[Bug 2169641] [NEW] Resolute update: upstream stable patchset 2026-10-06

Public bug reported: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-10-05 Ported from the following upstream stable releases: v6.18.54, v7.2.8 from git://git.kernel.org/ landlock: Fix TCP Fast Open connection bypass selftests/landlock: Add test for TCP fast open selftests/landlock: Use an actual chardev for MAKE_CHAR audit test selftests/landlock: Add tests for whiteout object creation selftests/landlock: Add audit test for whiteout object creation sunvdc: fix -EIO issue due to lack of retries media: video-i2c: fix buffer queue ordering ipv6: Select best matching nexthop object in fib6_table_lookup() ipv6: Honor oif when choosing nexthop for locally generated traffic xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() xfrm: iptfs: fix runt reassembly panic from short inner tot_len xfrm: fix compat ALLOCSPI request use-after-free xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() esp: downgrade zerocopy managed frags before mutating skb frags ARM: socfpga: select the PL310 erratum 753970 workaround RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept RDMA/rxe: validate access flags before swapping the MR's PD RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds RDMA/mlx5: Remove warn on missing representor in query_port_speed RDMA/core: Reject unregistering netdevs in ib_get_eth_speed power: sequencing: Fix build issue with COMPILE_TEST arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR IB/iser: reject a remote invalidation of an unregistered direction IB/isert: wait for deferred control PDU completions before releasing the connection RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup RDMA/mad: Fix receive buffer leak when PKey enforcement fails RDMA/irdma: Enforce local fence for IB_WR_REG_MR RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted dmaengine: sprd: Fix runtime PM reference leak in probe wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic wifi: virt_wifi: free skb when disconnected wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path wifi: brcmfmac: cyw: pass PMKID to firmware if present wifi: libipw: reject too-short beacon and probe responses wifi: libipw: reject too-short association responses IB/IPoIB: Avoid restoring OPER_UP after multicast flush wifi: cfg80211: don't get the radio mask for netdev-less wdevs wifi: cfg80211: check IP header size in cfg80211_classify8021d() soundwire: cadence_master: wait and cancel cdns->work before clock stop MIPS: Octeon: apply USB FDT fixups also when USB is modular dma-coherent: report a failed reserved memory assignment dmaengine: Fix device kref underflow in dma_chan_put() dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() dmaengine: wait for RCU readers before releasing dma_device wifi: cfg80211: don't free driver-owned scan requests wifi: cfg80211: only group hidden BSSes with beacon entries wifi: cfg80211: don't filter by BSS type when removing stale entries wifi: mac80211: don't start a ROC while scanning wifi: mac80211: don't warn when an IBSS has no channel to scan wifi: mac80211: don't offload TC setup on AP_VLAN interfaces wifi: mac80211: suppress chanctx warning for debugfs reset wifi: mac80211: abort chanswitch when leaving a mesh wifi: mac80211: reset state when starting AP fails wifi: cfg80211: restore netns_immutable on failures wifi: cfg80211: undo netns switch if renaming the wiphy fails wifi: mac80211: unlist vifs when their netdev is unregistered wifi: cfg80211: get the wiphy out of a dying network namespace wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping wifi: mac80211: don't allow injecting frames wider than the chanctx wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown wifi: mac80211: require a peer station for TDLS setup confirm wifi: mac80211: don't allow link changes when iface is down wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set wifi: mac80211: don't access the TSF of a down interface wifi: mac80211: add HE 6 GHz capability in the scan elems len wifi: mac80211: mesh: reset the CSA state when leaving wifi: mac80211: mesh: release the channel if start fails wifi: mac80211: set up the TX info early to fix failure paths mm: memblock: show all region flags in debugfs scsi: qla2xxx: Fix the ql2xfc2target parameter description dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA RDMA/efa: Keep admin queues alive while IRQ is registered RDMA/efa: Keep EQ resources alive while IRQ is registered RDMA/siw: Bound fragmented header copies by the remaining length drm/msm: Fix the separate_gpu_kms parameter description drm/msm/adreno: Fix the skip_gpu parameter description netfilter: nft_nat: fully initialise new_addr in netmap setup netfilter: nf_tables: fix device name and prefix match in hook lookup netfilter: nf_nat: unregister and release hooks on error netfilter: flowtable: hold reference on ct until flow is released perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations arm64: hibernate: clone only the linear map that exists at runtime drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr keys: fix lost wakeup when reaping a dead key type neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. neighbour: Add missing RCU annotation for neightbl_dump_info(). neighbour: Skip default parms when resumed in neightbl_dump_info(). ALSA: bcd2000: Fix race between rawmidi and disconnect phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting ALSA: pcm: set timer->private_data before registering the PCM timer drm/msm/dp: skip PUSH_IDLE when the link was never enabled drm/msm/dp: fix link bandwidth check when wide bus is enabled ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register Input: trackpoint - fix the inertia attribute name in the ABI document gpio: virtuser: skip free_irq when no IRQ is installed ALSA: usb: 6fire: Avoid embedded URBs ALSA: 6fire: fix OOB write from device-reported iso length wifi: virt_wifi: don't transfer operstate before register drm/xe/mmio_gem: forbid VMA split drm/xe/mmio_gem: use write-back mapping for dummy page drm/xe/mmio_gem: Revoke drm_vma_node on xe_mmio_gem destroy drm/xe/shrinker: Return the freed page count through a parameter drm/vc4: Use managed KMS polling to fix UAF on unbind ALSA: hda: trace PCM open only after assigning a stream wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() btrfs: tree-checker: print dev extent offset in error message drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation net: bcmgenet: convert RX path to page_pool net: bcmgenet: restore the hardware filters on open ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup net: fddi: skfp: fix NULL deref when setting the MAC address while down wifi: brcmfmac: fix lost 802.1x TX completion wakeup net: bridge: mst: move switchdev call outside rcu tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). tcp: do not let tcp_rmem be set below 4096 ksmbd: return buffer overflow for partial filesystem info ksmbd: fix partial file information responses ksmbd: keep compound responses on query info errors dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained Bluetooth: btintel_pcie: validate TX skb length in send_sync Bluetooth: coredump: Quiesce dump work on unregister Bluetooth: qca: Refactor code on the basis of chipset names Bluetooth: qca: enable pwrseq support for WCN39xx devices Bluetooth: hci_qca: Do not write to the serial port after it is closed Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). pppoatm: ensure a writable skb header and linear data drop_monitor: synchronize tracepoint unregistration on error path drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown drop_monitor: fix out-of-bounds write in reset_per_cpu_data() net: stmmac: do not overwrite phc_index when no PTP clock is registered KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba futex: Also allocate private hash on vfork() btrfs: handle lack of space when cleaning up verity items ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments ASoC: hdmi-codec: Report a change when the channel status moves ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers ASoC: sdw_utils: tidyup .count_sidecar ASoC: sdw_utils: tidyup asoc_sdw_parse_sdw_endpoints() ASoC: amd: acp: refactor codec config count in SOF SoundWire machine driver ASoC: amd: acp: fix ffs() operator precedence for SoundWire link ID net: netsec: fix device_node reference leak on phy_np eth: fbnic: ring the doorbell if a burst ends in a drop net: lock the socket in sock_gettstamp() net: ethernet: cortina: Ack RX overrun interrupt correctly net: stmmac: propagate FPE preemption-class mapping errors net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() x86/kprobes: Fix crash when probing CS CALL instructions net: macb: fix ordering around