This bug was fixed in the package linux-oem-7.0 - 7.0.0-1018.18 --------------- linux-oem-7.0 (7.0.0-1018.18) resolute; urgency=medium * resolute/linux-oem-7.0: 7.0.0-1018.18 -proposed tracker (LP: #2171659) [ Ubuntu: 7.0.0-43.43 ] * resolute/linux: 7.0.0-43.43 -proposed tracker (LP: #2171676) * HMC error triggers cascading PF resets and tears down RDMA connections (LP: #2167995) - RDMA/irdma: Suppress PF reset on HMC error * Loading certificate with --import enrolls it into the platform keyring instead of the machine keyring (LP: #2131181) - SAUCE: integrity: Load MokListRT certs into the machine keyring * Intel Bluetooth stops working on some cold boots on Dell systems (LP: #2170908) - Bluetooth: btintel_pcie: treat boot stage bit 12 as warning * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023) - ASoC: tas2783-sdw: add firmware download status check * Dell XPS 13 9340: OV02C10 front camera image upside down (missing ipu- bridge DMI quirk) (LP: #2169185) - SAUCE: media: ipu-bridge: fix rotation quirk for XPS 13 9340/14 9440 * AMD system hangs on resume when a Thunderbolt dock is plugged in during s2idle (LP: #2168944) - platform/x86/amd: Stop counting intermediate cycles with metrics table * ath12k: WCN7850 MLO double DMA-unmap/free of REO queue buffer on firmware restart corrupts memory (needs upstream 4a1b53417739) (LP: #2169101) - wifi: ath12k: prepare REO update element only for primary link * amdkfd kernel crash when KFD procfs creation fails after execve (LP: #2168705) - drm/amdkfd: fix kernel crash on releasing NULL sysfs entry * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) - bnxt_en: fix DMA mapping length for padded small packets - fs: Free any excess xarray nodes in clear_inode() - net/mlx5e: Prevent stale XSK buffer release on refill retry - net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() - net: mana: Skip WQ object destruction for uninitialized RXQ - accel/amdxdna: Bound the sync_bo flush range to the BO size - net: dsa: mt7530: fix .get_stats64 sleeping in atomic context - ipv6: Fix redirect exception creation for UDP/RAW sockets - ipv4: validate checksum_start before completing checksum - rust_binder: reschedule node refcount update on thread exit - ipv4: stop PMTU walk when nexthop group shrinks - ipv4: stop exception dump when nexthop group shrinks - ipv4: stop route notification sizing when nexthop group shrinks - ipv4: do not warn on route notification size race - ipv6: do not warn on route notification size race - Input: ati_remote2 - fix type confusion in device attribute handlers - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox - Input: xpad - add support for Corsair Novablade Pro - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers - ALSA: hda/tas2781: Accept V1 calibration data without CRC - arm64: irq: exclude the softirq stack switch from KCOV - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() - cipso: adjust cached option offsets when removing CIPSO - dm ioctl: don't let data_start run past the buffer - usb: f81604: fix struct f81604_int_data size mismatch - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() - wifi: mt76: mt7603: initialize global station WCID - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init() - wireguard: queueing: preserve tstamp_type when encapsulating packet - wireguard: noise: reject response consumption after intermediate initiation - workqueue: Fix NULL current_pwq deref in chained work check - xen/netfront: don't leak the skb when xennet_fill_frags() fails - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() - strparser: make sure __strp_recv isn't running before tearing down the parser - swiotlb: fix default_swiotlb_limit() for non-growable default pool - tcp: reject net_iov in zerocopy receive mapping hints - tipc: destroy topsrv workqueues before closing connections - tipc: hold a reference to nodes found by link name - Revert "wifi: libertas: reject short monitor TX frames" - selinux: fix data race on AVC latest_notif - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute - EDAC/amd64: Mask UMC chip select to the four implemented selects - gpio: mpsse: fix race when arming the IRQ poll worker - gpio: xilinx: fix runtime PM leak on request error path - gve: fix napi_disable deadlock when attempting to disable XSK pools - gve: fix XSK buffer leak when rings are stopped - gve: fix XSK buffer leak on error descriptor - ibmveth: h_free logical LAN on open-fail after register - ibmveth: fix TX LTB and filter unwind on open-fail - ice: fix use-after-free in dynamic port cleanup - ice: fix metadata_dst refcount handling on representor teardown - keys: finalize persistent keyring timeout after link attempt - KEYS: Fix add_key() race with keyring restriction - memstick: core: wait for request completion before freeing card - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them - mm: don't schedule deferred kernel page table freeing while booting - dm-crypt: reject the lmk IV mode with AEAD ciphers - dm-integrity: fix buffer overflow in inline mode with large tag size - dm-snap: reject the transient exception store for snapshot-merge - dm: fix reading free memory in do_resume - mmc: cavium-octeon: destroy slot platform devices on remove - mmc: cavium-thunderx: destroy slot platform devices on remove - mmc: mtk-sd: Cancel request timeout work on remove - mmc: sdhci-sprd: disable runtime PM on remove - net/packet: guard the ll header push in packet_rcv_spkt() - net/smc: protect clcsock lifetime in smc_getname - net: bridge: avoid recursive multicast port cleanup - net: dsa: microchip: fix KSZ8765 fiber detection - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() - net: sparx5: free the matchall entry on destroy - net: usb: ax88179_178a: fix rx frame length for non-last packets - net: team: stop reusing skb after queue override - net: team: free skb when broadcast has no txable port - nvme: fix swapped ZRASF zone state values for full and read only - openvswitch: fix soft lockup in the netlink flow dump - optee: register TEE