[Bug 2169638] Re: Resolute update: upstream stable patchset 2026-10-05

** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Changed in: linux (Ubuntu Resolute) Importance: Undecided => Medium ** Changed in: linux (Ubuntu Resolute) Status: New => In Progress ** Changed in: linux (Ubuntu Resolute) Assignee: (unassigned) => Alice C. Munduruca (cremfuelled) ** Description changed: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-10-05 + + Ported from the following upstream stable releases: + v6.18.52, v6.18.53, v7.2.6, v7.2.7 + from git://git.kernel.org/ + + perf record: Fix teardown hang on system-wide multi-threaded sessions + clk: spacemit: k3: fix parent clock of UFS aclk + esp: do not unref managed frag pages in esp_ssg_unref() + RDMA/rvt: Return NULL after port allocation failure + tools/sched_ext: scx_flatcg: Fix uninitialized stats on allocation failure + fs/resctrl: Fix UAF from worker threads when domains are removed + arm64: dts: renesas: rzt2h-n2h-evk: Remove unused MII/GMII pins + cxl/features: Serialize multi-part Get/Set Feature transfers + wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback + wifi: ath12k: fix MLO peer delete race + wifi: ath12k: fix rx_mpdu_start layout for QCC2072 + firmware: arm_scmi: Clear SystemPower flag on create failure + firmware: arm_scmi: Fix OF node reference handling + firmware: arm_scmi: Fix SCMI device destroy lifetimes + PCI: keystone: Fix OF node reference leak in init + media: ti: vpe: Select V4L2_FWNODE for VIP + OPP: Fix cleanup ordering + drm/amd/display: remove duplicate link_dp_panel_replay.h include + arm64: dts: qcom: milos: Add reset for sdhc_2 + perf sched: Add missing perf_session__delete() + perf sched: Fix memory leaks in perf sched stats report + perf sched: Free subcommand string after perf sched stats + drm/solomon: remove unneeded variables in blit functions + perf stat: Fix duplicate output with --for-each-cgroup + gpu: host1x: Avoid double device_add when clients already present + drm/msm/a6xx: Fix IRQ storm during msm_recovery test + bpf: Sync tail_call_reachable with callee state on entry + crypto: aspeed - Propagate platform_get_irq() errors + tlclk: if sscanf() fails, fall back to 0, not random value + gpib: use 'static inline' instead of 'extern inline' + vfio: selftests: Add helper to set/override a vf_token + vfio: selftests: Avoid VLAs + soc: ti: knav_qmss_queue: Implement resource cleanup in remove() + soc: ti: knav_qmss: Remove debugfs file on teardown + drm/v3d: Drop unused drm_encoder.h include from v3d_drv.h + drm/v3d: Extract v3d_job_add_syncobjs() helper + drm/v3d: Migrate BO reservation locking to DRM exec + drm/v3d: Introduce struct v3d_submit and convert CL/TFU/CSD ioctls + drm/v3d: Make v3d_get_cpu_indirect_csd_params() a pure parser + drm/v3d: Convert submit helpers to operate on struct v3d_submit + drm/v3d: Associate BOs with every job that accesses them + bpf: Disallow interpreter fallback for arena-related insns + bpf: Disallow interpreter fallback for gotox insn + bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn + samples: rust: debugfs: fix excessive stack use + selftests/bpf: Fix make install target + ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() + wifi: ath12k: advertise ieee_link_id in vdev start MLO params + wifi: ath12k: fix ML-STA authentication timeout on QCC2072 + wifi: ath12k: fix survey indexing across bands + riscv: dts: spacemit: set console baud rate on K3 Pico-ITX board + gpu: nova-core: correct RISC-V HALTED field + clk: sunxi-ng: mux: fix determine helper rate propagation + ASoC: spacemit: rename clock inputs to match binding + perf evsel: Add bounds checking to trace point raw data accessors + perf trace: Correct default cpumask formatting to hexadecimal + bpf: Fix WARNING in bpf_tracing_link_release + selftests/bpf: Fix missing allocation null checks in test_progs.c + pinctrl: Kconfig: drop unneeded dependencies on OF_GPIO + pinctrl: PINCTRL_STMFX should depend on CONFIG_OF + pinctrl: fix unmet dependencies from missing GPIOLIB + liveupdate: reject nonzero reserved value for SESSION_FINISH + liveupdate: Reference count outgoing FLB data + liveupdate: Remember FLB retrieve() status + pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip + scsi: ufs: core: Validate string descriptors + scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags + scsi: ufs: rpmb: Validate request frame length before parsing + ACPI: bus: Avoid confusing complaints regarding missing _OSC features + PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node + PCI/pwrctrl: tc9563: Power off only the external ports in tc9563_pwrctrl_disable_port() + gpu: nova-core: build SetRegistry entries dynamically + gpu: nova-core: fix packed registry table size + perf ui hists: In report UI ensure thread is set with reference counting + remoteproc: qcom: pas: Add late attach support for subsystems + remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side + iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() + PCI: Make pci_match_one_device() match on ID instead of device + PCI: Fix dyn_id add TOCTOU + PCI: Fix UAF when probe runs concurrent to dyn ID removal + clk: rockchip: Fractional PLL coefficient on RK3588/RK3576 is two's complement + clk: spacemit: k3: fix missing /2 factor in i2s sysclk dividers + RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() + nvmet: fix return status of RMI log page on allocation failure + nvme-pci: return error when parsing a quirk string fails + drm/panthor: Add vm_bind region with kbo range overlap check + wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() + media: qcom: iris: Remove duplicate HFI_PROP_OPB_ENABLE entry + s390/vdso: Pass --eh-frame-hdr to the linker + regulator: tps65185: handle gpiod_get_value_cansleep() error returns + md/raid5: fix lockless max_nr_stripes reads + md: remove REQ_NOWAIT support from raid1/10/456 + md/raid1: restrict atomic write limits and handle runtime constraints + PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup() + soc: qcom: pmic_glink_altmode: Define the TBT extradata properly + arm64: dts: qcom: talos: Fix cpu6 1094.4MHz OPP frequency typo + arm64: dts: qcom: kaanapali: Fix the PCIe iommu-map entries + arm64: dts: qcom: monaco: Fix the PCIe iommu-map entries + arm64: dts: qcom: qcs6490-radxa-dragon-q6a: Fix the PCIe iommu-map entries + platform/chrome: lightbar: Limit payload to max packet size + clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model + clk: qcom: dispcc-qcm2290: Enable runtime PM support + clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs + clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs + clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values + clk: qcom: gpucc-qcm2290: Drop pm_clk handling + clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model + clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe + iomap: avoid memset iomap when iter is done + iomap: release the folio batch on iomap callback failures + wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() + wifi: mt76: mt792x: add common USB transport reset helpers + wifi: mt76: mt7921u: escalate broken USB transport to device reset + wifi: mt76: mt792x: stop USB register access after bus hang + wifi: mt76: connac: add NAN connection type + wifi: