[Bug 2169603] Re: Jammy update: v5.15.222 upstream stable release

This bug was fixed in the package linux - 5.15.0-202.212 --------------- linux (5.15.0-202.212) jammy; urgency=medium * jammy/linux: 5.15.0-202.212 -proposed tracker (LP: #2170970) * Jammy update: v5.15.222 upstream stable release (LP: #2169603) - bus: fsl-mc: wait for the MC firmware to complete its boot - ALSA: usb-audio: Propagate write errors in generic mixer put callbacks - ima: return error early if file xattr cannot be changed - tee: optee: Allow MT_NORMAL_TAGGED shared memory - PCI: Stop setting cached power state to 'unknown' on unbind - hfsplus: fix issue of direct writes beyond end-of-file - wifi: mac80211: always allow transmitting null-data on TXQs - kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() - bridge: Do not suppress ARP probes and DAD NS unconditionally - soundwire: validate DT compatible before parsing it - media: rc: mceusb: Add support for 04eb:e033 - s390/cio: Purge based on the cdev's online status - thunderbolt: Keep the domain reference while processing hotplug - net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family - net: dsa: mv88e6xxx: define .pot_clear() for 6321 - net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family - media: em28xx-video: fix missing res_free() on init_usb_xfer failure - clk: renesas: cpg-mssr: Add number of clock cells check - ASoC: ti: omap3pandora: update board check to use DT compatible - mmc: core: Add validation for host-provided max_segs - drm/amd/display: Fix CRC open failure during active rendering - hfsplus: rework hfsplus_readdir() logic - drm/gud: Add RCade Display Adapter VID/PID pair - integrity: Check for NULL returned by asymmetric_key_public_key - scsi: pm8001: Reject firmware update in fatal error state - scsi: pm8001: Reject non-fatal dump when controller is crashed - crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y - crypto: atmel-ecc - add support for atecc608b - media: imon: Add iMON VFD HID OEM v1.2 key mappings - RDMA/mlx5: Use QP port when decoding responder CQEs - mailbox: Make mbox_send_message() return error code when tx fails - ALSA: usx2y: Drain pending US-428 pipe-4 output commands - 9p: invalidate readdir buffer on seek - arm64/daifflags: Make local_daif_*() helpers __always_inline - firmware: arm_scmi: Validate SENSOR_UPDATE payload size - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size - bitfield: wire __bf_shf to __builtin_ctzll - net: usb: qmi_wwan: add MeiG SRM813Q - net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() - net/sched: sch_drr: make cl->quantum lockless - befs: handle set_blocksize failures - minix: handle set_blocksize failures - isofs: handle set_blocksize failures - usb: host: add ARCH_AIROHA in XHCI MTK dependency - char/nvram: Remove redundant nvram_mutex - netlabel: fix IPv6 unlabeled address add error handling - rds: annotate data-race around rs_seen_congestion - s390/zcore: Removed unused variables - clk: socfpga: agilex: implement l3_main_free_clk - drm/panel: simple: Add AM-1280800W8TZQW-T00H - mips: cps: Assemble jr.hb with an R2 ISA level - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind - irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed - ALSA: usb-audio: Add quirk for Novation Mininova - drm/amd/pm/si: Fix updating clock limits from power states - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() - hfs: rework hfsplus_readdir() logic - host1x: bus: Fix missing ops null check in error teardown - scripts: modpost: detect and report truncated buf_printf() output - ASoC: Intel: catpt: Complete coredump handling - soundwire: only handle alert events when the peripheral is attached - mmc: davinci: fix mmc_add_host order in probe - mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC - mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC - iio: accel: mma8452: switch to non-devm request_threaded_irq() - libbpf: Also reset {insn,data}_cur on realloc failure - net: ibm: emac: Reserve VLAN header in MJS limit - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive - ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach - iommu/rockchip: disable fetch dte time limit - ASoC: codecs: rk3328: Use managed GPIO and clock helpers - ALSA: seq: oss: Reject reads that cannot fit the next event - dpaa2-switch: fix the error path in dpaa2_switch_rx() - clk: keystone: don't cache clock rate - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP - ipmi: si: Use platform_get_irq_optional() to retrieve interrupt - wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications - RDMA/mlx5: Fix state and counter desync on loopback enable failure - net: cpsw_new: unregister devlink on port registration failure - xprtrdma: Add request-pool slack for delayed recycling - configfs_depend_prep(): pass configfs_dirent instead of dentry - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table - wifi: mt76: transform aspm_conf for pci_disable_link_state - btrfs: protect sb_write_pointer() with invalidate lock - hwmon: (adt7462) Add of_match_table to support devicetree - ata: libata-pmp: add JMicron JMS562 quirk - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table - sctp: Unwind address notifier registration on failure - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems - dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure - sparc64: uprobes: add missing break - ptp: ocp: add shutdown callback - vsock: use sk_acceptq_is_full() helper in all transports - e1000e: limit endianness conversion to boundary words - net/sched: act_csum: don't mangle UDP tunnel GSO packets - i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA - sparc: Disable compat support with LLD - fuse: set ff->flock only on success - scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() - gpio: pisosr: Read "ngpios" as u32 - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 - leds: uleds: Return -EFAULT on copy_to_user() failure - leds: pca9532: Don't stop blinking for non-zero brightness - mfd: rsmu: Add 8a34002 support - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 - md/raid5: account discard IO - md/raid5: let stripe batch bm_seq comparison wrap-safe - rtc: aspeed: add AST2700 compatible - ksmbd: use connection ClientGUID for lease lookup - ksmbd: treat unnamed DATA stream as base file - ksmbd: apply create security descriptor first - ksmbd: break RH leases before delete-on-close - PCI/sysfs: Use kstrtobool() to parse the ROM attribute input - rtc: bq32000: add delay between RTC reads - fbdev: pm2fb: unwind WC setup on probe failure - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend - netfilter: nf_conntrack_expect: zero at allocation time - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers - ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr - xen/front-pgdir-shbuf: free grant reference head on errors - freevxfs: don't BUG() on unknown typed-extent type - xen/gntalloc: validate grant count before allocation - ksmbd: fix credit charge calculation for SMB2 QUERY_INFO - wifi: ralink: RT2X00: init EEPROM properly - wifi: mac80211: validate deauth frame length before reason access - wifi: libertas: reject short monitor TX frames - ksmbd: find bound sessions during reauthentication - ksmbd: mark invalid session responses as signed - ksmbd: validate SID namespace before mapping IDs - gpio: dwapb: Mask interrupts at hardware initialization - netfilter: ipset: mark the rcu locked areas properly - btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() - wifi: iwlwifi: mvm: fix sched scan IE sizing - arm64: fixmap: Allow 256K early_ioremap() at any offset - arm64: kprobes: Allow reentering kprobes while single-stepping - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless - wifi: mwifiex: replace one-element arrays with flexible array members - regulator: core: clamp voltage constraints before applying apply_uV - wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO - drm/gma500: return errors from Oaktrail HDMI I2C reads - phonet: check register_netdevice_notifier() error in phonet_device_init() - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx - ice: pass the return value of skb_checksum_help() - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) - ASoC: rt5645: Perform the initial jack detect at probe - clk: at91: pmc: #undef field_{get,prep}() before definition - Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" - Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" - ARM: 9484/1: enable interrupts when unhandled user faults are triggered - EDAC/igen6: Fix interleave boundary condition - EDAC/igen6: Fix channel selection hash - EDAC/igen6: Fix channel address decode for non-hash mode - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() - selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter - net/sched: act_api: budget all shared attributes in notify skbs - net/sched: act_api: size the RTM_GETACTION reply from the actions - smb: client: transport: Fix debug printing in __release_mid() - net: amd-xgbe: discard rx packets with bad FCS - OPP: of: Fix potential multiplication overflow when calculating freq - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() - ASoC: ab8500: Reset the audio block before configuring it - ASoC: ab8500: Repair the DAPM capture graph - ASoC: ab8500: Update to modern clocking terminology - ASoC: ab8500: Correct digital interface format setup - ASoC: ab8500: Validate and program TDM slots correctly - tty: make tty_ldisc_ops::hangup return void - ppp: ppp_async: simplify tty disc_data access - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits - btrfs: consolidate device_list_mutex in prepare_sprout to its parent - scsi: mpt3sas: Use irq_set_affinity_and_hint() - perf/core: Skip empty AUX records with only format flags - locking/lockdep: Introduce lock_sync() - locking/lockdep: Improve the deadlock scenario print for sync and read lock - lockdep: Add lock_set_cmp_fn() annotation - locking/lockdep: Invalidate stale class_cache entries for zapped classes - ASoC: ux500: Fix MSP stream lifecycle handling - ASoC: ux500: remove platform_data support - ASoC: ux500: Propagate MSP setup errors - ASoC: ux500: Correct MSP frame and bit clock setup - ASoC: ux500: Validate MSP DAI configuration - ASoC: ux500: remove stedma40 references - ASoC: ux500: Request the MSP MMIO resource - ASoC: ux500: Program the MSP FIFO watermarks - net/rds: use clear_bit_unlock() in release_refill() - net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown - net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset - bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() - net/mlx5e: Fix setting RS FEC after remapping - net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% - net_sched: sch_fq_pie: implement lockless fq_pie_dump() - net/sched: pie: clamp psched_mtu in pie_drop_early - ASoC: bcm: bcm63xx: Publish the OF module aliases - ASoC: Intel: SST: Publish the PCI module aliases - netfilter: ip6_tables: set F_PROTO when proto value is nonzero - ASoC: mt6351: Publish the OF module alias - virtio-console: call scheduler when we free unused buffs - vdpa_sim_blk: use dev_dbg() to print errors - vdpa_sim_blk: make vdpasim_blk_check_range usable by other requests - virtio-pci: return IRQ_HANDLED after non-zero ISR - net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward - net: ethernet: cortina: Finish RX updates before NAPI completion - net: ethernet: cortina: No mapping is a dropped rx - net: ethernet: cortina: Count RX drops once per frame - net: ethernet: cortina: Count RX descriptors for freeq refill - watchdog: fix hrtimer start when pretimeout is zero - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors - net: stmmac: optimize locking around PTP clock reads - net: sun4i-emac: fix missing of_node_put() for phy_node - octeontx2-af: fix PF/CGX debugfs PCI bus lookup - net/rds: Pass a pointer to virt_to_page() - scsi: target: iscsi: Handle abort for WRITE_PENDING cmds - Revert "scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches." - Revert "scsi: smartpqi: Fix BUILD_BUG_ON() statements" - Revert "scsi: core: Register sysfs attributes earlier" - Revert "scsi: smartpqi: Capture controller reason codes" - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough - dm/amdgpu: fix malformed link_settings debugfs output - watchdog: sunxi_wdt: preserve boot-enabled watchdog - tunnels: Drop stale dst when building an ICMP error for PMTUD - exec: do_close_on_exec() before taking exec_update_lock - net: hso: fix TIOCMIWAIT race - netfilter: report NLM_F_DUMP_FILTERED when all is filtered out - KVM: PPC: Book3S HV: Set irqfd->producer only on success - s390/qeth: allow bridgeport queries despite OS_MISMATCH - hwmon: (applesmc) fix key backlight workqueue leak on register failure - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS - media: hevc: add bounded tile-count helpers - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison - mptcp: options: handle MPC data + csum reqd + no csum - Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems" - [Config] remove CRYPTO_DEV_SUN8I_CE_PRNG - [Config] remove CRYPTO_DEV_SUN8I_SS_PRNG - netfilter: nft_set_pipapo_avx2: add missing vzeroupper - ARM: fix hash_name() fault - ARM: fix branch predictor hardening - ARM: ensure interrupts are enabled in __do_user_fault() - Bluetooth: L2CAP: Fix deadlock - Revert "alpha: don't leak hardware-fabricated FP exception bits to user space" - Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally" - selftests/landlock: Add tests for whiteout object creation - sunvdc: fix -EIO issue due to lack of retries - Revert "perf cs-etm: Avoid truncating AUX buffer sizes to int" - Revert "perf cs-etm: Flush thread stacks after decoder reset" - media: video-i2c: fix buffer queue ordering - ipv6: Select best matching nexthop object in fib6_table_lookup() - ipv6: Honor oif when choosing nexthop for locally generated traffic - xfrm: propagate extack to all netlink doit handlers - xfrm: add extack to verify_sec_ctx_len - xfrm: add extack support to verify_newsa_info - xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead - xfrm: avoid RCU warnings around the per-netns netlink socket - xfrm: fix compat ALLOCSPI request use-after-free - xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() - ARM: socfpga: select the PL310 erratum 753970 workaround - RDMA/siw: Introduce siw_cep_set_free_and_put - RDMA/siw: Cleanup siw_accept - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate - IB/iser: Align coding style across driver - IB/iser: Remove iser_reg_data_sg helper function - IB/iser: Use iser_fr_desc as registration context - IB/iser: reject a remote invalidation of an unregistered direction - scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd - IB/isert: wait for deferred control PDU completions before releasing the connection - RDMA/mad: Fix receive buffer leak when PKey enforcement fails - RDMA/irdma: Enforce local fence for IB_WR_REG_MR - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted - dmaengine: sprd: Fix runtime PM reference leak in probe - wifi: virt_wifi: free skb when disconnected - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path - wifi: libipw: reject too-short beacon and probe responses - wifi: libipw: reject too-short association responses - IB/IPoIB: Avoid restoring OPER_UP after multicast flush - wifi: cfg80211: check IP header size in cfg80211_classify8021d() - soundwire: cadence_master: wait and cancel cdns->work before clock stop - MIPS: Octeon: apply USB FDT fixups also when USB is modular - dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask - dma-coherent: report a failed reserved memory assignment - dmaengine: Fix device kref underflow in dma_chan_put() - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() - dmaengine: wait for RCU readers before releasing dma_device - wifi: cfg80211: only group hidden BSSes with beacon entries - wifi: cfg80211: don't filter by BSS type when removing stale entries - wifi: mac80211: suppress chanctx warning for debugfs reset - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set - wifi: mac80211: don't access the TSF of a down interface - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA - RDMA/siw: Bound fragmented header copies by the remaining length - netfilter: nft_nat: fully initialise new_addr in netmap setup - netfilter: flowtable: hold reference on ct until flow is released - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr - keys: fix lost wakeup when reaping a dead key type - ALSA: pcm: set timer->private_data before registering the PCM timer - Input: trackpoint - fix the inertia attribute name in the ABI document - wifi: virt_wifi: don't transfer operstate before register - ALSA: hda: trace PCM open only after assigning a stream - btrfs: tree-checker: print dev extent offset in error message - drm/msm/dsi: correct byte intf clock rate for 14nm DSI PHY - drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation - net: fddi: skfp: fix NULL deref when setting the MAC address while down - wifi: brcmfmac: fix lost 802.1x TX completion wakeup - tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). - tcp: do not let tcp_rmem be set below 4096 - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup - pppoatm: ensure a writable skb header and linear data - drop_monitor: synchronize tracepoint unregistration on error path - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() - KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure - powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments - ASoC: hdmi-codec: Report a change when the channel status moves - net: netsec: fix device_node reference leak on phy_np - net: lock the socket in sock_gettstamp() - net: ethernet: cortina: Ack RX overrun interrupt correctly - net: mvpp2: prevent buffer overflow in page_pool allocation - Input: eeti_ts - publish the OF module alias - Input: xpad - add support for Victrix Pro BFG Controller - Input: xpad - add support for Azeron devices - Input: xpad - fix PDP Marvel Xbox 360 controller - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY - rds: ib: use rds_conn_drop() on protocol version mismatch - tcp: exclude old ACKs from tcp fast path - RDMA/ucma: Serialize join and leave on copy_to_user failure - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() - openvswitch: avoid reallocating confirmed conntrack labels - net: xfrm: reject unrepresentable espintcp transport headers - kselftest/arm64: Fix size of thread_data values for pthread_join() - arm64: percpu: Fix this_cpu_write() casting - arm64: percpu: Fix this_cpu_and() mask generation - Bluetooth: btusb: fix NXP IW610 composite device handling - dmaengine: sun6i: fix non-atomic read of DMA position registers - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() - ipv6: xfrm: use full sockets in local error paths - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value - net/sched: hhf: cap hh_flows_limit at change time - net/packet: clear RX owner on VNET header error - net/packet: avoid truncating TPACKET_V3 private size - keys: translate request_key_auth pid for the reading procfs instance - KEYS: trusted: Fix tpm2_load_cmd() boundary check - i2c: at91: release DMA channels on remove and probe error - i2c: imx: release DMA channels on probe error - IB/mlx4: Fix use-after-free on pkey sysfs registration failure - selinux: always fill AVC decision in avc_has_perm_noaudit() - mmc: core: Fix OF node reference leak on card add failure - mmc: mxcmmc: cancel data work and watchdog on remove - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources - mmc: sdio_uart: fix xmit_fifo leak when the port table is full - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt - mmc: spi: reset bytes_xfered before retrying CRC failures - mmc: sdhci_am654: Reset command and data lines on failed tuning - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 - Input: evdev - zero absinfo before partial copy in EVIOCSABS - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() - Input: soc_button_array - fix MS Surface Pro 11 probe failure - Input: soc_button_array - check btns_desc->package.count - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound - Input: zero ff_effect before compat copy in input_ff_effect_from_user - hwmon: (pmbus/core) increase number of phases and add new mask - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove - hwmon: (w83793) release probe data through kref - watchdog: digicolor: Avoid division by zero - watchdog: msc313e: Fix premature reset during timeout update - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() - wifi: brcmsmac: fix UAF in brcms_free_timer() - wifi: iwlegacy: fix broadcast stations deallocation - wifi: libertas_tf: fix UAF in lbtf_free_adapter() - wifi: rsi: fix heap OOB write on key removal - wifi: wlcore: release runtime PM ref on regdomain config failure - wifi: wilc1000: fix out-of-bounds read in P2P public action frames - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() - wifi: p54: validate curve data length in the calibration curve converters - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length - wifi: mwifiex: validate scan response extents - wifi: mwifiex: validate action frame fixed fields - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver - drm/gud: fix out-of-bounds write in gud_plane_atomic_check() - drm/msm/adreno: fix autosuspend cleanup during teardown - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure - HID: logitech-hidpp: fix race condition when accessing stale stack pointer - spi: spi-zynqmp-gqspi: stop the controller on shutdown - spi: zynqmp-gqspi: Use devm_spi_alloc_host() - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - HID: hyperv: streamline driver probe to avoid devres issues - bpf: Fix bpf_skb_change_tail wrt csum partial skbs - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL - bpf: support access variable length array of integer type - bpf: Fix divide-by-zero in btf_struct_walk() - HID: elecom: fix bus type for M-XGL20DLBK - bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() - bpf: Fix out-of-bounds read of rtt_min in sock_ops - HID: amd_sfh: Move common macros and structures - HID: amd_sfh: Validate PCI BAR size before mapping - squashfs: Add dictionary size range check to prevent shift-out-of-bounds - Bluetooth: SMP: reject Security Request over BR/EDR - Documentation: s390: correct spelling - docs: s390/pci: Improve and update PCI documentation - s390/pci/docs: Fix sriov_numvfs attribute name - s390/cio: Fix cio_update_schib() to not cache invalid schib - s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points - xsk: Use a 32-bit compare in xsk_map_gen_lookup - libbpf: Fix an error in 64bit relocation value computation - bpf: Restrict CO-RE poisoning to relocatable instructions - netfilter: flowtable: allow unidirectional rules - netfilter: flowtable: publish HW_DEAD after worker is done - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier - netfilter: nft_synproxy: use the family-aware checksum helper - ipvs: revalidate ihl before icmp_send - ocfs2: make ocfs2_calc_xattr_init() return void - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure - net: gue: reject invalid REMCSUM offsets - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). - sctp: avoid livelock while updating retransmit path - net: usb: catc: bound the RX packet length in catc_rx_done() - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget - drm/virtio: fix object leak when drm_gem_handle_create() fails - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() - net: usb: sr9700: include receive overhead in the length check - tg3: clean up PHYLIB resources on probe failure - s390/debug: Do not register views for failed static debug areas - s390/debug: Fix NULL pointer dereference in debug_info_copy() - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error - bpf: Fix bpf_sock context code generation - bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc - sctp: hold asoc or transport before mod_timer() in timer handlers - net: stmmac: selftests: Support running selftests on DSA conduits - net: stmmac: selftests: Check the dev->features for S-TAG offload testing - net: stmmac: selftests: Capture all packets for vlan checks - net: stmmac: Remove some unnecessary void pointers - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K - nfc: nfcmrvl: validate helper command length before pull - nfc: st21nfca: remove redundant assignment to variable i - nfc: st21nfca: validate received frame size - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() - selftests: nci: Correct pthread_create return value check - nfc: llcp: Fix race condition in accept_queue lifecycle - selftests: nci: Fix uninitialized family ID on missing attribute - selftests/nci: Fix out-of-bounds store on thread join - nfc: virtual_ncidev: Add missing ioctl compat handler - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure - nfc: st21nfca: validate ISO15693 inventory length - nfc: llcp: fix -ENOMEM on connect with zero-length service name - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() - nfc: llcp: fix slab-out-of-bounds reads when logging service names - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() - veth: manage XDP program pointers during channel resize - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() - vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets - net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr - ip_gre: Reject enabling collect metadata through changelink - net: xps: reject an out of range traffic class - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() - net/smc: fix UAF on lgr list traversal in smcr_port_err() - tipc: Fix a data race on mon->peer_cnt in mon_timeout() - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure - bridge: check llc_mac_hdr_init() return value in br_send_bpdu() - net/sched: sch_teql: fix shadowed err in __teql_resolve() - vlan: ensure sufficient headroom in vlan_dev_hard_header() - autofs: fix sbi->pipe file reference leak in autofs_kill_sb() - rculist: add list_splice_rcu() for private lists - KVM: x86/mmu: Use a bool for direct - KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() - KVM: MMU: update comment on the number of page role combinations - KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct - KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes - KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction - KVM: x86/mmu: Derive shadow MMU page role from parent - KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes - SAUCE: Revert "KVM: x86: Fix shadow paging use-after-free due to unexpected role" - KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() - KVM: x86: Fix shadow paging use-after-free due to unexpected role - x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow - sctp: discard the rest of the packet on a stale-cookie error - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT - workqueue: Fix NULL current_pwq deref in flush dependency check - writeback: report a Tasks-RCU quiescent state per cgwb drain pass - fsl/fman: Fix clk reference leak in read_dts_node() - ipv6: do not let ipv6_find_hdr() return an offset past the packet end - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() - gpio: zynq: fix runtime PM leak on request error path - llc: reserve device headroom for allocated frames - rds: ib: Clear the sg list when mapping an MR fails - drm/nouveau: fix autosuspend cleanup during teardown - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() - drm/nouveau: fix double-free in nvif_vmm_dtor - drm/nouveau: Fix gem reference leak in validate_init() - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() - HID: alps: fix use-after-free on input2 registration failure - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() - net/sched: reject IDR error pointers when deleting actions - net: arp: terminate device name before lookup - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read - net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry - net: atl1c: fix soft lockup on out-of-range tpd_cons read - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist - netfilter: ip6t_rpfilter: reject routes without inet6_dev - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read - nfc: fix use-after-free in nfc_get_local_general_bytes - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() - nfc: port100: reject frames whose declared length exceeds the received data - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU - pinctrl: single: free the IRQ on domain creation failure - s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() - Bluetooth: hci_sock: validate event length before filtering - Bluetooth: hci_sock: reject out-of-range OCF values - Bluetooth: L2CAP: validate frame length before control and FCS access - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO - xfs: fix blockgc group quota scanning when usrquota isn't enforced - net: tls: fix silent data drop under pipe back-pressure - file: add fput() cleanup helper - eventpoll: use hlist_is_singular_node() in __ep_remove() - eventpoll: split __ep_remove() - eventpoll: kill __ep_remove() - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: move epi_fget() up - perf test: Change all remaining #!/bin/sh to #!/bin/bash - tools/thermal/tmon: Fix compilation warning for wrong format - lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected - lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected - Linux 5.15.222 * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2025-68190 - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-46242 - eventpoll: fix ep_remove struct eventpoll / struct file UAF * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2025-38349 - eventpoll: don't decrement ep refcount while still holding the ep mutex * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2025-37964 -- to the 6.1, 6.6 and 6.12 trees ended up with two - x86/mm: Fix check/use ordering in switch_mm_irqs_off() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-80726 - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-46113 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-52988 - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2023-53231 - erofs: Fix detection of atomic context * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2023-53707 - drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2024-49568 - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-89560 - landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2024-41062 - bluetooth/l2cap: sync sock recv cb and release * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2022-50406 - iomap: iomap: fix memory corruption when recording errors during writeback * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97523 - mptcp: close race between scheduler and state change * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97524 - mptcp: avoid unneeded actions on subflow reset * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-80833 - crypto: sun8i-ss - Remove crypto_rng interface * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-80834 - crypto: sun8i-ce - Remove crypto_rng interface * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-74496 - fou: Fix use-after-free in fou_create() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93286 - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93287 - i2c: smbus: reject oversized block transfers in the common path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97568 - mptcp: syncookies: remember the request backup flag * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97572 - bnxt_en: Propagate RX ring init failures in bnxt_init_nic() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97573 - bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97576 - media: v4l2-ctrls: validate HEVC tile counts * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97582 - hwmon: (gpio-fan) Fix use-after-free in alarm work * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97592 - s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97596 - ipvs: reject invalid states in connection template sync records * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97598 - ipv4: fib: bound automatic table ID allocation * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97601 - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97604 - fbdev: vfb: defer cleanup until the last reference * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97608 - netfilter: nf_log: unregister loggers before per-net teardown * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97611 - net: openvswitch: fix use-after-free of the flow table mask array * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97612 - net: mpls: clear inner_protocol when the last label is popped * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97899 - drm/i915: Fix memory leak in query_perf_config_list() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97904 - cpufreq: initialize policy rwsem before sysfs publication * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97905 - cpufreq: zero-initialize policy cpumask before sysfs publication * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97909 - ASoC: sti: initialize IRQ lock before requesting IRQ * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97910 - ASoC: sprd: validate compress buffer sizes against fixed allocations * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97923 - tracing: Free histogram the var ref when its initialization fails * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97926 - ufs: validate cylinder group metadata before caching it * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97927 - ufs: create the root dentry after loading cylinder metadata * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97930 - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97940 - ipv6: fix fib6 walker UAF on seq stop * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97948 - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-74743 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-89792 - ksmbd: prevent out-of-bounds reads in share config responses * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97951 - scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-68236 - drm/amd/display: set new_stream to NULL after release * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97952 - sunvdc: unmap LDC cookies when the descriptor send fails * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97954 - net/rds: fix tcp stream corruption with large pages * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97957 - net: hinic: fix mailbox segment buffer overflow * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97958 - net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97959 - net/sched: cls_route: free emptied bucket on filter move * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97963 - net: stmmac: initialize ptp_lock at probe time * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97964 - ppp_synctty: ensure a writeable skb header * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97969 - watchdog: msc313e: Fix clock leak and spurious timer in settimeout() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97970 - watchdog: msc313e: Avoid division by zero * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97981 - net: ethernet: cortina: Count dropped frames as NAPI work * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97982 - net: ethernet: cortina: Fix budget accounting * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97991 - vdpa_sim_blk: reject out-of-range sector starts * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97993 - vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97995 - virtio_console: do not free control-out buffers on remove * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97998 - netfilter: nfnetlink_log: cope with concurrent instance destruction * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98006 - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98009 - net/sched: ets: clamp quantum in parse and fallback paths * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98010 - net/sched: drr: clamp quantum in change class * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98011 - net/sched: hhf: clamp quantum in change and init paths * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98012 - net/sched: sfq: clamp quantum in change path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98013 - net/sched: fq_pie: clamp quantum in change path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98014 - net/mlx5: E-Switch, prevent mc_list repopulation during vport disable * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98015 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98016 - net/mlx5e: Fix use-after-free race in sample_restore_put() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98022 - net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98023 - vxlan: reject dynamic fdb entries that reference a nexthop id * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98025 - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98027 - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98030 - net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98031 - nexthop: Initialize extack in remove_nh_grp_entry() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98063 - bpf: Fix NULL-ptr-deref in btf_var_show() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98064 - bpf: Fix NULL-ptr-deref when showing a void BTF type * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98066 - ALSA: caiaq: Fix potential double-free at error path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98068 - net/rds: don't let rds_conn_shutdown() consume a concurrent drop * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98069 - net/rds: acquire the fastpath locks in rds_conn_shutdown() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98070 - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98071 - net/rds: clear cp_flags bits individually in rds_conn_path_reset() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98072 - net/rds: use wq_has_sleeper() in release_in_xmit() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98074 - bonding: do not clear curr_active_slave prematurely when releasing all slaves * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98075 - bpf: reject BPF_PSEUDO_FUNC reference to the main program * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98076 - tracing/probes: Fix use-after-free on field name/type of events with multiple probes * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98077 - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98078 - ipvs: fix reversed sequence option serialization * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98080 - btrfs: do not force reloc root creation during qgroup_account_snapshot() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98088 - scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98090 - btrfs: restore active device pointers after failed sprout * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98091 - btrfs: detach failed sprout device from transaction update list * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98094 - staging: fbtft: make dirty_lock IRQ-safe * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98095 - af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98096 - ipv6: sr: restore network header before routing and forwarding * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98098 - tipc: fix NULL deref in tipc_named_node_up() on empty publication list * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98108 - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98113 - ksmbd: rate limit unmapped SID errors * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98116 - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98121 - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98123 - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98130 - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98154 - nvme-rdma: fix -EIO cleanup order in queue_rq * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98157 - EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-89796 - mm/damon/core: avoid infinite kdamond_merge_regions() internal loop * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-98158 - ppp_async: drop the errored frame instead of resetting its headroom * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93288 - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93782 - vhost-scsi: flush backend after device ioctls * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93783 - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93784 - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93785 - cifs: validate idmap key payload length * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93789 - wifi: iwlwifi: bound aligned TLV advance in FW parser * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93795 - blk-cgroup: fix leaks and online flag on radix_tree_insert failure * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93797 - wifi: iwlwifi: mvm: fix an off-by-1 boundary check * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93798 - btrfs: fix reloc root cleanup in merge_reloc_roots() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93800 - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93802 - wifi: rsi: validate beacon length before fixed buffer copy * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93803 - wifi: libipw: fix key index receive bound checks * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93805 - wifi: cfg80211: validate rx/tx MLME callback frame lengths before access * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93807 - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93808 - ALSA: usb-audio: caiaq: validate EP1 reply lengths * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93811 - ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93812 - ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93813 - btrfs: tree-checker: validate INODE_REF's namelen * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93815 - net: au1000: move free_irq out of the close-time spinlocked section * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93816 - f2fs: validate inline dentry name lengths before conversion * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93819 - PCI: mediatek: Protect root bus removal with rescan lock * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93820 - PCI: rockchip: Protect root bus removal with rescan lock * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93821 - PCI: altera: Protect root bus removal with rescan lock * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93822 - PCI: iproc: Protect root bus removal with rescan lock * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93825 - spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-93830 - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97407 - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97408 - Bluetooth: L2CAP: validate connectionless PSM length * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97411 - net: ibm: emac: mal: fix potential system hang in mal_remove() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97413 - RDMA/rtrs-srv: Fix integer underflow in process_read and process_write * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97416 - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97417 - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97418 - ALSA: es18xx: check control allocation before private data setup * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97419 - hsr: broadcast netlink notifications in the device's net namespace * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97420 - bpf: NUL-terminate replaced sysctl value * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97421 - RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97430 - xhci: Prevent queuing new commands if xhci is inaccessible * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97434 - dpaa2-switch: fix handling of NAPI on the remove path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97435 - net: dsa: sja1105: flower: reject cross-chip redirect * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97436 - dpaa2-switch: rework FDB management on the bridge leave path * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97437 - ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97438 - fs/ntfs3: validate index entry key bounds * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97439 - fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97440 - net: qrtr: fix node refcount leak on ctrl packet alloc failure * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97441 - ata: ahci: fail probe if BAR too small for claimed ports * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97443 - perf/ftrace: Fix WARNING in __unregister_ftrace_function * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97444 - ACPICA: add boundary checks in two places * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97445 - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97446 - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97448 - ACPICA: Add validation for node in acpi_ns_build_normalized_path() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97449 - ACPICA: Add package limit checks in parser functions * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97450 - ACPICA: validate handler object type in two places * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97451 - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97452 - ACPICA: Prevent adding invalid references * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97453 - ACPICA: validate byte_count in acpi_ps_get_next_package_length() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97454 - ACPICA: add boundary checks in acpi_ps_get_next_field() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97455 - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97456 - ACPICA: Fix condition check in acpi_ps_parse_loop() * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97472 - ipv6: addrconf: fix temp address generation after prefix deprecation * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97475 - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97476 - rds: filter RDS_INFO_* getsockopt by caller's netns * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97481 - serial: 8250: fix possible ISR soft lockup * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97482 - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97483 - usb: core: hcd: fix possible deadlock in rh control transfers * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97484 - usbip: vhci_hcd: fix NULL deref in status_show_vhci * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97485 - omfs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97486 - hpfs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97487 - jfs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97488 - qnx4: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97489 - bfs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97490 - affs: handle set_blocksize failures * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97491 - net/rds: Don't sleep inside rds_ib_conn_path_shutdown * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97492 - wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97502 - mmc: davinci: avoid NULL deref of host->data in IRQ handler * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97506 - crypto: ixp4xx - fix buffer chain unwind on allocation failure * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97507 - media: dm1105: fix missing error check for dma_alloc_coherent * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97508 - thunderbolt: Set tb->root_switch to NULL when domain is stopped * Jammy update: v5.15.222 upstream stable release (LP: #2169603) // CVE-2026-97510 - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) - alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally - alpha: don't leak hardware-fabricated FP exception bits to user space - include/linux/list.h: mark list_add and __list_add as __always_inline - tools/compiler: match glibc 2.42 definition of __attribute_const__ - x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() - powerpc/powermac: fix OF node refcount - staging: greybus: hid: fix SET_REPORT return value - usb: dwc2: gadget: Exit partial power down state when changing USB pull- up - USB: phy: fsl-usb: fix missing static keywords - usb: gadget: snps_udc_plat: clean up PHY on probe deferral - NFSD: Encode only the status in NFS-ACL v2 GETACL error replies - NFSD: Fix off-by-one in DRC bucket pruning limit - nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types - nfsd: add filehandle match check to nfsd4_delegreturn() - nfsd: fix version mismatch loops in nfsd_acl_init_request() - nfsd: reject reclaim LOCK after RECLAIM_COMPLETE - eCryptfs: bound the packet-length peek to the user buffer - ecryptfs: fix tag 11 packet exact-fit size check - ecryptfs: show filename encryption options - fat: restore original value when fat_ent_write failed - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration - alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() - alpha: marvel: Fix irq_set_status_flags to use correct IRQ number - alpha: marvel: Fix lock ordering in init_io7_irqs() - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU - cpufreq: schedutil: Fix rate limit overflow - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection - Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative - SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat - staging: media: tegra-video: vi: fix probe failure on skipped last port - rpmsg: glink: smem: order FIFO read after availability check - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata - ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item - ocfs2: cluster: fix o2hb_dependent_users leak on pin failure - hwmon: (max6621) fix negative temperature offset and crit readings - hwmon: (max6621) fix temperature clamp range - nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path - sctp: distinguish sequence zero from wildcard in reconf lookup - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk - PCI: meson: Fix GPIO state while requesting PERST# - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses - iommu/vt-d: Fix no_iommu to disable platform opt-in - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition - net: openvswitch: fix nf_connlabels leak in ovs_ct_init - NTB: ntb_transport: Recycle TX entries before client callbacks - net: ntb_netdev: Avoid double-accounting netif_rx() drops - net: ntb_netdev: Count packets dropped on RX refill failure - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip - arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() - dm-switch: use WRITE_ONCE() in switch_region_table_write() - wifi: rtl818x: initialize eeprom_93cx6 struct to zero - taskstats: fix cpumask parsing cutting off the last character - timer: Keep debugobjects state consistent in migrate_timer_list() - udf: Fix i_lenExtents truncation on 32-bit kernels - platform/chrome: sensorhub: Fix dropped timestamp events and log spam - net: openvswitch: fix kernel-doc warnings in internal headers - selinux: avoid implicit conversions in services code - ALSA: seq: Fix port lock leak in deliver_to_subscribers() - net: ntb_netdev: Fix TX busy and drop handling - tracing/mmiotrace: Remove reference to unused per CPU data pointer - clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() - thermal/drivers/imx: Disable clock on runtime resume failure - thermal/drivers/qoriq: Disable clock on resume failure - dmaengine: dw-edma: Complete descriptors before pausing - block: flag zoned disks with GENHD_FL_NO_PART - ata: ahci: work around lost interrupts on Marvell 88SE61xx - Input: aiptek - validate raw macro indices before updating state - Input: aiptek - switch to using dev_groups for driver-specific attributes - Revert "irqchip/mbigen: Fix mbigen node address layout" - parisc: Fix alignment of asm statements in head.S - batman-adv: bla: prevent CRC corruptions after claim flush - clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src - clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src - clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk - clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure - AsoC: intel: sst: fix PCI device reference leak on probe failure - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get - iio: gyro: mpu3050: fix sign of raw angular velocity readings - iio: light: cm32181: return zero after writing calibscale - iio: light: gp2ap002: Disable regulators on resume failure - iio: srf04: fix pm_runtime handling on probe error path - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() - KVM: s390: Zero initialize irq in reinject_machine_check - KVM: s390: Restore sigset on error path - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash - media: v4l2-ctrls: Allow unknown HDR10 white point and luminance - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() - media: venus: fix payload size calculation in parse_raw_formats() - media: vimc: fix pixel format lookup in enum_framesizes - scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters - scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() - scsi: qla2xxx: Drop vport reference under lock in report ID acquisition - scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics - f2fs: return symlink writeback errors - f2fs: reject overlapping move range after len expansion - f2fs: return writeback error from collapse range - f2fs: fix i_size when pinned fallocate partially fails - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() - drm/hibmc: Fix list of formats on the primary plane - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT - drm/nouveau: Use write-combined maps for coherent - mm/damon/core-kunit: check region count before testing in split_at() - mm/damon/vaddr: drop last same folio access check optimization - mm/damon/vaddr-kunit: check region count in three_regions test - mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() - firmware: stratix10-svc: Add mutex in stratix10 memory management - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure - Smack: fix W=1 build warnings - smack: simplify write handlers of sysfs entries - smack: deduplicate smackfs/{direct,mapped} file_operations - smack: restrict smackfs/{direct,mapped} values to 0-255 - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() - media: cec-pin: Fix event FIFO ordering - clk: moxart: remove unused variables, fix refcount leak - clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller - ARM: imx: fix device_node refcount leak in imx_src_init() - ARM: imx: fix device_node refcount leaks in imx7_src_init() - clk: imx: scu: drop redundant init.ops variable assignment - perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define - perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning - perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test - perf test bpf-counters: Add test for BPF event modifier - perf test stat_bpf_counter.sh: Stabilize the test results - perf test: Use sqrtloop workload to test bperf event - perf test: Fix perf stat --bpf-counters on hybrid machines - perf tests: Fix flakiness in BPF counters test on hybrid systems - bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls - bpftool: Use libbpf_get_error() to check error - bpftool: Fix pretty print dump for maps without BTF loaded - tools/bpf/bpftool: Reset vmlinux BTF after map commands - bpftool: remove duplicate free_btf_vmlinux() definition - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure - selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check - crypto: atmel-ecc - replace min_t with min - crypto: atmel-ecc - clean up and improve ECDH comments - crypto: sa2ul - Use the defined variable to clean code - nvmet-rdma: avoid circular locking dependency on install_queue() - nvmet-rdma: use sbitmap to replace rsp free list - nvmet-rdma: factor out response resource cleanup - bus: ti-sysc: Fix /chosen node reference leak - PM: sleep: Fix off-by-one in wakelocks number limit check - staging: greybus: audio: correct sscanf() return value check - staging: sm750fb: gate dualview dataflow using g_dualview - staging: fbtft: Use sysfs_emit_at() to print to sysfs file - netdev: reshuffle netif_napi_add() APIs to allow dropping weight - staging: switch to netif_napi_add_weight() - staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown - staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions - staging: octeon: replace pr_warn with dev_warn in fill and rx paths - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() - selftests/bpf: Fix memory leak in msg_alloc_iov error path - selftests/bpf: Fix memory leak in msg_alloc_iov - irqchip/gic-v3-its: Fix memleak in its_probe_one() - selftests: timers: leap-a-day: Fix -w option and update usage comment - clocksource: Unregister subsystem on device registration failure - y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 - timekeeping: Account for monotonicity adjustment in ntp_error - clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status - clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains - clk: qcom: gdsc: enable optional power domain support - clk: qcom: gdsc: Release pm subdomains in reverse add order - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code - efi: fix stale reference to efi_recover_from_page_fault() - iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX - iommu/msm: Return -ENOMEM on memory allocation failure in probe - iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors - iommu/amd: Add support for Hygon family 18h model 4h IOAPIC - iommu/amd: Fix false positive in SB IOAPIC IVRS validation - leds: pca9532: Fix inverted GPIO output polarity - hwspinlock: propagate errno when registering single lock - usb: mtu3: allow system suspend during active gadget connection - usb: renesas_usbhs: Fix power-off ordering on unbind - drm/panel: samsung-s6d16d0: Power off on prepare failure - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE - RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage - RDMA/mlx4: Avoid flush_scheduled_work() usage - RDMA/mlx: Calling qp event handler in workqueue context - hwrng: ks-sa - access private data via struct hwrng - hwrng: ks-sa - Fix runtime PM cleanup on registration failure - ALSA: hpi: Check transport errors during HPI6000 adapter initialization - pmdomain: bcm: bcm2835: handle genpd provider registration errors - misc: rtsx_usb: avoid USB I/O in runtime autosuspend - RDMA/hfi1: Remove redundant PCI device ID validation - RDMA/hfi1: Create workqueues before device initialization - RDMA/hfi1: Stop flushing the global IB workqueue - RDMA/hfi1: Initialize debugfs after probe completes - fs/isofs: replace kmap() with kmap_local_page() - rpmsg: glink: Remove the rpmsg dev in close_ack - rpmsg: glink: remove duplicate code for rpmsg device remove - libnvdimm/labels: Bound the on-media label size before the shift - cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() - irqdomain: Introduce irq_domain_free() - irqdomain: Introduce irq_domain_instantiate() - irqdomain: Handle additional domain flags in irq_domain_instantiate() - genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips() - cpufreq: intel_pstate: Fix setting minimum P-state at init time - cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev - arm64: dts: qcom: sm8250: Use QMP property to control load state - arm64: dts: qcom: sm8250: remove mmcx regulator - arm64: dts: qcom: sm8250: Add camcc DT node - gpu: host1x: Fix offset calculation in trace_write_gather - crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping - ACPI: move from strlcpy() with unused retval to strscpy() - ACPI: processor: idle: Expand _LPI package sanity checks - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() - misc: rtsx: add missing write register handling - misc: ad525x_dpot: Make ad_dpot_remove() return void - ppdev: prevent overflow when setting port timeout - char: xilinx_hwicap: unregister class on init errors - perf ui hists: Fix uninitialized stack memory free on pstack allocation failure - driver core: soc: remove layering violation for the soc_bus - driver core: soc: Unregister bus on early device registration failure - dmaengine: dw-edma: Clear stale requests on termination - arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters - RDMA/srpt: Pass the mapped task attribute to target_init_cmd() - RDMA/nldev: Split nldev_stat_set_mode_doit out of nldev_stat_set_doit - RDMA/restrack: Fix typos in the comments - RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() - iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe - iommu/qcom: Remove sysfs device on probe failure path - iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() - thermal: int340x_thermal: Consolidate priv->data_vault checks - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request - ath11k: add trace log support - ARM: dts: allwinner: a10: Fix PMU interrupt - perf cs-etm: Flush thread stacks after decoder reset - perf cs-etm: Avoid truncating AUX buffer sizes to int - leds: pca9532: Fix phantom device registration on missing hardware - drm/tve200: add OF module alias for autoloading - netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet - arm64: dts: rockchip: Add gru-scarlet-dumo board - arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru - arm64: dts: rockchip: Fix Gru WLAN sideband interrupt - ARM: lpc32xx: only run SoC init on LPC32xx hardware - power: supply: sbs-battery: Use a per-device serial number buffer - crypto: keembay - publish OF module alias for OCS AES/SM4 - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() - remoteproc: Use unbounded workqueue for recovery work - remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() - staging: rtl8723bs: use kfree_sensitive() for key material - arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix - clk: tegra: tegra124-emc: put EMC node on register failure - clk: palmas: Manage external-control prepare with devm - clk/x86: pmc_atom: add kasprintf return value check - scsi: core: Register sysfs attributes earlier - scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. - RDMA/mlx5: Send cong param changes to the resolved port mdev - bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET - selftests/zram: fix kernel_gte() for POSIX sh - power: supply: sc2731_charger: Convert to platform remove callback returning void - clk: qcom: Return expected ENOMEM error on dynamic allocation failure - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() - fanotify: report full event length for FIONREAD - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields - perf: arm_spe: Make wakeup range check overflow safe - perf machine: Guard against NULL strlist in machines__findnew() - perf machine: Use snprintf() for guestmount path construction - perf machine: Check snprintf truncation in machines__findnew() - perf machine: Don't abort guest map creation on first inaccessible dir - perf machine: Reset errno before strtol in guest kernel map creation - perf machine: Free scandir entries in guest kernel map creation - perf machine: Check snprintf truncation for guest kallsyms path - iommu/arm-smmu-v3: Convert to use atomic poll timeout - wifi: mac80211: send TWT teardown to peer after setup TX failure - wifi: zd1211rw: reject secondary interfaces to prevent conflicts - wifi: mac80211: skip unused probe response countdown offsets - firmware: google: Add bounds checks in coreboot_table_populate() - powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL - serial: amba-pl011: unprepare console clock on unregister - HID: split apart hid_device_probe to make logic more apparent - HID: ensure timely release of driver-allocated resources - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails - HID: lg4ff: validate report length before fixed offsets - perf thread-stack: Fix heap buffer overflow on branch stack wrap copy - perf auxtrace: Fix queue grow overflow and old array leak - perf intel-pt: Fix off-by-one in auxtrace_info minimum size check - perf intel-bts: Fix off-by-one in auxtrace_info minimum size check - iio: light: tsl2772: fix ALS calibscale readback - iio: light: isl29028: return zero in write_raw() on success - iio: light: tsl2583: return zero in write_raw() on success - block/blk-stat: drain per-cpu callback stats over possible CPUs - block/blk-iocost: collect per-cpu latency stats over possible CPUs - block/kyber-iosched: flush per-cpu latency buckets over possible CPUs - lib/string: fix memchr_inv() for large ranges - pps: don't try to wait for negative timeouts in PPS_FETCH - pps: clients: gpio: Bypass edge's direction check when not needed - pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler - pps-gpio: remove dead capture_clear code - PCI/sysfs: Add static PCI resource attribute macros - remoteproc: Move resource table data structure to its own header - remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() - scripts/tags.sh: improve compiled sources generation - scripts/tags.sh: Prevent binary files appearing in cscope.files - ocfs2: use bitmap API in fill_node_map - drm/sun4i: vi scaler: Fix coefficient selection - of: property: add missing kerneldoc for of_graph_get_endpoint_count() - of: property: use unsigned int return on of_graph_get_endpoint_count() - bitfield: Add less-checking __FIELD_{GET,PREP}() - bitfield: Add non-constant field_{prep,get}() helpers - drm/sun4i: tcon: Drop remote endpoint reference - drm/sun4i: dw-hdmi: Drop TCON TOP port reference - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz - RDMA/siw: Introduce siw_free_cm_id - mfd: rave-sp: validate received frame payload lengths - mfd: iqs62x: Reject zero-length firmware records - drm/amdgpu/gfx6: Fixup emit_cntxcntl() - ext4: fix spurious message about orphan cleanup on RO fs - phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table - perf trace-event: Fix buffer overflow in read_string() - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets - firmware_loader: Check fw_state_is_done in loading_store - pinctrl: rockchip: Reset the pin count when recalculating SoC data - soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() - coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() - coresight: etm4x: Cleanup TRCIDR2 register accesses - coresight: etm4x: Cleanup TRCIDR3 register accesses - coresight: etm4x: Cleanup TRCIDR4 register accesses - coresight: etm4x: Cleanup TRCIDR5 register accesses - coresight: Change syncfreq to be a u8 - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling - sched/fair: Check CPU capacity before comparing group types during load balance - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() - perf trace-event: Fix integer truncation in do_read() and skip() - scsi: sd: Fix sd_done() sense handling condition - iio: light: gp2ap002: re-enable irq if runtime suspend fails - flow_offload: rename offload functions with offload instead of flow - arm64: dts: turris-mox: fix usb3 phys - ARM: dts: helios4: add vcc-supply to EEPROM - ARM: dts: helios4: add vcc-supply to GPIO expander - ARM: dts: helios4: add SATA regulator supplies - perf stat: Clear screen only if output file is a tty - perf stat: Fix evsel_list leak in cmd_stat - perf synthetic-events: Fix uninitialized pthread_join - perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads - iommu/vt-d: Fix UCTP context table slot when copying root entries - m68k: Fix backtraces for non-running tasks - powerpc/configs: enable CONFIG_RAS to fix EDAC support - spi: sprd-adi: Fix probe succeeding without registering the controller - nfc: digital: Do not dump a NULL response in command completion - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal - ASoC: pxa: Use devm_clk_get_optional() for extclk clock - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready - ubi: Fix repeated words in comments - ubi: fastmap: Use the bitmap API to allocate bitmaps - ubi: fastmap: Fix missed ec updating after erasing old fastmap data block - ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash - ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap - ubi: Replace erase_block() with sync_erase() - UBI: Preserve torture flag when rescheduling failed erasures - UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs - ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl - ubi: fastmap: Add fastmap control support for module parameter - ubi: Simplify bool conversion - ubi: fastmap: Wait until there are enough free PEBs before filling pools - ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs - ubi: fastmap: Add module parameter to control reserving filling pool PEBs - UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC - selfetests/bpf: Update vmtest.sh defaults - selfetests/bpf: Adapt vmtest.sh to s390 libbpf CI changes - bpf/docs: Update list of architectures supported. - selftests/bpf: Fix vmtest.sh getopts optstring - selftests/bpf: Limit URLS parsing logic to actual scope in vmtest - selftests/bpf: Support local rootfs image for vmtest - selftests/bpf: Add description for running vmtest on RV64 - selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM - spi: img-spfi: don't disable runtime PM on DMA deferred probe - power: supply: bd99954: Drop bad register fields - power: supply: bq27xxx: bq27520g4: fix REG_TTES address - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address - xenbus: Unregister reboot notifier on init failure - clocksource/drivers/clps711x: Do not unmap clocksource MMIO - clocksource/drivers/armada: Unwind timer clock on init failure - x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported - bpftool: Fix double close in map dump - tracing: Remove "__attribute__()" from the type field of event format - tracing: Have trace_event_update_all() only handle module that is loading - bpf: Fix pending_pos walk on 32-bit ring position wrap - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() - perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() - mailbox: rockchip: disable pclk on probe failure and unbind - hwmon: (emc1403) Add support for EMC1442 - smb/server: preserve error status in smb2_handle_negotiate() - nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper - nfs: refactor pNFS functions using clear_and_wake_up_bit - pppox: drain queued packets on channel handoff - hsr: Use a single struct for self_node. - net: hsr: Use full string description when opening HSR network device - net: bridge: vlan: fix inverted default vlan notification - ALSA: hda: Fix connection list comparison in proc output - 8139cp: fix Rx and Tx not being disabled in cp_suspend - platform/x86: dell-wmi-sysman: Fix instance ID bounds - vsock: use sock_error() to consume sk_err after a failed connect - bonding: initialize err for empty target lists - i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes - i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 - i3c: mipi-i3c-hci: Quieten initialization messages - i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() - i3c: mipi-i3c-hci: Refactor PIO register initialization - i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode - virtio_balloon: disable indirect descriptors - prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator - ALSA: control: Use automatic cleanup of kfree() - RDMA/ucma: Allow path records to exactly fit the output buffer - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes - forcedeth: stop the tx_timeout register dump past the requested window - net: ipa: report when the driver has been removed - net: ipa: Convert to platform remove callback returning void - net: ipa: balance runtime PM reference on remove error - nfs: move the nfs4_data_server_cache into struct nfs_net - scsi: qla2xxx: Fix an loop timeout test - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX - octeontx2-af: Fix TL3/TL2 link config ENA clearing - cifs: fix clearing stats for fastest execution of each smb2 command - net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() - net_sched: sch_fq: struct sched_data reorg - net_sched: sch_fq: change how @inactive is tracked - net_sched: export pfifo_fast prio2band[] - net/sched: sch_codel: clamp default mtu to avoid disabling CoDel - tpm: st33zp24: Validate locality read result - apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init - net: ethernet: sun4i-emac: Fix IRQ error handling - net: stmmac: selftests: Pass the IP proto mask in the TC selftest - netfilter: xt_cgroup: Make it independent from net_cls - netfilter: xt_HL: add pr_fmt and checkentry validation - netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() - selftests: arm64: add hugetlb mte tests - selftests/arm64: Print missing MTE TAP headers - selftests/arm64: Treat KSM merge_across_nodes as optional - net: stmmac: selftests: Check multiple MMC counters - net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering - net: stmmac: dwmac4: Account for the primary MAC address for UC filtering - net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering - net: stmmac: selftests: Account for the UC filter list for filtering tests - nvme: target: rdma: fix ndev refcount leak on queue connect - clk: qcom: Drop mmcx gdsc supply for dispcc and videocc - RDMA/nldev: Check stat attribute before accessing it - HID: fix an error code in hid_check_device_match() - ALSA: control: Fix unannotated kfree() cleanup - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings - kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c - nvmet-rdma: fix queue leak when connect backlog is exceeded - clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled - Linux 5.15.221 - SAUCE: Revert "bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls" * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90053 - net/sched: sch_htb: limit htb_classify inner-class filter hops * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90054 - tcp: fix corruption of urgent data on multi-segment retransmit * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90056 - net: fec: only stop PTP if it was initialized * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90062 - netfilter: nf_tables: move hardware offload step after building the chain blob * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90063 - virtio-net: Ensure that TCP packets don't overflow gso_segs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90067 - libceph: validate banner payload length * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90068 - ASoC: dapm: Fix off-by-one check on the second enum channel * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93245 - apparmor: policy_int make sure list heads are initialized before fail path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90071 - net/sched: sch_teql: restore skb->dev on the slave failure path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90072 - net/sched: sfq: clamp quantum to avoid signed overflow soft lockup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90074 - net/sched: fq_pie: clamp default quantum to avoid signed overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90075 - net/sched: fq_codel: clamp default quantum and mtu * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90078 - net/sched: act_skbmod: fix length calculations and avoid invalid header warnings * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90081 - net/rds: use wq_has_sleeper() in rds_cong_map_updated() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89780 - net: qualcomm: rmnet: restore skb->dev on deaggregated frames * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89789 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use- after-free * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90102 - NFSv4/pnfs: key the data server cache on the NFS version * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90107 - net/smc: free pending qentry in smc_llc_flow_stop() before memset * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90114 - net: bridge: Reject descending VLAN tunnel ranges * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90126 - rtc: pcf8563: fix clock provider leak on unbind * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90128 - vdpa/mlx5: fix wrong list iterated in add_direct_chain error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89779 - fs/ntfs3: validate ef->size covers the record's name and value * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89781 - fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90140 - cuse: wait for pending RCU callbacks on module exit * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90143 - net: kcm: Hold RCU read lock while running BPF parser * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90151 - NFSv4: remove callback IDR entry on client allocation failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90157 - bpf: Reject negative optlen in cgroup getsockopt hook * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90160 - lwt_bpf: Restore reserved headroom after xmit program * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90198 - ALSA: core: Fix use-after-free in snd_card_do_free() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90202 - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90203 - Squashfs: check block offset is not negative * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93252 - ocfs2: fix circular locking dependency in ocfs2_init_acl() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90209 - s390/debug: Fix deadlock during unregister * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90214 - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90218 - RDMA/cma: Fix WARNING in res_to_rt * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90219 - RDMA/cxgb4: Free debugfs on registration failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90221 - nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90222 - nfc: pn533: hold a reference to the request skb during send_frame * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90224 - nfc: nci: fix double completion race in nci_data_exchange_complete * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90228 - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89784 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90248 - net/sched: cls_api: fix teardown of an adopted proto on insert-race loss * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90249 - iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90251 - Bluetooth: MSFT: validate evt_prefix_len against the response length * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90257 - Bluetooth: virtio_bt: avoid OOB read of build info string * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90274 - coresight: etm4x: fix underflow for usage of (nrseqstate - 1) * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90281 - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90284 - firmware_loader: do not queue completed sysfs fallback requests * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90285 - scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90286 - drm/amdgpu/gfx6: Use PFP on the compute queues too * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90290 - arm64: hibernate: Restore DAIF state on error * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93256 - arm64: hibernate: mask DAIF before restoring hibernated kernel * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90292 - RDMA/siw: Fix use-after-free in siw_accept() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90293 - IB/isert: post the full-feature receive buffers after session registration * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90294 - IB/isert: delay the final Login Response until the session is registered * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90295 - cpufreq: imx6q: fix out-of-bounds write when probed more than once * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90296 - cpufreq: imx6q: fix devres accumulation across driver rebind * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90297 - drm/sun4i: crtc: Propagate layer initialization error * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90298 - drm/sun4i: tcon: Drop TCON TOP device reference * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90302 - ocfs2: synchronize heartbeat callbacks with o2net teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90303 - ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90314 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90316 - drm/omap: dsi: Do not copy isr table * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90318 - fat: release buffer head after rebuilding parent * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90319 - rapidio: clear mport->net when rio_add_net() fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90329 - HID: synchronize input before cleaning up a failed probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90341 - firmware: coreboot: Validate table bounds * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90348 - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90360 - regulator: core: use system_freezable_wq for init complete work * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90361 - wifi: ath11k: fix leak in ath11k_service_ready_ext_event() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90362 - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90372 - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90378 - wifi: mt76: mt792x: Fix memory leak in SDIO TX path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90382 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93261 - locking/lockdep: Fix NULL pointer dereference in __lock_set_class() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93283 - i3c: master: Fix device_register() error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90386 - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90388 - iommu/dma: Check atomic pool allocation result directly * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90391 - lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90393 - bpf: Fix potential UAF in bpf_netns_link_update_prog * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90394 - power: supply: sc2731_charger: cancel work on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93262 - md/raid5-ppl: fix use-after-free in ppl_do_flush() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90403 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90411 - nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90413 - IB/isert: reject login PDUs declaring more data than was received * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90416 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90420 - nilfs2: fix infinite loop in nilfs_clean_segments() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93264 - RDMA/efa: Fix PBL chunk length computation * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89782 - fs/ntfs3: reject restart table growth beyond U16_MAX entries * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90431 - remoteproc: Prevent crash handling to race with rproc_del() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90434 - isofs: release zisofs block pointer buffer head * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90435 - RDMA/mlx5: Fix integer overflow of user QP buffer size * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92476 - crypto: keembay - Initialize completion before