linux-azure (6.8.0-1059.65) noble; urgency=medium

  * noble/linux-azure: 6.8.0-1059.65 -proposed tracker (LP: #2154475)

 -- John Cabaj <john.cabaj@canonical.com>  Thu, 28 May 2026 10:04:00 -0500

linux-azure (6.8.0-1058.64) noble; urgency=medium

  [ Ubuntu: 6.8.0-124.124 ]

  * GRO managed-frag use-after-free leading to local privilege escalation
    (LP: #2154172)
    - net: gro: don't merge zcopy skbs

  [ Ubuntu: 6.8.0-121.121 ]

  * apparmor (LP: #2151747)
    - apparmor: Fix incorrect profile->signal range check
    - SAUCE: apparmor: pass big_resp to handler
    - SAUCE: apparmor: remove redundant kref_init for listener->count
    - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb
  * apparmor (LP: #2151747) // CVE-2026-47337
    - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr
  * apparmor (LP: #2151747) // CVE-2026-47336
    - SAUCE: apparmor: fix use of unintialized variable in net opt level
  * apparmor (LP: #2151747) // CVE-2026-47335
    - SAUCE: apparmor: fix possible NULL pointer dereference by adding a NULL
      check
  * apparmor (LP: #2151747) // CVE-2026-47334
    - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock
  * apparmor (LP: #2151747) // CVE-2026-47333
    - SAUCE: apparmor: fix dfa unpacking size of the notification filter
  * apparmor (LP: #2151747) // CVE-2026-47332
    - SAUCE: apparmor: fix size check against type instead of pointer
  * apparmor (LP: #2151747) // CVE-2026-47331
    - SAUCE: apparmor: fix changing rules list without a lock
  * apparmor: LLVM/clang build failure due to uninitialized variable in
    notify.c (LP: #2148809) // CVE-2026-47330
    - SAUCE: apparmor: initialize variable used in uninitialized context
  * apparmor (LP: #2151747) // CVE-2026-47329
    - SAUCE: apparmor: fix name validation bypass on notification
  * apparmor (LP: #2151747) // CVE-2026-47327 // CVE-2026-47328
    - SAUCE: apparmor: fix glob memory leak after kstrdup
  * apparmor (LP: #2151747) // CVE-2026-47326
    - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 27 May 2026 14:31:21 -0500

linux-azure (6.8.0-1057.63) noble; urgency=medium

  * noble/linux-azure: 6.8.0-1057.63 -proposed tracker (LP: #2153694)

  [ Ubuntu: 6.8.0-120.120 ]

  * noble/linux: 6.8.0-120.120 -proposed tracker (LP: #2153733)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails
  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic
  * CVE-2026-43500
    - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
    - rxrpc: Parse received packets before dealing with timeouts
    - rxrpc: Fix potential UAF after skb_unshare() failure
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * CVE-2026-31676 // CVE-2026-43500
    - rxrpc: only handle RESPONSE during service challenge
  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags

 -- John Cabaj <john.cabaj@canonical.com>  Tue, 26 May 2026 13:00:49 -0500

linux-azure (6.8.0-1056.62) noble; urgency=medium

  * noble/linux-azure: 6.8.0-1056.62 -proposed tracker (LP: #2151028)

  [ Ubuntu: 6.8.0-117.117 ]

  * noble/linux: 6.8.0-117.117 -proposed tracker (LP: #2151070)
  * CVE-2026-31419
    - net: bonding: fix use-after-free in bond_xmit_broadcast()
  * CVE-2026-31431
    - crypto: scatterwalk - Backport memcpy_sglist()
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
    - crypto: algif_aead - Revert to operating out-of-place
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: authenc - use memcpy_sglist() instead of null skcipher
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
      decryption
    - crypto: authencesn - Fix src offset when decrypting in-place
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
    - crypto: algif_aead - Fix minimum RX size check for decryption
  * CVE-2026-31533
    - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
  * CVE-2026-31504
    - net: fix fanout UAF in packet_release() via NETDEV_UP race

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 06 May 2026 11:28:21 -0500

linux-azure (6.8.0-1055.61) noble; urgency=medium

  * noble/linux-azure: 6.8.0-1055.61 -proposed tracker (LP: #2150009)

  [ Ubuntu: 6.8.0-116.116 ]

  * noble/linux: 6.8.0-116.116 -proposed tracker (LP: #2150048)
  * Linux kernel  6.17.0-22.22  breaks amdxdna (LP: #2149766)
    - Revert "iommu: disable SVA when CONFIG_X86 is set"
  * Revert "netfilter: conntrack: fix erronous removal of offload bit"
    (LP: #2149762)
    - Revert "netfilter: conntrack: fix erronous removal of offload bit"

  [ Ubuntu: 6.8.0-114.114 ]

  * noble/linux: 6.8.0-114.114 -proposed tracker (LP: #2148397)
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465)
    - SAUCE: Fix skb_vlan_inet_prepare() usage

  [ Ubuntu: 6.8.0-112.112 ]