PTP timestamp read net: mvpp2: prevent buffer overflow in page_pool allocation net: skbuff: do not leave stale header offsets after pskb_carve() drm/amdgpu: check ras and obj before dereference btrfs: abort transaction on failure to update inode for hole punching and reflinking btrfs: check if there is space for chunk item when validating sys chunk array x86/fred: Reconstruct the #GP context for rejected INT instructions Input: eeti_ts - publish the OF module alias hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler hwmon: (hp-wmi-sensors) Improve raw WMI string handling watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog wifi: rtw88: TX QOS Null data the same way as Null data Input: xpad - add support for Victrix Pro BFG Controller Input: xpad - add support for Azeron devices Input: xpad - fix PDP Marvel Xbox 360 controller ALSA: core: Fix potential UAF after asynchronous card release ALSA: virtio: reset device before deleting virtqueues ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() cifs: Fix server use-after-free in cifs_chan_skip_or_disable() exec: Cleanup POSIX timers right after de_thread() fs/dax: check zero or empty entry before converting xarray entry phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list rds: ib: use rds_conn_drop() on protocol version mismatch rust: net: phy: fix off-by-one bit positions in device status accessors Revert "nouveau/gsp: fix suspend/resume regression on r570 firmware" drm/nouveau/gsp: Increase delay for magic sleep in r535_gsp_fini() drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr drm/nouveau/gsp/r570: Enable S/R Display workaround in GSP x86/build/64: Prevent native builds from generating EGPR use UBUNTU: [Config] Add and enable config setting RUSTC_HAS_APXF x86/microcode/intel: Reject problematic loading on Granite Rapids systems tcp: exclude old ACKs from tcp fast path swiotlb: use the adjusted address for the highmem page lookup spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes spi: spi-zynqmp-gqspi: stop the controller on shutdown spi: virtio: Use the per-transfer bits per word RDMA/ucma: Serialize join and leave on copy_to_user failure RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() openvswitch: avoid reallocating confirmed conntrack labels net: xfrm: reject unrepresentable espintcp transport headers HID: logitech-hidpp: fix race condition when accessing stale stack pointer kselftest/arm64: Fix size of thread_data values for pthread_join() arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc arm64: dts: renesas: r8a779f0: Set UFS lane count arm64: percpu: Fix this_cpu_write() casting arm64: percpu: Fix this_cpu_and() mask generation arm64: percpu: Fix LSE operations on {8,16}-bit types Bluetooth: btusb: fix NXP IW610 composite device handling Bluetooth: eir: validate service data length before reading UUID Bluetooth: hci_codec: validate vendor codec count length Bluetooth: hci_sync: Serialize local codec list cleanup btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() btrfs: clear free space tree creation state on rebuild failure dmaengine: sun6i: fix non-atomic read of DMA position registers dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() ipv6: xfrm: use full sockets in local error paths net: ip_tunnel: initialize `options_len` before referencing options net: lan743x: fix RX checksum use-after-free net: phy: mediatek: do not report link and per-speed LED rules together net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value net/sched: act_api: release tail references on DELACTION failure net/sched: hhf: cap hh_flows_limit at change time net/packet: clear RX owner on VNET header error net/packet: avoid truncating TPACKET_V3 private size scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() xfrm: serialize state GC with device state flush xfrm: use hlist_del_init_rcu for state_cache and state_cache_input soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node memcg: avoid charging the root memcg from obj_cgroup_charge_pages() memstick: ms_block: destroy io_queue workqueue on removal mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP mm: filemap: retain mapped dropbehind folios KEYS: encrypted: fix integer overflow of datablob_len keys: translate request_key_auth pid for the reading procfs instance KEYS: trusted: Fix tpm2_load_cmd() boundary check i2c: at91: release DMA channels on remove and probe error i2c: atr: fix dangling adapter pointer on add failure i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() i2c: imx: release DMA channels on probe error i2c: imx: disable autosuspend on remove IB/mlx4: Fix use-after-free on pkey sysfs registration failure IB/hfi1: Resolve the credit-return buffer through the send context's node IB/hfi1: Fix the PIO_CRED credit-return mmap selinux: preserve user SID across nested backing files selinux: recheck intermediate backing files on mprotect() selinux: always fill AVC decision in avc_has_perm_noaudit() power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() mmc: core: Cancel SDIO IRQ work before freeing host mmc: core: Fix OF node reference leak on card add failure mmc: hsq: Fix use-after-free in retry work mmc: mmci: Fix use-after-free in busy-timeout work mmc: mxcmmc: cancel data work and watchdog on remove mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources mmc: sdio_uart: fix xmit_fifo leak when the port table is full mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt mmc: spi: reset bytes_xfered before retrying CRC failures mmc: sdhci_am654: Move tuning_loop to local variable mmc: sdhci_am654: Reset command and data lines on failed tuning mmc: sdhci_am654: Clear ITAPDLY on tuning failure mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure Input: adp5588-keys - cache GPIO state before registering the gpiochip Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 Input: cyttsp5 - clamp the HID report size before memcpy Input: evdev - zero absinfo before partial copy in EVIOCSABS Input: hp_sdc - shut down kicker timer on module exit Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() Input: soc_button_array - fix MS Surface Pro 11 probe failure Input: soc_button_array - check btns_desc->package.count Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Input: zero ff_effect before compat copy in input_ff_effect_from_user hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() hwmon: (pmbus/core) increase number of phases and add new mask hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 hwmon: (pwm-fan) Stop RPM timer before freeing tach data hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove hwmon: (w83793) release probe data through kref hwmon: (cgbc-hwmon) Fix current sensors ID lookup hwmon: (cgbc-hwmon) Add missing sensors watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog watchdog: digicolor: Avoid division by zero watchdog: msc313e: Fix premature reset during timeout update watchdog: msc313e: Propagate error code in resume() watchdog: rtd119x: Avoid division by zero watchdog: rzv2h: Avoid division by zero watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() wifi: brcmsmac: fix UAF in brcms_free_timer() wifi: iwlegacy: fix broadcast stations deallocation wifi: libertas_tf: fix UAF in lbtf_free_adapter() wifi: rsi: fix heap OOB write on key removal wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wifi: wlcore: release runtime PM ref on regdomain config failure wifi: wilc1000: fix out-of-bounds read in P2P public action frames wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() wifi: p54: validate curve data length in the calibration curve converters wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length wifi: mwifiex: validate scan response extents wifi: mwifiex: prevent authentication frame length truncation wifi: mwifiex: validate action frame fixed fields wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver drm/gud: fix out-of-bounds write in gud_plane_atomic_check() drm/gud: Ignore damage clips in full update mode drm/msm/adreno: fix autosuspend cleanup during teardown drm/msm/dpu: clear pending peripheral flush state drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure drm/msm: RCU-free the scheduler-containing ring and VM objects drm/amdgpu: fix rmmio iounmap skipped on device removal smb: client: cancel reconnect work in clean_demultiplex_info() smb: client: fix rlist race and missing initialization smb: client: fix use-after-free of iface in cifs_try_adding_channels() smb: client: reject short Next offsets in parse_server_interfaces() smb: client: fix smbd_connection leak on cifs_get_tcp_session() error smb: client: fix unaligned access in WSL reparse point parser smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() smb: client: fix potential OOB read in smb3_enum_snapshots() smb: client: fix server->total_read for compound encrypted PDUs smb: client: fix missing lower-bound check on DFS referral string offsets smb: client: fix missing iov bounds check in parse_posix_sids() time/namespace: Export init_time_ns and do_timens_ktime_to_host() ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts ntsync: reject wait ioctls with zero owner ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity signal: Prevent exec() race xfrm: save input state data before secpath resets mm/huge_memory: bypass THP tuneables for huge pfnmap mappings 9p: Fix v9fs_issue_write() to update i_size and remote_i_size mm/vma: correctly unaccount on mmap_prepare() failure wifi: mac80211: refuse to make a monitor active when it has no queue scsi: fnic: Rename fnic_scsi_fcpio_reset() scsi: fnic: Bump up version number scsi: fnic: Make debug logging protocol independent scsi: fnic: Bump up version number again scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU xfs: add a xfs_rmap_inode_owner helper xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt xfs: remove the i_ino field in struct xfs_inode drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 wifi: ipw2x00: Use michael_mic() from cfg80211 wifi: libipw: reject TKIP frames without a full MIC smb: client: fix reparse buffer bounds in cifs_query_reparse_point() ksmbd: fix partial normalized name responses Revert "ksmbd: Fix to handle removal of rfc1002 header from smb_hdr" smb/client: send lease break ACKs thru correct session for multiuser mounts xfrm: hold net_device reference under RCU in bundle creation clk: scpi: register scpi-cpufreq once and clear on failure RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR RDMA/rtrs: guard against null kobj name RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables mips: econet: fix unmet dependencies for ECONET dma-mapping: don't trace the DMA address when the allocation fails wifi: cfg80211: ibss: ref BSS entry for joined event wifi: mac80211: reset the LED state when ifup fails wifi: mac80211: only operate on TDLS peers in the TDLS code scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions dmaengine: pxa: fix double counting of the hw descriptors x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64() arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation smb: client: validate absolute native symlink targets before NT fixups neighbour: Don't render blackhole_netdev via RTM_GETNEIGHTBL. objtool: Validate disassembler headers in libopcodes probe sysctl: Check range in proc_dointvec_ms_jiffies_minmax Bluetooth: put the peer's on-air address on air when we cannot resolve Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access net: stmmac: fix TSO header length truncation drop_monitor: use raw_cpu_ptr() in tracepoint probes net: bridge: vlan: fix bugs caused by switchdev deletion errors netlink: do not free nlk->groups while lockless readers can use it Revert "drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable" drm/xe/i2c: Disable IRQ on unbind ASoC: cs-amp-lib: Prevent NULL pointer if efi variable is zero length net/sched: codel: bound the dropping loop per dequeue call net: do not advance stack index from dev_fwd_path() net: airoha: Fix non-standard return value in airoha_ppe_get_wdma_info() net: pass dst via net_device_path in dev_fill_forward_path() net: pass net_device_path_ctx to dev_fill_forward_path() net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check net: prevent torn reads in netdev_tc_txq net: stmmac: preserve real_num_tx_queues on mqprio setup failure drm/amd/display: fix MALL hysteresis timer underflow at high refresh rates perf: Fix null pointer access in is_include_guest_event() cgroup: Avoid iteration of dying tasks with zero refcount Bluetooth: keep dst_type with dst when reusing an LE connection gpiolib: Put fwnode reference on failure dma-buf: Fix silent overflow for phys vec to sgt dma-buf: Split sgl by largest page-aligned chunk mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ drm/amdkfd: Avoid integer underflow in EOP ring size calculation. drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1 smb: client: fix WSL reparse point uid/gid override smb: client: fix fattr leaking on wsl_to_fattr() failure drm/ttm: fix swapped-out resources never leaving their bulk_move range UBUNTU: Upstream stable to v6.18.54, v7.2.8 ** Affects: linux (Ubuntu) Importance: Undecided Status: Invalid ** Affects: linux (Ubuntu Resolute) Importance: Medium Assignee: Alice C. Munduruca (cremfuelled) Status: In Progress ** Tags: kernel-stable-tracking-bug ** Changed in: linux (Ubuntu) Status: New => Confirmed ** Also affects: linux (Ubuntu Resolute) Importance: Undecided Status: New ** Summary changed: - Resolute update: upstream stable patchset 2026-10-05 + Resolute update: upstream stable patchset 2026-10-06 ** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Changed in: linux (Ubuntu Resolute) Importance: Undecided => Medium ** Changed in: linux (Ubuntu Resolute) Status: New => In Progress ** Changed in: linux (Ubuntu Resolute) Assignee: (unassigned) => Alice C. Munduruca (cremfuelled) ** Summary changed: - Resolute update: upstream stable patchset 2026-10-06 + Resolute update: upstream stable patchset 2026-10-05 ** Description changed: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-10-05 + + Ported from the following upstream stable releases: + v6.18.54, v7.2.8 + from git://git.kernel.org/ + + landlock: Fix TCP Fast Open connection bypass + selftests/landlock: Add test for TCP fast open + selftests/landlock: Use an actual chardev for MAKE_CHAR audit test + selftests/landlock: Add tests for whiteout object creation + selftests/landlock: Add audit test for whiteout object creation + sunvdc: fix -EIO issue due to lack of retries + media: video-i2c: fix buffer queue ordering + ipv6: Select best matching nexthop object in fib6_table_lookup() + ipv6: Honor oif when choosing nexthop for locally generated traffic + xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() + xfrm: iptfs: fix runt reassembly panic from short inner tot_len + xfrm: fix compat ALLOCSPI request use-after-free + xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() + esp: downgrade zerocopy managed frags before mutating skb frags + ARM: socfpga: select the PL310 erratum 753970 workaround + RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept + RDMA/rxe: validate access flags before swapping the MR's PD + RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access + firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS + clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate + RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths + RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds + RDMA/mlx5: Remove warn on missing representor in query_port_speed + RDMA/core: Reject unregistering netdevs in ib_get_eth_speed + power: sequencing: Fix build issue with COMPILE_TEST + arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR + arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR + arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR + IB/iser: reject a remote invalidation of an unregistered direction + IB/isert: wait for deferred control PDU completions before releasing the connection + RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup + RDMA/mad: Fix receive buffer leak when PKey enforcement fails + RDMA/irdma: Enforce local fence for IB_WR_REG_MR + RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted + dmaengine: sprd: Fix runtime PM reference leak in probe + wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic + wifi: virt_wifi: free skb when disconnected + wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path + wifi: brcmfmac: cyw: pass PMKID to firmware if present + wifi: libipw: reject too-short beacon and probe responses + wifi: libipw: reject too-short association responses + IB/IPoIB: Avoid restoring OPER_UP after multicast flush + wifi: cfg80211: don't get the radio mask for netdev-less wdevs + wifi: cfg80211: check IP header size in cfg80211_classify8021d() + soundwire: cadence_master: wait and cancel cdns->work before clock stop + MIPS: Octeon: apply USB FDT fixups also when USB is modular + dma-coherent: report a failed reserved memory assignment + dmaengine: Fix device kref underflow in dma_chan_put() + dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() + dmaengine: wait for RCU readers before releasing dma_device + wifi: cfg80211: don't free driver-owned scan requests + wifi: cfg80211: only group hidden BSSes with beacon entries + wifi: cfg80211: don't filter by BSS type when removing stale entries + wifi: mac80211: don't start a ROC while scanning + wifi: mac80211: don't warn when an IBSS has no channel to scan + wifi: mac80211: don't offload TC setup on AP_VLAN