linux-azure-fde (5.15.0-1116.125) jammy; urgency=medium

  * jammy/linux-azure-fde: 5.15.0-1116.125 -proposed tracker (LP: #2157201)

  [ Ubuntu-azure: 5.15.0-1116.125 ]

  * jammy/linux-azure: 5.15.0-1116.125 -proposed tracker (LP: #2157204)
  [ Ubuntu: 5.15.0-185.195 ]
  * jammy/linux: 5.15.0-185.195 -proposed tracker (LP: #2157253)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
    - [Packaging] resync retpoline extraction
  * CVE-2026-45988
    - rxrpc: Fix re-decryption of RESPONSE packets
  * CVE-2026-46195
    - smb: client: validate dacloffset before building DACL pointers
  * CVE-2026-46135
    - nvmet-tcp: fix race between ICReq handling and queue teardown
  * CVE-2026-31402
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  * CVE-2026-43071
    - dcache: Limit the minimal number of bucket to two
  * CVE-2026-46119
    - libceph: Fix slab-out-of-bounds access in auth message processing
  * CVE-2026-43501
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
  * CVE-2026-46043
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
  * CVE-2026-43493
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  * CVE-2026-31637
    - rxrpc: reject undecryptable rxkad response tickets
  * CVE-2026-31657
    - batman-adv: hold claim backbone gateways by reference
  * CVE-2026-31685
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets
  * CVE-2026-43117
    - btrfs: tracepoints: get correct superblock from dentry in event
      btrfs_sync_file()
  * CVE-2026-43114
    - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on
      expiry
  * CVE-2026-31478
    - ksmbd: replace hardcoded hdr2_len with offsetof() in
      smb2_calc_max_out_buf_len()
  * CVE-2026-31668
    - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  * CVE-2026-31659
    - batman-adv: reject oversized global TT response buffers
  * CVE-2026-31649
    - net: stmmac: fix integer underflow in chain mode
  * CVE-2026-31669
    - mptcp: fix slab-use-after-free in __inet_lookup_established
  * CVE-2026-43011
    - net/x25: Fix potential double free of skb
  * CVE-2026-43037
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  * CVE-2026-43038
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
  * CVE-2026-31682
    - bridge: br_nd_send: linearize skb before parsing ND options
  * CVE-2026-23450
    - net/smc: Only save the original clcsock callback functions
    - net/smc: Fix slab-out-of-bounds issue in fallback
    - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
  * CVE-2026-23428
    - ksmbd: fix use-after-free of share_conf in compound request
  * CVE-2026-23455
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
  * CVE-2026-43186
    - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
  * CVE-2026-43185
    - ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
  * CVE-2026-43341
    - net/ipv6: ioam6: prevent schema length wraparound in trace fill
  * CVE-2026-31607
    - usbip: validate number_of_packets in usbip_pack_ret_submit()
  * CVE-2026-43383
    - net/tcp-md5: Fix MAC comparison to be constant-time
  * CVE-2025-68263
    - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
  * CVE-2026-46243
    - smb: client: reject userspace cifs.spnego descriptions
  * CVE-2026-43414
    - scsi: qla2xxx: Completely fix fcport double free
  * CVE-2026-43407
    - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  * CVE-2026-43406
    - libceph: prevent potential out-of-bounds reads in
      process_message_header()
  * CVE-2026-43304
    - libceph: define and enforce CEPH_MAX_KEY_LEN
  * CVE-2025-37924
    - ksmbd: fix use-after-free in kerberos authentication
  * CVE-2025-37778
    - ksmbd: Fix dangling pointer in krb_authenticate

 -- John Cabaj <john.cabaj@canonical.com>  Fri, 19 Jun 2026 14:36:04 -0500

linux-azure-fde (5.15.0-1115.124) jammy; urgency=medium

  * jammy/linux-azure-fde: 5.15.0-1115.124 -proposed tracker (LP: #2151955)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync retpoline extraction