devices only once fully initialized - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains - pmdomain: rockchip: don't ignore clock lookup errors on attach - pmdomain: rockchip: fix clock leak on domain probe failure - pmdomain: rockchip: propagate subdomain add errors - scsi: qedi: Initialize callback state before registration - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE - riscv: fix load_unaligned_zeropad() fixup for RV32 - riscv: futex: untag the user pointer before the atomic access - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header - Bluetooth: btintel_pcie: use managed IRQ teardown - Bluetooth: hci_sock: Serialize dead-device detachment - Bluetooth: hci_sync: Fix command skb lifetime during scan setup - Bluetooth: ISO: Reject concurrent BIS listener setup - Bluetooth: ISO: Serialize concurrent connect calls - Bluetooth: MGMT: Fix status of pending commands flushed on power off - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() - Bluetooth: RFCOMM: free the skb when the DLC has no owner - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN - drm/gud: don't keep a connector without a CRTC as connector_state - drm/i915/gem: Prevent overstepping exec array boundary - drm/i915/gt: Unmask interrupts only when ACTIVE is true - drm/imagination: Size page table preallocation by device address - drm/vc4: drain the hangcheck timer and works on V3D unbind - drm/vc4: Fix firmware reference leak in vc4_drm_bind() - drm/vmwgfx: validate pitch coming from userspace - drm/xe: Fix shrinker accounting double-subtraction on nested external pins - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin - drm/amdkfd: align SDMA doorbell base for shader doorbell writes - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info - drm/amdgpu: serialize vblank counter reads against GPU reset - drm/amdgpu: make Mac FB workaround generic - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell - drm/amdgpu/userq: return the memdup_user() error for the user MQD - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs - mount: keep a copied mount unbindable - fs: don't silently unmount busy mounts - namespace: reset the old parent's ->overmount in mnt_change_mountpoint() - namespace: don't inherit MNT_UMOUNT in clone_mnt() - namespace: don't copy an unmounted mount tree - fs: refuse fspick() on internal superblocks - namespace: check the target before walking it in do_mount_setattr() - namespace: queue a mount only once for mount notifications - namespace: check a submount for references right before unmounting it - namespace: check a recursive bind mount for mount namespace loops - namespace: look at the topmost mount for a mount namespace file - namespace: remove the fsnotify marks of a mount namespace in process context - namespace: check the mounts before reading their parents in pivot_root() - dcache: don't put a mountpoint on a dentry that's being removed - namespace: don't let a pseudo dentry become the root of a mount - namespace: unhash a dentry before detaching the mounts on it - namei: don't reveal overmounted entries in refwalk - fcntl: refuse F_SET_RW_HINT on an immutable inode - namespace: refuse an automount below a mount that is in no namespace - namespace: never expire a locked mount - namespace: handle mount locking for automounts correctly - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands - accel/amdxdna: Fix NULL pointer dereference of mgmt_chann - accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding - s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code - drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length - NTB: core: Add .get_dma_dev() callback to ntb_dev_ops - NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers - svcrdma: Add Write chunk WRs to the RPC's Send WR chain - svcrdma: wake sq waiters when the transport closes - blk-cgroup: delay freeing policy data after rcu grace period - ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer - ipv6: mcast: annotate data-races around mca_users - arm64: dts: lx2160a: fix incorrect pinmux - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount - fs: don't let a migrating task hide its reference from do_umount() - Bluetooth: btintel_pcie: fix TX descriptor bounds check - Bluetooth: btintel_pcie: Add shared HW reset for clean start - drm/dp: don't mark the AUX backlight enabled when enabling failed - gpio: exar: initialize the ID before registering its cleanup - drm/aspeed: Balance the display clock enable on teardown - drm/vc4: Free the BO cache size list on teardown - net/sched: em_text: reject unterminated algo before autoload - amt: send the relay's General Query directly from the receive path - cxgb4/ch_ktls: disable softirqs around tid_list erases - tee: optee: fix kernel-doc warnings - tee: optee: ffa: support shared memory offsets on large-page kernels - ice: Restore Ordered MMIO Writes for Tx Doorbells - nvmet: return Invalid Field for invalid NSIDs feature 82h - nvmet: use the local P2P device on metadata allocation failure - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3 - zloop: zero out only the unread tail of short reads - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio - btrfs: free iov when btrfs_uring_read_extent() fails - btrfs: unlock inode and extent in caller when io_uring read extent fails - btrfs: fix xattr replace when multiple xattrs are packed in the same item - btrfs: fix lost error return value in btrfs_listxattr() - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums - net: make dev_xdp_sb_prog_count() see programs attached through a link - riscv: vector: Fix data pointer constraints in context save/restore - riscv: vector: Fix output operands in context save - wifi: mt76: don't return TXQ when exceeding max non-AQL packets - wifi: mac80211: add AQL support for multicast packets - wifi: mac80211: add ieee80211_txq_aql_pending() - wifi: mt76: add PS buffering support for HW-managed TIM drivers - wifi: mt76: account non-AQL frames per peer rather than per link - wifi: mt76: route nullfunc