mt76: add init_wiphy callback + wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete + wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll + wifi: mt76: fix HE DCM max-RU capability encoding + wifi: mt76: fix out-of-bounds access in mmio copy helpers + wifi: mt76: decode the full VHT Rx STBC capability field + wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode + wifi: mt76: cancel reset and rc work on device unregister + wifi: mt76: report data NSS for STBC frames in RX rate decode + drm/msm/dpu: Fix DMA SSPP REC block offsets on DPU v13 + ARM: tegra: Fix OF node reference leaks in IRQ init + arm64: tegra: Fix CMDQV interrupt type on Tegra264 + perf unwind-libdw: Fix unwinding of multi-threaded processes + perf libdw: Fix outer-frame name resolution and spurious "(inlined)" tag + bpf: Reject >8 byte return values on return-reading trampoline paths + wifi: mt76: mt7996: clear stale link state on full reset + wifi: mt76: add offchannel check to mt76_roc_complete + wifi: mt76: check chanctx before restoring channel after ROC + wifi: mt76: optimize ROC for same-channel case + wifi: mt76: send nullfunc PS frames on offchannel transitions + wifi: mt76: set MT76_SCANNING when starting a hw scan + wifi: mt76: mt7996: do not leave state behind after a failed WED attach + wifi: ath12k: fix encrypted EAPOL TX in encap offload mode + arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry + wifi: nl80211: clean up color-change beacon data on errors + wifi: brcmfmac: fix P2P action frame handling without device vif + bpf: Fix mmap_lock deadlock on arena lock failure + objtool/klp: Fix module name normalization for paths with dots + objtool/klp: Normalize Module.symvers paths to module names + objtool/klp: Fix false module dependencies caused by dead relocs + objtool/klp: Extricate checksum calculation from validate_branch() + objtool/klp: Create empty checksum sections for function-less object files + objtool/klp: Fix --debug-checksum for duplicate symbol names + objtool/klp: Add "objtool klp checksum" subcommand + livepatch/klp-build: support patches that add/remove files + livepatch/klp-build: switch to GNU patch and recountdiff + livepatch/klp-build: report patch validation fuzz + klp-build: Suppress excessive fuzz output by default + modpost: Add __llvm_covfun and __llvm_covmap to section_white_list + objtool/klp: Remove "objtool --checksum" + objtool: Grow __cfi_* prefix symbols for all CFI+CALL_PADDING + UBUNTU: [Config] Remove PREFIX_SYMBOLS from configs. + objtool/klp: Add .klp.symid for sympos disambiguation + klp-build: Print "objtool klp diff" command in verbose mode + klp-build: Use "objtool klp checksum" subcommand + objtool/klp: Fix symbol resolution for duplicate data symbols + powerpc/xive: make xive IPI allocation NULL-safe + powerpc/xive: add error return value to xive_smp_probe() + powerpc/xive: propagate IPI init errors to prevent use-after-free + serial: core: do fallible allocations before the console can be registered + serial: core: clear freed pointers on uart_register_driver() failure + tty: skip cdev_del() when no cdev is registered + PCI: dwc: ep: Flush cached MSI write before unmapping the iATU + PCI: dwc: ep: Fix unmap potentially unmapping the wrong iATU + HID: asus: refactor the two workqueues and init sequence + HID: asus: fix a off-by-one in mcu_parse_version_string() validation + HID: logitech-hidpp: Fix FF device cleanup on init failure + block/blk-iolatency: account per-cpu latency stats over possible CPUs + ublk: validate auto buf reg before taking uring_cmd + ocfs2: validate inline xattr header before ibody lookups + ocfs2: validate inline xattrs during inode block validation + ocfs2: validate external xattr entries when reading metadata + ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full() + ublk: clear auto buf reg before updating io->buf in batch commit + ALSA: hda/realtek: ALC269 fixup for Yoga/Legion Mic noise + PCI/sysfs: Add static PCI resource attribute macros + PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers + selftests/mm: fix mmap() return value check in run_migration_benchmark + selftests/mm: fix memleak in migration benchmark + arm64: dts: qcom: sa8540p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sdm845: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sdm850: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sm8150: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sm8250: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sm8350: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sm8450: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sm8550: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: qcm6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: qcs6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sc7180: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sc7280: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sc8180x: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: hamoa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: purwa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sm8650: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sm8750: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: lemans: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies + arm64: dts: qcom: sa8155p-adp: Fix swapped USB and UFS QMP PHY vdda-phy/vdda-pll supplies + thermal: hwmon: Remove hwmon class device along with its parent + xen/xenbus: check otherend_id only after it has been initialized + perf header: Use write lock when translating BPF prog info pointers + ocfs2/heartbeat: fix slot mapping rollback leaks on error paths + ocfs2: o2hb: quiesce negotiate handlers and timeout work + bpf: Factor callchain_store function from __bpf_get_stack + bpf: Factor callchain_finalize function from __bpf_get_stack + bpf: Remove trace_in argument from __bpf_get_stack + bpf: Clear buf on error in __bpf_get_task_stack + perf c2c: Fix error masking, OOM, and unchecked caller errors in hpp_list__parse() + perf c2c: Clean up registered formats on c2c_hists__init() and c2c_hists__reinit() failure + drm/sun4i: Fix V3s YUV scanline size + drm/sun4i: vi scaler: Restore opaque alpha in video modes + drm/sun4i: tcon-top: Keep mixer routes distinct + drm/sun4i: Drop node references while building component list + soundwire: cadence_master: add BRA_NumBytes[8] support + tools: Ensure tools copy of linux/filter.h exports the UAPI + drm/gfx12: Program DB_RING_CONTROL + drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 + drm/amd/display: Resize MST HDCP per-connector arrays to 32 + ALSA: hda: cix-ipbloq: Avoid build with 32bit archs + phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure + PCI: cadence: Fix host/endpoint dependencies for cadence-plat driver + selftests/mm: unpoison pages in memory-failure teardown + ext4: teach ext4_meta_trans_blocks() about number of allocated extents + ext4: fix transaction overflow during writeback + coresight: etm4x: Set active path on target CPU + coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable + arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt + arm_mpam: Disable driver unbind to avoid UAF + ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC + scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver + scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails + btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock + btrfs: check if root is readonly when setting posix acl + btrfs: zoned: flush active metadata block group at btree_writepages() start + perf sched: Suppress latency table output when trace samples are missing + perf header: Add utility to convert feature number to a string + perf header: Refactor pipe mode end marker handling + perf sched: Handle missing trace samples in pipe mode + Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind + perf script: Fix metric_evlist leak in script_find_metrics + perf tools: Fix sb_evlist leaks in top and record + perf python: Fix memory leak in pyrf_evlist__get_pollfd + perf python: Validate attribute setters in pyrf_evsel + perf python: Fix count_values memory leak in pyrf_evsel__read + apparmor: fix integer overflow in verify_tags() bounds check + iommu/vt-d: Fix iopf_refcount leak on RID domain replacement + netfilter: nft_ct: support expectation creation for natted flows + netfilter: nf_conntrack_helper: add refcounting from datapath + netfilter: nft_ct: move custom expectation support to helper + nfsd: add protocol support for CB_NOTIFY + lockd: Regenerate NLMv4 XDR code + xdrgen: Emit a blank line ahead of enum declarations + xdrgen: Add XDR width macros for short integer types + NFS: Return a delegation the client fails to record + selftests/cgroup: Avoid awk -e in cpuset tests + pinctrl: rockchip: Decode drive strength in the get function + selftests: drv-net: Test queue stall upon reconfig + selftests: drv-net: so_txtime: remember to deploy the binaries + selftests: drv-net: so_txtime: only send test traffic to sch_etf + apparmor: fix unconfined user namespace restriction forced stack + phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpc + phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rate + phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow + phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRL + phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changes + bpf: Compare iterator types during state pruning + objtool/klp: Fix vmlinux .klp.symid link error for .no_trim_symbol symbols + objtool/klp: Fix size of empty special section entries + objtool/klp: Ignore replacement offset of empty x86 alternatives + objtool/klp: Fix cross-module klp relocation section naming + objtool/klp: Don't match local symbols against exports + objtool/klp: Fix relocations for EXPORT_SYMBOL_FOR_MODULES() symbols + iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit + arm64/efi: Avoid voluntary preemption with efi_mm installed + mfd: cs42l43: Fix regmap defaults ordering + backlight: aw99706: Validate all DT property values consistently + backlight: ktd2801: Fix unmet dependency on GPIOLIB + bpf, riscv: Clear fetch destination on faulting arena atomic + bpf, x86: Clear fetch destination on faulting arena atomic + bpf: Derive the atomic load register in one place + bpf, arm64: Clear fetch destination on faulting arena atomic + bpf, s390: Clear fetch destination on faulting arena atomic + ASoC: spacemit: advertise only DMA-backed DAI streams + objtool/klp: Fix vmlinux .klp.symid link error for .exitcall.exit symbols + power: supply: bd71815: Fix temperature reading + power: supply: bd71828: Fix current direction + power: supply: bd71828: Drop duplicate power-supply property + power: supply: bd71828: Do not hide errors + selftests: drv-net: so_txtime: fix qdisc replace with handle + sched/isolation: Defer freeing of cpumask memblock memory to initcall + clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type + nvmet: fix max_qid race between configfs and controller allocation + HID: tmff: Use 64-bit arithmetic for force feedback scaling + bpf: Fix arm64 KASAN false positive after bpf_throw + ACPI: bus: Introduce acpi_bus_get_primary_device() + ACPI: platform: Use acpi_bus_get_primary_device() + ACPI: scan: Use acpi_bus_get_primary_device() + selftests/bpf: Fix selftest build after filter.h update + sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable() + blk-iolatency: clear delay state when freeing policy data + blk-iocost: clear delay state when freeing policy data + bpf: Check pointer type for all atomic RMW paths + ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() + smb/server: abort initialization when proc setup fails + smb/server: call ksmbd_proc_cleanup() on module init failure + smb/server: fix memory leak in ksmbd_vfs_set_durable_owner() + objtool/klp: Fix vmlinux klp relocations for EXPORT_SYMBOL_FOR_MODULES() + ksmbd: safely discard unregistered deferred locks + ksmbd: validate SMB2 write offsets + ksmbd: fix encrypted request lookup on bound channels + ksmbd: scope session state changes to bound connections + ksmbd: add procfs monitoring for active shares + smb/server: warn if ksmbd_proc_create() fails + smb/server: update session counter under sessions table lock + smb/server: fix session counter on session removal + selftests/bpf: Retry stat generation in cgroup_iter_memcg + NFS: Fix delayed delegation return list handling + regulator: tps65185: wait for the IC to wake before the first I2C access + can: m_can: Use of_property_present() for wakeup-source + ionic: add missing dma_rmb() after the completion publish check + virtio_net: Fix resize of the RX ring + netfilter: ctnetlink: do not expose expectation DEAD flag + i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode + smb: client: set replay flag on the read send-error retry path + irqchip/gic-v5: Clear per-CPU IRS data on teardown + irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing + irqchip/gic-v5: Disable IRSes on probe failures + irqchip/gic-v5: Release IRS iomem region on driver init failure + irqchip/gic-v5: Defer default SPI and LPI IAFFID programming + drm/xe: don't WARN on kernel job timeout when device already wedged + ip6mr: do not clone dst in ip6mr_cache_report() + powercap: intel_rapl: Sign-extend the PMU delta on counter wraparound + net: bridge: arp/nd proxy: fix reading neigh ha + vxlan: fix reading neigh ha + NFSv4.1: zero referring call lists before decoding + ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS + net/sched: account classifier filter allocations to memcg + net: hibmcge: fix page_pool DMA direction mismatch + net/sched: sch_cake: fix autorate reconfiguration throttling + fuse: use release/acquire for fch->initialized + fuse: Fix the condition to enable over-io-uring + f2fs: use adjusted write range after f2fs_write_checks() + Bluetooth: L2CAP: access chan->conn safely in get/setsockopt + Bluetooth: hci_sync: add conditional locking annotations + Bluetooth: do not leak an hci_conn when a second LE connect is rejected + net: enetc: extract common helpers for MAC promiscuous mode setting + net: enetc: extract common helpers for MAC hash filter configuration + net: enetc: remove invalid code from enetc4_pl_mac_link_up() + net: enetc: restore RX ring congestion mode for ENETC v4 + net: mana: Cap MSI-X vectors to the device MSI-X table size + octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init() + smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() + smb/client: pass cifs_open_info_data to SMB2_open() + smb/client: preserve open info type across