mode to fix WARN_ON - net: thunderbolt: Fix frags[] overflow by bounding frame_count - mtd: spi-nor: Fix spi_nor_try_unlock_all() - mtd: spi-nor: swp: Improve locking user experience - dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip - dmaengine: dw-edma: Detach the private data and chip info structures - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - ksmbd: fix integer overflow in set_file_allocation_info() - i2c: imx: separate atomic, dma and non-dma use case - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - can/esd_usb2: Rename esd_usb2.c to esd_usb.c - [Config] Set CONFIG_CAN_ESD_USB=m - can: esd_usb: kill anchored URBs before freeing netdevs - thunderbolt: Remove usage of the deprecated ida_simple_xx() API - thunderbolt: Update property.c function documentation - thunderbolt: Keep XDomain reference during the lifetime of a service - thunderbolt: Remove service debugfs entries during unregister - thunderbolt: Remove XDomain from the bus without holding tb->lock - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - bpf,fork: wipe ->bpf_storage before bailouts that access it - ovl: use linked upper dentry in copy-up tmpfile - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - dm-integrity: don't increment hash_offset twice - dm-verity: make error counter atomic - firmware_loader: introduce __free() cleanup hanler - Input: ims-pcu - fix firmware leak in async update - mmc: vub300: fix use-after-free on disconnect - mmc: vub300: rename probe error labels - mmc: vub300: fix use-after-free on probe failure - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - net: Add helper function to parse netlink msg of ip_tunnel_encap - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: mana: Validate the packet length reported by the NIC - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - treewide: rename pinctrl_gpio_direction_output_new() - gpio: tegra: do not call pinctrl for GPIO direction - net/sched: taprio: avoid calling child->ops->dequeue(child) twice - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - espintcp: use sk_msg_free_partial to fix partial send - net: ipa: fix SMEM state handle leaks in SMP2P init - octeontx2-pf: fix SQB pointer leak on init failure - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - dma-buf/drivers: make reserving a shared slot mandatory v4 - drm/virtio: use uninterruptible resv lock for plane updates - drm/displayid: fix Tiled Display Topology ID size - drm/tegra: fbdev: Remove offset into framebuffer memory - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/virtio: Return proper error codes instead of -1 - drm/virtio: bound EDID block reads to the response buffer - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - media: marvell-cam: fix missing pci_disable_device() on remove - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Correct the minimum vblanking value - media: i2c: imx219: Rename VTS to FRM_LENGTH - media: imx219: Fix maximum frame length in lines - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l: async: Set owner for async sub-devices - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - ALSA: seq: close a re-opened queue timer in the destructor - wifi: brcmfmac: drain bus_reset work on device removal - serial: 8250_mid: Remove unneeded test for ->setup() presence - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - sc16is7xx: Properly resume TX after stop - serial: sc16is7xx: Fill in rs485_supported - serial: sc16is7xx: remove obsolete out_thread label - serial: sc16is7xx: fix regression with GPIO configuration - serial: sc16is7xx: implement gpio get_direction() callback - mptcp: cleanup MPJ subflow list handling - mptcp: fix subflow accounting on close - mptcp: decrement subflows counter on failed passive join - sctp: avoid auth_enable sysctl UAF during netns teardown - ceph: avoid fs reclaim while using current->journal_info - libceph: Amend checking to fix `make W=1` build breakage - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: add doutc and *_client debug macros support - ceph: rename _to_client() to _to_fs_client() - ceph: print cluster fsid and client global_id in all debug logs - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - libceph: fix two unsafe bare decodes in decode_lockers() - ksmbd: defer destroy_previous_session() until after NTLM authentication - net/sched: serialize qdisc_rtab_list against concurrent get/put - ftrace: Add global mutex to serialize trace_parser access - super: fix emergency thaw deadlock on frozen block devices - ksmbd: rename smb2_get_msg to smb_get_msg - smb/server: fix minimum SMB1 PDU size - smb/server: fix minimum SMB2 PDU size - ksmbd: validate minimum PDU size for transform requests - mm/vmstat: fold stranded per-cpu node stats when a node comes online - ksmbd: conn lock to serialize smb2 negotiate - ksmbd: reject repeated SMB2 NEGOTIATE requests - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - igc: remove napi_synchronize() in igc_down() - net: pktgen: fix code style (WARNING: Block comments) - net: pktgen: fix proc entry use-after-free - scsi: sd: sd_zbc: Improve source code documentation - scsi: sd: sd_zbc: Use logical blocks as unit when querying zones - scsi: sd: sd_zbc: Introduce struct zoned_disk_info - scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() - scsi: scsi_debug: Rename zone type constants - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - ice: fix VF interrupts cleanup - ice: fix memory leak in ice_lbtest_prepare_rings() - fsnotify: opt-in for permission events at file open time - fs: don't block write during exec on pre-content watched files - binfmt_misc: restore write access when removing an entry - i2c: imx: Fix slave registration race and error handling - i2c: bcm-iproc: remove printout on handled timeouts - i2c: iproc: reset bus after timeout if START_BUSY is stuck - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - jiffies: Define secs_to_jiffies() - ice: wait for reset completion in ice_resume() - drm/amd/pm: fix torn gpu metrics reads - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - mm/ptdump: always stabilise against page table freeing using init_mm - net: add a couple of helpers for iph tot_len - openvswitch: use skb_ip_totlen in conntrack - net: sched: use skb_ip_totlen and iph_totlen - openvswitch: move key and ovs_cb update out of handle_fragments - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free stranded TX buffers on ring deinit - net/smc: rdma write inline if qp has sufficient inline space - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 - crypto: ccm - Set rfc4309 maxauthsize from child - netfilter: ipset: fix refcount race between list:set GC and swap - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path - netfilter: flowtable: publish GC-visible tuple last - netfilter: ipset: fix list type element drift bug - net: packet: fix wrong transport_header when sending VLAN-tagged frame - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers - af_packet: Don't send zero-byte data in tpacket_snd(). - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG - net/x25: fix use-after-free of the socket by its timers - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - drm/vmwgfx: Reserve fence slots on buffer objects in cotables - drm/virtio: Unlock reservations on dma_resv_reserve_fences() error - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - ring-buffer: Use current_context for safe per-CPU buffer swap - Linux 5.15.217 linux (5.15.0-199.209) jammy; urgency=medium * jammy/linux: 5.15.0-199.209 -proposed tracker (LP: #2168214) * [SRU] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value (LP: #2107442) - selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value * CVE-2022-1205 - ax25: Fix ax25 session cleanup problems * CVE-2022-50303 - drm/amdkfd: Fix double release compute pasid * CVE-2023-53320 - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() * CVE-2025-39726 - s390/ism: fix concurrency management in ism_cmd() * CVE-2025-39779 - btrfs: subpage: keep TOWRITE tag until folio is cleaned * CVE-2025-39810 - bnxt_en: Fix memory corruption when FW resources change during ifdown * udpgro.sh from ubuntu_kselftests_net failed with J-5.15 (udpgso_bench_rx: recv: bad packet len) (LP: #2129861) - selftests: udpgro: no need to load xdp for gro * CVE-2026-68399 - bpf: Fix UAF in sock clone early bailouts * CVE-2025-37861 - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue * CVE-2025-38643 - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() * CVE-2025-38615 - fs/ntfs3: cancle set bad inode after removing name fails * CVE-2025-38361 - drm/amd/display: Check dce_hwseq before dereferencing it * CVE-2025-38259 - ASoC: codecs: wcd9335: Fix missing free of regulator supplies * CVE-2025-38239 - scsi: megaraid_sas: Fix invalid node index * CVE-2025-38069 - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops * CVE-2022-50071 - mptcp: move subflow cleanup in mptcp_destroy_common() * CVE-2025-37920 - xsk: Fix race condition in AF_XDP generic RX path * CVE-2026-43456 - bonding: fix type confusion in bond_setup_by_slave() - bonding: prevent potential infinite loop in bond_header_parse() * CVE-2022-49858 - octeontx2-pf: Fix SQE threshold checking * CVE-2025-22057 - net: decrease cached dst counters in dst_release * CVE-2025-22083 - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint * CVE-2024-58096 - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode * CVE-2025-21947 - ksmbd: fix type confusion via race condition when using ipc_msg_send_request * CVE-2022-49562 - KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits * CVE-2025-21812 - ax25: rcu protect dev->ax25_ptr * CVE-2025-21801 - net: ravb: Fix missing rtnl lock in suspend/resume path * CVE-2024-54683 - netfilter: IDLETIMER: Fix for possible ABBA deadlock * CVE-2024-53220 - f2fs: fix to account dirty data in __get_secs_required() * CVE-2025-21759 - ipv6: mcast: extend RCU protection in igmp6_send() * CVE-2024-57999 - powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW * CVE-2024-57982 - xfrm: state: fix out-of-bounds read during lookup * CVE-2022-49651 - srcu: Tighten cleanup_srcu_struct() GP checks * CVE-2022-49359 - drm/panfrost: Job should reference MMU not file_priv * CVE-2022-49234 - net: dsa: Avoid cross-chip syncing of VLAN filtering * CVE-2024-57945 - riscv: mm: Fix the out of bound issue of vmemmap address * CVE-2024-53210 - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() * CVE-2024-53187 - io_uring: check for overflows in io_pin_pages -- Mehmet Basaran <mehmet.basaran@canonical.com> Thu, 15 Oct 2026 15:20:14 +0300 ** Changed in: linux (Ubuntu Jammy) Status: Fix Committed => Fix Released ** CVE added: https://cve.org/CVERecord?id=CVE-2022-1205 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49234 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49359 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49562 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49651 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49858 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-50071 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-50303 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-50406 ** CVE added: https://cve.org/CVERecord?id=CVE-2023-52676 ** CVE added: https://cve.org/CVERecord?id=CVE-2023-53231 ** CVE added: https://cve.org/CVERecord?id=CVE-2023-53320 ** CVE added: https://cve.org/CVERecord?id=CVE-2023-53707 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-41062 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-46754 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-49568 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-50017 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-53187 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-53210 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-53220 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-54683 