interfaces + wifi: mac80211: suppress chanctx warning for debugfs reset + wifi: mac80211: abort chanswitch when leaving a mesh + wifi: mac80211: reset state when starting AP fails + wifi: cfg80211: restore netns_immutable on failures + wifi: cfg80211: undo netns switch if renaming the wiphy fails + wifi: mac80211: unlist vifs when their netdev is unregistered + wifi: cfg80211: get the wiphy out of a dying network namespace + wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping + wifi: mac80211: don't allow injecting frames wider than the chanctx + wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown + wifi: mac80211: require a peer station for TDLS setup confirm + wifi: mac80211: don't allow link changes when iface is down + wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set + wifi: mac80211: don't access the TSF of a down interface + wifi: mac80211: add HE 6 GHz capability in the scan elems len + wifi: mac80211: mesh: reset the CSA state when leaving + wifi: mac80211: mesh: release the channel if start fails + wifi: mac80211: set up the TX info early to fix failure paths + mm: memblock: show all region flags in debugfs + scsi: qla2xxx: Fix the ql2xfc2target parameter description + dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order + dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA + RDMA/efa: Keep admin queues alive while IRQ is registered + RDMA/efa: Keep EQ resources alive while IRQ is registered + RDMA/siw: Bound fragmented header copies by the remaining length + drm/msm: Fix the separate_gpu_kms parameter description + drm/msm/adreno: Fix the skip_gpu parameter description + netfilter: nft_nat: fully initialise new_addr in netmap setup + netfilter: nf_tables: fix device name and prefix match in hook lookup + netfilter: nf_nat: unregister and release hooks on error + netfilter: flowtable: hold reference on ct until flow is released + perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations + arm64: hibernate: clone only the linear map that exists at runtime + drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr + keys: fix lost wakeup when reaping a dead key type + neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. + neighbour: Add missing RCU annotation for neightbl_dump_info(). + neighbour: Skip default parms when resumed in neightbl_dump_info(). + ALSA: bcd2000: Fix race between rawmidi and disconnect + phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow + phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting + ALSA: pcm: set timer->private_data before registering the PCM timer + drm/msm/dp: skip PUSH_IDLE when the link was never enabled + drm/msm/dp: fix link bandwidth check when wide bus is enabled + ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask + ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map + ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params + spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register + Input: trackpoint - fix the inertia attribute name in the ABI document + gpio: virtuser: skip free_irq when no IRQ is installed + ALSA: usb: 6fire: Avoid embedded URBs + ALSA: 6fire: fix OOB write from device-reported iso length + wifi: virt_wifi: don't transfer operstate before register + drm/xe/mmio_gem: forbid VMA split + drm/xe/mmio_gem: use write-back mapping for dummy page + drm/xe/mmio_gem: Revoke drm_vma_node on xe_mmio_gem destroy + drm/xe/shrinker: Return the freed page count through a parameter + drm/vc4: Use managed KMS polling to fix UAF on unbind + ALSA: hda: trace PCM open only after assigning a stream + wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() + btrfs: tree-checker: print dev extent offset in error message + drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL + seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation + net: bcmgenet: convert RX path to page_pool + net: bcmgenet: restore the hardware filters on open + ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup + net: fddi: skfp: fix NULL deref when setting the MAC address while down + wifi: brcmfmac: fix lost 802.1x TX completion wakeup + net: bridge: mst: move switchdev call outside rcu + tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). + tcp: do not let tcp_rmem be set below 4096 + ksmbd: return buffer overflow for partial filesystem info + ksmbd: fix partial file information responses + ksmbd: keep compound responses on query info errors + dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() + Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained + Bluetooth: btintel_pcie: validate TX skb length in send_sync + Bluetooth: coredump: Quiesce dump work on unregister + Bluetooth: qca: Refactor code on the basis of chipset names + Bluetooth: qca: enable pwrseq support for WCN39xx devices + Bluetooth: hci_qca: Do not write to the serial port after it is closed + Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() + Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync + Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events + Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown + Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit + Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup + af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). + pppoatm: ensure a writable skb header and linear data + drop_monitor: synchronize tracepoint unregistration on error path + drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown + drop_monitor: fix out-of-bounds write in reset_per_cpu_data() + net: stmmac: do not overwrite phc_index when no PTP clock is registered + KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() + KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure + powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba + futex: Also allocate private hash on vfork() + btrfs: handle lack of space when cleaning up verity items + ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments + ASoC: hdmi-codec: Report a change when the channel status moves + ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers + ASoC: sdw_utils: tidyup .count_sidecar + ASoC: sdw_utils: tidyup asoc_sdw_parse_sdw_endpoints() + ASoC: amd: acp: refactor codec config count in SOF SoundWire machine driver + ASoC: amd: acp: fix ffs() operator precedence for SoundWire link ID + net: netsec: fix device_node reference leak on phy_np + eth: fbnic: ring the doorbell if a burst ends in a drop + net: lock the socket in sock_gettstamp() + net: ethernet: cortina: Ack RX overrun interrupt correctly + net: stmmac: propagate FPE preemption-class mapping errors + net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() + x86/kprobes: Fix crash when probing CS CALL instructions + net: macb: fix ordering around PTP timestamp read + net: mvpp2: prevent buffer overflow in page_pool allocation + net: skbuff: do not leave stale header offsets after pskb_carve() + drm/amdgpu: check ras and obj before dereference + btrfs: abort transaction on failure to update inode for hole punching and reflinking + btrfs: check if there is space for chunk item when validating sys chunk array + x86/fred: Reconstruct the #GP context for rejected INT instructions + Input: eeti_ts - publish the OF module alias + hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler + hwmon: (hp-wmi-sensors) Improve raw WMI string handling + watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog + wifi: rtw88: TX QOS Null data the same way as Null data + Input: xpad - add support for Victrix Pro BFG Controller + Input: xpad - add support for Azeron devices + Input: xpad - fix PDP Marvel Xbox 360 controller + ALSA: core: Fix potential UAF after asynchronous card release + ALSA: virtio: reset device before deleting virtqueues + ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type + ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY + ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() + cifs: Fix server use-after-free in cifs_chan_skip_or_disable() + exec: Cleanup POSIX timers right after de_thread() + fs/dax: check zero or empty entry before converting xarray entry + phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context + posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list + rds: ib: use rds_conn_drop() on protocol version mismatch + rust: net: phy: fix off-by-one bit positions in device status accessors + Revert "nouveau/gsp: fix suspend/resume regression on r570 firmware" + drm/nouveau/gsp: Increase delay for magic sleep in r535_gsp_fini() + drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr + drm/nouveau/gsp/r570: Enable S/R Display workaround in GSP + x86/build/64: Prevent native builds from generating EGPR use + UBUNTU: [Config] Add and enable config setting RUSTC_HAS_APXF + x86/microcode/intel: Reject problematic loading on Granite Rapids