compound queries + selftests/mm: fix read_file() return value check + of/irq: Fix device node refcount leak in of_irq_get_affinity() + net: phy: air_en8811h: move LED GPIO configuration to config_init + netfilter: nf_tables: skip double clone set expressions on element insert + net: stmmac: selftests: Don't test flow control for small rx fifos + Revert "esp: do not unref managed frag pages in esp_ssg_unref()" + perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflow + perf ui hists: Fix dso_filter reference leak and exit zoom cleanup + perf python: Add missed explicit dependencies + EDAC/igen6: Fix Raptor Lake-P logged error address + nvme: add context annotations for nvme_subsystem::lock + nvme: set ns->head in nvme_alloc_ns_head + nvme: fix racy access to FDP placement id array + selftests/cgroup: set the test plan after the setup checks + bpf: Fix BPF_F_CPU validation for sparse CPU IDs + bpf: Fix percpu map update indexing with sparse CPU IDs + printk: Don't WARN on kthread_run failure. + selftests/cgroup: Drop invalid boot isolation comparison + cgroup/cpuset: Preserve boot-isolated CPUs on partition release + accel: ethosu: Don't read the U65 rounding mode as a storage mode + bpf: check_cond_jmp_op(): properly infer if register is null + net: stmmac: helpers for filling tx_q->tx_skbuff_dma + net: stmmac: add helper to get hardware transmit descriptor + net: stmmac: fix dma mapping leak in stmmac_tso_xmit() + scsi: ufs: core: Introduce a new ufshcd vops negotiate_pwr_mode() + smb/client: fix stale page cache in insert/collapse range + smb/client: invalidate fscache for fallocate range operations + netfs: Fix readahead synchronisation issues by loading all folios upfront + netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs + netfs: Fix read progress reporting + drm/i915/cdclk: Fix dg2_power_well_count() return type + ovl: return EINVAL instead of EIO in case of mismatched user_ns + smb/server: cancel async requests when closing connection + ksmbd: safely drain sessions during logoff + ksmbd: fix listener task lifetime on netdev events + s390/pai: Reduce excessive debug feature size + ASoC: ab8500: Skip missing DMIC GPIOs on AB8505 + drm/pagemap: Prevent double migration of device pages + drm/pagemap: Reset migration page count on eviction retry + rust: samples: add missing newlines in rust_print_main + klp-build: Fix wrong index in funcs cleanup error path + objtool/klp: Fix checksums for constant pool references + ipv6: mcast: fix delay calculation in igmp6_join_group() + ipv6: mcast: use rcu_assign_pointer() for __rcu list updates + ipv6: mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show() + net: bonding: annotate lockless writes with WRITE_ONCE() + ASoC: cs35l56: Request IRQ in cs35l56_common_probe() + ASoC: cs35l56: Fix probe deadlock waiting for SoundWire enumeration + sched/core: Skip rq->avg_idle update without a valid idle_stamp + ksmbd: fix sparc build with atomic work state + bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge + bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks + net: macb: exclude software FCS from TX byte statistics + powerpc: Don't drop _TIF_RESTOREALL on syscall restart + bpf: Reject key-less BTF for hash maps + bpf: Mark syscall helpers as sleepable + ring-buffer: Add checking nr_subbufs to persistent ring buffer validation + nvme: print namespace IDs as unsigned 32bit value + nvmet: print namespace IDs as unsigned 32bit value + bpf: zero extend the result of an arena 32-bit cmpxchg + bpf: don't rewrite bpf_fastcall patterns entered by a jump + bpf: Don't infer non-NULL from a pointer with an unbounded offset + bpf: detect non null pointer with register operand in JEQ/JNE. + bpf: Mark the zero register precise for a register-form NULL check + bpf: Mark NULL kptr stores precise + bpf: Preserve inner map identity in callback frames + ring-buffer: Remove ring_buffer_per_cpu::mapped + tracing: Fix subbuf resize races with trace_pipe_raw readers + ring-buffer: Cap static ring buffer nr_pages + tracing: Fix comment in tracing_buffers_splice_read() + bpf: mark a NULL call argument precise + bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() + net/mlx5e: Fix reporting support for all RS FEC variants + erofs: delimit inode_share cache key components + iommu/riscv: Serialize command queue publishing + iommu/riscv: Avoid waiting on failed command enqueue + iommu/amd: Fix ineffective error check in nested domain allocation + regulator: pf1550: fix which regulator is notified + virtio_ring: fix stale descriptor flags after a failed packed add + vduse: validate virtqueue alignment + vhost: invalidate vring access on IOTLB transitions + vduse: return compat ioctl results directly + net: macb: zero the link settings taprio reads back + net: macb: reject an unknown link speed in the taprio setup + Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform + nstree: check listing permission before taking a namespace reference + drm/xe: Guard page-fault worker with runtime PM check + net: phylink: initialise link_state before a forced major config + drm/i915/dp: Gate UHBR SST SDP splitting on sink capability + block: Fix start and length check added to iov_iter_extract_bvecs() + ublk: clear force_abort in ublk_queue_reset_io_flags() + tracing: Fix ring_buffer_read_page_size() kernel-doc + x86/MCE/AMD: Fix inverted interrupt enablement during storm handling + ftrace: Use rcu_assign_pointer() for tmp_ops filter hash + tracing: Take trace_array reference when opening a tracer options file + tracing: Don't dereference trace_event_file in deferred trigger free + rust: num: seal Integer + rust: pin-init: use irrefutable pattern for `stack_pin_init` + riscv: hwprobe: initialize pair->value in hwprobe_one_pair() + drm/amdgpu: statically assign gart windows to ttm entities + drm/amdgpu: skip the VMID 0 flush for VRAM + accel: ethosu: Fix ethosu_job_open() return value + accel: ethosu: Drop IRQF_SHARED flag + accel: ethosu: Ensure cmd stream ends with a stop op + accel: ethosu: Ensure SRAM size is 0 on mapping failure + accel: ethosu: Validate SRAM size on submit + accel: ethosu: Ensure SRAM region size matches job + ata: pata_legacy: remove documentation for removed module parameters + drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 + drm/amd/display: Exit IPS before connector detection on resume + selftests: ublk: install test_common.sh and trace/ scripts + media: rkvdec: bound HEVC tile loops and PPS id to the array capacity + selftests: mptcp: lib: dump nstat for the right test + selftests: mptcp: lib: get counters for the right test + smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() + cifs: validate full SID length in security descriptors + smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid + smb: client: fix uid/gid override in getattr with posix extensions + smb: client: fix cifsFileInfo reference leak in deferred close + smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() + xfs: lock the healthmon when inserting unmount event + xfs: fix under-reservation of blocks when repairing sf directories + xfs: fix media verification ioctl for internal rt volumes + xfs: don't stash removename operations with unknown ftype + xfs: check healthmon outbuffer space correctly + xfs: bump lost_prev_errors