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-57945 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-57982 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-57999 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-58094 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-58095 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-58096 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21649 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21651 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21759 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21801 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21812 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21947 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-22039 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-22057 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-22083 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-22103 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-37861 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-37920 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-37964 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38069 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38097 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38239 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38259 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38349 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38361 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38615 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38643 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39726 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39779 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39810 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39925 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-40102 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-40123 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-68190 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-68794 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23191 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31420 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43437 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43456 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46113 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46158 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46170 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46242 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-52944 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-52988 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-53078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-53089 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-64561 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-64581 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68236 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68399 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-72323 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74268 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74378 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74626 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74632 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74637 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74647 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74662 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74663 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74666 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74668 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74743 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80536 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80547 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80548 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80552 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80553 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80555 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80557 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80562 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80583 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80587 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80590 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80671 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80689 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80726 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80737 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80765 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80766 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80767 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80768 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80781 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80782 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80783 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80788 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80789 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80790 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80792 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80793 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80794 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80795 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80796 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80797 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80798 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80799 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80800 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80801 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80802 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80803 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80805 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80806 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80807 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80808 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80809 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80812 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80814 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80819 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80823 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80824 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80826 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80827 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80828 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80829 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80830 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80831 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80832 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80833 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80834 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80840 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80842 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80843 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80844 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80846 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80848 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80854 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80855 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80856 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80863 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80888 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80889 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80912 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80916 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80917 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80918 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80921 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80923 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80928 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80930 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80931 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80932 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80938 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80941 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80944 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80949 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80951 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80952 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80963 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80964 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80965 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80966 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80967 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80968 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80969 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80971 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80972 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80973 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80976 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80977 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80978 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80983 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80987 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80988 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80994 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81000 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81001 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81002 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81003 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81005 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81007 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81008 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81017 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89440 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89444 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89456 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89457 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89458 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89461 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89463 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89464 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89469 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89470 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89471 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89474 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89475 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89477 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89478 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89479 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89480 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89482 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89483 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89485 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89487 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89488 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89489 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89490 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89491 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89493 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89494 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89495 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89497 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89498 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89504 