frames to PSD/ALTX queue - wifi: mt76: use ALTX queue for packets to disassociated stations - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout - wifi: mt76: mt7915: disable rx napi when removing device - wifi: mt76: mt7925: don't put the band auto marker in TGID - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit - wifi: mt76: mt792x: pick the SAR table layout from the table itself - Revert "wifi: ath12k: add panic handler" - ASoC: adau1372: allow sleepy powerdown GPIOs - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM - spi: sg2044-nor: Return transfer errors - spi: sg2044-nor: Honor SPI clock limits - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() - flow_dissector: avoid u16 truncation of skb->len when computing thoff - net: sparx5: start the TOD counters on non-PTP lan969x variants - devlink: fix devlink_rel reference leak when notify work is pending - net/sched: cls_route: reject change with no routing attribute - Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification" - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET - pfcp: make sure the SEID is linear before reading it - bnxt_en: Add bnxt_clear_bars() helper - bnxt_en: Fix driver init in kdump kernel - bnxt_en: Delay for 5 seconds after AER DPC for all chips - bnxt_en: Drop pci_save_state() after pci_restore_state() - bnxt_en: Re-write the BARs following any type of PCIe errors - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() - drm/imagination: Fix reference and vm_bo handling in remap() - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down - net/mlx5e: Order ICOSQ cc update after CQ doorbell - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() - ptp: ocp: fix PCIe delay estimation calculation - net: openvswitch: validate transport header presence in set_ipv6_addr - vsock: Fix memory leak in vmci_transport_recv_dgram_cb() - drm/vc4: Fix binner slot allocation failing on an idle GPU - x86/CPU/AMD: Fix AMD TLBI Erratum #1718 - drm/panthor: validate userspace queue count against initialized firmware slot count - s390/zcrypt: Improve CCA CPRB length and overflow checks - s390/zcrypt: Improve EP11 CPRB length and overflow checks - s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing - s390/zcrypt: Pad trailing CCA or EP11 message with zeros - xfs: remove duplicate INO1_WRITTEN check - xfs: stop exchanging reflink flags when exchanging mappings - xfs: fix exchange-range-to-eof file size exchange - can: fix unique skb identifier regression under RPS - SUNRPC: Add Kconfig dependency on CRYPTO_KRB5 - regulator: of: fill in supply names in of_regulator_bulk_get_all() - drm/amd/display: Don't replace a sink mode that shares the native totals - sched_ext: Generate qseq from a per-task counter - HID: steam: Fully unregister controller when hidraw is opened - HID: steam: Rearrange teardown sequence - HID: steam: Refactor registration - HID: steam: Clean up locking - ipv4: udp: Create exceptions before socket matching - ipv6: udp: Create exceptions before socket matching - can: dev: init_can_skb(): restore skb header initialization - e1000e: add system to disable K1 list - fsverity: RCU-delay the freeing of struct fsverity_info - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test - iavf: send MAC change request synchronously - io_uring/register: don't exempt disabled rings from task restrictions - ip6_tunnel: do not use dst6_mtu() in ip4ip6_err() and ip6erspan_tunnel_xmit() - ip6_gre: remove obsolete ERSPAN PMTU update - mm/vma: introduce vma_test[_any[_mask]](), and make inlining consistent - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() - scsi: ch: Do not keep references to data transfer element devices - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ - riscv: patch: fix handling of bpf-jit execmem addresses - riscv: ptrace: reject CFI regset access when extensions are absent - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex - drm/xe/i2c: cancel the client work on remove - drm/amd/display: disable self-refresh on tearing flips - statmount: read the parent of an unmounted mount under mount_lock - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE - namespace: don't reconfigure internal superblocks via remount and umount - unshare: don't drop active namespace references that were never taken - nullfs: don't update the access time - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys - scsi: ufs: core: Hold a clock reference across the probe - drm/bridge: Fix unlocked list_del in drm_bridge_add() - drm/bridge: Fix unlocked list access in drm_bridge_attach() - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() - drm/vc4: Use kvmalloc_objs() for the BO cache size list - lib/dim: fix 32-bit overflow in dim_calc_stats() rates - net: stmmac: propagate PTP addend and system time programming errors - bonding: fix the program leak when XDP is replaced - btrfs: don't stash io_uring encoded data across -EAGAIN - drm/xe: Do not emit Wa_16010904313 twice - net/mlx5: Lag, split aggregate speed into oper and max helpers - net: stmmac: Do not advertise S-VLAN stripping when it is disabled - net: stmmac: Disable S-Tag processing on dwmac4 - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param() - Revert "net: stmmac: propagate PTP addend and system time programming errors" - scsi: ufs: mediatek: Handle mPHY power-on failures - net: always dissect GSO packets in __virtio_net_hdr_to_skb() - ASoC: sdw_utils: Add codec info for CS35L62 - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI - riscv: ptrace: Zero-initialize regset buffers before copyin - bareudp: set the inner protocol to the protocol of the packet - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb - drm/vc4: Use devm_request_irq() for automatic cleanup - drm/vc4: Disable the V3D interrupt across runtime suspend - io_uring/memmap: account the pages a compound region really uses - io_uring/zcrx: use better name for RQ region - io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring() - io_uring/zcrx: use correct mmap off constants - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge - Upstream stable to v6.18.57, v7.2.11 * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-98038 - bpf: Keep refcount_acquire nullable for borrowed RCU kptrs * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-93175 - drm/amd/display: Fix dangling pointer in CRTC reset function * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90317 - bpf: Invalidate RCU pointers after final spin unlock * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90315 - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90167 - ksmbd: serialize oplock close with pending break ownership * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90162 - ksmbd: defer publishing granted locks to prevent UAF/double-free race * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90155 - ksmbd: detach blocked lock requests before freeing * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90144 - dpll: fix NULL deref in dpll_device_ops() during teardown race * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-89907 - LoongArch: KVM: Validate MSI data before routing it to EIOINTC * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-89709 - lockd, nfsd: RCU-protect nlmsvc_ops dispatch * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-89568 - kho: fix size calculation in kho_preserved_memory_reserve() * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-74568 - KVM: arm64: vgic: Fix race between LPI release and re-registration * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-74527 - octeontx2-af: Block VFs from clobbering special CGX PKIND state * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-74466 - s390/zcrypt: Close speculative mem read possibility * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-72497 - RDMA/bnxt_re: Add a max slot check for SQ * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-72404 - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-68305 - drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2024-50169. - vsock/virtio: account only unread bytes in read_skb() * Resolute update: upstream stable patchset 2026-10-20 (LP: #2171596) - selftests/mm: hugetlb-mremap: add setup of HugeTLB pages - mm/execmem: make the populate and alloc atomic - ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table - smb/client: pass cifs_open_info_data to SMB2_open() - ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices - audit: fix exe mark UAF in kill_rules() - crypto: x86/aes-gcm - fix always true check for last AAD segment - HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request - HID: multitouch: stop the release timer from being rearmed on remove - io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full - io_uring/zcrx: requeue multishot receives stopped by a local resource - kasan: unpoison task stack below watermark only in generic mode - kprobes: Skip disarmed probes when checking optkprobe overlap - octeontx2-pf: Fix RSS indirection table size - of/irq: Fix remaining refcount leaks in of_irq_init() - of/overlay: put property on deadprops only after changeset add succeeds - of/overlay: only treat a positive changeset id as registered - net: fix checksum offsets in skb_splice_from_iter() - net: phy: aquantia: fix system interface type not updated in forced mode - netfilter: nft_flow_offload: drop flowtable reference on init error path - net/packet: prevent TX_RING byte count overflow - r8169: disable EEE on RTL8168h/8111h - rtc: ac100: Assign .num before accessing .hws - rtc: spear: initialize IRQ state before requesting alarm IRQ - sctp: check RCV_SHUTDOWN after the sendmsg connect wait - tpm: Disable TPM on null key name mismatch - netfs: zero gaps in read-gaps folio to avoid writing back stale data - module: fix lost error code from codetag_load_module() - virt: vmgenid: remap memory as decrypted - virt: vmgenid: set driver_data before registering notification handlers - mm: shmem: ignore sysfs configs for shmem forced collapse - rds_tcp: close NULL deref window in rds_tcp_set_callbacks - vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF - vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() - vt: skip screen update for DEC alignment test on backgroup consoles - wifi: wlcore: Fix runtime PM leak in wlcore_remove() - ALSA: caiaq: unregister the input device when probe fails - ALSA: line6: reject oversized playback packets - random: vDSO: avoid call to memset() when zeroing reserved parameter - [Config] Add CC_OPT_INLINE_MEMSET compiler option - mm/damon/core: don't skip damos_adjust_quota() while esz is not zero - iio: dac: rohm-bd79703: Do not allow writing SCALE - iio: light: rohm-bu27034: Fix error return - iio: accel: kionix-kx022a: Fix array boundary check - mtd: core: call _get_device() with the master MTD - nvmet: preserve device path on allocation failure - random: fix vgetrandom_opaque_params kernel-doc - of/overlay: don't leak fragment references when changeset init fails - of/overlay: don't create "//" paths for fragments targeting the root - ASoC: wm8903: Move the DRC QR threshold to the register that holds it - wifi: wfx: validate MIB read length before copying to caller - ASoC: tegra: Fix ASRC Stream6 input threshold control - wifi: mac80211: drop oversized fragments to avoid extra_len overflow - wifi: ath11k: reset ar->num_stations on hardware start - wifi: ath9k: reject short WMI command responses - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE - rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak - rtc: ac100: Fix clock provider use-after-free on probe failure - rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() - wifi: cfg80211: preserve hidden-group beacon IE ownership - wifi: mac80211: Add multicast to unicast support for 802.3 path - wifi: mac80211: Add 802.3 multicast encapsulation offload support - wifi: mac80211: prevent AP VLAN tx from other interfaces - ASoC: codecs: rt286: Revert delay value for jack setup - ASoC: codecs: rt274: Fix format setting for 44100 rate - block: reject polled dio with user