  * noble/linux: 6.8.0-112.112 -proposed tracker (LP: #2147982)
  * Canonical Kmod 2025 key rotation (LP: #2147447)
    - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing
      extensible
    - [Packaging] ubuntu-compatible-signing -- allow consumption of positive
      certs
    - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key
    - [Config] prepare for Canonical Kmod key rotation
    - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key
  * Remount ext4 to readonly with data=journal mode may dump call trace
    (LP: #2147400)
    - ext4: fix stale xarray tags after writeback
  * Compile error due to nonexistent struct member with CONFIG_PCI_EPF_TEST
    (LP: #2147065)
    - SAUCE: Revert "PCI: endpoint: pci-epf-test: Limit PCIe BAR size for
      fixed BARs"
  * BUG: kernel NULL pointer dereference in amdgpu (LP: #2144577)
    - drm/amdgpu: validate the flush_gpu_tlb_pasid()
    - drm/amdgpu: Fix validating flush_gpu_tlb_pasid()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841)
    - x86/kfence: fix booting on 32bit non-PAE systems
    - platform/x86: intel_telemetry: Fix swapped arrays in PSS output
    - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest
      state
    - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup
    - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset
    - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system
      wakeup
    - rbd: check for EOD after exclusive lock is ensured to be held
    - ARM: 9468/1: fix memset64() on big-endian
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
    - binder: fix BR_FROZEN_REPLY error log
    - binderfs: fix ida_alloc_max() upper bound
    - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test
      failures
    - tracing: Fix ftrace event field alignments
    - net: usb: sr9700: support devices with virtual driver CD
    - block,bfq: fix aux stat accumulation destination
    - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED
    - HID: intel-ish-hid: Update ishtp bus match to support device ID table
    - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
    - HID: intel-ish-hid: Reset enum_devices_done before enumeration
    - HID: playstation: Center initial joystick axes to prevent spurious
      events
    - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
    - netfilter: replace -EEXIST with -EBUSY
    - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
    - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
    - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
    - wifi: mac80211: collect station statistics earlier when disconnect
    - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
    - ASoC: amd: yc: Fix microphone on ASUS M6500RE
    - ASoC: tlv320adcx140: Propagate error codes during probe
    - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs
      initialization
    - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
    - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    - wifi: mac80211: correctly check if CSA is active
    - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
    - platform/x86: intel_telemetry: Fix PSS event register mask
    - platform/x86: hp-bioscfg: Skip empty attribute names
    - net: add skb_header_pointer_careful() helper
    - net: don't touch dev->stats in BPF redirect paths
    - tipc: use kfree_sensitive() for session key material
    - net: ethernet: adi: adin1110: Check return value of
      devm_gpiod_get_optional() in adin1110_check_spi()
    - drm/mgag200: fix mgag200_bmc_stop_scanout()
    - hwmon: (occ) Mark occ_init_attribute() as __printf
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
    - gve: Correct ethtool rx_dropped calculation
    - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed
      transfer
    - spi: tegra210-quad: Move curr_xfer read inside spinlock
    - spi: tegra210-quad: Protect curr_xfer assignment in
      tegra_qspi_setup_transfer_one
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
    - spi: tegra210-quad: Protect curr_xfer clearing in
      tegra_qspi_non_combined_seq_xfer
    - spi: tegra114: Preserve SPI mode bits in def_command1_reg
    - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
    - PCI/ERR: Ensure error recoverability at all times
    - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
    - PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
    - HID: logitech: add HID++ support for Logitech MX Anywhere 3S
    - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
    - net: phy: add phy_interface_weight()
    - net: phy: add phy_interface_copy()
    - net: sfp: pre-parse the module support
    - net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module
    - net: sfp: convert sfp quirks to modify struct sfp_module_support
    - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
    - drm/amd/display: fix wrong color value mapping on MCM shaper LUT
    - drm/xe/query: Fix topology query pointer advance
    - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
    - gpiolib-acpi: Update file references in the Documentation and
      MAINTAINERS
    - Upstream stable to v6.6.124, v6.12.70
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23214
    - btrfs: reject new transactions if the fs is fully read-only
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23213
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71225
    - md: suspend array while updating raid_disks via sysfs
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-68823
    - ublk: fix deadlock when reading partition table
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23191
    - ALSA: aloop: Fix racy access at PCM trigger
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23215
    - x86/vmware: Fix hypercall clobbers
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23182
    - spi: tegra: Fix a memory leak in tegra_slink_probe()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23190
    - ASoC: amd: fix memory leak in acp3x pdm dma ops
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23254
    - net: gro: fix outer network offset
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23180
    - dpaa2-switch: add bounds check for if_id in IRQ handler
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23256
    - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23257
    - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23258
    - net: liquidio: Initialize netdev pointer before queue setup
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23206
    - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23204
    - net/sched: cls_u32: use skb_header_pointer_careful()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23205
    - smb/client: fix memory leak in smb2_open_file()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23176
    - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23216
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23193
    - scsi: target: iscsi: Fix use-after-free in
      iscsit_dec_session_usage_count()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23260
    - regmap: maple: free entry on mas_store_gfp() failure
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23179
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23261
    - nvme-fc: release admin tagset if init fails
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23178
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71268
    - btrfs: fix reservation leak in some error paths when inserting inline
      extent
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71270
    - LoongArch: Enable exception fixup for specific ADE subcode
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71220
    - smb/server: call ksmbd_session_rpc_close() on error path in
      create_smb2_pipe()
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71222
    - wifi: wlcore: ensure skb headroom before skb_push
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71224
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23262
    - gve: Fix stats report corruption on queue count change
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-38201
    - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23198
    - KVM: Don't clobber irqfd routing type when deassigning irqfd
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23264
    - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"
  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23187
    - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543)
    - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
    - net: bcmasp: fix early exit leak with fixed phy
    - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
    - ipv6: use the right ifindex when replying to icmpv6 from localhost
    - ice: stop counting UDP csum mismatch as rx_errors
    - net/mlx5e: Report rx_discards_phy via rx_dropped
    - net/mlx5e: Account for netdev stats in ndo_get_stats64
    - net: bridge: fix static key check
    - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
    - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
    - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
    - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
    - dma/pool: distinguish between missing and exhausted atomic pools
    - pinctrl: meson: mark the GPIO controller as sleeping
    - riscv: compat: fix COMPAT_UTS_MACHINE definition
    - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target
    - ASoC: fsl: imx-card: Do not force slot width to sample width
    - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
    - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
    - gpio: pca953x: mask interrupts in irq shutdown
    - scsi: qla2xxx: edif: Fix dma_free_coherent() size
    - mptcp: only reset subflow errors when propagated
    - selftests: mptcp: check no dup close events after error
    - selftests: mptcp: check subflow errors in close events
    - selftests: mptcp: join: fix local endp not being tracked
    - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
    - drm/amdgpu/soc21: fix xclk for APUs
    - drm/amdgpu/gfx10: fix wptr reset in KGQ init
    - drm/amdgpu/gfx11: fix wptr reset in KGQ init
    - mm/kfence: randomize the freelist on initialization
    - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state
    - arm64/fpsimd: signal: Consistently read FPSIMD context
    - btrfs: prevent use-after-free on page private data in
      btrfs_subpage_clear_uptodate()
    - net/sched: act_ife: convert comma to semicolon
    - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
    - drm/msm/a6xx: fix bogus hwcg register updates
    - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
    - mptcp: avoid dup SUB_CLOSED events after disconnect
    - ksmbd: fix recursive locking in RPC handle list access
    - bpf/selftests: test_select_reuseport_kern: Remove unused header
    - can: at91_can: Fix memory leak in at91_can_probe()
    - net: phy: micrel: fix clk warning when removing the driver
    - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
    - net/mlx5: Initialize events outside devlink lock
    - net/mlx5: Fix vhca_id access call trace use before alloc
    - bcache: fix improper use of bi_end_io
    - bcache: use bio cloning for detached device requests
    - bcache: fix I/O accounting leak in detached_dev_do_request
    - gpio: rockchip: Stop calling pinctrl for set_direction
    - mm/memory-failure: improve memory failure action_result messages
    - mm/memory-failure: fix redundant updates for already poisoned pages
    - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
    - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail
      page pfn
    - gpiolib: acpi: Fix potential out-of-boundary left shift
    - rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0
    - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR
      TX pins
    - [Config] remove PINCTRL_SM8350_LPASS_LPI
    - Upstream stable to v6.6.123, v6.12.69
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23148
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23166
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23151
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23163
    - drm/amdgpu: fix NULL pointer dereference in
      amdgpu_gmc_filter_faults_remove
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23159
    - perf: sched: Fix perf crash with new is_user_task() helper
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2024-58096
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2025-40039
    - ksmbd: Fix race condition in RPC handle list access
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23093
    - ksmbd: smbd: fix dma_unmap_sg() nents
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23102
    - arm64/fpsimd: signal: Fix restoration of SVE context
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23170
    - drm/imx/tve: fix probe device leak
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23168
    - flex_proportions: make fprop_new_period() hardirq safe
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23156
    - efivarfs: fix error propagation in efivar_entry_get()
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23167
    - nfc: nci: Fix race between rfkill and nci_unregister_device().
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23173
    - net/mlx5e: TC, delete flows only for existing peers
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23150
    - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23164
    - rocker: fix memory leak in rocker_world_port_post_fini()
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23172
    - net: wwan: t7xx: fix potential skb->frags overflow in RX path
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23212
    - bonding: annotate data-races around slave->last_rx
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23160
    - octeon_ep: Fix memory leak in octep_device_setup()
  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23146
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
  * CVE-2026-23394
    - af_unix: Give up GC if MSG_PEEK intervened.
  * [SRU] MIPI camera is not working after upgrading to 6.17-oem
    (LP: #2145171)
    - SAUCE: ACPI: respect items already in honor_dep before skipping
  * ADATA SU680 causes repeated SATA resets and I/O errors on Ubuntu unless
    link power management is forced to max_performance (LP: #2144060)
    - ata: libata-core: disable LPM on ADATA SU680 SSD
  *  intel_idle: add Clearwater Forest SoC support (LP: #2144006)
    - intel_idle: add Clearwater Forest SoC support
  * Noble kernel 6.8.0-108 does not compile when KASAN enabled (LP: #2144914)
    - mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN
  * Generic noble linux throws warning from file tegra-i2c.c (LP: #2143152)
    - i2c: tegra: Use internal reset when reset property is not available
  * [SRU] Duplicated entries in /proc/<pid>/mountinfo (LP: #2143083)
    - namespace: fix proc mount iteration
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465)
    - firmware: imx: scu-irq: Set mu_resource_id before get handle
    - efi/cper: Fix cper_bits_to_str buffer handling and return value
    - ASoC: codecs: wsa884x: fix codec initialisation
    - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
    - net: bridge: annotate data-races around fdb->{updated,used}
    - net: update netdev_lock_{type,name}
    - vsock/test: add a final full barrier after run all tests
    - net/mlx5e: Restore destroying state bit after profile cleanup
    - btrfs: store fs_info in space_info
    - btrfs: factor out init_space_info() from create_space_info()
    - btrfs: factor out check_removing_space_info() from
      btrfs_free_block_groups()
    - btrfs: introduce btrfs_space_info sub-group
    - btrfs: fix memory leaks in create_space_info() error paths
    - selftests: drv-net: fix RPS mask handling for high CPU numbers
    - ASoC: tlv320adcx140: fix word length
    - textsearch: describe @list member in ts_ops search
    - mm, kfence: describe @slab parameter in __kfence_obj_info()
    - dmaengine: xilinx_dma: Fix uninitialized addr_width when
      "xlnx,addrwidth" property is missing
    - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
    - phy: phy-snps-eusb2: refactor constructs names
    - phy: drop probe registration printks
    - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
    - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
    - HID: usbhid: paper over wrong bNumDescriptor field
    - scsi: core: Fix error handler encryption support
    - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
    - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
    - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
    - phy: rockchip: inno-usb2: fix communication disruption in gadget mode
    - phy: freescale: imx8m-pcie: assert phy reset during power on
    - phy: rockchip: inno-usb2: fix disconnection in gadget mode
    - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
    - usb: dwc3: Check for USB4 IP_NAME
    - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
    - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
    - USB: serial: option: add Telit LE910 MBIM composition
    - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
    - nvme-pci: disable secondary temp for Wodposit WPBSNM8
    - hrtimer: Fix softirq base check in update_needs_ipi()
    - EDAC/x38: Fix a resource leak in x38_probe1()
    - EDAC/i3200: Fix a resource leak in i3200_probe1()
    - tcpm: allow looking for role_sw device in the main node
    - x86/resctrl: Add missing resctrl initialization for Hygon
    - x86/resctrl: Fix memory bandwidth counter width for Hygon
    - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
    - LoongArch: Fix PMU counter allocation for mixed-type event groups
    - drm/amd/display: Bump the HDMI clock to 340MHz
    - drm/amd: Clean up kfd node on surprise disconnect
    - drm/amdkfd: fix a memory leak in device_queue_manager_init()
    - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
    - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
    - dmaengine: apple-admac: Add "apple,t8103-admac" compatible
    - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
    - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
    - dmaengine: ti: k3-udma: fix device leak on udma lookup
    - io_uring: move local task_work in exit cancel loop
    - posix-clock: Store file pointer in struct posix_clock_context
    - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
    - selftest/ptp: update ptp selftest to exercise the gettimex options
    - testptp: Add option to open PHC in readonly mode
    - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
    - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_*
    - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
    - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
    - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
    - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
    - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
    - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
    - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
    - ata: libata: Add cpr_log to ata_dev_print_features() early return
    - ata: libata-core: Introduce ata_dev_config_lpm()
    - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
    - ata: libata: Print features also for ATAPI devices
    - ice: initialize ring_stats->syncp
    - ice: Avoid detrimental cleanup for bond during interface stop
    - igc: fix race condition in TX timestamp read for register 0
    - net: usb: dm9601: remove broken SR9700 support
    - selftests: net: fib-onlink-tests: Convert to use namespaces by default
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
      usb_submit_urb() error
    - amd-xgbe: avoid misleading per-packet error log
    - tools: ynl: Specify --no-line-number in ynl-regen.sh.
    - veth: fix data race in veth_get_ethtool_stats
    - octeontx2: cn10k: fix RX flowid TCAM mask handling
    - serial: 8250_pci: Fix broken RS485 for F81504/508/512
    - comedi: dmm32at: serialize use of paged registers
    - w1: fix redundant counter decrement in w1_attach_slave_device()
    - Revert "nfc/nci: Add the inconsistency check between the input data
      length and count"
    - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
    - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
    - scsi: storvsc: Process unsupported MODE_SENSE_10
    - arm64: dts: rockchip: remove dangerous max-link-speed from helios64
    - arm64: dts: rockchip: Fix voltage threshold for volume keys for
      Pinephone Pro
    - x86/kfence: avoid writing L1TF-vulnerable PTEs
    - comedi: Fix getting range information for subdevices 16 to 255
    - iio: adc: ad7280a: handle spi_setup() errors in probe()
    - kconfig: fix static linking of nconf
    - riscv: clocksource: Fix stimecmp update hazard on RV32
    - ALSA: usb: Increase volume range that triggers a warning
    - net: hns3: fix data race in hns3_fetch_stats
    - be2net: fix data race in be_get_new_eqd
    - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
    - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
    - usbnet: limit max_mtu based on device's hard_mtu
    - drm/amd/pm: Don't clear SI SMC table when setting power limit
    - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
    - selftests: net: amt: wait longer for connection before sending packets
    - net: dsa: fix off-by-one in maximum bridge ID determination
    - octeontx2-af: Fix error handling
    - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
    - vsock/test: fix seqpacket message bounds test
    - x86: make page fault handling disable interrupts properly
    - of: fix reference count leak in of_alias_scan()
    - of: platform: Use default match table for /firmware
    - iio: accel: iis328dq: fix gain values
    - iio: adc: ad9467: fix ad9434 vref mask
    - iio: chemical: scd4x: fix reported channel endianness
    - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
    - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
    - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
    - octeontx2: Fix otx2_dma_map_page() error return code
    - slimbus: core: fix runtime PM imbalance on report present
    - platform/x86: hp-bioscfg: Fix automatic module loading
    - perf/x86/intel: Do not enable BTS for guests
    - selftests/bpf: Check for timeout in perf_link test
    - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup
      failure
    - iio: core: add missing mutex_destroy in iio_dev_release()
    - iio: core: add separate lockdep class for info_exist_lock
    - mm/rmap: fix two comments related to huge_pmd_unshare()
    - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
    - iio: adc: exynos_adc: fix OF populate on driver rebind
    - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
    - mm: kmsan: fix poisoning of high-order non-compound pages
    - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
    - ASoC: codecs: wsa881x: Drop unused version readout
    - ASoC: codecs: wsa881x: fix unnecessary initialisation
    - ASoC: codecs: wsa883x: fix unnecessary initialisation
    - nvme-fc: rename free_ctrl callback to match name pattern
    - nvme-pci: do not directly handle subsys reset fallout
    - nvme: fix PCIe subsystem reset controller state transition
    - net: phy: fix phy_uses_state_machine()
    - pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
    - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
    - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
    - ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type
    - selftests/landlock: Fix TCP bind(AF_UNSPEC) test case
    - xfs: Fix the return value of xfs_rtcopy_summary()
    - phy: ti: gmii-sel: fix regmap leak on probe failure
    - LoongArch: dts: loongson-2k0500: Add default interrupt controller
      address cells
    - LoongArch: dts: loongson-2k1000: Add default interrupt controller
      address cells
    - LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names
    - LoongArch: dts: loongson-2k2000: Add default interrupt controller
      address cells
    - HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume
      blocking
    - HID: intel-ish-hid: Fix -Wcast-function-type-strict in
      devm_ishtp_alloc_workqueue()
    - xfs: set max_agbno to allow sparse alloc of last full inode chunk
    - selftests/bpf: Test invalid narrower ctx load
    - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
    - mm/page_alloc: batch page freeing in decay_pcp_high
    - ata: libata-sata: Improve link_power_management_supported sysfs
      attribute
    - igc: Restore default Qbv schedule when changing channels
    - vsock/virtio: Coalesce only linear skb
    - platform/x86/amd: Fix memory leak in wbrf_record()
    - drm/imagination: Wait for FW trace update command completion
    - ice: Fix persistent failure in ice_get_rxfh
    - sched/fair: Fix pelt clock sync when entering idle
    - drm/nouveau: add missing DCB connector types
    - drm/nouveau: implement missing DCB connector types; gracefully handle
      unknown connectors
    - dpll: Prevent duplicate registrations
    - mei: trace: treat reg parameter as string
    - s390/ap: Fix wrong APQN fill calculation
    - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
    - gpio: cdev: Correct return code on memory allocation failure
    - dmaengine: ti: k3-udma: Enable second resource range for BCDMA and
      PKTDMA
    - exfat: fix refcount leak in exfat_find
    - accel/ivpu: Fix race condition when unbinding BOs
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
    - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
    - vsock/virtio: Rename virtio_vsock_alloc_skb()
    - vsock/virtio: Move SKB allocation lower-bound check to callers
    - vsock/virtio: Rename virtio_vsock_skb_rx_put()
    - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
    - vsock/virtio: Allocate nonlinear SKBs for handling large transmit
      buffers
    - net: Introduce skb_copy_datagram_from_iter_full()
    - vsock/virtio: Fix message iterator handling on transmit path
    - Upstream stable to v6.6.122, v6.12.67, v6.12.68
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-38591
    - bpf: Reject narrower access to pointer ctx fields
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23035
    - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-22996
    - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23000
    - net/mlx5e: Fix crash on profile change rollback failure
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23053
    - NFS: Fix a deadlock involving nfs_release_folio()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23050
    - pNFS: Fix a deadlock when returning a delegation during open()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23005
    - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2024-58097
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-68365
    - fs/ntfs3: Initialize allocated memory before use
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-37926
    - ksmbd: fix use-after-free in ksmbd_session_rpc_open
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23030
    - phy: rockchip: inno-usb2: Fix a double free bug in
      rockchip_usb2phy_probe()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23025
    - mm/page_alloc: prevent pcp corruption with SMP=n
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71186
    - dmaengine: stm32: dmamux: fix device leak on route allocation
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23078
    - ALSA: scarlett2: Fix buffer overflow in config retrieval
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23142
    - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir
      setup failure
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23075
    - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-68725
    - bpf: Do not let BPF test infra emit invalid GSO types to stack
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23097
    - migrate: correct lock ordering for hugetlb file folios
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23108
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23080
    - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23061
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23058
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23085
    - irqchip/gic-v3-its: Avoid truncating memory addresses
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23116
    - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23098
    - netrom: fix double-free in nr_route_frame()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23063
    - uacce: ensure safe queue release with state management
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23056
    - uacce: implement mremap in uacce_vm_ops to return -EPERM
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23094
    - uacce: fix isolate sysfs check condition
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23096
    - uacce: fix cdev handling in the cleanup path
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23091
    - intel_th: fix device leak on output open()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23088
    - tracing: Fix crash on synthetic stacktrace field usage