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89508 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89510 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89511 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89512 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89515 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89525 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89532 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89533 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89538 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89540 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89541 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89542 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89548 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89549 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89551 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89554 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89555 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89557 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89559 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89560 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89562 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89563 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89569 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89573 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89575 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89576 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89585 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89586 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89594 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89595 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89596 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89597 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89599 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89603 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89605 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89606 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89607 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89608 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89609 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89615 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89616 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89617 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89621 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89626 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89627 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89628 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89643 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89649 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89650 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89653 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89655 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89656 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89662 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89663 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89665 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89669 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89673 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89674 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89684 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89694 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89696 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89697 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89699 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89704 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89706 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89710 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89711 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89712 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89720 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89723 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89724 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89725 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89726 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89729 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89730 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89732 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89733 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89736 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89741 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89742 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89749 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89752 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89753 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89765 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89777 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89778 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89779 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89780 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89781 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89782 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89783 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89784 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89785 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89786 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89787 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89789 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89792 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89796 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89816 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89817 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89821 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89823 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89843 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89845 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89846 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89847 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89849 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89850 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89851 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89852 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89853 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89854 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89855 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89856 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89858 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89861 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89863 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89864 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89865 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89871 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89872 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89876 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89878 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89879 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89880 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89881 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89883 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89887 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89888 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89890 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89891 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89892 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89893 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89894 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89895 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89896 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89897 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89901 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89923 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89924 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89925 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89926 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89927 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89930 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89932 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89936 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89937 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89939 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89945 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89946 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89947 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89948 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89949 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89951 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89952 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89953 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89954 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89964 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89965 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89968 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89969 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89973 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89979 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89980 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89982 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89983 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89984 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89989 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89993 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89997 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89999 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90000 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90007 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90011 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90015 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90017 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90018 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90019 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90020 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90025 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90031 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90032 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90033 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90034 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90049 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90053 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90054 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90055 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90056 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90058 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90062 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90063 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90067 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90068 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90070 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90071 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90072 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90073 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90074 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90075 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90081 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90102 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90103 