requesting IRQ * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89785 - fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89787 - ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92494 - ext4: fix buffer_head leak in ext4_init_orphan_info * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92496 - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92501 - ext4: drain in-flight DIO before buffered write fallback * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92504 - thermal: intel: int3400: clean up ODVP on probe failures * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92508 - RDMA/core: Fix potential use after free in ib_free_cq() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93268 - ext4: skip extra isize expansion during mount to prevent deadlock * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89786 - ext4: fix out-of-bounds read in ext4_read_inline_dir() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-92524 - irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93037 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93039 - ASoC: meson: Keep link pointers valid on realloc failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93040 - dmaengine: dw-edma: Serialize channel state checks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93041 - dmaengine: dw-edma: Serialize abort state updates * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93046 - software node: Fix software_node_get_reference_args() with index -1 * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93049 - mtd: mtdswap: Avoid freeing registered blktrans device twice * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89777 - vfio/pci: clear vdev->msi_perm after freeing it on init failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93051 - misc: ad525x_dpot: use driver core groups for sysfs files * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93052 - misc: bcm-vk: Use acquire/release for msgq_inited * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93054 - uio: Fix stale info pointer in failed registration path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93055 - UDF symlink pathComponent header OOB read * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93056 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93061 - gpu: host1x: Avoid stack over-read in debug output helpers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93067 - drm/bridge: tc358767: clamp the reported AUX read size to the request * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93271 - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93095 - hfsplus: validate thread record before delete key rebuild * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93098 - rpmsg: glink: fix deadlock in endpoint destroy during driver detach * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89778 - isofs: fix out-of-bounds page array access on empty zisofs block * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93102 - RDMA/hfi1: Free RX data on late probe failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93103 - RDMA/hfi1: Preserve unit 0 on allocation failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89783 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93109 - RDMA/mlx5: Drain RCU callbacks during module teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93110 - RDMA/core: Wait for RCU callbacks before unloading ib_core * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93114 - platform/surface: acpi-notify: Check ACPI companion before use * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93115 - platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93120 - usb: gadget: configfs: fix out-of-bounds read of qw_sign * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93130 - platform/x86: dell-wmi-base: Fix resource leak on module load failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93131 - platform/x86: dell-privacy: Fix race condition * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93138 - bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93140 - udf: Mark LVID buffer as uptodate before marking it dirty * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93145 - clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93278 - staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93279 - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93280 - greybus: audio: bound the topology section sizes against the fetched size * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93151 - nvmet-rdma: fix response resource leak on queue teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93158 - crypto: sa2ul - stop probe if context pool creation fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93159 - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93160 - crypto: atmel-ecc - reject hardware ECDH without a public key * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93161 - crypto: qat - clear AES key schedule from stack * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93165 - platform/chrome: sensorhub: Fix memory overread in ring handler * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93167 - csky: Fix a4/a5 restoration in syscall trace path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93170 - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93177 - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93178 - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93274 - pinctrl: bcm2835: Don't remove an unregistered GPIO chip * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93183 - drm/lima: call drm_mm_init() with a valid allocation range * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93185 - ASoC: rt700-sdw: always drain jack work on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93188 - HID: roccat: bound device-supplied profile index * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93191 - smack: fix incorrect task context in smack_msg_queue_msgrcv * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-40123 - bpf: Enforce expected_attach_type for tailcall compatibility * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89947 - clk: meson: align gxbb_32k_clk_sel number of parents with actual count * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80671 - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93203 - batman-adv: bla: avoid CRC corruption due to parallel claim add * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93204 - batman-adv: dat: atomically update mac addresses * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-52944 - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-22039 - ksmbd: fix overflow in dacloffset bounds check * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-21651 - net: hns3: don't auto enable misc vector * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-53078 - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-43088 - net: af_key: zero aligned sockaddr tail in PF_KEY exports * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-31420 - bridge: mrp: reject zero test interval to avoid OOM panic * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-22103 - net: fix NULL pointer dereference in l3mdev_l3_rcv * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-21649 - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2023-52676 - bpf: Guard stack limits against 32bit overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2024-50017 - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-74268 - tcp: clear sock_ops cb flags before force-closing a child socket * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90015 - xhci: fix lost bounce buffers on TDs spanning several ring segments * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89816 - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93234 - drm/gud: validate TV mode names before creating enum property * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89817 - drm/gud: NUL-terminate TV mode names read from the device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89821 - drm/amd/display: avoid divide-by-zero in __is_lut_linear() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89823 - drm: fix race between partial drm_dev_register() failure and ioctl * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89847 - scsi: qla2xxx: Avoid double completion in async IOCB timeout * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93242 - scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89849 - scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89850 - scsi: qla2xxx: Don't query firmware state while chip is down * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89851 - scsi: qla2xxx: Fix FCE trace enable parsing in debugfs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89853 - scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89855 - scsi: qla2xxx: Serialize flash version read in reset handler * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89856 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89861 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89863 - scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89871 - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89872 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89876 - media: tda18250: fix possible integer overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89879 - media: s2255: bound JPEG frame size before copying into the buffer * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89880 - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89881 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89883 - media: rc: sunxi-cir: Unregister rc device on probe failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93236 - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89887 - media: i2c: ov7740: fix use-after-destroy in remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89888 - media: i2c: ov02a10: fix endpoint parsing use-after-free * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89891 - media: em28xx: fix use-after-free of dev_next->devlist on disconnect * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89892 - media: em28xx: defer audio-only extension registration * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89894 - media: cx231xx: reject geometry changes while the VBI queue is busy * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89896 - media: cedrus: fix memory leak in cedrus_init_ctrls() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89897 - media: cec: Serialize exclusive follower delivery * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89901 - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89923 - KVM: s390: Free guest debug data on vcpu destroy * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89924 - KVM: s390: Fix old_data leak in guest debug error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89925 - KVM: s390: Fix memory leak in guest debug handling * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89926 - KVM: s390: Fix length check __import_wp_info() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89927 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89930 - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89932 - KVM: nVMX: Always flush vpid02 on first use * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89937 - iio: chemical: sgp30: Handle IAQ thread creation failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89939 - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89945 - ASoC: cs35l34: drain threaded IRQ before runtime suspend * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89946 - ASoC: cs35l33: drain threaded IRQ before runtime suspend * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89954 - mtd: afs: validate v2 image info bounds * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89964 - parisc: eisa: Fix infinite loop when parsing invalid IRQ value * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89968 - nvmet-tcp: reject unsolicited H2CData PDUs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89969 - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89973 - nvme-tcp: check the data direction of a C2HData PDU * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89979 - ALSA: pcm: Fix race between non-atomic ops and trigger-start * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89980 - ALSA: harmony: initialize locks before requesting IRQ * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89983 - i2c: core: fix debugfs UAF on adapter removal * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89984 - perf/x86/intel: Fix kernel address leakages in LBR stack * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89989 - ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89993 - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89997 - dm: fix resume-vs-remove race * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89999 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90007 - scsi: pm8001: Use rollback index when freeing MSI-X vectors * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90017 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90018 - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90025 - usb: typec: ucsi: displayport: Fix OOB altmode array index * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2025-38097 - espintcp: remove encap socket caching to avoid reference leak * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89515 - scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80689 - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80888 - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80912 - selinux: reject an unclaimed class value in security_get_classes() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89595 - fsnotify: Fix stale object mask after concurrent mark updates * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89603 - entry: Fix seccomp bypass after ptrace with TSYNC * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-74378 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89488 - openvswitch: Fix CT limit teardown use-after-free * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80977 - net: skbuff: don't touch shared zerocopy state in skb_tx_error() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80928 - smack: fix cred UAF in smack_file_send_sigiotask() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93222 - signal: avoid shared siginfo namespace rewrites * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80930 - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80931 - w1: ds28e17: reject an oversize length on an I2C block read * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80932 - vsock/virtio: flush works in dependency order * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80938 - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80941 - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80944 - wifi: mwifiex: Detach sync cmd buffer on interrupted wait * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80949 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80951 - i3c: master: svc: bound IBI payload to the requested max_payload_len * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80952 - i3c: master: Fix info leak and UAF in device unregister path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80963 - dm-stats: fix a crash if allocation of per-cpu data fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80964 - ALSA: virmidi: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80965 - ALSA: serial-u16550: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80966 - ALSA: portman2x4: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80967 - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80968 - ALSA: mts64: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80969 - ALSA: mpu401: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80971 - ALSA: bcd2000: clear the URB pointers on disconnect * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80972 - ALSA: aloop: Check card index validity at probe * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80973 - ALSA: 6fire: bound the MIDI event length from the device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80976 - seg6: reset IP6CB after IPv6 decapsulation * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80978 - net: cap advertised IP tunnel headroom * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80983 - net/smc: fix socket refcount leak in smc_switch_conns() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80987 - NTB: ntb_transport: Reject oversized TX buffers * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80988 - NTB: ntb_transport: Fail TX enqueue when the QP link is down * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-80994 - net: openvswitch: fix flow mask use-after-free on flow deletion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81000 - net: tun: bound receive headroom * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81001 - slip: fix use-after-free in sl_sync() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81002 - xdp: fix zero-copy frame layout * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81003 - net/iucv: filter frames in afiucv_hs_rcv() by ingress device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81005 - ipmi: si: Fix NULL pointer dereference after failed registration * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81007 - ipmi: ipmb: validate write message length * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81008 - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-81017 - platform/chrome: sensorhub: Bound the EC-reported sensor number * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89440 - mmc: via-sdmmc: stop card-detect handling on probe failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89444 - platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93206 - PCI/proc: Use file_ns_capable() when checking config space read access * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89456 - s390/dasd: Propagate partial completion length across ERP recovery * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89457 - s390/dasd: Guard sysfs discipline callbacks against unallocated private data * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89458 - s390/dasd: Do not complete a failed ESE read as successful * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89461 - power: supply: max17040: synchronize work cancellation on suspend * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89463 - power: supply: ucs1002: fix use-after-free on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89464 - power: supply: twl4030_charger: cancel workers via devm * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89469 - power: supply: lp8727: fix use-after-free in lp8727_release_irq() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89470 - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89471 - power: supply: cros_usbpd-charger: bound the EC-reported port count * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89474 - power: supply: bq256xx: drain usb_work before freeing the charger * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89475 - power: supply: bq24257: fix use-after-free on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89476 - sctp: fix stream->outcnt underflow on duplicate RECONF responses * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89477 - sctp: fix NULL deref on untransmitted RECONF completion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89478 - sctp: drop a chunk if its transport was removed * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89479 - sctp: stop processing a packet once its association is deleted * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89480 - nvme-tcp: reject a read that transferred too few bytes * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89482 - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89483 - nvme: zero the discard fallback page * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89485 - lockd: pin next file across nlm_inspect_file lock-drop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89489 - openrisc: fix arbitrary kernel memory access via or1k_atomic syscall * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89490 - ocfs2: fix readdir position truncation on 32-bit kernels * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89491 - ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89493 - ocfs2: validate rl_used against rl_count in refcount block validator * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89496 - ocfs2: always run deallocs on copy-on-write completion * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89497 - orangefs: skip leading spaces before parsing client debug masks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89498 - orangefs: fix double-free of trailer_buf on readdir copy failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89504 - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89508 - RDMA/ucma: Lock the handler in ucma_set_ib_path() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89510 - RDMA/cxgb4: Cancel reg_work before freeing device on remove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89511 - qede: Fix NULL pointer dereference in TPA fragment processing * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89512 - remoteproc: scp: Fix device reference leak on failed lookup * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89524 - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89525 - udf: reject VAT indexes equal to the entry count * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89532 - svcrdma: Fix pcl_for_each_segment for empty chunks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89533 - svcrdma: Fix offset arithmetic in read_chunk_range * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89538 - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89540 - sunrpc: init gssp_lock before publishing proc entry * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89541 - SUNRPC: harden gss_unwrap_resp_priv length checks * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89542 - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89551 - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89554 - mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89555 - mpls: reload header after pskb_may_pull() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89557 - md: do overflow check for sb->bblog_shift in super_1_load() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89559 - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93226 - ipv6: use RCU iterator to dump route exceptions * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89562 - ip6_gre: fix hardware header length for NBMA tunnels * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89563 - ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89569 - Bluetooth: RFCOMM: serialize security confirmation handling * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89573 - dm array: reject an array block whose value size is not the caller's * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89576 - dm-era: fix shadowed superblock leak on take-snap failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89582 - bnx2x: fix double free in bnx2x_init_firmware() error path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89585 - auxdisplay: charlcd: cancel backlight work on registration failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89586 - ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89594 - hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89596 - forcedeth: fix off-by-one when saving/restoring non-PCI config space * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89597 - fbdev: uvesafb: unregister connector callback on init failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89599 - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89605 - ecryptfs: release message context on send failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89606 - ecryptfs: reject too-small tag 70 packets * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89608 - ecryptfs: pass packet set buffer size to parser * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89609 - ecryptfs: hold msg ctx list lock when cleaning daemon queue * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89615 - fs/ntfs3: bound page_lcns[] index by the log record * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89616 - fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89617 - fs/ntfs3: validate dirty page table on log replay * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89621 - HID: mcp2221: validate report size in mcp2221_raw_event() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89626 - HID: sensor: custom: Fix field sysfs group cleanup on failure * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89627 - HID: roccat: free buffered reports when destroying device * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89628 - HID: picolcd: clamp eeprom debugfs read to bytes actually received * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89643 - audit: avoid dropping live tree ref on fsnotify rule autoremove * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89649 - ceph: bound xattr value length in __build_xattrs() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89650 - ceph: bound num_export_targets array for mds info v2/v3 * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89653 - ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89655 - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89656 - libceph: reject buckets with mismatched CRUSH ids * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89662 - NFSD: Prevent lock owner use-after-free during client teardown * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89663 - nfsd: revoke copy-notify stateids before dropping their reference * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89665 - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89669 - nfsd: initialize copy-notify stateid before publishing it * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89673 - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89674 - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89684 - nfsd: fix cpntf publish race in nfs4_init_cp_state * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89694 - nfsd: check client ownership when cancelling a copy-notify stateid * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89696 - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89697 - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89704 - nfsd: sample writeback error cursor before async COPY loop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89706 - nfsd: Reset write verifier when async COPY writeback fails * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89710 - NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89711 - NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89712 - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89720 - ubifs: fix out-of-bounds read in signature length check * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93213 - of: fix out-of-bounds read in of_alias_scan() stem parser * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89723 - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89724 - media: vicodec: fix out-of-bounds write in FWHT encoder * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89725 - media: cec: stm32: prevent out-of-bounds write on RX overflow * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89726 - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89729 - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89730 - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89732 - usb: gadget: f_fs: Prevent deadlock during ep0 read loop * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93214 - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89736 - usb: gadget: u_audio: Fix use-after-free on sound card disconnect * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89741 - Revert "media: v4l2-dev: fix error handling in __video_register_device()" * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89742 - rapidio: mport_cdev: fix use-after-free in dma_req_free() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89749 - tracing: Fix crash passing ERR_PTR to kthread_stop() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89752 - mm: memcg: stop reclaim when a limit update is superseded * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89753 - mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-89765 - timers/itimer: Zero-init old itimerval before copy to userspace * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-93219 - clocksource/drivers/timer-sun4i: Advertise a real minimum delta * Jammy update: v5.15.221 upstream stable release (LP: #2168726) // CVE-2026-23191 - ALSA: aloop: Fix racy access at PCM trigger * Jammy update: v5.15.220 upstream stable release (LP: #2168586) - io_uring/io-wq: fix worker accounting when canceling creation callbacks - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler - can: j1939: make j1939_sk_bind() fail if device is no longer registered - Revert "PM: sleep: Use complete() in device_pm_sleep_init()" - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). - selinux: switch two allocations to use kzalloc_objs() - ALSA: pcm: fix wait_time calculations - ASoC: tegra: Fix Master Volume Control - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - kcov: replace local_irq_save() with a local_lock_t - ext4: propagate errors from fast commit range replay - nilfs2: correct return value kernel-doc descriptions for ioctl functions - nvme: rename CDR/MORE/DNR to NVME_STATUS_* - HID: ft260: fix i2c probing for hwmon devices - HID: ft260: improve i2c write performance - HID: ft260: improve i2c large reads performance - HID: ft260: skip unexpected HID input reports - HID: ft260: wake up device from power saving mode - HID: ft260: missed NACK from busy device - HID: ft260: validate i2c input report length - HID: input: read battery capacity from its actual report offset - fpga: dfl: fme: add error handling - accessibility: speakup: unregister tty ldisc on later init failures - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure - usb: usbtest: disable dynamic ID support - mm/swap: reject swapon() on filesystem-level encrypted files - crypto: atmel-tdes - use scatterlist length before DMA mapping - crypto: qce - Remove unsafe/deprecated algorithms - usb: core: Strengthen error handling in hub_hub_status() - USB: serial: spcp8x5: drop broken carrier detect support - Linux 5.15.220 * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80824 - usb: usbfs: fix use-after-free of usb_device in usbdev_release() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80826 - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80827 - USB: serial: option: fix slab OOB read in interrupt URB callback * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80828 - ALSA: usb-audio: Complete cleanup after system-resume errors * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80829 - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80830 - usb: core: Add lock to usb_wakeup_notification() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80921 - KVM: s390: vsie: zero stale crypto bits * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80831 - crypto: mxs-dcp - fix source scatterlist length access * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80832 - crypto: qce - fix CCM AAD buffer underallocation * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80840 - ipv6: seg6: clear IPv4 control block on IPIP decapsulation * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80842 - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80843 - xfrm: fix xfrm_state_construct() auth-trunc leak * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80844 - xfrm: ah6: validate routing header segments_left * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80846 - xfrm: drop ESP-in-TCP packets with no ingress device * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80848 - xfrm: espintcp: fix UAF during close * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80854 - usb: gadget: f_tcm: keep port count until LUN teardown completes * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80855 - fuse: fix invalidate lock leak on open O_TRUNC DAX failure * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80856 - fuse: fix invalidate lock leak on setattr writeback failure * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80923 - xhci: dbgtty: Fix unregister on tty_register_driver() failure * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80768 - HID: ft260: fix stack-use-after-return write in I2C read race * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80766 - HID: uclogic: fix use-after-free of inrange_timer on remove * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80789 - nvmet-tcp: bound SGL data length before allocating command buffers * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80783 - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80796 - nfc: nci: add data_len bound checks to activation parameter extractors * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80807 - nilfs2: reject invalid block index in GC ioctl * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80916 - kcov: fix data corruption and race conditions on PREEMPT_RT * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-72323 - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-43437 - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-53089 - bpf: Fix use-after-free in offloaded map/prog info fill * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2025-40102 - KVM: arm64: Prevent access to vCPU events before init * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2025-39925 - can: j1939: implement NETDEV_UNREGISTER notification handler * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2024-58095 - jfs: add check read-only before txBeginAnon() call * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2024-58094 - jfs: add check read-only before truncation in jfs_truncate_nolock() * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2024-46754 - bpf: Remove tst_run from lwt_seg6local_prog_ops. * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-68476 - ipvs: reload ip header after head reallocation * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80806 - ext4: don't enable DAX on new encrypted files * Jammy update: v5.15.220 upstream stable release (LP: #2168586) // CVE-2026-80863 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() * Jammy update: v5.15.219 upstream stable release (LP: #2168549) - Linux 5.15.219 * Jammy update: v5.15.219 upstream stable release (LP: #2168549) // CVE-2026-80590 - inet: frags: strip GSO state from fragments before reassembly * Jammy update: v5.15.218 upstream stable release (LP: #2168525) - null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows - ext4: clear error before retrying inode xattr space fallback - misc: fastrpc: separate fastrpc device from channel context - misc: fastrpc: Rework fastrpc_req_munmap - perf/core: Fix child_total_time_enabled accounting bug at task exit - perf: Fix cgroup state vs ERROR - perf: Fix dangling cgroup pointer in cpuctx - nfc: nci: free destination parameters when closing a connection - drm/amdgpu: check ASPM on the dGPU host link - KVM: x86/mmu: Retry page fault if root is invalidated by memslot update - KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs - KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() - KVM: Rename mmu_notifier_* to mmu_invalidate_* - KVM: x86/mmu: Split out TDP MMU page fault handling - KVM: x86/mmu: Rename __direct_map() to direct_map() - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - KVM: x86: Retry page fault if MMU reload is pending and root has no sp - Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard - Input: atkbd - skip deactivate for HONOR ZQC-P - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: fix data race in add_addr timer callback - can: use skb hash instead of private variable in headroom - Revert "ALSA: aoa: Use guard() for mutex locks" - Linux 5.15.218 * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80765 - HID: hyperv: validate initial device info bounds * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80767 - HID: sensor: custom: Fix use-after-free in enable_sensor * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80918 - HID: core: fix number/pointer type confusion on long items * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80889 - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-46170 - mptcp: pm: ADD_ADDR rtx: free sk if last * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-46158 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80555 - s390/vfio_ccw: Free all memory if cp_init() fails * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2025-68794 - iomap: adjust read range correctly for non-block-aligned positions * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-64581 - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80781 - HID: core: fix OOB read of field->usage in hid_set_field() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80782 - HID: magicmouse: do not keep a stale msc->input if no input is claimed * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-64561 - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80583 - ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80587 - mptcp: avoid combining some incoming suboptions * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80547 - s390/vfio_ccw: Implement a crw lock * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80548 - s390/vfio_ccw: Selectively expand io_mutex * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80552 - s390/vfio_ccw: Ensure index for read/write regions are within range * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80788 - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80790 - nvmet-fc: fix invalid free in LS IOD error path * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80792 - ipv6: fix use-after-free in ip6_finish_output2() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80793 - ipv4: reject undersized MTUs in ip_do_fragment() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80557 - libceph: fix OOB read in decode_watchers() via missing bounds check * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80794 - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80795 - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80823 - nfc: st21nfca: validate ATR_REQ length against the received frame * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80797 - nfc: pn533: purge fragmented skbs during cleanup * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80798 - nfc: llcp: reject PDUs shorter than the LLCP header * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80799 - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80800 - nfc: llcp: bound the connect_sn TLV walk to the skb * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80801 - nfc: microread: validate target discovery payload lengths * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80802 - nfc: fdp: bound the device-reported read length and fix an skb leak * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80803 - nfc: digital: clamp SENSF_RES length to the destination buffer * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80536 - xfs: bounds-check buffer log item's dirty bitmap * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80553 - s390/vfio_ccw: Cancel existing workqueues * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74662 - inet: frags: publish queues before arming timer * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74666 - packet: synchronize pressure clearing with ring reconfiguration * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74663 - net/sched: reject overly deep qdisc hierarchies * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74668 - packet: use consistent hard_header_len in TX_RING send path * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74582 - packet: use consistent hard_header_len in non-ring send paths * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80737 - serial: amba-pl011: synchronize DMA teardown * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74626 - NTB: ntb_netdev: Preserve RX queue depth on allocation failure * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74647 - misc: fastrpc: Remove buffer from list prior to unmap operation * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-74632 - mm/huge_memory: fix huge_zero_pfn race * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80562 - gpio: ml-ioh: use raw_spinlock_t for the register lock * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80805 - xfs: validate attr entry pointer before field access * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80808 - ext4: stop retrying saturated xattr cache entries * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80809 - ocfs2: fix missing metadata reservation for large xattrs * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80812 - ALSA: dummy: Check card index validity at probe * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80814 - rndis_host: add overflow check in rndis_rx_fixup() * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80819 - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept * Jammy update: v5.15.218 upstream stable release (LP: #2168525) // CVE-2026-80917 - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems * Jammy update: v5.15.217 upstream stable release (LP: #2168510) - f2fs: fix UAF issue in f2fs_merge_page_bio() - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ipvs: separate destination availability state - selinux: require every boolean value to be defined - selinux: reject a class permission count below its inherited common - selinux: do not cancel a policy conversion that never started - mptcp: options: reset DSS fields in case of unexpected size - s390/qeth: validate user buffer length in SNMP and ARP query ioctls - ASoC: cs4265: sort the register default table - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses - powerpc/pseries: pci - logic bug - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet - Input: psxpad-spi - set driver data before use - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard - Input: iforce - validate input packet lengths - powerpc/pseries: lparcfg - fix kbuf[] underflow - Input: synaptics-rmi4 - zero report size on F54 work error - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer - Input: synaptics-rmi4 - block s_input when F54 queue is busy - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue - crypto: qce - fix error path in devm_qce_register_algs - libceph: fix multiple unsafe decodes in decode_locker() - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() - openrisc: signal: do not restore privileged SR bits on sigreturn - Input: sur40 - fix input device registration ordering - Input: sur40 - fix V4L error path cleanup - libceph: Avoid using invalid osd indices from primary_temp - ceph: fix MDS random selection readiness predicate - libceph: tolerate addrvecs with multiple entries of the same type - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit - mmc: sdhci: unmap the bounce buffer before device release - mmc: sdhci: make tuning_err a signed int - drm/radeon: fix autosuspend cleanup during teardown - s390/vfio_ccw: Fix out of bounds check on CCW array - drm/amdgpu: Reject UVD message with invalid number of h265 refs - drm/amdgpu: validate GEM_CREATE domain combinations - drm/amdgpu: Reject UVD message with dimensions above 4096 - drm/amdgpu: Implement insert_end for VCE 3 - drm/amdgpu: Fix UVD decode image min size calculation - xfs: fix ilock leak on error in xfs_dq_get_next_id - xfs: check v5 superblock features early - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - mm: do file ownership checks with the proper mount idmap - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - udmabuf: Do not create malformed scatterlists - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - Input: mms114 - fix touch indexing for MMS134S and MMS136 - i2c: davinci: Unregister cpufreq notifier on probe failure - Input: mms114 - reject an oversized device packet size - ALSA: hda: conexant: Remove mic bias threshold override - VFS/audit: introduce kern_path_parent() for audit - audit: widen ino fields to u64 - audit: use 'unsigned int' instead of 'unsigned' - audit: fix recursive locking deadlock in audit_dupe_exe() - ALSA: hda: Fix cached processing coefficient verbs - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: max310x: implement gpio_chip::get_direction() - rxrpc: serialize kernel accept preallocation with socket teardown - fbcon: Rename struct fbcon_ops to struct fbcon_par - fbcon: Use correct type for vc_resize() return value - tipc: restrict socket queue dumps in enqueue tracepoints - mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - vduse: Use fixed 4KB bounce pages for non-4KB page size - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: take out allocations from vduse_dev_alloc_coherent - VDUSE: avoid leaking information to userspace - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - ASoC: mediatek: mt8183: Check runtime resume during probe - tcp: convert to dev_net_rcu() - net: dst: annotate data-races around dst->input - net: dst: annotate data-races around dst->output - net: dst: add four helpers to annotate data-races around dst->dev - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: mt8192: Check runtime resume during probe - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - remoteproc: qcom: replace kstrdup with kstrndup - remoteproc: qcom: fix sparse warnings - remoteproc: qcom: pas: Adjust the phys addr wrt the mem region - remoteproc: qcom: Fix leak when custom dump_segments addition fails - lsm: use default hook return value in call_int_hook() - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - fs/ntfs3: Make ntfs_update_mftmirr return void - fs/ntfs3: Undo critial modificatins to keep directory consistency - ntfs3: validate split-point offset in indx_insert_into_buffer - 9p: skip nlink update in cacheless mode to fix WARN_ON - net: thunderbolt: Fix frags[] overflow by bounding frame_count - mtd: spi-nor: Fix spi_nor_try_unlock_all() - mtd: spi-nor: swp: Improve locking user experience - dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip - dmaengine: dw-edma: Detach the private data and chip info structures - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - ksmbd: fix integer overflow in set_file_allocation_info() - i2c: imx: separate atomic, dma and non-dma use case - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - can/esd_usb2: Rename esd_usb2.c to esd_usb.c - [Config] Set CONFIG_CAN_ESD_USB=m - can: esd_usb: kill anchored URBs before freeing netdevs - thunderbolt: Remove usage of the deprecated ida_simple_xx() API - thunderbolt: Update property.c function documentation - thunderbolt: Keep XDomain reference during the lifetime of a service - thunderbolt: Remove service debugfs entries during unregister - thunderbolt: Remove XDomain from the bus without holding tb->lock - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - bpf,fork: wipe ->bpf_storage before bailouts that access it - ovl: use linked upper dentry in copy-up tmpfile - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - dm-integrity: don't increment hash_offset twice - dm-verity: make error counter atomic - firmware_loader: introduce __free() cleanup hanler - Input: ims-pcu - fix firmware leak in async update - mmc: vub300: fix use-after-free on disconnect - mmc: vub300: rename probe error labels - mmc: vub300: fix use-after-free on probe failure - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - net: Add helper function to parse netlink msg of ip_tunnel_encap - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: mana: Validate the packet length reported by the NIC - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - treewide: rename pinctrl_gpio_direction_output_new() - gpio: tegra: do not call pinctrl for GPIO direction - net/sched: taprio: avoid calling child->ops->dequeue(child) twice - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - espintcp: use sk_msg_free_partial to fix partial send - net: ipa: fix SMEM state handle leaks in SMP2P init - octeontx2-pf: fix SQB pointer leak on init failure - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - dma-buf/drivers: make reserving a shared slot mandatory v4 - drm/virtio: use uninterruptible resv lock for plane updates - drm/displayid: fix Tiled Display Topology ID size - drm/tegra: fbdev: Remove offset into framebuffer memory - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/virtio: Return proper error codes instead of -1 - drm/virtio: bound EDID block reads to the response buffer - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - media: marvell-cam: fix missing pci_disable_device() on remove - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Correct the minimum vblanking value - media: i2c: imx219: Rename VTS to FRM_LENGTH - media: imx219: Fix maximum frame length in lines - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l: async: Set owner for async sub-devices - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - ALSA: seq: close a re-opened queue timer in the destructor - wifi: brcmfmac: drain bus_reset work on device removal - serial: 8250_mid: Remove unneeded test for ->setup() presence - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - sc16is7xx: Properly resume TX after stop - serial: sc16is7xx: Fill in rs485_supported - serial: sc16is7xx: remove obsolete out_thread label - serial: sc16is7xx: fix regression with GPIO configuration - serial: sc16is7xx: implement gpio get_direction() callback - mptcp: cleanup MPJ subflow list handling - mptcp: fix subflow accounting on close - mptcp: decrement subflows counter on failed passive join - sctp: avoid auth_enable sysctl UAF during netns teardown - ceph: avoid fs reclaim while using current->journal_info - libceph: Amend checking to fix `make W=1` build breakage - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: add doutc and *_client debug macros support - ceph: rename _to_client() to _to_fs_client() - ceph: print cluster fsid and client global_id in all debug logs - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - libceph: fix two unsafe bare decodes in decode_lockers() - ksmbd: defer destroy_previous_session() until after NTLM authentication - net/sched: serialize qdisc_rtab_list against concurrent get/put - ftrace: Add global mutex to serialize trace_parser access - super: fix emergency thaw deadlock on frozen block devices - ksmbd: rename smb2_get_msg to smb_get_msg - smb/server: fix minimum SMB1 PDU size - smb/server: fix minimum SMB2 PDU size - ksmbd: validate minimum PDU size for transform requests - mm/vmstat: fold stranded per-cpu node stats when a node comes online - ksmbd: conn lock to serialize smb2 negotiate - ksmbd: reject repeated SMB2 NEGOTIATE requests - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - igc: remove napi_synchronize() in igc_down() - net: pktgen: fix code style (WARNING: Block comments) - net: pktgen: fix proc entry use-after-free - scsi: sd: sd_zbc: Improve source code documentation - scsi: sd: sd_zbc: Use logical blocks as unit when querying zones - scsi: sd: sd_zbc: Introduce struct zoned_disk_info - scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() - scsi: scsi_debug: Rename zone type constants - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - ice: fix VF interrupts cleanup - ice: fix memory leak in ice_lbtest_prepare_rings() - fsnotify: opt-in for permission events at file open time - fs: don't block write during exec on pre-content watched files - binfmt_misc: restore write access when removing an entry - i2c: imx: Fix slave registration race and error handling - i2c: bcm-iproc: remove printout on handled timeouts - i2c: iproc: reset bus after timeout if START_BUSY is stuck - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - jiffies: Define secs_to_jiffies() - ice: wait for reset completion in ice_resume() - drm/amd/pm: fix torn gpu metrics reads - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - mm/ptdump: always stabilise against page table freeing using init_mm - net: add a couple of helpers for iph tot_len - openvswitch: use skb_ip_totlen in conntrack - net: sched: use skb_ip_totlen and iph_totlen - openvswitch: move key and ovs_cb update out of handle_fragments - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free stranded TX buffers on ring deinit - net/smc: rdma write inline if qp has sufficient inline space - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 - crypto: ccm - Set rfc4309 maxauthsize from child - netfilter: ipset: fix refcount race between list:set GC and swap - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path - netfilter: flowtable: publish GC-visible tuple last - netfilter: ipset: fix list type element drift bug - net: packet: fix wrong transport_header when sending VLAN-tagged frame - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers - af_packet: Don't send zero-byte data in tpacket_snd(). - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG - net/x25: fix use-after-free of the socket by its timers - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - drm/vmwgfx: Reserve fence slots on buffer objects in cotables - drm/virtio: Unlock reservations on dma_resv_reserve_fences() error - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - ring-buffer: Use current_context for safe per-CPU buffer swap - Linux 5.15.217 linux (5.15.0-199.209) jammy; urgency=medium * jammy/linux: 5.15.0-199.209 -proposed tracker (LP: #2168214) * [SRU] selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value (LP: #2107442) - selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value * CVE-2022-1205 - ax25: Fix ax25 session cleanup problems * CVE-2022-50303 - drm/amdkfd: Fix double release compute pasid * CVE-2023-53320 - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() * CVE-2025-39726 - s390/ism: fix concurrency management in ism_cmd() * CVE-2025-39779 - btrfs: subpage: keep TOWRITE tag until folio is cleaned * CVE-2025-39810 - bnxt_en: Fix memory corruption when FW resources change during ifdown * udpgro.sh from ubuntu_kselftests_net failed with J-5.15 (udpgso_bench_rx: recv: bad packet len) (LP: #2129861) - selftests: udpgro: no need to load xdp for gro * CVE-2026-68399 - bpf: Fix UAF in sock clone early bailouts * CVE-2025-37861 - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue * CVE-2025-38643 - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() * CVE-2025-38615 - fs/ntfs3: cancle set bad inode after removing name fails * CVE-2025-38361 - drm/amd/display: Check dce_hwseq before dereferencing it * CVE-2025-38259 - ASoC: codecs: wcd9335: Fix missing free of regulator supplies * CVE-2025-38239 - scsi: megaraid_sas: Fix invalid node index * CVE-2025-38069 - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops * CVE-2022-50071 - mptcp: move subflow cleanup in mptcp_destroy_common() * CVE-2025-37920 - xsk: Fix race condition in AF_XDP generic RX path * CVE-2026-43456 - bonding: fix type confusion in bond_setup_by_slave() - bonding: prevent potential infinite loop in bond_header_parse() * CVE-2022-49858 - octeontx2-pf: Fix SQE threshold checking * CVE-2025-22057 - net: decrease cached dst counters in dst_release * CVE-2025-22083 - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint * CVE-2024-58096 - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode * CVE-2025-21947 - ksmbd: fix type confusion via race condition when using ipc_msg_send_request * CVE-2022-49562 - KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits * CVE-2025-21812 - ax25: rcu protect dev->ax25_ptr * CVE-2025-21801 - net: ravb: Fix missing rtnl lock in suspend/resume path * CVE-2024-54683 - netfilter: IDLETIMER: Fix for possible ABBA deadlock * CVE-2024-53220 - f2fs: fix to account dirty data in __get_secs_required() * CVE-2025-21759 - ipv6: mcast: extend RCU protection in igmp6_send() * CVE-2024-57999 - powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW * CVE-2024-57982 - xfrm: state: fix out-of-bounds read during lookup * CVE-2022-49651 - srcu: Tighten cleanup_srcu_struct() GP checks * CVE-2022-49359 - drm/panfrost: Job should reference MMU not file_priv * CVE-2022-49234 - net: dsa: Avoid cross-chip syncing of VLAN filtering * CVE-2024-57945 - riscv: mm: Fix the out of bound issue of vmemmap address * CVE-2024-53210 - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() * CVE-2024-53187 - io_uring: check for overflows in io_pin_pages -- Mehmet Basaran <mehmet.basaran@canonical.com> Thu, 15 Oct 2026 15:20:14 +0300 ** Changed in: linux (Ubuntu Jammy) Status: Fix Committed => Fix Released ** CVE added: https://cve.org/CVERecord?id=CVE-2022-1205 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49234 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49359 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49562 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49651 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-49858 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-50071 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-50303 ** CVE added: https://cve.org/CVERecord?id=CVE-2022-50406 ** CVE added: https://cve.org/CVERecord?id=CVE-2023-52676 ** CVE added: https://cve.org/CVERecord?id=CVE-2023-53231 ** CVE added: https://cve.org/CVERecord?id=CVE-2023-53320 ** CVE added: https://cve.org/CVERecord?id=CVE-2023-53707 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-41062 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-46754 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-49568 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-50017 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-53187 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-53210 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-53220 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-54683 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-57945 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-57982 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-57999 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-58094 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-58095 ** CVE added: https://cve.org/CVERecord?id=CVE-2024-58096 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21649 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21651 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21759 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21801 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21812 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-21947 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-22039 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-22057 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-22083 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-22103 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-37861 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-37920 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-37964 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38069 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38097 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38239 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38259 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38349 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38361 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38615 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-38643 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39726 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39779 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39810 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-39925 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-40102 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-40123 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-68190 ** CVE added: https://cve.org/CVERecord?id=CVE-2025-68794 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-23191 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-31420 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43437 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-43456 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46113 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46158 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46170 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-46242 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-52944 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-52988 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-53078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-53089 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-64561 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-64581 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68236 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68399 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-72323 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74268 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74378 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74626 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74632 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74637 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74647 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74662 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74663 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74666 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74668 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74743 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80536 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80547 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80548 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80552 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80553 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80555 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80557 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80562 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80583 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80587 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80590 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80671 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80689 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80726 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80737 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80765 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80766 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80767 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80768 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80781 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80782 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80783 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80788 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80789 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80790 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80792 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80793 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80794 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80795 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80796 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80797 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80798 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80799 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80800 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80801 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80802 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80803 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80805 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80806 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80807 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80808 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80809 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80812 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80814 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80819 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80823 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80824 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80826 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80827 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80828 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80829 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80830 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80831 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80832 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80833 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80834 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80840 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80842 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80843 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80844 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80846 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80848 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80854 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80855 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80856 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80863 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80888 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80889 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80912 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80916 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80917 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80918 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80921 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80923 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80928 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80930 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80931 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80932 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80938 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80941 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80944 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80949 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80951 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80952 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80963 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80964 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80965 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80966 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80967 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80968 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80969 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80971 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80972 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80973 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80976 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80977 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80978 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80983 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80987 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80988 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80994 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81000 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81001 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81002 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81003 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81005 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81007 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81008 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-81017 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89440 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89444 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89456 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89457 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89458 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89461 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89463 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89464 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89469 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89470 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89471 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89474 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89475 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89477 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89478 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89479 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89480 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89482 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89483 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89485 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89487 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89488 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89489 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89490 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89491 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89493 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89494 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89495 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89497 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89498 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89504 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89508 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89510 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89511 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89512 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89515 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89525 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89532 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89533 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89538 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89540 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89541 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89542 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89548 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89549 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89551 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89554 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89555 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89557 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89559 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89560 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89562 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89563 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89569 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89573 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89575 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89576 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89585 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89586 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89594 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89595 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89596 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89597 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89599 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89603 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89605 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89606 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89607 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89608 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89609 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89615 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89616 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89617 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89621 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89626 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89627 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89628 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89643 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89649 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89650 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89653 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89655 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89656 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89662 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89663 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89665 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89669 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89673 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89674 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89684 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89694 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89696 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89697 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89699 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89704 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89706 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89710 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89711 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89712 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89720 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89723 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89724 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89725 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89726 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89729 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89730 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89732 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89733 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89736 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89741 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89742 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89749 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89752 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89753 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89765 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89777 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89778 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89779 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89780 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89781 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89782 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89783 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89784 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89785 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89786 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89787 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89789 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89792 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89796 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89816 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89817 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89821 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89823 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89843 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89845 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89846 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89847 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89849 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89850 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89851 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89852 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89853 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89854 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89855 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89856 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89858 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89861 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89863 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89864 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89865 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89871 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89872 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89876 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89878 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89879 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89880 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89881 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89883 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89887 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89888 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89890 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89891 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89892 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89893 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89894 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89895 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89896 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89897 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89901 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89923 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89924 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89925 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89926 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89927 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89930 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89932 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89936 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89937 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89939 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89945 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89946 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89947 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89948 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89949 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89951 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89952 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89953 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89954 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89964 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89965 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89968 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89969 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89973 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89979 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89980 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89982 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89983 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89984 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89989 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89993 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89997 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89999 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90000 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90007 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90011 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90015 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90017 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90018 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90019 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90020 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90025 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90031 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90032 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90033 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90034 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90049 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90053 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90054 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90055 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90056 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90058 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90062 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90063 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90067 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90068 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90070 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90071 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90072 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90073 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90074 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90075 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90081 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90102 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90103 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90107 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90114 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90126 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90128 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90140 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90141 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90143 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90151 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90157 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90160 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90198 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90202 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90203 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90209 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90214 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90216 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90218 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90219 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90221 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90222 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90223 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90224 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90225 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90226 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90228 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90245 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90248 