  [ Ubuntu-azure: 5.15.0-1115.124 ]

  * jammy/linux-azure: 5.15.0-1115.124 -proposed tracker (LP: #2151958)
  [ Ubuntu: 5.15.0-184.194 ]
  * jammy/linux: 5.15.0-184.194 -proposed tracker (LP: #2154219)
  * Kernel regression (6.8.0-117.generic) (LP: #2153556)
    - net: bonding: update the slave array for broadcast mode
    - bonding: do not set usable_slaves for broadcast mode
  * kernel null pointer BUG in 5.15 when disconnecting from cifs share
    (LP: #2150730)
    - SAUCE: cifs: fix null pointer dereference in find_ipc_from_server_path
  * SUNRPC: System wide grep leads to NULL pointer deference in sysfs reads
    (LP: #2149767)
    - SUNRPC: Check if the xprt is connected before handling sysfs reads
    - SUNRPC: Do not dereference non-socket transports in sysfs
  * SUNRPC: System wide grep leads to NULL pointer deference in sysfs reads
    (LP: #2149767) // CVE-2022-48816
    - SUNRPC: lock against ->sock changing during sysfs read
  * iptables connlimit traffic loss (LP: #2149872)
    - netfilter: nf_conncount: fix tracking of connections from localhost
  * Some powerpc test from ubuntu_kernel_selftests timeout with 45 seconds
    (LP: #2141536)
    - selftests/powerpc: Lower run time of count_stcx_fail test
    - selftests/powerpc: Give all tests 2 minutes timeout
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598)
    - x86/kfence: fix booting on 32bit non-PAE systems
    - platform/x86: intel_telemetry: Fix swapped arrays in PSS output
    - rbd: check for EOD after exclusive lock is ensured to be held
    - ARM: 9468/1: fix memset64() on big-endian
    - mm/kfence: randomize the freelist on initialization
    - Documentation: Remove bogus claim about del_timer_sync()
    - timers: Get rid of del_singleshot_timer_sync()
    - Documentation: Replace del_timer/del_timer_sync()
    - timers: Update the documentation to reflect on the new timer_shutdown()
      API
    - Bluetooth: hci_qca: Fix the teardown problem for real
    - binderfs: fix ida_alloc_max() upper bound
    - net: usb: sr9700: support devices with virtual driver CD
    - block,bfq: fix aux stat accumulation destination
    - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
    - HID: intel-ish-hid: Reset enum_devices_done before enumeration
    - HID: playstation: Center initial joystick axes to prevent spurious
      events
    - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
    - netfilter: replace -EEXIST with -EBUSY
    - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
    - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
    - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
    - wifi: mac80211: collect station statistics earlier when disconnect
    - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
    - ASoC: tlv320adcx140: Propagate error codes during probe
    - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
    - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
    - platform/x86: intel_telemetry: Fix PSS event register mask
    - tipc: use kfree_sensitive() for session key material
    - hwmon: (occ) Mark occ_init_attribute() as __printf
    - nvmet-tcp: add an helper to free the cmd buffers
    - nvmet-tcp: fix memory leak when performing a controller reset
    - nvmet-tcp: fix regression in data_digest calculation
    - nvmet-tcp: don't map pages which can't come from HIGHMEM
    - tracing: Fix ftrace event field alignments
    - gve: Correct ethtool rx_dropped calculation
    - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed
      transfer
    - spi: tegra210-quad: Move curr_xfer read inside spinlock
    - spi: tegra210-quad: Protect curr_xfer assignment in
      tegra_qspi_setup_transfer_one
    - spi: tegra210-quad: Protect curr_xfer clearing in
      tegra_qspi_non_combined_seq_xfer
    - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page()