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90107 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90114 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90126 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90128 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90140 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90141 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90143 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90151 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90157 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90160 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90198 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90202 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90203 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90209 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90214 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90216 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90218 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90219 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90221 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90222 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90223 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90224 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90225 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90226 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90228 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90245 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90248 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90249 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90251 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90257 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90274 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90281 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90283 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90284 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90285 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90286 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90290 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90292 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90293 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90294 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90295 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90296 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90297 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90298 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90302 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90303 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90307 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90314 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90316 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90318 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90319 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90327 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90329 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90334 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90341 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90348 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90360 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90361 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90362 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90372 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90378 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90382 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90386 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90388 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90391 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90393 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90394 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90395 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90403 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90411 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90413 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90414 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90415 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90416 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90419 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90420 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90431 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90434 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90435 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92494 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92498 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92501 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92504 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92508 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92521 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92522 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93037 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93039 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93040 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93041 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93046 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93048 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93049 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93051 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93052 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93053 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93054 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93055 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93056 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93061 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93067 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93095 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93098 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93102 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93103 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93108 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93109 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93110 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93114 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93115 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93120 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93130 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93131 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93138 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93140 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93141 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93145 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93151 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93158 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93159 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93160 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93161 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93165 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93167 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93170 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93177 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93178 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93183 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93185 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93188 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93189 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93191 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93203 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93204 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93206 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93213 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93214 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93219 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93222 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93226 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93234 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93236 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93242 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93245 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93252 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93256 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93261 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93262 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93264 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93268 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93271 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93274 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93278 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93279 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93280 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93283 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93286 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93287 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93288 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93782 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93783 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93784 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93785 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93789 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93795 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93797 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93798 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93800 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93802 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93803 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93805 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93807 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93808 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93811 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93812 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93813 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93815 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93816 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93819 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93820 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93821 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93822 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93825 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93830 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97407 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97408 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97411 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97413 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97416 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97417 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97418 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97419 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97420 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97421 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97430 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97434 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97435 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97436 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97437 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97438 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97439 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97440 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97441 