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90249 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90251 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90257 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90274 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90281 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90283 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90284 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90285 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90286 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90290 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90292 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90293 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90294 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90295 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90296 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90297 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90298 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90302 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90303 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90307 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90314 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90316 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90318 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90319 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90327 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90329 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90334 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90341 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90348 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90360 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90361 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90362 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90372 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90378 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90382 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90386 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90388 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90391 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90393 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90394 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90395 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90403 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90411 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90413 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90414 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90415 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90416 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90419 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90420 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90431 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90434 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90435 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92494 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92498 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92501 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92504 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92508 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92521 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92522 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93037 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93039 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93040 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93041 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93046 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93048 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93049 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93051 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93052 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93053 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93054 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93055 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93056 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93061 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93067 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93095 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93098 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93102 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93103 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93108 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93109 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93110 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93114 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93115 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93120 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93130 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93131 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93138 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93140 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93141 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93145 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93151 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93158 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93159 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93160 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93161 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93165 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93167 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93170 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93177 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93178 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93183 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93185 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93188 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93189 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93191 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93203 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93204 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93206 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93213 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93214 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93219 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93222 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93226 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93234 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93236 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93242 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93245 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93252 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93256 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93261 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93262 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93264 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93268 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93271 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93274 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93278 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93279 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93280 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93283 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93286 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93287 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93288 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93782 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93783 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93784 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93785 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93789 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93795 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93797 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93798 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93800 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93802 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93803 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93805 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93807 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93808 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93811 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93812 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93813 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93815 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93816 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93819 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93820 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93821 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93822 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93825 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93830 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97407 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97408 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97411 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97413 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97416 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97417 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97418 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97419 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97420 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97421 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97430 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97434 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97435 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97436 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97437 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97438 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97439 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97440 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97441 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97443 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97444 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97445 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97446 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97448 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97449 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97450 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97451 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97452 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97453 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97454 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97455 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97456 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97472 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97475 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97481 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97482 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97483 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97484 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97485 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97486 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97487 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97488 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97489 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97490 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97491 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97492 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97502 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97506 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97507 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97508 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97510 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97523 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97568 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97572 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97573 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97576 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97592 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97596 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97598 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97601 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97604 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97608 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97611 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97612 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97899 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97904 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97905 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97909 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97910 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97923 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97926 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97927 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97930 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97931 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97940 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97948 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97951 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97952 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97954 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97957 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97958 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97959 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97963 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97964 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97969 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97970 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97981 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97982 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97991 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97993 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97995 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-97998 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98006 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98009 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98010 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98011 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98012 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98013 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98014 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98015 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98016 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98022 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98023 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98025 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98027 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98030 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98031 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98063 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98064 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98066 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98068 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98069 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98070 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98071 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98072 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98074 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98075 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98076 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98077 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98080 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98090 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98091 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98094 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98095 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98096 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98098 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98108 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98113 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98116 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98121 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98123 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98130 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98154 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98157 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98158 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169603 Title: Jammy update: v5.15.222 upstream stable release Status in linux package in Ubuntu: Invalid Status in linux source package in Jammy: Fix Released Bug description: SRU Justification     Impact:        The upstream process for stable tree updates is quite similar        in scope to the Ubuntu SRU process, e.g., each patch has to        demonstrably fix a bug, and each patch is vetted by upstream        by originating either directly from a mainline/stable Linux tree or        a minimally backported form of that patch. The following upstream        stable patches should be included in the Ubuntu kernel:        v5.15.222 upstream stable release        from git://git.kernel.org/ bus: fsl-mc: wait for the MC firmware to complete its boot ALSA: usb-audio: Propagate write errors in generic mixer put callbacks ima: return error early if file xattr cannot be changed tee: optee: Allow MT_NORMAL_TAGGED shared memory PCI: Stop setting cached power state to 'unknown' on unbind hfsplus: fix issue of direct writes beyond end-of-file wifi: mac80211: always allow transmitting null-data on TXQs kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() bridge: Do not suppress ARP probes and DAD NS unconditionally soundwire: validate DT compatible before parsing it media: rc: mceusb: Add support for 04eb:e033 s390/cio: Purge based on the cdev's online status thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() thunderbolt: Keep the domain reference while processing hotplug thunderbolt: Set tb->root_switch to NULL when domain is stopped media: dm1105: fix missing error check for dma_alloc_coherent net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family net: dsa: mv88e6xxx: define .pot_clear() for 6321 net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family media: em28xx-video: fix missing res_free() on init_usb_xfer failure crypto: ixp4xx - fix buffer chain unwind on allocation failure clk: renesas: cpg-mssr: Add number of clock cells check ASoC: ti: omap3pandora: update board check to use DT compatible mmc: core: Add validation for host-provided max_segs mmc: davinci: avoid NULL deref of host->data in IRQ handler drm/amd/display: Fix CRC open failure during active rendering hfsplus: rework hfsplus_readdir() logic drm/gud: Add RCade Display Adapter VID/PID pair integrity: Check for NULL returned by asymmetric_key_public_key scsi: pm8001: Reject firmware update in fatal error state scsi: pm8001: Reject non-fatal dump when controller is crashed crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y crypto: atmel-ecc - add support for atecc608b media: imon: Add iMON VFD HID OEM v1.2 key mappings RDMA/mlx5: Use QP port when decoding responder CQEs mailbox: Make mbox_send_message() return error code when tx fails ALSA: usx2y: Drain pending US-428 pipe-4 output commands 9p: invalidate readdir buffer on seek arm64/daifflags: Make local_daif_*() helpers __always_inline firmware: arm_scmi: Validate SENSOR_UPDATE payload size firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed bitfield: wire __bf_shf to __builtin_ctzll net: usb: qmi_wwan: add MeiG SRM813Q net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() net/sched: sch_drr: make cl->quantum lockless net/rds: Don't sleep inside rds_ib_conn_path_shutdown befs: handle set_blocksize failures affs: handle set_blocksize failures bfs: handle set_blocksize failures minix: handle set_blocksize failures qnx4: handle set_blocksize failures jfs: handle set_blocksize failures hpfs: handle set_blocksize failures omfs: handle set_blocksize failures isofs: handle set_blocksize failures usbip: vhci_hcd: fix NULL deref in status_show_vhci usb: core: hcd: fix possible deadlock in rh control transfers usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log serial: 8250: fix possible ISR soft lockup usb: host: add ARCH_AIROHA in XHCI MTK dependency char/nvram: Remove redundant nvram_mutex netlabel: fix IPv6 unlabeled address add error handling rds: filter RDS_INFO_* getsockopt by caller's netns rds: annotate data-race around rs_seen_congestion s390/zcore: Removed unused variables clk: socfpga: agilex: implement l3_main_free_clk thermal/drivers/tegra/soctherma: Switch to devm cooling device registration drm/panel: simple: Add AM-1280800W8TZQW-T00H mips: cps: Assemble jr.hb with an R2 ISA level iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed ALSA: usb-audio: Add quirk for Novation Mininova ipv6: addrconf: fix temp address generation after prefix deprecation drm/amd/pm/si: Fix updating clock limits from power states ACPICA: Fix condition check in acpi_ps_parse_loop() ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() ACPICA: add boundary checks in acpi_ps_get_next_field() ACPICA: validate byte_count in acpi_ps_get_next_package_length() ACPICA: Prevent adding invalid references ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() ACPICA: validate handler object type in two places ACPICA: Add package limit checks in parser functions ACPICA: Add validation for node in acpi_ns_build_normalized_path() ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() ACPICA: add boundary checks in two places hfs: rework hfsplus_readdir() logic host1x: bus: Fix missing ops null check in error teardown scripts: modpost: detect and report truncated buf_printf() output ASoC: Intel: catpt: Complete coredump handling soundwire: only handle alert events when the peripheral is attached mmc: davinci: fix mmc_add_host order in probe mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC perf/ftrace: Fix WARNING in __unregister_ftrace_function iio: accel: mma8452: switch to non-devm request_threaded_irq() libbpf: Also reset {insn,data}_cur on realloc failure net: ibm: emac: Reserve VLAN header in MJS limit ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive ata: ahci: fail probe if BAR too small for claimed ports ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach net: qrtr: fix node refcount leak on ctrl packet alloc failure iommu/rockchip: disable fetch dte time limit fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib fs/ntfs3: validate index entry key bounds ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() ASoC: codecs: rk3328: Use managed GPIO and clock helpers ALSA: seq: oss: Reject reads that cannot fit the next event dpaa2-switch: rework FDB management on the bridge leave path dpaa2-switch: fix the error path in dpaa2_switch_rx() net: dsa: sja1105: flower: reject cross-chip redirect dpaa2-switch: fix handling of NAPI on the remove path xhci: Prevent queuing new commands if xhci is inaccessible clk: keystone: don't cache clock rate ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP ipmi: si: Use platform_get_irq_optional() to retrieve interrupt wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() RDMA/mlx5: Fix state and counter desync on loopback enable failure bpf: NUL-terminate replaced sysctl value net: cpsw_new: unregister devlink on port registration failure hsr: broadcast netlink notifications in the device's net namespace ALSA: es18xx: check control allocation before private data setup netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() RDMA/rtrs-srv: Fix integer underflow in process_read and process_write xprtrdma: Add request-pool slack for delayed recycling configfs_depend_prep(): pass configfs_dirent instead of dentry net: ibm: emac: mal: fix potential system hang in mal_remove() platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table wifi: mt76: transform aspm_conf for pci_disable_link_state btrfs: protect sb_write_pointer() with invalidate lock hwmon: (adt7462) Add of_match_table to support devicetree ata: libata-pmp: add JMicron JMS562 quirk platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table sctp: Unwind address notifier registration on failure PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i Bluetooth: L2CAP: validate connectionless PSM length ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure sparc64: uprobes: add missing break net: stmmac: xgmac2: disable RBUE in default RX interrupt mask ptp: ocp: add shutdown callback vsock: use sk_acceptq_is_full() helper in all transports e1000e: limit endianness conversion to boundary words net/sched: act_csum: don't mangle UDP tunnel GSO packets i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA sparc: Disable compat support with LLD fuse: set ff->flock only on success scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() gpio: pisosr: Read "ngpios" as u32 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 leds: uleds: Return -EFAULT on copy_to_user() failure leds: pca9532: Don't stop blinking for non-zero brightness mfd: rsmu: Add 8a34002 support ALSA: usb-audio: Add quirk for YAMAHA CDS3000 PCI: iproc: Protect root bus removal with rescan lock PCI: altera: Protect root bus removal with rescan lock PCI: rockchip: Protect root bus removal with rescan lock PCI: mediatek: Protect root bus removal with rescan lock md/raid5: account discard IO md/raid5: let stripe batch bm_seq comparison wrap-safe f2fs: validate inline dentry name lengths before conversion rtc: aspeed: add AST2700 compatible ksmbd: use connection ClientGUID for lease lookup ksmbd: treat unnamed DATA stream as base file ksmbd: apply create security descriptor first ksmbd: break RH leases before delete-on-close PCI/sysfs: Use kstrtobool() to parse the ROM attribute input net: au1000: move free_irq out of the close-time spinlocked section rtc: bq32000: add delay between RTC reads fbdev: pm2fb: unwind WC setup on probe failure btrfs: tree-checker: validate INODE_REF's namelen drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend netfilter: nf_conntrack_expect: zero at allocation time ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr drm/arm/komeda: fix error handling for clk_prepare_enable() and callers ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling xen/front-pgdir-shbuf: free grant reference head on errors freevxfs: don't BUG() on unknown typed-extent type xen/gntalloc: validate grant count before allocation ksmbd: fix credit charge calculation for SMB2 QUERY_INFO ALSA: usb-audio: caiaq: validate EP1 reply lengths wifi: ralink: RT2X00: init EEPROM properly wifi: mac80211: validate deauth frame length before reason access wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers wifi: libertas: reject short monitor TX frames ksmbd: find bound sessions during reauthentication ksmbd: mark invalid session responses as signed ksmbd: validate SID namespace before mapping IDs wifi: cfg80211: validate rx/tx MLME callback frame lengths before access gpio: dwapb: Mask interrupts at hardware initialization wifi: libipw: fix key index receive bound checks netfilter: ipset: mark the rcu locked areas properly wifi: rsi: validate beacon length