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23090
    - slimbus: core: fix device reference leak on report present
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23128
    - arm64: Set __nocfi on swsusp_arch_resume()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23107
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23073
    - wifi: rsi: Fix memory corruption due to not set vif driver data size
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23135
    - wifi: ath12k: fix dma_free_coherent() pointer
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23133
    - wifi: ath10k: fix dma_free_coherent() pointer
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71200
    - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400
      mode
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23089
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23076
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71199
    - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
      driver
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23101
    - leds: led-class: Only Add LED to leds_list when it is fully ready
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23064
    - net/sched: act_ife: avoid possible NULL deref
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23086
    - vsock/virtio: cap TX credit to local buffer size
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23069
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23119
    - bonding: provide a net pointer to __skb_flow_dissect()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23084
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23124
    - ipv6: annotate data-race in ndisc_router_discovery()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23121
    - mISDN: annotate data-race around dev->work
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23126
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs
      list
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23059
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23110
    - scsi: core: Wake up the error handler when final completions race
      against each other
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23071
    - regmap: Fix race condition in hwspinlock irqsave routine
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23068
    - spi: spi-sprd-adi: Fix double free in probe error path
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23123
    - interconnect: debugfs: initialize src_node and dst_node to empty strings
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71198
    - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event
      detection
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23113
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23062
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23131
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23087
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71197
    - w1: therm: Fix off-by-one buffer overflow in alarms_store
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23105
    - net/sched: qfq: Use cl_is_active to determine whether class is active in
      qfq_rm_from_ag
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23103
    - ipvlan: Make the addrs_lock be per port
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23120
    - l2tp: avoid one data-race in l2tp_tunnel_del_work()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23083
    - fou: Don't allow 0 for FOU_ATTR_IPPROTO.
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23095
    - gue: Fix skb memleak with inner IP protocol 0.
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23125
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23099
    - bonding: limit BOND_MODE_8023AD to Ethernet devices
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71194
    - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
      type
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71185
    - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23026
    - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71188
    - dmaengine: lpc18xx-dmamux: fix device leak on route allocation
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71163
    - dmaengine: idxd: fix device leaks on compat bind and unbind
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71189
    - dmaengine: dw: dmamux: fix OF node leak on route allocation failure
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71190
    - dmaengine: bcm-sba-raid: fix device leak on probe
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71191
    - dmaengine: at_hdmac: fix device leak on of_dma_xlate()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23049
    - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23144
    - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23145
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-22997
    - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
      upon receiving the second rts
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23031
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23032
    - null_blk: fix kmemleak by releasing references to fault configfs items
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23033
    - dmaengine: omap-dma: fix dma_pool resource leak in error paths
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71196
    - phy: stm32-usphyc: Fix off by one in probe()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71193
    - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71162
    - dmaengine: tegra-adma: Fix use-after-free
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71195
    - dmaengine: xilinx: xdma: Fix regmap max_register
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23006
    - ASoC: tlv320adcx140: fix null pointer
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-22999
    - net/sched: sch_qfq: do not free existing class in qfq_change_class()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23010
    - ipv6: Fix use-after-free in inet6_addr_del().
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23054
    - net: hv_netvsc: reject RSS hash key programming without RX indirection
      table
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23011
    - ipv4: ip_gre: make ipgre_header() robust
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23001
    - macvlan: fix possible UAF in macvlan_forward_source()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23003
    - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23141
    - btrfs: send: check for inline extents in range_is_hole_in_parent()
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-22998
    - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23037
    - can: etas_es58x: allow partial RX URB allocation to succeed
  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23038
    - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058)
    - NFSD: Fix permission check for read access to executable-only files
    - atm: Fix dma_free_coherent() size
    - mei: me: add nova lake point S DID
    - lib/crypto: aes: Fix missing MMU protection for AES S-box
    - counter: 104-quad-8: Fix incorrect return value in IRQ handler
    - drm/pl111: Fix error handling in pl111_amba_probe
    - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
    - gpio: rockchip: mark the GPIO controller as sleeping
    - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
    - net: Add locking to protect skb->dev access in ip_output
    - nfsd: Fix a regression in nfsd_setattr()
    - nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr()
    - nfsd: set security label during create operations
    - csky: fix csky_cmpxchg_fixup not working
    - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
    - alpha: don't reference obsolete termio struct for TC* constants
    - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
    - NFSv4: ensure the open stateid seqid doesn't go backwards
    - NFS: Fix up the automount fs_context to use the correct cred
    - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
    - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
    - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
    - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
    - scsi: ufs: core: Fix EH failure after W-LUN resume error
    - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
      failure scanned in again after probe failed"
    - arm64: dts: add off-on-delay-us for usdhc2 regulator
    - ARM: dts: imx6q-ba16: fix RTC interrupt level
    - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics
      i.MX8M Plus DHCOM
    - netfilter: nft_synproxy: avoid possible data-race on update operation
    - gpio: pca953x: Add support for level-triggered interrupts
    - gpio: pca953x: handle short interrupt pulses on PCAL devices
    - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
    - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
    - inet: ping: Fix icmp out counting
    - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
    - net/mlx5e: Don't print error message due to invalid module
    - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
    - bnxt_en: Fix potential data corruption with HW GRO/LRO
    - net: enetc: fix build warning when PAGE_SIZE is greater than 128K
    - arp: do not assume dev_hard_header() does not change skb->head
    - ALSA: ac97bus: Use guard() for mutex locks
    - NFS: trace: show TIMEDOUT instead of 0x6e
    - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno
    - NFSD: Remove NFSERR_EAGAIN
    - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than
      4K
    - bpf: Make variables in bpf_prog_test_run_xdp less confusing
    - bpf: Support specifying linear xdp packet data size for
      BPF_PROG_TEST_RUN
    - powercap: fix race condition in register_control_type()
    - powercap: fix sscanf() error return value handling
    - ALSA: usb-audio: Update for native DSD support quirks
    - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
    - ASoC: fsl_sai: Add missing registers to cache default
    - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
    - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
    - ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
    - btrfs: tracepoints: use btrfs_root_id() to get the id of a root
    - crypto: qat - fix duplicate restarting msg during AER error
    - netfilter: nft_set_pipapo: fix range overlap detection
    - vsock: Make accept()ed sockets use custom setsockopt()
    - btrfs: only enforce free space tree if v1 cache is required for bs < ps
      cases
    - riscv: pgtable: Cleanup useless VA_USER_XXX definitions
    - idpf: keep the netdev when a reset fails
    - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant
    - ata: libata-core: Disable LPM on ST2000DM008-2FR102
    - drm/amd/display: Fix DP no audio issue
    - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL
    - spi: cadence-quadspi: Prevent lost complete() call during indirect read
    - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
    - Upstream stable to v6.6.121, v6.12.66
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71184
    - btrfs: fix NULL dereference on root when tracing inode eviction
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71182
    - can: j1939: make j1939_session_activate() fail if device is no longer
      registered
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71160
    - netfilter: nf_tables: avoid chain re-validation if possible
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22994
    - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23140
    - bpf, test_run: Subtract size of xdp_frame from allowed metadata size
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71192
    - ALSA: ac97: fix a double free in snd_ac97_controller_register()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23021
    - net: usb: pegasus: fix memory leak in update_eth_regs_async()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22976
    - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate
      in qfq_reset
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22979
    - net: fix memory leak in skb_segment_list for GRO packets
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22977
    - net: sock: fix hardened usercopy panic in sock_recv_errqueue
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22982
    - net: mscc: ocelot: Fix crash when adding interface under a lag
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23019
    - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23139
    - netfilter: nf_conncount: update last_gc only when GC has been performed
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-40149
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-68803
    - NFSD: NFSv4 file creation neglects setting ACL
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23047
    - libceph: make calc_target() set t->paused, not just clear it
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23136
    - libceph: reset sparse-read state in osd_fault()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22992
    - libceph: return the handler error from mon_handle_auth_done()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22991
    - libceph: make free_choose_arg_map() resilient to partial allocation
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22990
    - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22984
    - libceph: prevent potential out-of-bounds reads in handle_auth_done()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22978
    - wifi: avoid kernel-infoleak from struct iw_point
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71180
    - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71183
    - btrfs: always detect conflicting inodes when logging inode refs
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23020
    - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22980
    - nfsd: provide locking for v4_end_grace
  * CVE-2024-50004
    - drm/amd/display: update DML2 policy
      EnhancedPrefetchScheduleAccelerationFinal DCN35
  * CVE-2026-23274
    - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  * CVE-2026-23351
    - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
  * CVE-2026-23231
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
  * macvlan: observe an RCU grace period in macvlan_common_newlink() error
    path (LP: #2144380) // CVE-2026-23209
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path
  * CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 29 Apr 2026 15:36:12 -0500