integrity metadata - blk-mq: set RQF_USE_SCHED when the operation is known - Bluetooth: hci_core: free the HCI ID if naming fails - Bluetooth: btintel: validate DDC record lengths - arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz - ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer - net/mctp: publish the mctp_dev only after it is initialised - net/sched: cls_api: reclaim an empty proto on the error path - net: bcmgenet: allocate RX buffers as page fragments - ipv6: fix prefix route expiry in modify_prefix_route() - netfilter: ipset: do not update comments from kernel-side adds - Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister - net: systemport: Fix buffer overflow in bcm_sysport_get_stats() - net: systemport: Fix RUNT MIB counter register offset calculation - net/mlx5: Fix slab-out-of-bounds when handling team device events - octeontx2-af: mcs: Fix SC resource cleanup loop - tipc: prevent GCM nonce reuse on peer key changes - net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() - net: stmmac: fix rx Scatter-Gather support - net: restrict SO_RESERVE_MEM to TCP sockets and cap max value - gve: DQO: accept TSO packets with non-protocol gso_type bits - net/sched: fq_codel: match the no-drop threshold to the packet size - net/sched: sch_codel: match the no-drop threshold to the packet size - virtio_blk: set the zone write granularity - net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence - net: bcmgenet: fix NULL dereference in set_coalesce before first open - net: cap skb->queue_mapping when the tx queue is picked - net: ethernet: mtk_eth_soc: allocate dummy netdev sooner - net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values - net: sparx5: move netdev and notifier block registration to probe - net: sparx5: move VCAP initialization to probe - net: sparx5: move MAC table initialization and add deinit function - net: sparx5: move stats initialization and add deinit function - net: sparx5: move PTP IRQ handling out of sparx5_start() - net: sparx5: skip ptp deinit if init was skipped - tcp: refresh TS.Recent for accepted old ACKs - ipvs: fix missing counter decrement in lblc - ipvs: do not create invisible templates - ipvs: filter some flags received in the backup server - netfilter: bpf: reject invalid NAT manipulation types - netfilter: flowtable: generalize pending status bit - net: microchip: vcap: stop scanning after deleting key field - of: Put coreboot node after compatibility check - net: sparx5: make ports inherit the switch base mac address type - net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference - ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() - net: mvneta: clear XDP pfmemalloc flag between frames - i2c: at91: release DMA channels when probe defers - perf: Fix race between perf_event_exit_task() and perf_pending_task() - ALSA: core: Define auto-cleanup for snd_card_free() - ALSA: ice1712: Fix the error handling via auto-cleanup at probe - spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260 - PCI: Accept AtomicOps already enabled by the hypervisor - drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC - drm/amd/pm/si: Fix updating clock limits on AC/DC - drm/amdgpu/gfx6: fix firmware leak on teardown - drm/radeon: Read the VRAM VBIOS signature with readb() - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device - drm/mediatek: Fix ovl adaptor platform device leak - drm/mediatek: Fix pdev reference leak in mtk_drm_bind() - drm/amdgpu: fix IP instance memory leak on kobject add failure - drm/amdgpu: fix ACP MFD device leak on init failure - drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU - binder: fix is_failure flag for superseded transaction cleanup - binder: fix leaked fd fixups on TF_UPDATE_TXN supersede - kgdboc: Fix tty driver reference leak in configure_kgdboc() - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 - Input: s6sy761 - fix resume ordering and restore sensing - Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 - Input: synaptics - limit T440p InterTouch quirk to LEN0036 - nitro_enclaves: fix use-after-free on SLOT_ALLOC failure - rust_binder: cancel deferred work items in thread exit - soc: qcom: geni-se: Correct QUP Core ICC vote constants - USB: cdc-acm: fix racy TIOCMIWAIT implementation - USB: cdc-acm: skip URB restart in port_shutdown if disconnected - USB: serial: fix port tear down use-after-free - usb: storage: sierra_ms: reject short SWoC info transfers - usb: hub: use shorter 120ms post resume hold for SS root hubs - usb: octeon-hcd: fix the FIFO-flush timeout computation - usb: ohci-da8xx: disable controller wakeup on cleanup - usb: ohci-s3c2410: disable controller wakeup on removal - usb: ohci-spear: disable controller wakeup on removal - usb: ohci-st: disable controller wakeup on removal - usb: gadget: midi2: Fix the jack descriptor array sizes - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd - usb: typec: anx7411 - stop the IRQ before destroying the workqueue - usb: typec: port-mapper: Only match USB4 port if host interface is available - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path - usb: gadget: aspeed-vhub: cancel wake work on device removal - USB: gadget: dummy-hcd: Fix wait for outstanding request completions - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC - usb: chipidea: tegra: disable runtime PM on resume failure - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints - USB: dwc2: shut down wakeup timer before freeing HCD state - usb: typec: tcpm: recover after failure to start the frs ams - usb: typec: tipd: don't send GAID when probe fails in APP mode - usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() - usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove - usb: typec: ucsi: Get the connector fwnode based on reg value - usb: typec: ucsi: displayport: Current CAM OOB index fixup - usb: cdns3: fix use-after-free in cdns3_gadget_exit() - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe - tty: vt: fix memory leak in vc_allocate() - tty: amiserial: fix broken