    - riscv: Replace function-like macro by static inline function
    - Linux 5.15.200
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23182
    - spi: tegra: Fix a memory leak in tegra_slink_probe()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23202
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-71089
    - iommu: disable SVA when CONFIG_X86 is set
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2023-53673
    - Bluetooth: hci_event: call disconnect callback before deleting conn
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23262
    - gve: Fix stats report corruption on queue count change
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-40082
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-37822
    - riscv: uprobes: Add missing fence.i after building the XOL buffer
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23190
    - ASoC: amd: fix memory leak in acp3x pdm dma ops
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23111
    - netfilter: nf_tables: fix inverted genmask check in
      nft_map_catchall_activate()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23180
    - dpaa2-switch: add bounds check for if_id in IRQ handler
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23256
    - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23257
    - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23258
    - net: liquidio: Initialize netdev pointer before queue setup
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23206
    - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23176
    - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23216
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23193
    - scsi: target: iscsi: Fix use-after-free in
      iscsit_dec_session_usage_count()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-71220
    - smb/server: call ksmbd_session_rpc_close() on error path in
      create_smb2_pipe()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-71222
    - wifi: wlcore: ensure skb headroom before skb_push
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-71224
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-68214
    - timers: Fix NULL function pointer race in timer_shutdown_sync()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-38201
    - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23198
    - KVM: Don't clobber irqfd routing type when deassigning irqfd
  * CVE-2026-23272
    - netfilter: nf_tables: always increment set element count
    - netfilter: nf_tables: fix set size with rbtree backend
    - netfilter: nf_tables: unconditionally bump set->nelems before insertion
  * CVE-2026-31418
    - netfilter: ipset: drop logically empty buckets in mtype_del
  * CVE-2026-23278
    - netfilter: nf_tables: always walk all pending catchall elements
  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails
  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic
  * CVE-2026-43500
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags
    - xfrm: esp: ipv4: fix up flags setting
  * CVE-2026-31419
    - net: bonding: fix use-after-free in bond_xmit_broadcast()
  * CVE-2026-31431
    - crypto: scatterwalk - Backport memcpy_sglist()
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
    - crypto: algif_aead - Revert to operating out-of-place
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: authenc - use memcpy_sglist() instead of null skcipher
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
      decryption
    - crypto: authencesn - Fix src offset when decrypting in-place
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
    - crypto: algif_aead - Fix minimum RX size check for decryption
  * CVE-2026-31533
    - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
  * CVE-2026-31504
    - net: fix fanout UAF in packet_release() via NETDEV_UP race