before fixed buffer copy btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() btrfs: fix reloc root cleanup in merge_reloc_roots() wifi: iwlwifi: mvm: fix an off-by-1 boundary check wifi: iwlwifi: mvm: fix sched scan IE sizing blk-cgroup: fix leaks and online flag on radix_tree_insert failure arm64: fixmap: Allow 256K early_ioremap() at any offset arm64: kprobes: Allow reentering kprobes while single-stepping drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized wifi: iwlwifi: bound aligned TLV advance in FW parser ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless wifi: mwifiex: replace one-element arrays with flexible array members regulator: core: clamp voltage constraints before applying apply_uV wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO drm/gma500: return errors from Oaktrail HDMI I2C reads phonet: check register_netdevice_notifier() error in phonet_device_init() ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx ice: pass the return value of skb_checksum_help() powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash cifs: validate idmap key payload length wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) vhost-scsi: flush backend after device ioctls ASoC: rt5645: Perform the initial jack detect at probe netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state clk: at91: pmc: #undef field_{get,prep}() before definition ppp_async: drop the errored frame instead of resetting its headroom mm/damon/core: avoid infinite kdamond_merge_regions() internal loop Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" ARM: 9484/1: enable interrupts when unhandled user faults are triggered EDAC/igen6: Fix interleave boundary condition EDAC/igen6: Fix channel selection hash EDAC/igen6: Fix channel address decode for non-hash mode EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() nvme-rdma: fix -EIO cleanup order in queue_rq selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter net/sched: act_api: budget all shared attributes in notify skbs net/sched: act_api: size the RTM_GETACTION reply from the actions sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START smb: client: transport: Fix debug printing in __release_mid() sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration net: amd-xgbe: discard rx packets with bad FCS watchdog: msc313e: Fix NULL pointer dereference in PM callbacks OPP: of: Fix potential multiplication overflow when calculating freq ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF ksmbd: rate limit unmapped SID errors Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() ASoC: ab8500: Reset the audio block before configuring it ASoC: ab8500: Repair the DAPM capture graph ASoC: ab8500: Update to modern clocking terminology ASoC: ab8500: Correct digital interface format setup ASoC: ab8500: Validate and program TDM slots correctly tty: make tty_ldisc_ops::hangup return void ppp: ppp_async: simplify tty disc_data access tipc: fix NULL deref in tipc_named_node_up() on empty publication list ipv6: sr: restore network header before routing and forwarding af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). staging: fbtft: make dirty_lock IRQ-safe ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits btrfs: detach failed sprout device from transaction update list btrfs: consolidate device_list_mutex in prepare_sprout to its parent btrfs: restore active device pointers after failed sprout scsi: mpt3sas: Use irq_set_affinity_and_hint() scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() perf/core: Skip empty AUX records with only format flags locking/lockdep: Introduce lock_sync() locking/lockdep: Improve the deadlock scenario print for sync and read lock lockdep: Add lock_set_cmp_fn() annotation locking/lockdep: Invalidate stale class_cache entries for zapped classes ASoC: ux500: Fix MSP stream lifecycle handling ASoC: ux500: remove platform_data support ASoC: ux500: Propagate MSP setup errors ASoC: ux500: Correct MSP frame and bit clock setup ASoC: ux500: Validate MSP DAI configuration ASoC: ux500: remove stedma40 references ASoC: ux500: Request the MSP MMIO resource ASoC: ux500: Program the MSP FIFO watermarks btrfs: do not force reloc root creation during qgroup_account_snapshot() ipvs: fix reversed sequence option serialization netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() tracing/probes: Fix use-after-free on field name/type of events with multiple probes bpf: reject BPF_PSEUDO_FUNC reference to the main program bonding: do not clear curr_active_slave prematurely when releasing all slaves net/rds: use wq_has_sleeper() in release_in_xmit() net/rds: use clear_bit_unlock() in release_refill() net/rds: clear cp_flags bits individually in rds_conn_path_reset() net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() net/rds: acquire the fastpath locks in rds_conn_shutdown() net/rds: don't let rds_conn_shutdown() consume a concurrent drop net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset ALSA: caiaq: Fix potential double-free at error path bpf: Fix NULL-ptr-deref when showing a void BTF type bpf: Fix NULL-ptr-deref in btf_var_show() nexthop: Initialize extack in remove_nh_grp_entry() bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow vxlan: reject dynamic fdb entries that reference a nexthop id net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations powerpc/kexec_file: Use inclusive range checks in add_usable_mem() net/mlx5e: Fix setting RS FEC after remapping net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% net/mlx5e: Fix use-after-free race in sample_restore_put() net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put net/mlx5: E-Switch, prevent mc_list repopulation during vport disable net_sched: sch_fq_pie: implement lockless fq_pie_dump() net/sched: fq_pie: clamp quantum in change path net/sched: sfq: clamp quantum in change path net/sched: hhf: clamp quantum in change and init paths net/sched: pie: clamp psched_mtu in pie_drop_early net/sched: drr: clamp quantum in change class net/sched: ets: clamp quantum in parse and fallback paths ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev ASoC: bcm: bcm63xx: Publish the OF module aliases ASoC: Intel: SST: Publish the PCI module aliases netfilter: nfnetlink_log: cope with concurrent instance destruction netfilter: ip6_tables: set F_PROTO when proto value is nonzero ASoC: mt6351: Publish the OF module alias virtio-console: call scheduler when we free unused buffs virtio_console: do not free control-out buffers on remove vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx vdpa_sim_blk: use dev_dbg() to print errors vdpa_sim_blk: make vdpasim_blk_check_range usable by other requests vdpa_sim_blk: reject out-of-range sector starts virtio-pci: return IRQ_HANDLED after non-zero ISR net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward net: ethernet: cortina: Fix budget accounting net: ethernet: cortina: Finish RX updates before NAPI completion net: ethernet: cortina: Count dropped frames as NAPI work net: ethernet: cortina: No mapping is a dropped rx net: ethernet: cortina: Count RX drops once per frame net: ethernet: cortina: Count RX descriptors for freeq refill watchdog: fix hrtimer start when pretimeout is zero watchdog: msc313e: Avoid division by zero watchdog: msc313e: Fix clock leak and spurious timer in settimeout() hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors ppp_synctty: ensure a writeable skb header net: stmmac: optimize locking around PTP clock reads net: stmmac: initialize ptp_lock at probe time selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value net/sched: cls_route: free emptied bucket on filter move net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). net: sun4i-emac: fix missing of_node_put() for phy_node net: hinic: fix mailbox segment buffer overflow octeontx2-af: fix PF/CGX debugfs PCI bus lookup net/rds: Pass a pointer to virt_to_page() net/rds: fix tcp stream corruption with large pages sunvdc: unmap LDC cookies when the descriptor send fails drm/amd/display: set new_stream to NULL after release scsi: target: iscsi: Handle abort for WRITE_PENDING cmds scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands ksmbd: prevent out-of-bounds reads in share config responses macvlan: inherit needed_headroom and needed_tailroom from lowerdev Revert "scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches." Revert "scsi: smartpqi: Fix BUILD_BUG_ON() statements" Revert "scsi: core: Register sysfs attributes earlier" Revert "scsi: smartpqi: Capture controller reason codes" powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver ipv6: fix fib6 walker UAF on seq stop ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf dm/amdgpu: fix malformed link_settings debugfs output watchdog: sunxi_wdt: preserve boot-enabled watchdog ufs: create the root dentry after loading cylinder metadata ufs: validate cylinder group metadata before caching it tunnels: Drop stale dst when building an ICMP error for PMTUD tracing: Free histogram the var ref when its initialization fails ASoC: sprd: validate compress buffer sizes against fixed allocations ASoC: sti: initialize IRQ lock before requesting IRQ cpufreq: zero-initialize policy cpumask before sysfs publication cpufreq: initialize policy rwsem before sysfs publication exec: do_close_on_exec() before taking exec_update_lock drm/i915: Fix memory leak in query_perf_config_list() net: hso: fix TIOCMIWAIT race net: mpls: clear inner_protocol when the last label is popped net: openvswitch: fix use-after-free of the flow table mask array netfilter: nf_log: unregister loggers before per-net teardown netfilter: report NLM_F_DUMP_FILTERED when all is filtered out fbdev: vfb: defer cleanup until the last reference ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink ipv4: fib: bound automatic table ID allocation ipvs: reject invalid states in connection template sync records KVM: PPC: Book3S HV: Set irqfd->producer only on success s390/qeth: allow bridgeport queries despite OS_MISMATCH s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm hwmon: (applesmc) fix key backlight workqueue leak on register failure hwmon: (gpio-fan) Fix use-after-free in alarm work hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS media: hevc: add bounded tile-count helpers media: v4l2-h264: Fix memcmp() size in B1 reference list comparison media: v4l2-ctrls: validate HEVC tile counts bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_en: Propagate RX ring init failures in bnxt_init_nic() mptcp: options: handle MPC data + csum reqd + no csum mptcp: syncookies: remember the request backup flag ipv6: mcast: extend RCU protection in igmp6_send() Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems" ALSA: us122l: Prevent write upgrades for read mappings i2c: smbus: reject oversized block transfers in the common path net: appletalk: fix NULL pointer dereference in aarp_send_ddp() fou: Fix use-after-free in fou_create() crypto: sun8i-ce - Remove crypto_rng interface UBUNTU: [Config] remove CRYPTO_DEV_SUN8I_CE_PRNG crypto: sun8i-ss - Remove crypto_rng interface UBUNTU: [Config] remove CRYPTO_DEV_SUN8I_SS_PRNG netfilter: nft_set_pipapo_avx2: add missing vzeroupper mptcp: avoid unneeded actions on subflow reset mptcp: close race between scheduler and state change iomap: iomap: fix memory corruption when recording errors during writeback ARM: fix hash_name() fault ARM: fix branch predictor hardening ARM: ensure interrupts are enabled in __do_user_fault() Bluetooth: L2CAP: Fix deadlock bluetooth/l2cap: sync sock recv cb and release landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation Revert "alpha: don't leak hardware-fabricated FP exception bits to user space" Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally" selftests/landlock: Add tests for whiteout object creation sunvdc: fix -EIO issue due to lack of retries net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg Revert "perf cs-etm: Avoid truncating AUX buffer sizes to int" Revert "perf cs-etm: Flush thread stacks after decoder reset" media: video-i2c: fix buffer queue ordering ipv6: Select best matching nexthop object in fib6_table_lookup() ipv6: Honor oif when choosing nexthop for locally generated traffic xfrm: propagate extack to all netlink doit handlers xfrm: add extack to verify_sec_ctx_len xfrm: add extack support to verify_newsa_info xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead xfrm: avoid RCU warnings around the per-netns netlink socket xfrm: fix compat ALLOCSPI request use-after-free xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() ARM: socfpga: select the PL310 erratum 753970 workaround RDMA/siw: Introduce siw_cep_set_free_and_put RDMA/siw: Cleanup siw_accept RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate IB/iser: Align coding style across driver IB/iser: Remove iser_reg_data_sg helper function IB/iser: Use iser_fr_desc as registration context IB/iser: reject a remote invalidation of an unregistered direction scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd IB/isert: wait for deferred control PDU completions before releasing the connection RDMA/mad: Fix receive buffer leak when PKey enforcement fails RDMA/irdma: Enforce local fence for IB_WR_REG_MR RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted dmaengine: sprd: Fix runtime PM reference leak in probe wifi: virt_wifi: free skb when disconnected wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path wifi: libipw: reject too-short beacon and probe responses wifi: libipw: reject too-short association responses IB/IPoIB: Avoid restoring OPER_UP after multicast flush wifi: cfg80211: check IP header size in cfg80211_classify8021d() soundwire: cadence_master: wait and cancel cdns->work before clock stop MIPS: Octeon: apply USB FDT fixups also when USB is modular dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask dma-coherent: report a failed reserved memory assignment dmaengine: Fix device kref underflow in dma_chan_put() dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() dmaengine: wait for RCU readers before releasing dma_device wifi: cfg80211: only group hidden BSSes with beacon entries wifi: cfg80211: don't filter by BSS type when removing stale entries wifi: mac80211: suppress chanctx warning for debugfs reset wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set wifi: mac80211: don't access the TSF of a down interface dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA RDMA/siw: Bound fragmented header copies by the remaining length netfilter: nft_nat: fully initialise new_addr in netmap setup netfilter: flowtable: hold reference on ct until flow is released drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr keys: fix lost wakeup when reaping a dead key type ALSA: pcm: set timer->private_data before registering the PCM timer Input: trackpoint - fix the inertia attribute name in the ABI document wifi: virt_wifi: don't transfer operstate before register ALSA: hda: trace PCM open only after assigning a stream btrfs: tree-checker: print dev extent offset in error message drm/msm/dsi: correct byte intf clock rate for 14nm DSI PHY drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation net: fddi: skfp: fix NULL deref when setting the MAC address while down wifi: brcmfmac: fix lost 802.1x TX completion wakeup tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). tcp: do not let tcp_rmem be set below 4096 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup pppoatm: ensure a writable skb header and linear data drop_monitor: synchronize tracepoint unregistration on error path drop_monitor: fix out-of-bounds write in reset_per_cpu_data() KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments ASoC: hdmi-codec: Report a change when the channel status moves net: netsec: fix device_node reference leak on phy_np net: lock the socket in sock_gettstamp() net: ethernet: cortina: Ack RX overrun interrupt correctly net: mvpp2: prevent buffer overflow in page_pool allocation Input: eeti_ts - publish the OF module alias drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 Input: xpad - add support for Victrix Pro BFG Controller Input: xpad - add support for Azeron devices Input: xpad - fix PDP Marvel Xbox 360 controller ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY rds: ib: use rds_conn_drop() on protocol version mismatch tcp: exclude old ACKs from tcp fast path RDMA/ucma: Serialize join and leave on copy_to_user failure RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() openvswitch: avoid reallocating confirmed conntrack labels net: xfrm: reject unrepresentable espintcp transport headers kselftest/arm64: Fix size of thread_data values for pthread_join() arm64: percpu: Fix this_cpu_write() casting arm64: percpu: Fix this_cpu_and() mask generation Bluetooth: btusb: fix NXP IW610 composite device handling dmaengine: sun6i: fix non-atomic read of DMA position registers dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() ipv6: xfrm: use full sockets in local error paths net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value net/sched: hhf: cap hh_flows_limit at change time net/packet: clear RX owner on VNET header error net/packet: avoid truncating TPACKET_V3 private size keys: translate request_key_auth pid for the reading procfs instance KEYS: trusted: Fix tpm2_load_cmd() boundary check i2c: at91: release DMA channels on remove and probe error i2c: imx: release DMA channels on probe error IB/mlx4: Fix use-after-free on pkey sysfs registration failure selinux: always fill AVC decision in avc_has_perm_noaudit() mmc: core: Fix OF node reference leak on card add failure mmc: mxcmmc: cancel data work and watchdog on remove mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources mmc: sdio_uart: fix xmit_fifo leak when the port table is full mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt mmc: spi: reset bytes_xfered before retrying CRC failures mmc: sdhci_am654: Reset command and data lines on failed tuning Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 Input: evdev - zero absinfo before partial copy in EVIOCSABS Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() Input: soc_button_array - fix MS Surface Pro 11 probe failure Input: soc_button_array - check btns_desc->package.count Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Input: zero ff_effect before compat copy in input_ff_effect_from_user hwmon: (pmbus/core) increase number of phases and add new mask hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove hwmon: (w83793) release probe data through kref watchdog: digicolor: Avoid division by zero watchdog: msc313e: Fix premature reset during timeout update watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() wifi: brcmsmac: fix UAF in brcms_free_timer() wifi: iwlegacy: fix broadcast stations deallocation wifi: libertas_tf: fix UAF in lbtf_free_adapter() wifi: rsi: fix heap OOB write on key removal wifi: wlcore: release runtime PM ref on regdomain config failure wifi: wilc1000: fix out-of-bounds read in P2P public action frames wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() wifi: p54: validate curve data length in the calibration curve converters wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length wifi: mwifiex: validate scan response extents wifi: mwifiex: validate action frame fixed fields wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver drm/gud: fix out-of-bounds write in gud_plane_atomic_check() drm/msm/adreno: fix autosuspend cleanup during teardown drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure HID: logitech-hidpp: fix race condition when accessing stale stack pointer spi: spi-zynqmp-gqspi: stop the controller on shutdown spi: zynqmp-gqspi: Use devm_spi_alloc_host() erofs: Fix detection of atomic context erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC HID: hyperv: streamline driver probe to avoid devres issues bpf: Fix bpf_skb_change_tail wrt csum partial skbs bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL bpf: support access variable length array of integer type bpf: Fix divide-by-zero in btf_struct_walk() HID: elecom: fix bus type for M-XGL20DLBK bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() bpf: Fix out-of-bounds read of rtt_min in sock_ops HID: amd_sfh: Move common macros and structures HID: amd_sfh: Validate PCI BAR size before mapping squashfs: Add dictionary size range check to prevent shift-out-of-bounds Bluetooth: SMP: reject Security Request over BR/EDR Documentation: s390: correct spelling docs: s390/pci: Improve and update PCI documentation s390/pci/docs: Fix sriov_numvfs attribute name s390/cio: Fix cio_update_schib() to not cache invalid schib s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points xsk: Use a 32-bit compare in xsk_map_gen_lookup libbpf: Fix an error in 64bit relocation value computation bpf: Restrict CO-RE poisoning to relocatable instructions netfilter: flowtable: allow unidirectional rules netfilter: flowtable: publish HW_DEAD after worker is done netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation netfilter: nfnetlink_queue: hold nfnl mutex in event notifier netfilter: nft_synproxy: use the family-aware checksum helper ipvs: revalidate ihl before icmp_send ocfs2: make ocfs2_calc_xattr_init() return void drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update drm/nouveau/clk: don't clobber reclock status when restoring volt/fan net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure net: gue: reject invalid REMCSUM offsets ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). sctp: avoid livelock while updating retransmit path net: usb: catc: bound the RX packet length in catc_rx_done() net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget drm/virtio: fix object leak when drm_gem_handle_create() fails drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() drm/virtio: release the GEM object on virtio_gpu_vram_create() errors Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() net: usb: sr9700: include receive overhead in the length check tg3: clean up PHYLIB resources on probe failure s390/debug: Do not register views for failed static debug areas s390/debug: Fix NULL pointer dereference in debug_info_copy() net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error bpf: Fix bpf_sock context code generation bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc sctp: hold asoc or transport before mod_timer() in timer handlers net: stmmac: selftests: Support running selftests on DSA conduits net: stmmac: selftests: Check the dev->features for S-TAG offload testing net: stmmac: selftests: Capture all packets for vlan checks net: stmmac: Remove some unnecessary void pointers net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K nfc: nfcmrvl: validate helper command length before pull nfc: st21nfca: remove redundant assignment to variable i nfc: st21nfca: validate received frame size nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() selftests: nci: Correct pthread_create return value check nfc: llcp: Fix race condition in accept_queue lifecycle selftests: nci: Fix uninitialized family ID on missing attribute selftests/nci: Fix out-of-bounds store on thread join nfc: virtual_ncidev: Add missing ioctl compat handler nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc: st21nfca: validate ISO15693 inventory length nfc: llcp: fix -ENOMEM on connect with zero-length service name nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() veth: manage XDP program pointers during channel resize net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr ip_gre: Reject enabling collect metadata through changelink net: xps: reject an out of range traffic class tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() net/smc: fix UAF on lgr list traversal in smcr_port_err() tipc: Fix a data race on mon->peer_cnt in mon_timeout() llc: fix skb UAF and leaks on llc_mac_hdr_init() failure bridge: check llc_mac_hdr_init() return value in br_send_bpdu() net/sched: sch_teql: fix shadowed err in __teql_resolve() vlan: ensure sufficient headroom in vlan_dev_hard_header() autofs: fix sbi->pipe file reference leak in autofs_kill_sb() rculist: add list_splice_rcu() for private lists netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase KVM: x86/mmu: Use a bool for direct KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() KVM: MMU: update comment on the number of page role combinations KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct KVM: X86: Calculate quadrant when !role.gpte_is_8_bytes KVM: X86: Rename gpte_is_8_bytes to has_4_byte_gpte and invert the direction KVM: x86/mmu: Derive shadow MMU page role from parent KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes UBUNTU: SAUCE: Revert "KVM: x86: Fix shadow paging use-after-free due to unexpected role" KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() KVM: x86: Fix shadow paging use-after-free due to unexpected GFN KVM: x86: Fix shadow paging use-after-free due to unexpected role KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page x86/mm: Fix check/use ordering in switch_mm_irqs_off() x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow sctp: discard the rest of the packet on a stale-cookie error af_packet: fix integer overflow in prb_calc_retire_blk_tmo() fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT workqueue: Fix NULL current_pwq deref in flush dependency check writeback: report a Tasks-RCU quiescent state per cgwb drain pass fsl/fman: Fix clk reference leak in read_dts_node() ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() gpio: zynq: fix runtime PM leak on request error path llc: reserve device headroom for allocated frames rds: ib: Clear the sg list when mapping an MR fails drm/nouveau: fix autosuspend cleanup during teardown drm/nouveau: Fix bridge reference leak in nv1a_ram_new() drm/nouveau: fix double-free in nvif_vmm_dtor drm/nouveau: Fix gem reference leak in validate_init() drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() HID: alps: fix use-after-free on input2 registration failure HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() net/sched: reject IDR error pointers when deleting actions net: arp: terminate device name before lookup net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry net: atl1c: fix soft lockup on out-of-range tpd_cons read net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist netfilter: ip6t_rpfilter: reject routes without inet6_dev netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read nfc: fix use-after-free in nfc_get_local_general_bytes nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() nfc: port100: reject frames whose declared length exceeds the received data scsi: libiscsi_tcp: Check the data direction of a Data-In PDU pinctrl: single: free the IRQ on domain creation failure s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() Bluetooth: hci_sock: validate event length before filtering Bluetooth: hci_sock: reject out-of-range OCF values Bluetooth: L2CAP: validate frame length before control and FCS access Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO xfs: fix blockgc group quota scanning when usrquota isn't enforced net: tls: fix silent data drop under pipe back-pressure eventpoll: don't decrement ep refcount while still holding the ep mutex file: add fput() cleanup helper eventpoll: use hlist_is_singular_node() in __ep_remove() eventpoll: split __ep_remove() eventpoll: kill __ep_remove() eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() eventpoll: rename ep_remove_safe() back to ep_remove() eventpoll: move epi_fget() up eventpoll: fix ep_remove struct eventpoll / struct file UAF perf test: Change all remaining #!/bin/sh to #!/bin/bash tools/thermal/tmon: Fix compilation warning for wrong format lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() Linux 5.15.222 UBUNTU: Upstream stable to v5.15.222 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169603/+subscriptions