systems + tcp: exclude old ACKs from tcp fast path + swiotlb: use the adjusted address for the highmem page lookup + spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes + spi: spi-zynqmp-gqspi: stop the controller on shutdown + spi: virtio: Use the per-transfer bits per word + RDMA/ucma: Serialize join and leave on copy_to_user failure + RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() + openvswitch: avoid reallocating confirmed conntrack labels + net: xfrm: reject unrepresentable espintcp transport headers + HID: logitech-hidpp: fix race condition when accessing stale stack pointer + kselftest/arm64: Fix size of thread_data values for pthread_join() + arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc + arm64: dts: renesas: r8a779f0: Set UFS lane count + arm64: percpu: Fix this_cpu_write() casting + arm64: percpu: Fix this_cpu_and() mask generation + arm64: percpu: Fix LSE operations on {8,16}-bit types + Bluetooth: btusb: fix NXP IW610 composite device handling + Bluetooth: eir: validate service data length before reading UUID + Bluetooth: hci_codec: validate vendor codec count length + Bluetooth: hci_sync: Serialize local codec list cleanup + btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() + btrfs: clear free space tree creation state on rebuild failure + dmaengine: sun6i: fix non-atomic read of DMA position registers + dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status + dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() + ipv6: xfrm: use full sockets in local error paths + net: ip_tunnel: initialize `options_len` before referencing options + net: lan743x: fix RX checksum use-after-free + net: phy: mediatek: do not report link and per-speed LED rules together + net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() + net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain + net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value + net/sched: act_api: release tail references on DELACTION failure + net/sched: hhf: cap hh_flows_limit at change time + net/packet: clear RX owner on VNET header error + net/packet: avoid truncating TPACKET_V3 private size + scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() + xfrm: serialize state GC with device state flush + xfrm: use hlist_del_init_rcu for state_cache and state_cache_input + soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node + memcg: avoid charging the root memcg from obj_cgroup_charge_pages() + memstick: ms_block: destroy io_queue workqueue on removal + mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count + mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() + mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP + mm: filemap: retain mapped dropbehind folios + KEYS: encrypted: fix integer overflow of datablob_len + keys: translate request_key_auth pid for the reading procfs instance + KEYS: trusted: Fix tpm2_load_cmd() boundary check + i2c: at91: release DMA channels on remove and probe error + i2c: atr: fix dangling adapter pointer on add failure + i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() + i2c: imx: release DMA channels on probe error + i2c: imx: disable autosuspend on remove + IB/mlx4: Fix use-after-free on pkey sysfs registration failure + IB/hfi1: Resolve the credit-return buffer through the send context's node + IB/hfi1: Fix the PIO_CRED credit-return mmap + selinux: preserve user SID across nested backing files + selinux: recheck intermediate backing files on mprotect() + selinux: always fill AVC decision in avc_has_perm_noaudit() + power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed + power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() + power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() + mmc: core: Cancel SDIO IRQ work before freeing host + mmc: core: Fix OF node reference leak on card add failure + mmc: hsq: Fix use-after-free in retry work + mmc: mmci: Fix use-after-free in busy-timeout work + mmc: mxcmmc: cancel data work and watchdog on remove + mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 + mmc: sdhci-of-aspeed: Remove children before releasing SDC resources + mmc: sdio_uart: fix xmit_fifo leak when the port table is full + mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt + mmc: spi: reset bytes_xfered before retrying CRC failures + mmc: sdhci_am654: Move tuning_loop to local variable + mmc: sdhci_am654: Reset command and data lines on failed tuning + mmc: sdhci_am654: Clear ITAPDLY on tuning failure + mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure + Input: adp5588-keys - cache GPIO state before registering the gpiochip + Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 + Input: cyttsp5 - clamp the HID report size before memcpy + Input: evdev - zero absinfo before partial copy in EVIOCSABS + Input: hp_sdc - shut down kicker timer on module exit + Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P + Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() + Input: soc_button_array - fix MS Surface Pro 11 probe failure + Input: soc_button_array - check btns_desc->package.count + Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) + Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound + Input: zero ff_effect before compat copy in input_ff_effect_from_user + hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() + hwmon: (pmbus/core) increase number of phases and add new mask + hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding + hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 + hwmon: (pwm-fan) Stop RPM timer before freeing tach data + hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove + hwmon: (w83793) release probe data through kref + hwmon: (cgbc-hwmon) Fix current sensors ID lookup + hwmon: (cgbc-hwmon) Add missing sensors + watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog + watchdog: digicolor: Avoid division by zero + watchdog: msc313e: Fix premature reset during timeout update + watchdog: msc313e: Propagate error code in resume() + watchdog: rtd119x: Avoid division by zero + watchdog: rzv2h: Avoid division by zero + watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() + watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() + wifi: brcmsmac: fix UAF in brcms_free_timer() + wifi: iwlegacy: fix broadcast stations deallocation + wifi: libertas_tf: fix UAF in lbtf_free_adapter() + wifi: rsi: fix heap OOB write on key removal + wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown + wifi: wlcore: release runtime PM ref on regdomain config failure + wifi: wilc1000: fix out-of-bounds read in P2P public action frames + wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() + wifi: p54: validate curve data length in the calibration curve converters + wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST + wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length + wifi: mwifiex: validate scan response extents + wifi: mwifiex: prevent authentication frame length truncation + wifi: mwifiex: validate action frame fixed fields + wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver + drm/gud: fix out-of-bounds write in gud_plane_atomic_check() + drm/gud: Ignore damage clips in full update mode + drm/msm/adreno: fix autosuspend cleanup during teardown + drm/msm/dpu: clear pending peripheral flush state + drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure + drm/msm: RCU-free the scheduler-containing ring and VM objects + drm/amdgpu: fix rmmio iounmap skipped on device removal + smb: client: cancel reconnect work in clean_demultiplex_info() + smb: client: fix rlist race and missing initialization + smb: client: fix use-after-free of iface in cifs_try_adding_channels() + smb: client: reject short Next offsets in parse_server_interfaces() + smb: client: fix smbd_connection leak on cifs_get_tcp_session() error + smb: client: fix unaligned access in WSL reparse point parser + smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs + smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() + smb: client: fix potential OOB read in smb3_enum_snapshots() + smb: client: fix server->total_read for compound encrypted PDUs + smb: client: fix missing lower-bound check on DFS referral string offsets + smb: client: fix missing iov bounds check in parse_posix_sids() + time/namespace: Export init_time_ns and do_timens_ktime_to_host() + ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts + ntsync: reject wait ioctls with zero owner + ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity + signal: Prevent exec() race + xfrm: save input state data before secpath resets + mm/huge_memory: bypass THP tuneables for huge pfnmap mappings + 9p: Fix v9fs_issue_write() to update i_size and remote_i_size + mm/vma: correctly unaccount on mmap_prepare() failure + wifi: mac80211: refuse to make a