TIOCMIWAIT - tty: vcc: zero-initialize control packet in vcc_send_ctl() - tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup - tty: tty_port: restore TTY_IO_ERROR on activation failure - tty: port: fix tty_port_tty_vhangup() race - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle - tty: abort break signalling on hangup - tty: serial: max3100: shut down timer before freeing port - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() - serial: 8250_omap: fix wake irq cleared during suspend - serial: revert guards in uart_wait_modem_status() - serial: fix TIOCMIWAIT race - serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() - serial: tegra: don't clear the Tx FIFO on an Rx-only reset - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() - serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap- around - serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL - arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems - ASoC: codecs: max98363: fix uninitialized stream_config->type - ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 - ALSA: seq: Serialize compat port-info ioctls - ALSA: ua101: reject mismatched capture/playback packet sizes - ALSA: hda/realtek: Fix square wave output on ASUS Strix G615LR - ALSA: hda/realtek: Fix silent speaker on Higole F9B - EDAC/versalnet: Drop remote processor handle refcount on driver removal - EDAC/altera: Do not allow driver unbinding - EDAC/altera: Drop __init from ECC setup paths for re-probe safety - EDAC/altera: Fix memory leak on dci allocation failure - EDAC/altera: Fix use-after-free in error paths - EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup - i2c: xiic: preserve PEC byte length in SMBus block read setup - i2c: xiic: don't clobber msg->len to signal block-read completion - Bluetooth: RFCOMM: Fix initial port reference race - Bluetooth: hci_sync: Fix inquiry cache use-after-free - Bluetooth: hci_conn: Lock parent access during enhanced SCO setup - Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown - Bluetooth: hci_core: Serialize fragmented ISO packet queueing - Bluetooth: btintel: fix buffer over-read in btintel_hw_error() - Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() - x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h - x86/mm: Drop unnecessary PMD page copy when freeing - mm/damon/core: do non-safe region walk on kdamond_apply_schemes() - fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() - io_uring: fix task_work add use-after-free with SQPOLL - ipvs: bound LBLCR and LBLC cache growth - net: extend IPv6 exthdr detection of tunneled packets - tpm: fix off-by-four bounds check in tpm2_get_random() - nvme-multipath: fix underflow in ANA log bounds checks - nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() - nvmet: pci-epf: reject too-short SGL segments - mtd: block2mtd: Fix divide error when erase_size is zero - mtd: mtd_intel_dg: reset poll counter for each erase - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB - mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive() - mtd: spinand: Enable QE on all dies - mtd: spinand: fix zero oobavail when no ECC engine is used - mtd: spinand: Do not update the QE bit on devices without one - KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified - KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it - KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state - KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy - KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs - KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor - wifi: cfg80211: fix RTS threshold setting for single-radio PHY - wifi: cw1200: fix TX padding OOB read leaking heap data to device - wifi: iwlegacy: 3945: free EEPROM data on remove - wifi: mac80211: keep paired old chanctx alive - wifi: mac80211: shut down RX BA session timer on teardown - wifi: mac80211: drain PS delivery work during station teardown - wifi: mac80211: account proxy paths against the mesh path limit - wifi: mac80211: keep fallback association elements alive - wifi: mac80211: minstrel_ht: validate fixed rate index - wifi: mac80211: reject invalid 320 MHz CSA bandwidth - wifi: mac80211: release mesh path quota on failed additions - wifi: mac80211: fix mesh fast xmit path deletion UAF - wifi: mac80211: handle empty FILS association request payload - USB: serial: cp210x: add Corsair AX1500i Power Supply - USB: serial: quatech2: fix baud rate overflow - USB: serial: ssu100: fix baud rate overflow - USB: serial: fix dynamic id driver deregistration race - USB: serial: fix driver deregistration order - USB: serial: fix ioctl hangup race - USB: serial: option: add support for SIMCom SIM8260C - USB: serial: option: add Quectel EG060W - USB: serial: option: add Compal EXM-G1x support - USB: serial: option: add Quectel RG660QB - USB: serial: option: add Compal EXC-T1 support - thunderbolt: Fix KASAN reported use-after-free when request is canceled - thunderbolt: Hold a router reference for each allocated HopID - thunderbolt: Mark discovered tunnels as active - thunderbolt: Tear down inactive DP tunnels when the domain is stopped - thunderbolt: Fix domain reference leak when DPRX read is canceled - thunderbolt: Disable CL states for the Anker Prime TB5 dock - thunderbolt: Reject oversized XDomain properties responses - smb: client: discard post-EOF pagecache when extending a file via zero range - smb: client: discard post-EOF pagecache when extending a file via copy range - smb: client: flush and commit data before querying allocated ranges - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races - iio: accel: kionix-kx022a: Prevent memory leak and fix state - iio: accel: kxcjk-1013: reject duplicate event disable - iio: accel: sca3000: fix frequency divider condition check - iio: adc: ad7173: Fix digital filter configuration - iio: adc: ad_sigma_delta: fix use-after-free on unbind - iio: adc: ade9000: fix NULL pointer dereference in clkout registration - iio: adc: ade9000: fix overlapping scan_index for current and