 -- John Cabaj <john.cabaj@canonical.com>  Mon, 01 Jun 2026 16:49:51 -0500

linux-azure-fde (5.15.0-1114.123) jammy; urgency=medium

  * jammy/linux-azure-fde: 5.15.0-1114.123 -proposed tracker (LP: #2153627)

  [ Ubuntu-azure: 5.15.0-1114.123 ]

  * jammy/linux-azure: 5.15.0-1114.123 -proposed tracker (LP: #2153630)
  [ Ubuntu: 5.15.0-181.191 ]
  * jammy/linux: 5.15.0-181.191 -proposed tracker (LP: #2153680)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
    - [Packaging] resync retpoline extraction
  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails
  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic
  * CVE-2026-43500
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags
    - xfrm: esp: ipv4: fix up flags setting

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 27 May 2026 10:22:32 -0500

linux-azure-fde (5.15.0-1113.122) jammy; urgency=medium

  * jammy/linux-azure-fde: 5.15.0-1113.122 -proposed tracker (LP: #2150962)

  [ Ubuntu-azure: 5.15.0-1113.122 ]

  * jammy/linux-azure: 5.15.0-1113.122 -proposed tracker (LP: #2150965)
  [ Ubuntu: 5.15.0-179.189 ]
  * jammy/linux: 5.15.0-179.189 -proposed tracker (LP: #2151014)
  * CVE-2026-31419
    - net: bonding: fix use-after-free in bond_xmit_broadcast()
  * CVE-2026-31431
    - crypto: scatterwalk - Backport memcpy_sglist()
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
    - crypto: algif_aead - Revert to operating out-of-place
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: authenc - use memcpy_sglist() instead of null skcipher
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
      decryption
    - crypto: authencesn - Fix src offset when decrypting in-place
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
    - crypto: algif_aead - Fix minimum RX size check for decryption
  * CVE-2026-31533
    - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
  * CVE-2026-31504
    - net: fix fanout UAF in packet_release() via NETDEV_UP race

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 06 May 2026 16:01:19 -0500

linux-azure-fde (5.15.0-1112.121) jammy; urgency=medium

  * jammy/linux-azure-fde: 5.15.0-1112.121 -proposed tracker (LP: #2148402)

  [ Ubuntu-azure: 5.15.0-1112.121 ]

  * jammy/linux-azure: 5.15.0-1112.121 -proposed tracker (LP: #2148406)
  [ Ubuntu: 5.15.0-178.188 ]
  * jammy/linux: 5.15.0-178.188 -proposed tracker (LP: #2148097)
  * Canonical Kmod 2025 key rotation (LP: #2147447)
    - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing
      extensible
    - [Packaging] ubuntu-compatible-signing -- allow consumption of positive
      certs
    - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key
    - [Config] prepare for Canonical Kmod key rotation
    - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key
  * ADATA SU680 causes repeated SATA resets and I/O errors on Ubuntu unless
    link power management is forced to max_performance (LP: #2144060)
    - ata: libata-core: disable LPM on ADATA SU680 SSD
  * CVE-2024-50060
    - io_uring: check if we need to reschedule during overflow flush
  * CVE-2024-35862
    - smb: client: fix potential UAF in smb2_is_network_name_deleted()
  * CVE-2026-23274
    - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  * CVE-2026-23351
    - netfilter: nf_tables: de-constify set commit ops function argument
    - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
  * macvlan: observe an RCU grace period in macvlan_common_newlink() error
    path (LP: #2144380) // CVE-2026-23209
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path
  * CVE-2023-2640 // CVE-2023-32629
    - SAUCE: overlayfs: default to userxattr when mounted from non initial
      user namespace
  * CVE-2023-2640 // CVE-2023-2640 and CVE-2023-32629. // CVE-2023-32629
    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Skip permission checking for
      trusted.overlayfs.* xattrs"
  * CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

  [ Ubuntu-azure: 5.15.0-1111.120 ]

  * jammy/linux-azure: 5.15.0-1111.120 -proposed tracker (LP: #2147789)
  [ Ubuntu: 5.15.0-177.187 ]
  * jammy/linux: 5.15.0-177.187 -proposed tracker (LP: #2147840)
  * macvlan: observe an RCU grace period in macvlan_common_newlink() error
    path (LP: #2144380) // CVE-2026-23209
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path
  * CVE-2023-2640 // CVE-2023-32629
    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Skip permission checking for
      trusted.overlayfs.* xattrs"
    - SAUCE: overlayfs: default to userxattr when mounted from non initial
      user namespace
  * CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

  [ Ubuntu-azure: 5.15.0-1110.119 ]