monitor active when it has no queue + scsi: fnic: Rename fnic_scsi_fcpio_reset() + scsi: fnic: Bump up version number + scsi: fnic: Make debug logging protocol independent + scsi: fnic: Bump up version number again + scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU + xfs: add a xfs_rmap_inode_owner helper + xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt + xfs: remove the i_ino field in struct xfs_inode + drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments + wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() + wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 + wifi: ipw2x00: Use michael_mic() from cfg80211 + wifi: libipw: reject TKIP frames without a full MIC + smb: client: fix reparse buffer bounds in cifs_query_reparse_point() + ksmbd: fix partial normalized name responses + Revert "ksmbd: Fix to handle removal of rfc1002 header from smb_hdr" + smb/client: send lease break ACKs thru correct session for multiuser mounts + xfrm: hold net_device reference under RCU in bundle creation + clk: scpi: register scpi-cpufreq once and clear on failure + RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency + arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR + arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR + RDMA/rtrs: guard against null kobj name + RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() + RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables + mips: econet: fix unmet dependencies for ECONET + dma-mapping: don't trace the DMA address when the allocation fails + wifi: cfg80211: ibss: ref BSS entry for joined event + wifi: mac80211: reset the LED state when ifup fails + wifi: mac80211: only operate on TDLS peers in the TDLS code + scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions + dmaengine: pxa: fix double counting of the hw descriptors + x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64() + arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation + smb: client: validate absolute native symlink targets before NT fixups + neighbour: Don't render blackhole_netdev via RTM_GETNEIGHTBL. + objtool: Validate disassembler headers in libopcodes probe + sysctl: Check range in proc_dointvec_ms_jiffies_minmax + Bluetooth: put the peer's on-air address on air when we cannot resolve + Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access + net: stmmac: fix TSO header length truncation + drop_monitor: use raw_cpu_ptr() in tracepoint probes + net: bridge: vlan: fix bugs caused by switchdev deletion errors + netlink: do not free nlk->groups while lockless readers can use it + Revert "drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable" + drm/xe/i2c: Disable IRQ on unbind + ASoC: cs-amp-lib: Prevent NULL pointer if efi variable is zero length + net/sched: codel: bound the dropping loop per dequeue call + net: do not advance stack index from dev_fwd_path() + net: airoha: Fix non-standard return value in airoha_ppe_get_wdma_info() + net: pass dst via net_device_path in dev_fill_forward_path() + net: pass net_device_path_ctx to dev_fill_forward_path() + net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check + net: prevent torn reads in netdev_tc_txq + net: stmmac: preserve real_num_tx_queues on mqprio setup failure + drm/amd/display: fix MALL hysteresis timer underflow at high refresh rates + perf: Fix null pointer access in is_include_guest_event() + cgroup: Avoid iteration of dying tasks with zero refcount + Bluetooth: keep dst_type with dst when reusing an LE connection + gpiolib: Put fwnode reference on failure + dma-buf: Fix silent overflow for phys vec to sgt + dma-buf: Split sgl by largest page-aligned chunk + mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ + drm/amdkfd: Avoid integer underflow in EOP ring size calculation. + drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc + drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1 + smb: client: fix WSL reparse point uid/gid override + smb: client: fix fattr leaking on wsl_to_fattr() failure + drm/ttm: fix swapped-out resources never leaving their bulk_move range + UBUNTU: Upstream stable to v6.18.54, v7.2.8 ** Summary changed: - Resolute update: upstream stable patchset 2026-10-05 + Resolute update: upstream stable patchset 2026-10-06 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169641 Title: Resolute update: upstream stable patchset 2026-10-06 Status in linux package in Ubuntu: Invalid Status in linux source package in Resolute: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-10-05 Ported from the following upstream stable releases: v6.18.54, v7.2.8 from git://git.kernel.org/ landlock: Fix TCP Fast Open connection bypass selftests/landlock: Add test for TCP fast open selftests/landlock: Use an actual chardev for MAKE_CHAR audit test selftests/landlock: Add tests for whiteout object creation selftests/landlock: Add audit test for whiteout object creation sunvdc: fix -EIO issue due to lack of retries media: video-i2c: fix buffer queue ordering ipv6: Select best matching nexthop object in fib6_table_lookup() ipv6: Honor oif when choosing nexthop for locally generated traffic xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() xfrm: iptfs: fix runt reassembly panic from short inner tot_len xfrm: fix compat ALLOCSPI request use-after-free xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() esp: downgrade zerocopy managed frags before mutating skb frags ARM: socfpga: select the PL310 erratum 753970 workaround RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept RDMA/rxe: validate access flags before swapping the MR's PD RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds RDMA/mlx5: Remove warn on missing representor in query_port_speed RDMA/core: Reject unregistering netdevs in ib_get_eth_speed power: sequencing: Fix build issue with COMPILE_TEST arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR IB/iser: reject a remote invalidation of an unregistered direction IB/isert: wait for deferred control PDU completions before releasing the connection RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup RDMA/mad: Fix receive buffer leak when PKey enforcement fails RDMA/irdma: Enforce local fence for IB_WR_REG_MR RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted dmaengine: sprd: Fix runtime PM reference leak in probe wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic wifi: virt_wifi: free skb when disconnected wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path wifi: brcmfmac: cyw: pass PMKID to firmware if present wifi: libipw: reject too-short beacon and probe responses wifi: libipw: reject too-short association responses IB/IPoIB: Avoid restoring OPER_UP after multicast flush wifi: cfg80211: don't get the radio mask for netdev-less wdevs wifi: cfg80211: check IP header size in cfg80211_classify8021d() soundwire: cadence_master: wait and cancel cdns->work before clock stop MIPS: Octeon: apply USB FDT fixups also when USB is modular dma-coherent: report a failed reserved memory assignment dmaengine: Fix device kref underflow in dma_chan_put() dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() dmaengine: wait for RCU readers before releasing dma_device wifi: cfg80211: don't free driver-owned scan requests wifi: cfg80211: only group hidden BSSes with beacon entries wifi: cfg80211: don't filter by BSS type when removing stale entries wifi: mac80211: don't start a ROC while scanning wifi: mac80211: don't warn when an IBSS has no channel to scan wifi: mac80211: don't offload TC setup on AP_VLAN interfaces wifi: mac80211: suppress chanctx warning for debugfs reset wifi: mac80211: abort chanswitch when leaving a mesh wifi: mac80211: reset state when starting AP fails wifi: cfg80211: restore netns_immutable on failures wifi: cfg80211: undo netns switch if renaming the wiphy fails wifi: mac80211: unlist vifs when their netdev is unregistered wifi: cfg80211: get the wiphy out of a dying network namespace wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping wifi: mac80211: don't allow injecting frames wider than the chanctx wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown wifi: mac80211: require a peer station for TDLS setup confirm wifi: mac80211: don't allow link changes when iface is down wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set wifi: mac80211: don't access the TSF of a down interface wifi: mac80211: add HE 6 GHz capability in the scan elems len wifi: mac80211: mesh: reset the CSA state when leaving wifi: mac80211: mesh: release the channel if start fails wifi: mac80211: set up the TX info early to fix failure paths mm: memblock: show all region flags in debugfs scsi: qla2xxx: Fix the ql2xfc2target parameter description dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA RDMA/efa: Keep admin queues alive while IRQ is registered RDMA/efa: Keep EQ resources alive while IRQ is registered RDMA/siw: Bound fragmented header copies by the remaining length drm/msm: Fix the separate_gpu_kms parameter description drm/msm/adreno: Fix the skip_gpu parameter description netfilter: nft_nat: fully initialise new_addr in netmap setup netfilter: nf_tables: fix device name and prefix match in hook lookup netfilter: nf_nat: unregister and release hooks on error netfilter: flowtable: hold reference on ct until flow is released perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations arm64: hibernate: clone only the linear map that exists at runtime drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr keys: fix lost wakeup when reaping a dead key type neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. neighbour: Add missing RCU annotation for neightbl_dump_info(). neighbour: Skip default parms when resumed in neightbl_dump_info(). ALSA: bcd2000: Fix race between rawmidi and disconnect phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting ALSA: pcm: set timer->private_data before registering the PCM timer drm/msm/dp: skip PUSH_IDLE when the link was never enabled drm/msm/dp: fix link bandwidth check when wide bus is enabled ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register Input: trackpoint - fix the inertia attribute name in the ABI document gpio: virtuser: skip free_irq when no IRQ is installed ALSA: usb: 6fire: Avoid embedded URBs ALSA: 6fire: fix OOB write from device-reported iso length wifi: virt_wifi: don't transfer operstate before register drm/xe/mmio_gem: forbid VMA split drm/xe/mmio_gem: use write-back mapping for dummy page drm/xe/mmio_gem: Revoke drm_vma_node on xe_mmio_gem destroy drm/xe/shrinker: Return the freed page count through a parameter drm/vc4: Use managed KMS polling to fix UAF on unbind ALSA: hda: trace PCM open only after assigning a stream wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() btrfs: tree-checker: print dev extent offset in error message drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation net: bcmgenet: convert RX path to page_pool net: bcmgenet: restore the hardware filters on open ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup net: fddi: skfp: fix NULL deref when setting the MAC address while down wifi: brcmfmac: fix lost 802.1x TX completion wakeup net: bridge: mst: move switchdev call outside rcu tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). tcp: do not let tcp_rmem be set below 4096 ksmbd: return buffer overflow for partial filesystem info ksmbd: fix partial file information responses ksmbd: keep compound responses on query info errors dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained Bluetooth: btintel_pcie: validate TX skb length in send_sync Bluetooth: coredump: Quiesce dump work on unregister Bluetooth: qca: Refactor code on the basis of chipset names Bluetooth: qca: enable pwrseq support for WCN39xx devices Bluetooth: hci_qca: Do not write to the serial port after it is closed Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). pppoatm: ensure a writable skb header and linear data drop_monitor: synchronize tracepoint unregistration on error path drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown drop_monitor: fix out-of-bounds write in reset_per_cpu_data() net: stmmac: do not overwrite phc_index when no PTP clock is registered KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba futex: Also allocate private hash on vfork() btrfs: handle lack of space when cleaning up verity items ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments ASoC: hdmi-codec: Report a change when the channel status moves ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers ASoC: sdw_utils: tidyup .count_sidecar ASoC: sdw_utils: tidyup asoc_sdw_parse_sdw_endpoints() ASoC: amd: acp: refactor codec config count in SOF SoundWire machine driver ASoC: amd: acp: fix ffs() operator precedence for SoundWire link ID net: netsec: fix device_node reference leak on phy_np eth: fbnic: ring the doorbell if a burst ends in a drop net: lock the socket in sock_gettstamp() net: ethernet: cortina: Ack RX overrun interrupt correctly net: stmmac: propagate FPE preemption-class mapping errors net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() x86/kprobes: Fix crash when probing CS CALL instructions net: macb: fix ordering around PTP timestamp read net: mvpp2: prevent buffer overflow in page_pool allocation net: skbuff: do not leave stale header offsets after pskb_carve() drm/amdgpu: check ras and obj before dereference btrfs: abort transaction on failure to update inode for hole punching and reflinking btrfs: check if there is space for chunk item when validating sys chunk array x86/fred: Reconstruct the #GP context for rejected INT instructions Input: eeti_ts - publish the OF module alias hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler hwmon: (hp-wmi-sensors) Improve raw WMI string handling watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog wifi: rtw88: TX QOS Null data the same way as Null data Input: xpad - add support for Victrix Pro BFG Controller Input: xpad - add support for Azeron devices Input: xpad - fix PDP Marvel Xbox 360 controller ALSA: core: Fix potential UAF after asynchronous card release ALSA: virtio: reset device before deleting virtqueues ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() cifs: Fix server use-after-free in cifs_chan_skip_or_disable() exec: Cleanup POSIX timers right after de_thread() fs/dax: check zero or empty entry before converting xarray entry phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list rds: ib: use rds_conn_drop() on protocol version mismatch rust: net: phy: fix off-by-one bit positions in device status accessors Revert "nouveau/gsp: fix suspend/resume regression on r570 firmware" drm/nouveau/gsp: Increase delay for magic sleep in r535_gsp_fini() drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr drm/nouveau/gsp/r570: Enable S/R Display workaround in GSP x86/build/64: Prevent native builds from generating EGPR use UBUNTU: [Config] Add and enable config setting RUSTC_HAS_APXF x86/microcode/intel: Reject problematic loading on Granite Rapids systems tcp: exclude old ACKs from tcp fast path swiotlb: use the adjusted address for the highmem page lookup spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes spi: spi-zynqmp-gqspi: stop the controller on shutdown spi: virtio: Use the per-transfer bits per word RDMA/ucma: Serialize join and leave on copy_to_user failure RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() openvswitch: avoid reallocating confirmed conntrack labels net: xfrm: reject unrepresentable espintcp transport headers HID: logitech-hidpp: fix race condition when accessing stale stack pointer kselftest/arm64: Fix size of thread_data values for pthread_join() arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc arm64: dts: renesas: r8a779f0: Set UFS lane count arm64: percpu: Fix this_cpu_write() casting arm64: percpu: Fix this_cpu_and() mask generation arm64: percpu: Fix LSE operations on {8,16}-bit types Bluetooth: btusb: fix NXP IW610 composite device handling Bluetooth: eir: validate service data length before reading UUID Bluetooth: hci_codec: validate vendor codec count length Bluetooth: hci_sync: Serialize local codec list cleanup btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() btrfs: clear free space tree creation state on rebuild failure dmaengine: sun6i: fix non-atomic read of DMA position registers dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() ipv6: xfrm: use full sockets in local error paths net: ip_tunnel: initialize `options_len` before referencing options net: lan743x: fix RX checksum use-after-free net: phy: mediatek: do not report link and per-speed LED rules together net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value net/sched: act_api: release tail references on DELACTION failure net/sched: hhf: cap hh_flows_limit at change time net/packet: clear RX owner on VNET header error net/packet: avoid truncating TPACKET_V3 private size scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() xfrm: serialize state GC with device state flush xfrm: use hlist_del_init_rcu for state_cache and state_cache_input soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node memcg: avoid charging the root memcg from obj_cgroup_charge_pages() memstick: ms_block: destroy io_queue workqueue on removal mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP mm: filemap: retain mapped dropbehind folios KEYS: encrypted: fix integer overflow of datablob_len keys: translate request_key_auth pid for the reading procfs instance KEYS: trusted: Fix tpm2_load_cmd() boundary check i2c: at91: release DMA channels on remove and probe error i2c: atr: fix