linux-azure (6.8.0-1054.60) noble; urgency=medium

  * noble/linux-azure: 6.8.0-1054.60 -proposed tracker (LP: #2147853)

  * Backporting critical SMB client fixes to affected Ubuntu distros
    (LP: #2147347)
    - smb: client: fix in-place encryption corruption in SMB2_write()
    - cifs: make default value of retrans as zero

  [ Ubuntu: 6.8.0-111.111 ]

  * noble/linux: 6.8.0-111.111 -proposed tracker (LP: #2147890)
  * CVE-2026-23231
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
  * macvlan: observe an RCU grace period in macvlan_common_newlink() error
    path (LP: #2144380) // CVE-2026-23209
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path
  * CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 15 Apr 2026 09:43:14 -0500

linux-azure (6.8.0-1053.59) noble; urgency=medium

  * noble/linux-azure: 6.8.0-1053.59 -proposed tracker (LP: #2143441)

  * [Mana_IB][RDMA][Backport] RDMA/mana_ib: Take CQ type from the device type
    (LP: #2140368)
    - RDMA/mana_ib: Take CQ type from the device type

  [ Ubuntu: 6.8.0-110.110 ]

  * noble/linux: 6.8.0-110.110 -proposed tracker (LP: #2144887)
  * ITS mitigation is not enabled on affected CPUs (LP: #2144730)
    - x86/bugs: Rename CONFIG_RETPOLINE => CONFIG_MITIGATION_RETPOLINE
    - x86/bugs: Rename CONFIG_RETHUNK => CONFIG_MITIGATION_RETHUNK
    - [Config] rename config options RETHUNK and RETPOLINE

  [ Ubuntu: 6.8.0-108.108 ]