  * jammy/linux-azure: 5.15.0-1110.119 -proposed tracker (LP: #2143488)
  [ Ubuntu: 5.15.0-176.186 ]
  * jammy/linux: 5.15.0-176.186 -proposed tracker (LP: #2143539)
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343)
    - nvmet-tcp: remove boilerplate code
    - SAUCE: Fix skb_vlan_inet_prepare() usage
    - net: update netdev_lock_{type,name}
    - vsock/test: add a final full barrier after run all tests
    - net/mlx5e: Restore destroying state bit after profile cleanup
    - selftests: drv-net: fix RPS mask handling for high CPU numbers
    - ASoC: tlv320adcx140: fix word length
    - textsearch: describe @list member in ts_ops search
    - mm, kfence: describe @slab parameter in __kfence_obj_info()
    - dmaengine: xilinx_dma: Fix uninitialized addr_width when
      "xlnx,addrwidth" property is missing
    - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
    - HID: usbhid: paper over wrong bNumDescriptor field
    - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
    - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
    - phy: rockchip: inno-usb2: fix disconnection in gadget mode
    - phy: rockchip: inno-usb2: fix communication disruption in gadget mode
    - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
    - usb: dwc3: Check for USB4 IP_NAME
    - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
    - USB: serial: option: add Telit LE910 MBIM composition
    - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
    - nvme-pci: disable secondary temp for Wodposit WPBSNM8
    - hrtimer: Fix softirq base check in update_needs_ipi()
    - EDAC/x38: Fix a resource leak in x38_probe1()
    - EDAC/i3200: Fix a resource leak in i3200_probe1()
    - x86/resctrl: Add missing resctrl initialization for Hygon
    - x86/resctrl: Fix memory bandwidth counter width for Hygon
    - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
    - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
    - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
    - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
    - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
    - dmaengine: ti: k3-udma: fix device leak on udma lookup
    - posix-clock: introduce posix_clock_context concept
    - Fix memory leak in posix_clock_open()
    - posix-clock: Store file pointer in struct posix_clock_context
    - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
    - testptp: add option to shift clock by nanoseconds
    - testptp: Add support for testing ptp_clock_info .adjphase callback
    - selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED
    - selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE
    - ptp: add testptp mask test
    - selftest/ptp: update ptp selftest to exercise the gettimex options
    - testptp: Add option to open PHC in readonly mode
    - net: usb: dm9601: remove broken SR9700 support
    - amd-xgbe: avoid misleading per-packet error log
    - netlink: add a proto specification for FOU
    - net: fou: rename the source for linking
    - net: fou: use policy and operation tables generated from the spec
    - comedi: dmm32at: serialize use of paged registers
    - w1: fix redundant counter decrement in w1_attach_slave_device()
    - Revert "nfc/nci: Add the inconsistency check between the input data
      length and count"
    - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
    - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
    - scsi: storvsc: Process unsupported MODE_SENSE_10
    - x86/kfence: avoid writing L1TF-vulnerable PTEs
    - staging:iio:adc:ad7280a: Register define cleanup.
    - iio: adc: ad7280a: handle spi_setup() errors in probe()
    - ALSA: usb: Increase volume range that triggers a warning
    - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
    - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
    - usbnet: limit max_mtu based on device's hard_mtu
    - drm/amd/pm: Don't clear SI SMC table when setting power limit
    - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
    - octeontx2-af: Fix error handling
    - x86: make page fault handling disable interrupts properly
    - of: fix reference count leak in of_alias_scan()
    - iio: adc: ad9467: fix ad9434 vref mask
    - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
    - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
    - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
    - octeontx2: Fix otx2_dma_map_page() error return code
    - slimbus: core: fix runtime PM imbalance on report present
    - perf/x86/intel: Do not enable BTS for guests
    - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
    - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
    - ipv6: use the right ifindex when replying to icmpv6 from localhost
    - ice: stop counting UDP csum mismatch as rx_errors
    - net/mlx5: Add HW definitions of vport debug counters
    - net/mlx5e: Expose rx_oversize_pkts_buffer counter
    - net/mlx5e: Report rx_discards_phy via rx_dropped
    - net/mlx5e: Account for netdev stats in ndo_get_stats64
    - net: bridge: fix static key check
    - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
    - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
    - dma/pool: distinguish between missing and exhausted atomic pools
    - ASoC: fsl: imx-card: Do not force slot width to sample width
    - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
    - scsi: qla2xxx: edif: Fix dma_free_coherent() size
    - mptcp: only reset subflow errors when propagated
    - net: Add locking to protect skb->dev access in ip_output
    - comedi: Fix getting range information for subdevices 16 to 255