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97443 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97444 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97445 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97446 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97448 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97449 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97450 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97451 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97452 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97453 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97454 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97455 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97456 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97472 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97475 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97481 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97482 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97483 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97484 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97485 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97486 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97487 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97488 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97489 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97490 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97491 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97492 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97502 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97506 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97507 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97508 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97510 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97523 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97568 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97572 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97573 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97576 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97592 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97596 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97598 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97601 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97604 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97608 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97611 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97612 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97899 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97904 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97905 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97909 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97910 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97923 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97926 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97927 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97930 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97931 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97940 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97948 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97951 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97952 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97954 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97957 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97958 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97959 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97963 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97964 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97969 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97970 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97981 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97982 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97991 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97993 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97995 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97998 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98006 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98009 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98010 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98011 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98012 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98013 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98014 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98015 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98016 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98022 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98023 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98025 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98027 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98030 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98031 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98063 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98064 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98066 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98068 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98069 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98070 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98071 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98072 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98074 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98075 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98076 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98077 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98080 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98090 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98091 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98094 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98095 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98096 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98098 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98108 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98113 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98116 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98121 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98123 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98130 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98154 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98157 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98158 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2129861 Title: udpgro.sh from ubuntu_kselftests_net failed with J-5.15 (udpgso_bench_rx: recv: bad packet len) Status in ubuntu-kernel-tests: Invalid Status in linux package in Ubuntu: Invalid Status in linux source package in Jammy: Fix Released Bug description: Issue found with Jammy 5.15.0-162.172 in sru-20251013 START ubuntu_kselftests_net.net:udpgro.sh ubuntu_kselftests_net.net:udpgro.sh timestamp=1761032521 timeout=2700 localtime=Oct 21 07:42:01 Persistent state client._record_indent now set to 2 Persistent state client.unexpected_reboot now set to ('ubuntu_kselftests_net.net:udpgro.sh', 'ubuntu_kselftests_net.net:udpgro.sh') Waiting for pid 55215 for 2700 seconds System python is too old, crash handling disabled Running 'make run_tests -C net TEST_PROGS=udpgro.sh TEST_GEN_PROGS='' TEST_CUSTOM_PROGS=''' make: Entering directory '/home/ubuntu/autotest/client/tmp/ubuntu_kselftests_net/src/linux/tools/testing/selftests/net' make --no-builtin-rules ARCH=x86 -C ../../../.. headers_install make[1]: Entering directory '/home/ubuntu/autotest/client/tmp/ubuntu_kselftests_net/src/linux' INSTALL ./usr/include make[1]: Leaving directory '/home/ubuntu/autotest/client/tmp/ubuntu_kselftests_net/src/linux' TAP version 13 1..1 # selftests: net: udpgro.sh # ipv4 # no GRO ok # no GRO chk cmsg ok # GRO ./udpgso_bench_rx: recv: bad packet len, got 1472, expected 14720 # # failed # GRO chk cmsg ./udpgso_bench_rx: recv: bad packet len, got 1472, expected 14720 # # failed # GRO with custom segment size ./udpgso_bench_rx: recv: bad packet len, got 500, expected 14720 # # failed # GRO with custom segment size cmsg ./udpgso_bench_rx: recv: bad packet len, got 500, expected 14720 # # failed # bad GRO lookup ok # multiple GRO socks ./udpgso_bench_rx: recv: bad packet len, got 1472, expected 14720 # # ./udpgso_bench_rx: recv: bad packet len, got 1472, expected 14720 # # failed # ipv6 # no GRO ok # no GRO chk cmsg ok # GRO ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 # # failed # GRO chk cmsg ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 # # failed # GRO with custom segment size ./udpgso_bench_rx: recv: bad packet len, got 500, expected 14520 # # failed # GRO with custom segment size cmsg ./udpgso_bench_rx: recv: bad packet len, got 500, expected 14520 # # failed # bad GRO lookup ok # multiple GRO socks ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 # # ./udpgso_bench_rx: recv: bad packet len, got 1452, expected 14520 # # failed not ok 1 selftests: net: udpgro.sh # exit=1 This is not a regression, it's actually failing with the same output with older kernels. We didn't see this failure in previous cycles because the test is giving a false-negative result. With commit "selftests: udpgro: report error when receive failed"[1] from upstream this is now reporting the correct status of the test. [1] https://git.launchpad.net/~ubuntu- kernel/ubuntu/+source/linux/+git/jammy/commit/tools/testing/selftests/net?h=master- next&id=f83d21a592cad5a1171bc8e9e2ed295dc4845d9d SRU Justification: [ Impact ] Running `tools/testing/selftests/net/udpgro.sh` fails on Jammy 5.15 kernels with: GRO ./udpgso_bench_rx: recv: bad packet len, got 1472, expected 14720 In commit 886a0a957ce0 ("net: veth: do not manipulate GRO when using XDP") (upstream commit d7db7775ea2e), veth was changed so that attaching an XDP program no longer automatically enables the GRO feature bit. However, udpgro.sh previously relied on attaching xdp_dummy.o to trigger GRO. Furthermore, upstream commit 7167395a4be7 ("selftests: udpgro: report error when receive failed") landed in Jammy 5.15 in commit f83d21a592ca (via v5.15.190, LP: #2122364), causing udpgro.sh to check the receiver process exit code and actively report the failure that had previously been silently ignored. [ Fix ] Backport upstream commit d7818402b1d8 ("selftests: udpgro: no need to load xdp for gro"). This replaces the XDP dummy program attachment with explicit `ethtool -K veth1 gro on` and removes the dependency on xdp_dummy.o. Context was adjusted due to the absence of commit 6b88ce902f0b ("selftests: net: name bpf objects consistently and simplify Makefile") in 5.15. [ Test Plan ] Build and execute the udpgro test: cd tools/testing/selftests/net make udpgso_bench_tx udpgso_bench_rx sudo ./udpgro.sh All test cases must report "ok" with exit code 0. Verified on a target machine running Jammy 5.15 kernel (5.15.0-191-generic): ipv4 no GRO ok no GRO chk cmsg ok GRO ok GRO chk cmsg ok GRO with custom segment size ok GRO with custom segment size cmsg ok bad GRO lookup ok multiple GRO socks ok ipv6 no GRO ok no GRO chk cmsg ok GRO ok GRO chk cmsg ok GRO with custom segment size ok GRO with custom segment size cmsg ok bad GRO lookup ok multiple GRO socks ok Exit code: 0 [ Where problems could occur ] Changes are strictly isolated to tools/testing/selftests/net/udpgro.sh and do not touch any kernel code or runtime drivers. Risk of regression in production environments is none. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/2129861/+subscriptions