if we lose even the healthmon lost event + xfs: always set xfs_healthmon::first_event when inserting at front of list + ASoC: cs35l56: Fix race between kexec and snd_soc_register_component() + hwmon: (asus_rog_ryujin) Add per-device configuration + hwmon: (asus_rog_ryujin) Validate HID report lengths + hwmon: (asus_rog_ryujin) Synchronize HID command and report handling + f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() + f2fs: fix to reset all pinned status during fggc + drm/i915/cdclk: Avoid spurious cdclk sanitization on PTL+ + accel/amdxdna: Disable device buffer exporting + drm/xe/i2c: Assert/Deassert I2C IRQ + drm/xe/i2c: Fix the interrupt handling + s390/pai: Use PAI PMU index as parameter replacing event + s390/pai: Move locking to event init and delete + s390/pai: Support CPU hotplug for PMU PAI + UBUNTU: Upstream stable to v6.18.52, v6.18.53, v7.2.6, v7.2.7 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169638 Title: Resolute update: upstream stable patchset 2026-10-05 Status in linux package in Ubuntu: Invalid Status in linux source package in Resolute: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-10-05 Ported from the following upstream stable releases: v6.18.52, v6.18.53, v7.2.6, v7.2.7 from git://git.kernel.org/ perf record: Fix teardown hang on system-wide multi-threaded sessions clk: spacemit: k3: fix parent clock of UFS aclk esp: do not unref managed frag pages in esp_ssg_unref() RDMA/rvt: Return NULL after port allocation failure tools/sched_ext: scx_flatcg: Fix uninitialized stats on allocation failure fs/resctrl: Fix UAF from worker threads when domains are removed arm64: dts: renesas: rzt2h-n2h-evk: Remove unused MII/GMII pins cxl/features: Serialize multi-part Get/Set Feature transfers wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback wifi: ath12k: fix MLO peer delete race wifi: ath12k: fix rx_mpdu_start layout for QCC2072 firmware: arm_scmi: Clear SystemPower flag on create failure firmware: arm_scmi: Fix OF node reference handling firmware: arm_scmi: Fix SCMI device destroy lifetimes PCI: keystone: Fix OF node reference leak in init media: ti: vpe: Select V4L2_FWNODE for VIP OPP: Fix cleanup ordering drm/amd/display: remove duplicate link_dp_panel_replay.h include arm64: dts: qcom: milos: Add reset for sdhc_2 perf sched: Add missing perf_session__delete() perf sched: Fix memory leaks in perf sched stats report perf sched: Free subcommand string after perf sched stats drm/solomon: remove unneeded variables in blit functions perf stat: Fix duplicate output with --for-each-cgroup gpu: host1x: Avoid double device_add when clients already present drm/msm/a6xx: Fix IRQ storm during msm_recovery test bpf: Sync tail_call_reachable with callee state on entry crypto: aspeed - Propagate platform_get_irq() errors tlclk: if sscanf() fails, fall back to 0, not random value gpib: use 'static inline' instead of 'extern inline' vfio: selftests: Add helper to set/override a vf_token vfio: selftests: Avoid VLAs soc: ti: knav_qmss_queue: Implement resource cleanup in remove() soc: ti: knav_qmss: Remove debugfs file on teardown drm/v3d: Drop unused drm_encoder.h include from v3d_drv.h drm/v3d: Extract v3d_job_add_syncobjs() helper drm/v3d: Migrate BO reservation locking to DRM exec drm/v3d: Introduce struct v3d_submit and convert CL/TFU/CSD ioctls drm/v3d: Make v3d_get_cpu_indirect_csd_params() a pure parser drm/v3d: Convert submit helpers to operate on struct v3d_submit drm/v3d: Associate BOs with every job that accesses them bpf: Disallow interpreter fallback for arena-related insns bpf: Disallow interpreter fallback for gotox insn bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn samples: rust: debugfs: fix excessive stack use selftests/bpf: Fix make install target ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() wifi: ath12k: advertise ieee_link_id in vdev start MLO params wifi: ath12k: fix ML-STA authentication timeout on QCC2072 wifi: ath12k: fix survey indexing across bands riscv: dts: spacemit: set console baud rate on K3 Pico-ITX board gpu: nova-core: correct RISC-V HALTED field clk: sunxi-ng: mux: fix determine helper rate propagation ASoC: spacemit: rename clock inputs to match binding perf evsel: Add bounds checking to trace point raw data accessors perf trace: Correct default cpumask formatting to hexadecimal bpf: Fix WARNING in bpf_tracing_link_release selftests/bpf: Fix missing allocation null checks in test_progs.c pinctrl: Kconfig: drop unneeded dependencies on OF_GPIO pinctrl: PINCTRL_STMFX should depend on CONFIG_OF pinctrl: fix unmet dependencies from missing GPIOLIB liveupdate: reject nonzero reserved value for SESSION_FINISH liveupdate: Reference count outgoing FLB data liveupdate: Remember FLB retrieve() status pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip scsi: ufs: core: Validate string descriptors scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags scsi: ufs: rpmb: Validate request frame length before parsing ACPI: bus: Avoid confusing complaints regarding missing _OSC features PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node PCI/pwrctrl: tc9563: Power off only the external ports in tc9563_pwrctrl_disable_port() gpu: nova-core: build SetRegistry entries dynamically gpu: nova-core: fix packed registry table size perf ui hists: In report UI ensure thread is set with reference counting remoteproc: qcom: pas: Add late attach support for subsystems remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() PCI: Make pci_match_one_device() match on ID instead of device PCI: Fix dyn_id add TOCTOU PCI: Fix UAF when probe runs concurrent to dyn ID removal clk: rockchip: Fractional PLL coefficient on RK3588/RK3576 is two's complement clk: spacemit: k3: fix missing /2 factor in i2s sysclk dividers RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() nvmet: fix return status of RMI log page on allocation failure nvme-pci: return error when parsing a quirk string fails drm/panthor: Add vm_bind region with kbo range overlap check wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() media: qcom: iris: Remove duplicate HFI_PROP_OPB_ENABLE entry s390/vdso: Pass --eh-frame-hdr to the linker regulator: tps65185: handle gpiod_get_value_cansleep() error returns md/raid5: fix lockless max_nr_stripes reads md: remove REQ_NOWAIT support from raid1/10/456 md/raid1: restrict atomic write limits and handle runtime constraints PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup() soc: qcom: pmic_glink_altmode: Define the TBT extradata properly arm64: dts: qcom: talos: Fix cpu6 1094.4MHz OPP frequency typo arm64: dts: qcom: kaanapali: Fix the PCIe iommu-map entries arm64: dts: qcom: monaco: Fix the PCIe iommu-map entries arm64: dts: qcom: qcs6490-radxa-dragon-q6a: Fix the PCIe iommu-map entries platform/chrome: lightbar: Limit payload to max packet size clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: dispcc-qcm2290: Enable runtime PM support clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values clk: qcom: gpucc-qcm2290: Drop pm_clk handling clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe iomap: avoid memset iomap when iter is done iomap: release the folio batch on iomap callback failures wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() wifi: mt76: mt792x: add common USB transport reset helpers wifi: mt76: mt7921u: escalate broken USB transport to device reset wifi: mt76: mt792x: stop USB register access after bus hang wifi: mt76: connac: add NAN connection type wifi: mt76: add init_wiphy callback wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll wifi: mt76: fix HE DCM max-RU capability encoding wifi: mt76: fix out-of-bounds access in mmio copy helpers wifi: mt76: decode the full VHT Rx STBC capability field wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode wifi: mt76: cancel reset and rc work on device unregister wifi: mt76: report data NSS for STBC frames in RX rate decode drm/msm/dpu: Fix DMA SSPP REC block offsets on DPU v13 ARM: tegra: Fix OF node reference leaks in IRQ init arm64: tegra: Fix CMDQV interrupt type on Tegra264 perf unwind-libdw: Fix unwinding of multi-threaded processes perf libdw: Fix outer-frame name resolution and spurious "(inlined)" tag bpf: Reject >8 byte return values on return-reading trampoline paths wifi: mt76: mt7996: clear stale link state on full reset wifi: mt76: add offchannel check to mt76_roc_complete wifi: mt76: check chanctx before restoring channel after ROC wifi: mt76: optimize ROC for same-channel case wifi: mt76: send nullfunc PS frames on offchannel transitions wifi: mt76: set MT76_SCANNING when starting a hw scan wifi: mt76: mt7996: do not leave state behind after a failed WED attach wifi: ath12k: fix encrypted EAPOL TX in encap offload mode arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry wifi: nl80211: clean up color-change beacon data on errors wifi: brcmfmac: fix P2P action frame handling without device vif bpf: Fix mmap_lock deadlock on arena lock failure objtool/klp: Fix module name normalization for paths with dots objtool/klp: Normalize Module.symvers paths to module names objtool/klp: Fix false module dependencies caused by dead relocs objtool/klp: Extricate checksum calculation from validate_branch() objtool/klp: Create empty checksum sections for function-less object files objtool/klp: Fix --debug-checksum for duplicate symbol names objtool/klp: Add "objtool klp checksum" subcommand livepatch/klp-build: support patches that add/remove files livepatch/klp-build: switch to GNU patch and recountdiff livepatch/klp-build: report patch validation fuzz klp-build: Suppress excessive fuzz output by default modpost: Add __llvm_covfun and __llvm_covmap to section_white_list objtool/klp: Remove "objtool --checksum" objtool: Grow __cfi_* prefix symbols for all CFI+CALL_PADDING UBUNTU: [Config] Remove PREFIX_SYMBOLS from configs. objtool/klp: Add .klp.symid for sympos disambiguation klp-build: Print "objtool klp diff" command in verbose mode klp-build: Use "objtool klp checksum" subcommand objtool/klp: Fix symbol resolution for duplicate data symbols powerpc/xive: make xive IPI allocation NULL-safe powerpc/xive: add error return value to xive_smp_probe() powerpc/xive: propagate IPI init errors to prevent use-after-free serial: core: do fallible allocations before the console can be registered serial: core: clear freed pointers on uart_register_driver() failure tty: skip cdev_del() when no cdev is registered PCI: dwc: ep: Flush cached MSI write before unmapping the iATU PCI: dwc: ep: Fix unmap potentially unmapping the wrong iATU HID: asus: refactor the two workqueues and init sequence HID: asus: fix a off-by-one in mcu_parse_version_string() validation HID: logitech-hidpp: Fix FF device cleanup on init failure block/blk-iolatency: account per-cpu latency stats over possible CPUs ublk: validate auto buf reg before taking uring_cmd ocfs2: validate inline xattr header before ibody lookups ocfs2: validate inline xattrs during inode block validation ocfs2: validate external xattr entries when reading metadata ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full() ublk: clear auto buf reg before updating io->buf in batch commit ALSA: hda/realtek: ALC269 fixup for Yoga/Legion Mic noise PCI/sysfs: Add static PCI resource attribute macros PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers selftests/mm: fix mmap() return value check in run_migration_benchmark selftests/mm: fix memleak in migration benchmark arm64: dts: qcom: sa8540p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sdm845: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sdm850: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8150: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8250: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8350: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8450: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8550: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: qcm6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: qcs6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sc7180: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sc7280: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sc8180x: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: hamoa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: purwa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8650: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8750: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: lemans: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sa8155p-adp: Fix swapped USB and UFS QMP PHY vdda-phy/vdda-pll supplies thermal: hwmon: Remove hwmon class device along with its parent xen/xenbus: check otherend_id only after it has been initialized perf header: Use write lock when translating BPF prog info pointers ocfs2/heartbeat: fix slot mapping rollback leaks on error paths ocfs2: o2hb: quiesce negotiate handlers and timeout work bpf: Factor callchain_store function from __bpf_get_stack bpf: Factor callchain_finalize function from __bpf_get_stack bpf: Remove trace_in argument from __bpf_get_stack bpf: Clear buf on error in __bpf_get_task_stack perf c2c: Fix error masking, OOM, and unchecked caller errors in hpp_list__parse() perf c2c: Clean up registered formats on c2c_hists__init() and c2c_hists__reinit() failure drm/sun4i: Fix V3s YUV scanline size drm/sun4i: vi scaler: Restore opaque alpha in video modes drm/sun4i: tcon-top: Keep mixer routes distinct drm/sun4i: Drop node references while building component list soundwire: cadence_master: add BRA_NumBytes[8] support tools: Ensure tools copy of linux/filter.h exports the UAPI drm/gfx12: Program DB_RING_CONTROL drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 drm/amd/display: Resize MST HDCP per-connector arrays to 32 ALSA: hda: cix-ipbloq: Avoid build with 32bit archs phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure PCI: cadence: Fix host/endpoint dependencies for cadence-plat driver selftests/mm: unpoison pages in memory-failure teardown ext4: teach ext4_meta_trans_blocks() about number of allocated extents ext4: fix transaction overflow during writeback coresight: etm4x: Set active path on target CPU coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt arm_mpam: Disable driver unbind to avoid UAF ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock btrfs: check if root is readonly when setting posix acl btrfs: zoned: flush active metadata block group at btree_writepages() start perf sched: Suppress latency table output when trace samples