voltage channels - iio: adc: ade9000: handle Phase C dip events in IRQ1 handler - iio: adc: ade9000: request interrupts after powering the device - iio: adc: axp288: Add TS bias override for Haier HV103H - iio: adc: max1363: sign-extend bipolar differential channel reads - iio: adc: pac1934: check ACPI label duplication - iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop - iio: adc: rohm-bd79124: Fix channel initialization - iio: adc: rohm-bd79124: Fix GPIO mask check - iio: adc: rohm-bd79124: Fix rising alarm - iio: adc: stm32-adc: fix check on internal channel availability - iio: adc: stm32-adc: fix possible division by zero in processed channel - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind - iio: admv1013: initialize callback mutex before registering notifier - iio: buffer: serialize buffer teardown with mode claims - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. - iio: cdc: ad7150: fix OF matching and publish module aliases - iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() - iio: gyro: adis16136: fix unprotected debugfs reads - iio: health: max30102: fix NULL dereference in interrupt handler - iio: imu: adis16400: fix unprotected debugfs reads - iio: imu: adis16480: fix unprotected debugfs reads - iio: light: gp2ap020a00f: drain irq_work after free_irq - iio: light: rohm-bu27034: Fix infinite delay on error - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup - iio: pressure: rohm-bm1390: Return error when read fails - iio: proximity: aw96103: validate firmware data length - iio: proximity: isl29501: Fix return type of isl29501_register_write - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure - iio: proximity: sx9324: Correct proximity channel resolution - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler - iio: proximity: vl53l0x-i2c: claim direct mode for raw reads - iio: trigger: cancel reenable_work before freeing trigger - mptcp: fix msk->timer_ival reset - mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages - pfcp: fix socket lifetime on netdevice registration failure - netfs: clear post-EOF pagecache when extending a file via write - mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc - rust: devres: ensure revocation is complete before device finishes unbinding - rust: irq: pass RegistrationInner as cookie to request_irq - Bluetooth: Serialize SMP remote OOB data access - nvmet-tcp: Don't error if TLS is enabed on a reset - nvmet: copy the hostid into the ctrl before creating PR pc_refs - nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known - mtd: spinand: fix NULL pointer dereference with no ECC engine - wifi: mac80211: count only matching reservations in reserved switch - wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() - wifi: mac80211: set info->band for 802.3 encap offload frames - thunderbolt: Don't access a DP tunnel after its DPRX read was canceled - smb: client: flush dirty data before zeroing a range - smb: client: distinguish real EOF from a stale remote_i_size on read - iio: adc: aspeed: propagate reset deassert errors - smb: client: only require read lease for size-extending preallocate - iio: adc: ad4030: fix invalid oversampling_ratio validation - drm/amd/display: Mark DCE 6.4 as not APU - drm/amd/display: Preserve eDP mode on initial ASSR failure - drm/amdgpu: reset VI ASIC on MacBookPro15,1 - drm/amdgpu: reset VI ASIC on MacBookPro14,3 - drm/amd/display: Fix fast updates on DCE 8.1 - usb: dwc3: gadget: fix IRQ storm on invalid event buffer count - tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 - usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 - tty: fix saved termios reset race - perf: Replace perf_event_header__init_id with full header init - perf/core: Check kernel access when kernel callchains are requested - perf: Require kernel access for text poke events - arm64: mm: Fix the break-before-make flush range for erratum 2645198 - arm64: errata: Factor out broken AMU const counter cap - [Config] Enable ARM64_WORKAROUND_BROKEN_AMU_CONSTCNT - arm64: errata: Add Cortex-A725 erratum 3821522 workaround - [Config] Enable ARM64_ERRATUM_3821522 - KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h - KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT - KVM: arm64: Use stage-1 leaf size for VM_PFNMAP - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted - KVM: move TSS constants from kvm_host.h to tss.h - KVM: x86: Add static calls for nested virtualization ops - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails - net: usb: qmi_wwan: add Quectel EG120K-EA - xen/netfront: drop RX packets with a short Ethernet header - net: mana: remove double CQ cleanup in mana_create_rxq error path - iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs - iio: adc: adi-axi-adc: Initialize state mutex - ipv4: free inet_opt and ireq_opt after an RCU grace period - drm/xe/i2c: Keep the i2c controller always enabled - selftests/cgroup: account for zswap shrinker writeback - KVM: x86: Move nested_run_pending to kvm_vcpu_arch - KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths - net: gso: limit recursive IP-in-IP segmentation - sysctl: Negate before converting in the int read path - time/jiffies: Saturate in mult_hz() instead of wrapping - netfs: zero the tail of a short DIO/unbuffered read - ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270) - ext4: don't enable large folios on encrypted inodes - mtd: core: avoid double-free of OTP NVMEM device - wifi: ath9k: Clean up device initialisation guards - wifi: mac80211: validate TX status rate metadata - mm/slab: handle the !allow_spin case in kfree_rcu_sheaf() - mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() - ASoC: SDCA: Set suspended flag after resuming within system suspend - ASoC: SDCA: Add better pm_runtime error handling in func probe - bpf: Fix overflow of jump offset in constant blinding - nvme: fix command effects log lifetime for multipath heads - bpf: Hold map BTF for the memory allocator destructor record - wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() - drm/xe/pf: Refactor VF LMEM BAR resize helper function - drm/xe/pf: Keep VF LMEM BAR size low if no VFs enabled - drm/mediatek: mtk_hdmi_v2: fix VID_DOWNSAMPLE_CONFIG register offset - octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled - seg6: ensure packet data is writable before modifying SRH and IPv6 DA - net: ethtool: let tsconfig reach a PHY-only timestamp provider - bpf: Wait for an RCU tasks grace period before freeing trampoline progs - bpf: Skip detached progs in trampoline images that are still in use - bpf: Factor out __do_call_rcu_ttrace() - bpf: Fix objects stuck in free_by_rcu_ttrace - drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() - futex: Fix private hash use-after-free on resize - drm/amd/display: guard dc_sink dereferences in MST mode validation - drm/amd/display: Fix fast updates on DCE 6.x - drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub() - drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub() - drm/i915/vrr: Disable DC balance by default - drm/amdgpu: drop userq callback assignment for sdma 7.1 - binderfs: fix UAF write in binder_add_device - clk: spacemit: k3: add CPU PLL rate tables - serial: core: fix NULL pointer dereference in serial_core_unregister_port() - ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after enabling clocks - ALSA: hda/realtek: Add quirk for Acer Nitro ANV15-41 - ALSA: hda/realtek: Update Acer Nitro ANV15-41 quirk to enable mute LED - ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72 - Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() - KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN - KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded - KVM: arm64: vgic: Allow last_lr_irq to be NULL when LRs are not overflowing - KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq - thunderbolt: Make the DP tunnel activation callback mandatory - smb: client: discard post-EOF pagecache when extending a file via clone range - smb: client: only require read lease for size-extending zero range - smb: client: drain and invalidate before server-side copy/clone - smb: client: require stable pages for signed connections - iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data - Upstream stable to v6.18.56, v7.2.10 * Resolute update: upstream stable patchset 2026-10-20 (LP: #2171596) // CVE-2026-89764 - rust: devres: fix race between concurrent revokers -- alice.munduruca@canonical.com (Alice C. Munduruca) Wed, 28 Oct 2026 10:17:00 -0400 ** Changed in: linux-oem-7.0 (Ubuntu Resolute) Status: Confirmed => Fix Released ** CVE added: https://cve.org/CVERecord?id=CVE-2024-50169 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68305 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-72404 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-72497 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74466 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74527 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74568 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89568 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89709 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89764 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89907 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90144 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90155 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90162 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90167 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90315 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90317 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93175 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98038 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169023 Title: Fix TI TAS2783 amplifier firmware load issue Status in HWE Next: New Status in linux package in Ubuntu: Fix Released Status in linux-oem-7.0 package in Ubuntu: Confirmed Status in linux source package in Resolute: Fix Committed Status in linux-oem-7.0 source package in Resolute: Fix Released Status in linux source package in Stonking: Fix Released Status in linux-oem-7.0 source package in Stonking: Confirmed Bug description: [Impact] Systems with TAS2783 SoundWire amplifiers take longer to resume from suspend because the driver downloads the amplifier firmware again even when the firmware remains in PRAM across the reset. This adds avoidable wake-up latency on resume. The issue affects the TAS2783 SoundWire codec driver. [Fix] Read the firmware version from the amplifier before downloading firmware. When the version matches the version already loaded, skip the PRAM block. Keep downloading the other firmware blocks, retry a failed block once, and refresh the regcache after the download. Upstream commit: f42fbd560cd834c7d10118743683def979c68739 ASoC: tas2783-sdw: add firmware download status check The commit is merged in linux-next but is not present in a released upstream v* tag. [Test Plan] Enable dynamic debug for the TAS2783 codec driver, then suspend and resume the system: echo 'file sound/soc/codecs/tas2783-sdw.c +p' | \ sudo tee /sys/kernel/debug/dynamic_debug/control sudo rtcwake -m mem -s 20 dmesg | grep -E 'Get Firmware version|Ignore PRAM block|FW download failed' Without the patch, the driver writes the PRAM firmware block during resume. With the patch, when the retained firmware version matches, dmesg shows "Ignore PRAM block", no firmware download error, and resume completes without the redundant PRAM write. [Where problems could occur] The change is limited to the TAS2783 SoundWire codec firmware-loading path. If the firmware version is read incorrectly, the driver could skip a needed PRAM download. The amplifier could then fail to initialize or audio could be missing after resume. If the new retry or regcache handling is wrong, firmware loading could fail or codec controls could use stale values. To manage notifications about this bug go to: https://bugs.launchpad.net/hwe-next/+bug/2169023/+subscriptions
Комментариев нет:
Отправить комментарий