dangling adapter pointer on add failure i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() i2c: imx: release DMA channels on probe error i2c: imx: disable autosuspend on remove IB/mlx4: Fix use-after-free on pkey sysfs registration failure IB/hfi1: Resolve the credit-return buffer through the send context's node IB/hfi1: Fix the PIO_CRED credit-return mmap selinux: preserve user SID across nested backing files selinux: recheck intermediate backing files on mprotect() selinux: always fill AVC decision in avc_has_perm_noaudit() power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() mmc: core: Cancel SDIO IRQ work before freeing host mmc: core: Fix OF node reference leak on card add failure mmc: hsq: Fix use-after-free in retry work mmc: mmci: Fix use-after-free in busy-timeout work mmc: mxcmmc: cancel data work and watchdog on remove mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources mmc: sdio_uart: fix xmit_fifo leak when the port table is full mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt mmc: spi: reset bytes_xfered before retrying CRC failures mmc: sdhci_am654: Move tuning_loop to local variable mmc: sdhci_am654: Reset command and data lines on failed tuning mmc: sdhci_am654: Clear ITAPDLY on tuning failure mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure Input: adp5588-keys - cache GPIO state before registering the gpiochip Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 Input: cyttsp5 - clamp the HID report size before memcpy Input: evdev - zero absinfo before partial copy in EVIOCSABS Input: hp_sdc - shut down kicker timer on module exit Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() Input: soc_button_array - fix MS Surface Pro 11 probe failure Input: soc_button_array - check btns_desc->package.count Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Input: zero ff_effect before compat copy in input_ff_effect_from_user hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() hwmon: (pmbus/core) increase number of phases and add new mask hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 hwmon: (pwm-fan) Stop RPM timer before freeing tach data hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove hwmon: (w83793) release probe data through kref hwmon: (cgbc-hwmon) Fix current sensors ID lookup hwmon: (cgbc-hwmon) Add missing sensors watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog watchdog: digicolor: Avoid division by zero watchdog: msc313e: Fix premature reset during timeout update watchdog: msc313e: Propagate error code in resume() watchdog: rtd119x: Avoid division by zero watchdog: rzv2h: Avoid division by zero watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() wifi: brcmsmac: fix UAF in brcms_free_timer() wifi: iwlegacy: fix broadcast stations deallocation wifi: libertas_tf: fix UAF in lbtf_free_adapter() wifi: rsi: fix heap OOB write on key removal wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wifi: wlcore: release runtime PM ref on regdomain config failure wifi: wilc1000: fix out-of-bounds read in P2P public action frames wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() wifi: p54: validate curve data length in the calibration curve converters wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length wifi: mwifiex: validate scan response extents wifi: mwifiex: prevent authentication frame length truncation wifi: mwifiex: validate action frame fixed fields wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver drm/gud: fix out-of-bounds write in gud_plane_atomic_check() drm/gud: Ignore damage clips in full update mode drm/msm/adreno: fix autosuspend cleanup during teardown drm/msm/dpu: clear pending peripheral flush state drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure drm/msm: RCU-free the scheduler-containing ring and VM objects drm/amdgpu: fix rmmio iounmap skipped on device removal smb: client: cancel reconnect work in clean_demultiplex_info() smb: client: fix rlist race and missing initialization smb: client: fix use-after-free of iface in cifs_try_adding_channels() smb: client: reject short Next offsets in parse_server_interfaces() smb: client: fix smbd_connection leak on cifs_get_tcp_session() error smb: client: fix unaligned access in WSL reparse point parser smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() smb: client: fix potential OOB read in smb3_enum_snapshots() smb: client: fix server->total_read for compound encrypted PDUs smb: client: fix missing lower-bound check on DFS referral string offsets smb: client: fix missing iov bounds check in parse_posix_sids() time/namespace: Export init_time_ns and do_timens_ktime_to_host() ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts ntsync: reject wait ioctls with zero owner ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity signal: Prevent exec() race xfrm: save input state data before secpath resets mm/huge_memory: bypass THP tuneables for huge pfnmap mappings 9p: Fix v9fs_issue_write() to update i_size and remote_i_size mm/vma: correctly unaccount on mmap_prepare() failure wifi: mac80211: refuse to make a monitor active when it has no queue scsi: fnic: Rename fnic_scsi_fcpio_reset() scsi: fnic: Bump up version number scsi: fnic: Make debug logging protocol independent scsi: fnic: Bump up version number again scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU xfs: add a xfs_rmap_inode_owner helper xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt xfs: remove the i_ino field in struct xfs_inode drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 wifi: ipw2x00: Use michael_mic() from cfg80211 wifi: libipw: reject TKIP frames without a full MIC smb: client: fix reparse buffer bounds in cifs_query_reparse_point() ksmbd: fix partial normalized name responses Revert "ksmbd: Fix to handle removal of rfc1002 header from smb_hdr" smb/client: send lease break ACKs thru correct session for multiuser mounts xfrm: hold net_device reference under RCU in bundle creation clk: scpi: register scpi-cpufreq once and clear on failure RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR RDMA/rtrs: guard against null kobj name RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables mips: econet: fix unmet dependencies for ECONET dma-mapping: don't trace the DMA address when the allocation fails wifi: cfg80211: ibss: ref BSS entry for joined event wifi: mac80211: reset the LED state when ifup fails wifi: mac80211: only operate on TDLS peers in the TDLS code scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions dmaengine: pxa: fix double counting of the hw descriptors x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64() arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation smb: client: validate absolute native symlink targets before NT fixups neighbour: Don't render blackhole_netdev via RTM_GETNEIGHTBL. objtool: Validate disassembler headers in libopcodes probe sysctl: Check range in proc_dointvec_ms_jiffies_minmax Bluetooth: put the peer's on-air address on air when we cannot resolve Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access net: stmmac: fix TSO header length truncation drop_monitor: use raw_cpu_ptr() in tracepoint probes net: bridge: vlan: fix bugs caused by switchdev deletion errors netlink: do not free nlk->groups while lockless readers can use it Revert "drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable" drm/xe/i2c: Disable IRQ on unbind ASoC: cs-amp-lib: Prevent NULL pointer if efi variable is zero length net/sched: codel: bound the dropping loop per dequeue call net: do not advance stack index from dev_fwd_path() net: airoha: Fix non-standard return value in airoha_ppe_get_wdma_info() net: pass dst via net_device_path in dev_fill_forward_path() net: pass net_device_path_ctx to dev_fill_forward_path() net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check net: prevent torn reads in netdev_tc_txq net: stmmac: preserve real_num_tx_queues on mqprio setup failure drm/amd/display: fix MALL hysteresis timer underflow at high refresh rates perf: Fix null pointer access in is_include_guest_event() cgroup: Avoid iteration of dying tasks with zero refcount Bluetooth: keep dst_type with dst when reusing an LE connection gpiolib: Put fwnode reference on failure dma-buf: Fix silent overflow for phys vec to sgt dma-buf: Split sgl by largest page-aligned chunk mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ drm/amdkfd: Avoid integer underflow in EOP ring size calculation. drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1 smb: client: fix WSL reparse point uid/gid override smb: client: fix fattr leaking on wsl_to_fattr() failure drm/ttm: fix swapped-out resources never leaving their bulk_move range UBUNTU: Upstream stable to v6.18.54, v7.2.8 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169641/+subscriptions