    - of: platform: Use default match table for /firmware
    - iio: adc: exynos_adc: fix OF populate on driver rebind
    - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
    - w1: w1_therm: use swap() to make code cleaner
    - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
    - xfs: set max_agbno to allow sparse alloc of last full inode chunk
    - nvme-fc: rename free_ctrl callback to match name pattern
    - nvme-pci: do not directly handle subsys reset fallout
    - nvme: fix PCIe subsystem reset controller state transition
    - mei: trace: treat reg parameter as string
    - mm/pagewalk: add walk_page_range_vma()
    - wifi: cfg80211: add a work abstraction with special semantics
    - wifi: mac80211: use wiphy work for sdata->work
    - wifi: mac80211: move TDLS work to wiphy work
    - HID: uclogic: Add NULL check in uclogic_input_configured()
    - drm/amdkfd: fix a memory leak in device_queue_manager_init()
    - btrfs: prevent use-after-free on page private data in
      btrfs_subpage_clear_uptodate()
    - net/sched: act_ife: convert comma to semicolon
    - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
    - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
    - mptcp: avoid dup SUB_CLOSED events after disconnect
    - pinctrl: meson: mark the GPIO controller as sleeping
    - wifi: cfg80211: use system_unbound_wq for wiphy work
    - wifi: cfg80211: fix wiphy delayed work queueing
    - wifi: cfg80211: cancel wiphy_work before freeing wiphy
    - wifi: cfg80211: fully move wiphy work to unbound workqueue
    - wifi: cfg80211: init wiphy_work before allocating rfkill fails
    - Linux 5.15.199
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-68340
    - team: Move team device type change at the end of team_port_add
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23170
    - drm/imx/tve: fix probe device leak
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23075
    - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-38408
    - genirq/irq_sim: Initialize work context pointers properly
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2023-54207
    - HID: uclogic: Correct devm device reference for hidinput input_dev name
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2023-53520
    - Bluetooth: Fix hci_suspend_sync crash
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-38125
    - net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-40164
    - usbnet: Fix using smp_processor_id() in preemptible code warnings
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-38232
    - NFSD: fix race between nfsd registration and exports_proc
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2023-53662
    - ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-38057
    - espintcp: fix skb leaks
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2023-53421
    - blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-68365
    - fs/ntfs3: Initialize allocated memory before use
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-68817
    - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2022-50390
    - drm/ttm: fix undefined behavior in bit shift for
      TTM_TT_FLAG_PRIV_POPULATED
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-68211
    - ksm: use range-walk function to jump over holes in
      scan_get_next_rmap_item
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23093
    - ksmbd: smbd: fix dma_unmap_sg() nents
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23078
    - ALSA: scarlett2: Fix buffer overflow in config retrieval
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71186
    - dmaengine: stm32: dmamux: fix device leak on route allocation
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71197
    - w1: therm: Fix off-by-one buffer overflow in alarms_store
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23087
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-40149
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23167
    - nfc: nci: Fix race between rfkill and nci_unregister_device().
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23150
    - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23164
    - rocker: fix memory leak in rocker_world_port_post_fini()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23146
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-38591
    - bpf: Reject narrower access to pointer ctx fields
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-68725
    - bpf: Do not let BPF test infra emit invalid GSO types to stack
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23097
    - migrate: correct lock ordering for hugetlb file folios
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23108
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23080
    - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23061
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23058
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23085
    - irqchip/gic-v3-its: Avoid truncating memory addresses
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23098
    - netrom: fix double-free in nr_route_frame()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23063
    - uacce: ensure safe queue release with state management
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23056
    - uacce: implement mremap in uacce_vm_ops to return -EPERM
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23096
    - uacce: fix cdev handling in the cleanup path
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23091
    - intel_th: fix device leak on output open()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23090