  * noble/linux: 6.8.0-108.108 -proposed tracker (LP: #2143478)
  * linux-riscv-6.8 is FTBFS because of missing patches (LP: #2142235)
    - riscv, bpf: Unify 32-bit sign-extension to emit_sextw
    - riscv, bpf: Unify 32-bit zero-extension to emit_zextw
    - riscv, bpf: Simplify sext and zext logics in branch instructions
    - riscv, bpf: Add necessary Zbb instructions
    - riscv, bpf: Optimize sign-extention mov insns with Zbb support
    - riscv, bpf: Optimize bswap insns with Zbb support
  * ADT test for linux package failed with "fatal: unable to connect to
    git.launchpad.net" (LP: #2143033)
    - [Packaging] d/t/ubuntu-regression-suite: use https to clone
  * Coresight fails to build on 6.8.0-102 due to missing function and arg
    definitions (LP: #2142337)
    - SAUCE: Revert "coresight: catu: Support atclk"
    - SAUCE: Revert "coresight: catu: Move ACPI support from AMBA driver to
      platform driver"
    - SAUCE: Revert "coresight: tmc: Support atclk"
    - SAUCE: Revert "coresight: tmc: Move ACPI support from AMBA driver to
      platform driver"
    - SAUCE: Revert "Coresight: Set correct cs_mode for TPDM to fix disable
      issue"
    - SAUCE: Revert "Coresight: Set correct cs_mode for dummy source to fix
      disable issue"
  * efi: Fix swapped arguments to bsearch() in efi_status_to_*() SAUCE patch
    (LP: #2141276)
    - SAUCE efi: Fix swapped arguments to bsearch() in efi_status_to_*()
  * Fix conntrack use after free when ovs hardware offload is enabled
    (LP: #2139322)
    - netfilter: conntrack: remove skb argument from nf_ct_refresh
    - netfilter: conntrack: rework offload nf_conn timeout extension logic
    - netfilter: conntrack: fix erronous removal of offload bit
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789)
    - xhci: fix stale flag preventig URBs after link state error is cleared
    - Revert "xfrm: destroy xfrm_state synchronously on net exit path"
    - xfrm: flush all states in xfrm_state_fini
    - leds: spi-byte: Use devm_led_classdev_register_ext()
    - Documentation: process: Also mention Sasha Levin as stable tree
      maintainer
    - USB: serial: option: add Foxconn T99W760
    - USB: serial: option: add Telit Cinterion FE910C04 new compositions
    - USB: serial: option: move Telit 0x10c7 composition in the right place
    - USB: serial: ftdi_sio: match on interface number for jtag
    - serial: add support of CPCI cards
    - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
    - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
    - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
    - spi: xilinx: increase number of retries before declaring stall
    - spi: imx: keep dma request disabled before dma transfer setup
    - drm/vmwgfx: Use kref in vmw_bo_dirty
    - Bluetooth: btrtl: Avoid loading the config file on security chips
    - smb: fix invalid username check in smb3_fs_context_parse_param()
    - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
    - HID: hid-input: Extend Elan ignore battery quirk to USB
    - pinctrl: qcom: msm: Fix deadlock in pinmux configuration
    - platform/x86: acer-wmi: Ignore backlight event
    - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
    - platform/x86: huawei-wmi: add keys for HONOR models
    - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
    - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
    - HID: elecom: Add support for ELECOM M-XT3URBK (018F)
    - LoongArch: Mask all interrupts during kexec/kdump
    - samples: work around glibc redefining some of our defines wrong
    - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
    - drm/panel: visionox-rm69299: Don't clear all mode flags
    - USB: Fix descriptor count when handling invalid MBIM extended descriptor
    - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
    - clk: renesas: Use str_on_off() helper
    - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register
    - clk: renesas: cpg-mssr: Read back reset registers to assure values
      latched
    - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
    - objtool: Fix standalone --hacks=jump_label
    - objtool: Fix weak symbol detection
    - sched/fair: Forfeit vruntime on yield
    - irqchip/irq-bcm7038-l1: Fix section mismatch
    - irqchip/irq-bcm7120-l2: Fix section mismatch
    - irqchip/irq-brcmstb-l2: Fix section mismatch
    - irqchip/imx-mu-msi: Fix section mismatch
    - irqchip/qcom-irq-combiner: Fix section mismatch
    - crypto: authenc - Correctly pass EINPROGRESS back up to the caller
    - rculist: Add hlist_nulls_replace_rcu() and
      hlist_nulls_replace_init_rcu()
    - inet: Avoid ehash lookup race in inet_ehash_insert()
    - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
    - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1
      props
    - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
    - arm64: dts: imx8mp-venice-gw702x: remove off-board uart
    - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1
    - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2
    - uio: uio_fsl_elbc_gpcm:: Add null pointer check to
      uio_fsl_elbc_gpcm_probe
    - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to
      other
    - clk: qcom: camcc-sm6350: Fix PLL config of PLL2
    - crypto: hisilicon/qm - restore original qos values
    - s390/smp: Fix fallback CPU detection
    - s390/ap: Don't leak debug feature files if AP instructions are not
      available
    - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU
    - firmware: imx: scu-irq: fix OF node leak in
    - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider
    - phy: mscc: Fix PTP for VSC8574 and VSC8572
    - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
    - ARM: dts: renesas: gose: Remove superfluous port property
    - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties
    - Revert "mtd: rawnand: marvell: fix layouts"
    - mtd: nand: relax ECC parameter validation check
    - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and
      remove
    - task_work: Fix NMI race condition
    - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
    - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
    - soc: qcom: smem: fix hwspinlock resource leak in probe error paths
    - pinctrl: stm32: fix hwspinlock resource leak in probe function
    - i3c: fix refcount inconsistency in i3c_master_register
    - i3c: master: svc: Prevent incomplete IBI transaction
    - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
    - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller
    - interconnect: debugfs: Fix incorrect error handling for NULL path
    - perf lock contention: Load kernel map before lookup
    - perf record: skip synthesize event when open evsel failed
    - power: supply: cw2015: Check devm_delayed_work_autocancel() return code
    - power: supply: rt9467: Return error on failure in
      rt9467_set_value_from_ranges()
    - power: supply: rt9467: Prevent using uninitialized local variable in
      rt9467_set_value_from_ranges()
    - power: supply: wm831x: Check wm831x_set_bits() return value
    - power: supply: apm_power: only unset own apm_get_power_status
    - scsi: target: Do not write NUL characters into ASCII configfs output
    - fs/9p: Don't open remote file with APPEND mode when writeback cache is
      used
    - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels
    - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
    - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible
    - x86/boot: Fix page table access in 5-level to 4-level paging transition
    - efi/libstub: Fix page table access in 5-level to 4-level paging
      transition
    - mfd: da9055: Fix missing regmap_del_irq_chip() in error path
    - ext4: correct the checking of quota files before moving extents
    - perf/x86/intel: Correct large PEBS flag check
    - regulator: core: disable supply if enabling main regulator fails
    - scsi: stex: Fix reboot_notifier leak in probe error path
    - staging: most: i2c: Drop explicit initialization of struct
      i2c_device_id::driver_data to 0
    - [Config] remove MOST_I2C driver
    - dt-bindings: PCI: amlogic: Fix the register name of the DBI region
    - RDMA/rtrs: server: Fix error handling in get_or_create_srv
    - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node
      properties
    - ntfs3: init run lock for extend inode
    - scsi: ufs: core: fix incorrect buffer duplication in
      ufshcd_read_string_desc()
    - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
    - powerpc/32: Fix unpaired stwcx. on interrupt exit
    - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
    - coresight: etm4x: Correct polling IDLE bit
    - coresight: etm4x: Extract the trace unit controlling
    - coresight: etm4x: Add context synchronization before enabling trace
    - clk: renesas: r9a06g032: Fix memory leak in error path
    - lib/vsprintf: Check pointer before dereferencing in time_and_date()
    - ACPI: property: Fix fwnode refcount leak in
      acpi_fwnode_graph_parse_endpoint()
    - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