are missing perf header: Add utility to convert feature number to a string perf header: Refactor pipe mode end marker handling perf sched: Handle missing trace samples in pipe mode Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind perf script: Fix metric_evlist leak in script_find_metrics perf tools: Fix sb_evlist leaks in top and record perf python: Fix memory leak in pyrf_evlist__get_pollfd perf python: Validate attribute setters in pyrf_evsel perf python: Fix count_values memory leak in pyrf_evsel__read apparmor: fix integer overflow in verify_tags() bounds check iommu/vt-d: Fix iopf_refcount leak on RID domain replacement netfilter: nft_ct: support expectation creation for natted flows netfilter: nf_conntrack_helper: add refcounting from datapath netfilter: nft_ct: move custom expectation support to helper nfsd: add protocol support for CB_NOTIFY lockd: Regenerate NLMv4 XDR code xdrgen: Emit a blank line ahead of enum declarations xdrgen: Add XDR width macros for short integer types NFS: Return a delegation the client fails to record selftests/cgroup: Avoid awk -e in cpuset tests pinctrl: rockchip: Decode drive strength in the get function selftests: drv-net: Test queue stall upon reconfig selftests: drv-net: so_txtime: remember to deploy the binaries selftests: drv-net: so_txtime: only send test traffic to sch_etf apparmor: fix unconfined user namespace restriction forced stack phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpc phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rate phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRL phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changes bpf: Compare iterator types during state pruning objtool/klp: Fix vmlinux .klp.symid link error for .no_trim_symbol symbols objtool/klp: Fix size of empty special section entries objtool/klp: Ignore replacement offset of empty x86 alternatives objtool/klp: Fix cross-module klp relocation section naming objtool/klp: Don't match local symbols against exports objtool/klp: Fix relocations for EXPORT_SYMBOL_FOR_MODULES() symbols iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit arm64/efi: Avoid voluntary preemption with efi_mm installed mfd: cs42l43: Fix regmap defaults ordering backlight: aw99706: Validate all DT property values consistently backlight: ktd2801: Fix unmet dependency on GPIOLIB bpf, riscv: Clear fetch destination on faulting arena atomic bpf, x86: Clear fetch destination on faulting arena atomic bpf: Derive the atomic load register in one place bpf, arm64: Clear fetch destination on faulting arena atomic bpf, s390: Clear fetch destination on faulting arena atomic ASoC: spacemit: advertise only DMA-backed DAI streams objtool/klp: Fix vmlinux .klp.symid link error for .exitcall.exit symbols power: supply: bd71815: Fix temperature reading power: supply: bd71828: Fix current direction power: supply: bd71828: Drop duplicate power-supply property power: supply: bd71828: Do not hide errors selftests: drv-net: so_txtime: fix qdisc replace with handle sched/isolation: Defer freeing of cpumask memblock memory to initcall clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type nvmet: fix max_qid race between configfs and controller allocation HID: tmff: Use 64-bit arithmetic for force feedback scaling bpf: Fix arm64 KASAN false positive after bpf_throw ACPI: bus: Introduce acpi_bus_get_primary_device() ACPI: platform: Use acpi_bus_get_primary_device() ACPI: scan: Use acpi_bus_get_primary_device() selftests/bpf: Fix selftest build after filter.h update sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable() blk-iolatency: clear delay state when freeing policy data blk-iocost: clear delay state when freeing policy data bpf: Check pointer type for all atomic RMW paths ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() smb/server: abort initialization when proc setup fails smb/server: call ksmbd_proc_cleanup() on module init failure smb/server: fix memory leak in ksmbd_vfs_set_durable_owner() objtool/klp: Fix vmlinux klp relocations for EXPORT_SYMBOL_FOR_MODULES() ksmbd: safely discard unregistered deferred locks ksmbd: validate SMB2 write offsets ksmbd: fix encrypted request lookup on bound channels ksmbd: scope session state changes to bound connections ksmbd: add procfs monitoring for active shares smb/server: warn if ksmbd_proc_create() fails smb/server: update session counter under sessions table lock smb/server: fix session counter on session removal selftests/bpf: Retry stat generation in cgroup_iter_memcg NFS: Fix delayed delegation return list handling regulator: tps65185: wait for the IC to wake before the first I2C access can: m_can: Use of_property_present() for wakeup-source ionic: add missing dma_rmb() after the completion publish check virtio_net: Fix resize of the RX ring netfilter: ctnetlink: do not expose expectation DEAD flag i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode smb: client: set replay flag on the read send-error retry path irqchip/gic-v5: Clear per-CPU IRS data on teardown irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing irqchip/gic-v5: Disable IRSes on probe failures irqchip/gic-v5: Release IRS iomem region on driver init failure irqchip/gic-v5: Defer default SPI and LPI IAFFID programming drm/xe: don't WARN on kernel job timeout when device already wedged ip6mr: do not clone dst in ip6mr_cache_report() powercap: intel_rapl: Sign-extend the PMU delta on counter wraparound net: bridge: arp/nd proxy: fix reading neigh ha vxlan: fix reading neigh ha NFSv4.1: zero referring call lists before decoding ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS net/sched: account classifier filter allocations to memcg net: hibmcge: fix page_pool DMA direction mismatch net/sched: sch_cake: fix autorate reconfiguration throttling fuse: use release/acquire for fch->initialized fuse: Fix the condition to enable over-io-uring f2fs: use adjusted write range after f2fs_write_checks() Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Bluetooth: hci_sync: add conditional locking annotations Bluetooth: do not leak an hci_conn when a second LE connect is rejected net: enetc: extract common helpers for MAC promiscuous mode setting net: enetc: extract common helpers for MAC hash filter configuration net: enetc: remove invalid code from enetc4_pl_mac_link_up() net: enetc: restore RX ring congestion mode for ENETC v4 net: mana: Cap MSI-X vectors to the device MSI-X table size octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init() smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() smb/client: pass cifs_open_info_data to SMB2_open() smb/client: preserve open info type across compound queries selftests/mm: fix read_file() return value check of/irq: Fix device node refcount leak in of_irq_get_affinity() net: phy: air_en8811h: move LED GPIO configuration to config_init netfilter: nf_tables: skip double clone set expressions on element insert net: stmmac: selftests: Don't test flow control for small rx fifos Revert "esp: do not unref managed frag pages in esp_ssg_unref()" perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflow perf ui hists: Fix dso_filter reference leak and exit zoom cleanup perf python: Add missed explicit dependencies EDAC/igen6: Fix Raptor Lake-P logged error address