    - slimbus: core: fix device reference leak on report present
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23128
    - arm64: Set __nocfi on swsusp_arch_resume()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23073
    - wifi: rsi: Fix memory corruption due to not set vif driver data size
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23133
    - wifi: ath10k: fix dma_free_coherent() pointer
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23089
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23076
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71199
    - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
      driver
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23101
    - leds: led-class: Only Add LED to leds_list when it is fully ready
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23064
    - net/sched: act_ife: avoid possible NULL deref
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23119
    - bonding: provide a net pointer to __skb_flow_dissect()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23084
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23124
    - ipv6: annotate data-race in ndisc_router_discovery()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23121
    - mISDN: annotate data-race around dev->work
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23071
    - regmap: Fix race condition in hwspinlock irqsave routine
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23105
    - net/sched: qfq: Use cl_is_active to determine whether class is active in
      qfq_rm_from_ag
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23103
    - ipvlan: Make the addrs_lock be per port
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23120
    - l2tp: avoid one data-race in l2tp_tunnel_del_work()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23083
    - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23095
    - gue: Fix skb memleak with inner IP protocol 0.
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23125
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23099
    - bonding: limit BOND_MODE_8023AD to Ethernet devices
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71194
    - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
      type
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71185
    - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23026
    - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71188
    - dmaengine: lpc18xx-dmamux: fix device leak on route allocation
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71163
    - dmaengine: idxd: fix device leaks on compat bind and unbind
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71190
    - dmaengine: bcm-sba-raid: fix device leak on probe
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71191
    - dmaengine: at_hdmac: fix device leak on of_dma_xlate()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23049
    - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23145
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-22997
    - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
      upon receiving the second rts
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23033
    - dmaengine: omap-dma: fix dma_pool resource leak in error paths
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71196
    - phy: stm32-usphyc: Fix off by one in probe()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2025-71162
    - dmaengine: tegra-adma: Fix use-after-free
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-22999
    - net/sched: sch_qfq: do not free existing class in qfq_change_class()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23011
    - ipv4: ip_gre: make ipgre_header() robust
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23001
    - macvlan: fix possible UAF in macvlan_forward_source()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23003
    - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-22998
    - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23037
    - can: etas_es58x: allow partial RX URB allocation to succeed
  * Jammy update: v5.15.199 upstream stable release (LP: #2143343) //
    CVE-2026-23038
    - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
  * ADT test for linux package failed with "fatal: unable to connect to
    git.launchpad.net" (LP: #2143033)
    - [Packaging] d/t/ubuntu-regression-suite: use https to clone
  * efi: Fix swapped arguments to bsearch() in efi_status_to_*() SAUCE patch
    (LP: #2141276)
    - SAUCE efi: Fix swapped arguments to bsearch() in efi_status_to_*()
  * CVE-2026-23111
    - netfilter: nf_tables: fix inverted genmask check in
      nft_map_catchall_activate()
  * CVE-2026-23209
    - macvlan: fix error recovery in macvlan_common_newlink()
  * CVE-2025-37849
    - KVM: arm64: vgic: Add a non-locking primitive for
      kvm_vgic_vcpu_destroy()
    - KVM: arm64: Tear down vGIC on failed vCPU creation
  * CVE-2026-23074
    - net/sched: Enforce that teql can only be used as root qdisc
  * CVE-2026-23060
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
      spec

 -- John Cabaj <john.cabaj@canonical.com>  Mon, 20 Apr 2026 12:24:42 -0500

linux-azure-fde (5.15.0-1108.118) jammy; urgency=medium

  * Miscellaneous Ubuntu changes
    - [Packaging] azure-fde: Including full Linux kernel tree

 -- John Cabaj <john.cabaj@canonical.com>  Thu, 19 Mar 2026 22:18:02 -0500

linux-azure-fde (5.15.0-1108.117) jammy; urgency=medium

  * Updating versioning to <abi>-<upload num>

 -- John Cabaj <john.cabaj@canonical.com>  Thu, 19 Mar 2026 17:33:47 -0500