nvme: add context annotations for nvme_subsystem::lock nvme: set ns->head in nvme_alloc_ns_head nvme: fix racy access to FDP placement id array selftests/cgroup: set the test plan after the setup checks bpf: Fix BPF_F_CPU validation for sparse CPU IDs bpf: Fix percpu map update indexing with sparse CPU IDs printk: Don't WARN on kthread_run failure. selftests/cgroup: Drop invalid boot isolation comparison cgroup/cpuset: Preserve boot-isolated CPUs on partition release accel: ethosu: Don't read the U65 rounding mode as a storage mode bpf: check_cond_jmp_op(): properly infer if register is null net: stmmac: helpers for filling tx_q->tx_skbuff_dma net: stmmac: add helper to get hardware transmit descriptor net: stmmac: fix dma mapping leak in stmmac_tso_xmit() scsi: ufs: core: Introduce a new ufshcd vops negotiate_pwr_mode() smb/client: fix stale page cache in insert/collapse range smb/client: invalidate fscache for fallocate range operations netfs: Fix readahead synchronisation issues by loading all folios upfront netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs netfs: Fix read progress reporting drm/i915/cdclk: Fix dg2_power_well_count() return type ovl: return EINVAL instead of EIO in case of mismatched user_ns smb/server: cancel async requests when closing connection ksmbd: safely drain sessions during logoff ksmbd: fix listener task lifetime on netdev events s390/pai: Reduce excessive debug feature size ASoC: ab8500: Skip missing DMIC GPIOs on AB8505 drm/pagemap: Prevent double migration of device pages drm/pagemap: Reset migration page count on eviction retry rust: samples: add missing newlines in rust_print_main klp-build: Fix wrong index in funcs cleanup error path objtool/klp: Fix checksums for constant pool references ipv6: mcast: fix delay calculation in igmp6_join_group() ipv6: mcast: use rcu_assign_pointer() for __rcu list updates ipv6: mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show() net: bonding: annotate lockless writes with WRITE_ONCE() ASoC: cs35l56: Request IRQ in cs35l56_common_probe() ASoC: cs35l56: Fix probe deadlock waiting for SoundWire enumeration sched/core: Skip rq->avg_idle update without a valid idle_stamp ksmbd: fix sparc build with atomic work state bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks net: macb: exclude software FCS from TX byte statistics powerpc: Don't drop _TIF_RESTOREALL on syscall restart bpf: Reject key-less BTF for hash maps bpf: Mark syscall helpers as sleepable ring-buffer: Add checking nr_subbufs to persistent ring buffer validation nvme: print namespace IDs as unsigned 32bit value nvmet: print namespace IDs as unsigned 32bit value bpf: zero extend the result of an arena 32-bit cmpxchg bpf: don't rewrite bpf_fastcall patterns entered by a jump bpf: Don't infer non-NULL from a pointer with an unbounded offset bpf: detect non null pointer with register operand in JEQ/JNE. bpf: Mark the zero register precise for a register-form NULL check bpf: Mark NULL kptr stores precise bpf: Preserve inner map identity in callback frames ring-buffer: Remove ring_buffer_per_cpu::mapped tracing: Fix subbuf resize races with trace_pipe_raw readers ring-buffer: Cap static ring buffer nr_pages tracing: Fix comment in tracing_buffers_splice_read() bpf: mark a NULL call argument precise bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() net/mlx5e: Fix reporting support for all RS FEC variants erofs: delimit inode_share cache key components iommu/riscv: Serialize command queue publishing iommu/riscv: Avoid waiting on failed command enqueue iommu/amd: Fix ineffective error check in nested domain allocation regulator: pf1550: fix which regulator is notified virtio_ring: fix stale descriptor flags after a failed packed add vduse: validate virtqueue alignment vhost: invalidate vring access on IOTLB transitions vduse: return compat ioctl results directly net: macb: zero the link settings taprio reads back net: macb: reject an unknown link speed in the taprio setup Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform nstree: check listing permission before taking a namespace reference drm/xe: Guard page-fault worker with runtime PM check net: phylink: initialise link_state before a forced major config drm/i915/dp: Gate UHBR SST SDP splitting on sink capability block: Fix start and length check added to iov_iter_extract_bvecs() ublk: clear force_abort in ublk_queue_reset_io_flags() tracing: Fix ring_buffer_read_page_size() kernel-doc x86/MCE/AMD: Fix inverted interrupt enablement during storm handling ftrace: Use rcu_assign_pointer() for tmp_ops filter hash tracing: Take trace_array reference when opening a tracer options file tracing: Don't dereference trace_event_file in deferred trigger free rust: num: seal Integer rust: pin-init: use irrefutable pattern for `stack_pin_init` riscv: hwprobe: initialize pair->value in hwprobe_one_pair() drm/amdgpu: statically assign gart windows to ttm entities drm/amdgpu: skip the VMID 0 flush for VRAM accel: ethosu: Fix ethosu_job_open() return value accel: ethosu: Drop IRQF_SHARED flag accel: ethosu: Ensure cmd stream ends with a stop op accel: ethosu: Ensure SRAM size is 0 on mapping failure accel: ethosu: Validate SRAM size on submit accel: ethosu: Ensure SRAM region size matches job ata: pata_legacy: remove documentation for removed module parameters drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 drm/amd/display: Exit IPS before connector detection on resume selftests: ublk: install test_common.sh and trace/ scripts media: rkvdec: bound HEVC tile loops and PPS id to the array capacity selftests: mptcp: lib: dump nstat for the right test selftests: mptcp: lib: get counters for the right test smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() cifs: validate full SID length in security descriptors smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid smb: client: fix uid/gid override in getattr with posix extensions smb: client: fix cifsFileInfo reference leak in deferred close smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() xfs: lock the healthmon when inserting unmount event xfs: fix under-reservation of blocks when repairing sf directories xfs: fix media verification ioctl for internal rt volumes xfs: don't stash removename operations with unknown ftype xfs: check healthmon outbuffer space correctly xfs: bump lost_prev_errors if we lose even the healthmon lost event xfs: always set xfs_healthmon::first_event when inserting at front of list ASoC: cs35l56: Fix race between kexec and snd_soc_register_component() hwmon: (asus_rog_ryujin) Add per-device configuration hwmon: (asus_rog_ryujin) Validate HID report lengths hwmon: (asus_rog_ryujin) Synchronize HID command and report handling f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() f2fs: fix to reset all pinned status during fggc drm/i915/cdclk: Avoid spurious cdclk sanitization on PTL+ accel/amdxdna: Disable device buffer exporting drm/xe/i2c: Assert/Deassert I2C IRQ drm/xe/i2c: Fix the interrupt handling s390/pai: Use PAI PMU index as parameter replacing event s390/pai: Move locking to event init and delete s390/pai: Support CPU hotplug for PMU PAI UBUNTU: Upstream stable to v6.18.52, v6.18.53, v7.2.6, v7.2.7 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169638/+subscriptions