    - leds: netxbig: Fix GPIO descriptor leak in error paths
    - PCI: keystone: Exit ks_pcie_probe() for invalid mode
    - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK
      5A
    - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
    - ps3disk: use memcpy_{from,to}_bvec index
    - bpf: Handle return value of ftrace_set_filter_ip in register_fentry
    - selftests/bpf: Fix failure paths in send_signal test
    - watchdog: wdat_wdt: Fix ACPI table leak in probe function
    - watchdog: starfive: Fix resource leak in probe error path
    - tracefs: fix a leak in eventfs_create_events_dir()
    - NFSD/blocklayout: Fix minlength check in proc_layoutget
    - drm/msm/a2xx: stop over-complaining about the legacy firmware
    - bpf: Improve program stats run-time calculation
    - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within
      RMA limit
    - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE
      format
    - fs/ntfs3: out1 also needs to put mi
    - fs/ntfs3: Prevent memory leaks in add sub record
    - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
    - net/ipv6: Remove expired routes with a separated list of routes.
    - ipv6: clear RA flags when adding a static route
    - perf arm-spe: Extend branch operations
    - perf arm_spe: Fix memset subclass in operation
    - pwm: bcm2835: Make sure the channel is enabled after pwm_request()
    - wifi: mac80211: fix CMAC functions not handling errors
    - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
    - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
    - phy: renesas: rcar-gen3-usb2: Fix an error handling path in
      rcar_gen3_phy_usb2_probe()
    - net: phy: adin1100: Fix software power-down ready condition
    - cpuset: Treat cpusets in attaching as populated
    - usb: chaoskey: fix locking for O_NONBLOCK
    - usb: dwc2: disable platform lowlevel hw resources during shutdown
    - usb: dwc2: fix hang during shutdown if set as peripheral
    - usb: dwc2: fix hang during suspend if set as peripheral
    - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
    - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
    - selftests/bpf: Improve reliability of test_perf_branches_no_hw()
    - crypto: ccree - Correctly handle return of sg_nents_for_len
    - RISC-V: KVM: Fix guest page fault within HLV* instructions
    - RDMA/bnxt_re: Fix the inline size for GenP7 devices
    - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
    - staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
    - btrfs: fix leaf leak in an error path in btrfs_del_items()
    - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
    - drm/nouveau: restrict the flush page to a 32-bit address
    - iomap: factor out a iomap_dio_done helper
    - iomap: always run error completions in user context
    - wifi: ieee80211: correct FILS status codes
    - backlight: lp855x: Fix lp855x.h kernel-doc warnings
    - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-
      metal
    - RDMA/irdma: Fix data race in irdma_sc_ccq_arm
    - RDMA/irdma: Fix data race in irdma_free_pble
    - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
    - ASoC: fsl_xcvr: clear the channel status control memory
    - drm/amd/display: Fix logical vs bitwise bug in
      get_embedded_panel_info_v2_1()
    - hwmon: sy7636a: Fix regulator_enable resource leak on error path
    - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
    - ublk: prevent invalid access with DEBUG
    - ext4: improve integrity checking in __mb_check_buddy by enhancing
      order-0 validation
    - virtio_vdpa: fix misleading return in void function
    - virtio: fix typo in virtio_device_ready() comment
    - virtio: fix whitespace in virtio_config_ops
    - virtio: fix virtqueue_set_affinity() docs
    - vdpa/pds: use %pe for ERR_PTR() in event handler registration
    - ASoC: Intel: catpt: Fix error path in hw_params()
    - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system
      suspend
    - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during
      system suspend
    - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during
      system suspend
    - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during
      system suspend
    - resource: replace open coded resource_intersection()
    - resource: introduce is_type_match() helper and use it
    - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
    - netfilter: flowtable: check for maximum number of encapsulations in
      bridge vlan
    - netfilter: nf_conncount: rework API to use sk_buff directly
    - netfilter: nft_connlimit: update the count if add was skipped
    - net: stmmac: fix rx limit check in stmmac_rx_zc()
    - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors
    - selftests: bonding: add ipvlan over bond testing
    - selftests: bonding: add delay before each xvlan_over_bond connectivity
      check
    - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
    - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
    - md/raid5: fix IO hang when array is broken with IO inflight
    - clk: keystone: fix compile testing
    - perf tools: Fix split kallsyms DSO counting
    - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling
    - pinctrl: single: Fix incorrect type for error return variable
    - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
    - 9p: fix cache/debug options printing in v9fs_show_options
    - NFS: Avoid changing nlink when file removes and attribute updates race
    - fs/nls: Fix utf16 to utf8 conversion
    - NFS: Initialise verifiers for visible dentries in readdir and lookup
    - NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
    - Revert "nfs: ignore SB_RDONLY when remounting nfs"
    - Revert "nfs: clear SB_RDONLY before getting superblock"
    - Revert "nfs: ignore SB_RDONLY when mounting nfs"
    - Expand the type of nfs_fattr->valid
    - NFS: Fix inheritance of the block sizes when automounting
    - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
    - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
    - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of
      of_dma_configure()
    - ASoC: ak4458: Disable regulator when error happens
    - ASoC: ak5558: Disable regulator when error happens
    - blk-mq: Abort suspend when wakeup events are pending
    - block: fix comment for op_is_zone_mgmt() to include RESET_ALL
    - nvme-auth: use kvfree() for memory allocated with kvcalloc()
    - dma/pool: eliminate alloc_pages warning in atomic_pool_expand
    - ALSA: uapi: Fix typo in asound.h comment
    - rtc: gamecube: Check the return value of ioremap()
    - ARM: 9464/1: fix input-only operand modification in
      load_unaligned_zeropad()
    - dm-raid: fix possible NULL dereference with undefined raid type
    - dm log-writes: Add missing set_freezable() for freezable kthread
    - efi/cper: Add a new helper function to print bitmasks
    - efi/cper: Adjust infopfx size to accept an extra space
    - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
    - ocfs2: fix memory leak in ocfs2_merge_rec_left()
    - LoongArch: Add machine_kexec_mask_interrupts() implementation
    - net: lan743x: Allocate rings outside ZONE_DMA
    - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
    - usb: phy: Initialize struct usb_phy list_head
    - ipv6: add exception routes to GC list in rt6_insert_exception
    - btrfs: do not skip logging new dentries when logging a new name
    - btrfs: fix a potential path leak in print_data_reloc_error()
    - bpf, arm64: Do not audit capability check in do_jit()
    - btrfs: fix memory leak of fs_devices in degraded seed device path
    - iomap: account for unaligned end offsets when truncating read range
    - sched/fair: Revert max_newidle_lb_cost bump
    - x86/ptrace: Always inline trivial accessors
    - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint()
      only
    - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist
    - cpufreq: s5pv210: fix refcount leak
    - cpuidle: menu: Use residency threshold in polling state override
      decisions
    - livepatch: Match old_sympos 0 and 1 in klp_find_func()
    - fs/ntfs3: Support timestamps prior to epoch
    - kbuild: Use objtree for module signing key path
    - hfsplus: fix volume corruption issue for generic/070
    - hfsplus: fix volume corruption issue for generic/073
    - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
    - btrfs: scrub: always update btrfs_scrub_progress::last_physical
    - gfs2: fix remote evict for read-only filesystems
    - smb/server: fix return value of smb2_ioctl()
    - ksmbd: use rwsem instead of rwlock for lease break
    - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV
    - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE
    - net: fec: ERR007885 Workaround for XDP TX path
    - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()
    - mlxsw: spectrum_router: Fix possible neighbour reference count leak
    - broadcom: b44: prevent uninitialized value usage
    - netfilter: nf_conncount: fix leaked ct in error paths
    - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()
    - netfilter: nf_tables: pass context structure to nft_parse_register_load
    - netfilter: nf_tables: allow loads only when register is initialized
    - netfilter: nf_tables: remove redundant chain validation on register
      store
    - net/mlx5: fw reset, clear reset requested on drain_fw_reset
    - net/mlx5: Drain firmware reset in shutdown callback
    - net/mlx5: fw_tracer, Handle escaped percent properly
    - net/mlx5: Skip HotPlug check on sync reset using hot reset
    - net/mlx5: Serialize firmware reset with devlink
    - net: enetc: do not transmit redirected XDP frames when the link is down
    - net: hns3: using the num_tqps to check whether tqp_index is out of range
      when vf get ring info from mbx
    - hwmon: (tmp401) fix overflow caused by default conversion rate value
    - MIPS: Fix a reference leak bug in ip22_check_gio()
    - drm/panel: sony-td4353-jdi: Enable prepare_prev_first
    - x86/xen: Move Xen upcall handler
    - x86/xen: Fix sparse warning in enlighten_pv.c
    - spi: cadence-quadspi: Fix clock disable on probe failure path
    - block: rnbd-clt: Fix leaked ID in init_dev()
    - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen
    - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk
      table
    - can: gs_usb: gs_can_open(): fix error handling
    - ACPI: PCC: Fix race condition by removing static qualifier
    - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
    - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig
    - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml
    - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
    - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
    - ipmi: Fix the race between __scan_channels() and deliver_response()
    - ipmi: Fix __scan_channels() failing to rescan channels
    - firmware: imx: scu-irq: Init workqueue before request mbox channel
    - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
    - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4
    - powerpc/addnote: Fix overflow on 32-bit builds
    - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
    - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
    - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
    - fuse: Always flush the page cache before FOPEN_DIRECT_IO write
    - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
    - reset: fix BIT macro reference
    - exfat: fix remount failure in different process environments
    - usbip: Fix locking bug in RT-enabled kernels
    - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains
    - usb: xhci: limit run_graceperiod for only usb 3.0 devices
    - usb: usb-storage: No additional quirks need to be added to the EL-R12
      optical drive.
    - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
    - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
    - i2c: designware: Disable SMBus interrupts to prevent storms from mis-
      configured firmware
    - nvme-fc: don't hold rport lock when putting ctrl
    - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI
      quirks
    - block: rnbd-clt: Fix signedness bug in init_dev()
    - vhost/vsock: improve RCU read sections around vhost_vsock_get()
    - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition
    - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit
    - s390/dasd: Fix gendisk parent after copy pair swap
    - block: rate-limit capacity change info log
    - floppy: fix for PAGE_SIZE != 4KB
    - kallsyms: Fix wrong "big" kernel symbol type read from procfs
    - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
    - ktest.pl: Fix uninitialized var in config-bisect.pl
    - ext4: clear i_state_flags when alloc inode
    - ext4: fix incorrect group number assertion in mb_check_buddy
    - ext4: align max orphan file size with e2fsprogs limit
    - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key
    - jbd2: use a weaker annotation in journal handling
    - media: v4l2-mem2mem: Fix outdated documentation
    - mptcp: schedule rtx timer only after pushing data
    - usb: usb-storage: Maintain minimal modifications to the bcdDevice range.
    - media: pvrusb2: Fix incorrect variable used in trace message
    - phy: broadcom: bcm63xx-usbh: fix section mismatches
    - USB: lpc32xx_udc: Fix error handling in probe
    - usb: phy: isp1301: fix non-OF device reference imbalance
    - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe
    - usb: dwc3: keep susphy enabled during exit to avoid controller faults
    - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()
    - intel_th: Fix error handling in intel_th_output_open
    - cpuidle: governors: teo: Drop misguided target residency check
    - cpufreq: nforce2: fix reference count leak in nforce2
    - NFSD: use correct reservation type in nfsd4_scsi_fence_client
    - f2fs: fix age extent cache insertion skip on counter overflow
    - tools/testing/nvdimm: Use per-DIMM device handle
    - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on
      #SMI)
    - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with
      period=0
    - KVM: x86: Explicitly set new periodic hrtimer expiration in
      apic_timer_fn()
    - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE
    - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN
    - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation
    - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN
    - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed
      VMRUN)
    - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits
    - xfs: fix a memory leak in xfs_buf_item_init()
    - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
    - r8169: fix RTL8117 Wake-on-Lan in DASH mode
    - nfsd: Mark variable __maybe_unused to avoid W=1 build break
    - svcrdma: return 0 on success from svc_rdma_copy_inline_range
    - s390/ipl: Clear SBP flag when bootprog is set
    - gpio: regmap: Fix memleak in error path in gpio_regmap_register()
    - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()
    - selftests: openvswitch: Fix escape chars in regexp.
    - crypto: caam - Add check for kcalloc() in test_len()
    - amba: tegra-ahb: Fix device leak on SMMU enable
    - tracing: Fix fixed array of synthetic event
    - soc: qcom: ocmem: fix device leak on lookup
    - soc: amlogic: canvas: fix device leak on lookup
    - rpmsg: glink: fix rpmsg device leak
    - platform/x86: intel: chtwc_int33fe: don't dereference swnode args
    - i2c: amd-mp2: fix reference leak in MP2 PCI device
    - hwmon: (max16065) Use local variable to avoid TOCTOU
    - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU
    - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32
    - wifi: rtw88: limit indirect IO under powered off for RTL8822CS
    - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
    - wifi: mac80211: do not use old MBSSID elements
    - i40e: fix scheduling in set_rx_mode
    - net: mdio: aspeed: add dummy read to avoid read-after-write issue
    - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
    - platform/x86: msi-laptop: add missing sysfs_remove_group()
    - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
    - amd-xgbe: reset retries and mode on RX adapt failures
    - Revert "UBUNTU: SAUCE: selftests: net: fix "buffer overflow detected"
      for tap.c"
    - selftests: net: fix "buffer overflow detected" for tap.c
    - genalloc.h: fix htmldocs warning
    - firewire: nosy: Fix dma_free_coherent() size
    - net: dsa: b53: skip multicast entries for fdb_dump()
    - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group
      struct
    - RDMA/efa: Remove possible negative shift
    - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
    - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
    - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
    - RDMA/bnxt_re: Fix to use correct page size for PDE table
    - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
    - RDMA/bnxt_re: fix dma_free_coherent() pointer
    - blk-mq: don't schedule block kworker on isolated CPUs
    - blk-mq: skip CPU offline notify on unmapped hctx
    - selftests/ftrace: traceonoff_triggers: strip off names
    - ntfs: Do not overwrite uptodate pages
    - ASoC: stm32: sai: fix device leak on probe
    - ASoC: stm32: sai: fix clk prepare imbalance on probe failure
    - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of
      appl_ptr
    - ASoC: qcom: q6asm-dai: perform correct state check before closing
    - ASoC: qcom: q6adm: the the copp device only during last instance
    - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
    - iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
    - iommu/apple-dart: fix device leak on of_xlate()
    - iommu/exynos: fix device leak on of_xlate()
    - iommu/ipmmu-vmsa: fix device leak on of_xlate()
    - iommu/mediatek-v1: fix device leak on probe_device()
    - iommu/mediatek-v1: fix device leaks on probe()
    - iommu/mediatek: fix device leak on of_xlate()
    - iommu/omap: fix device leaks on probe_device()
    - iommu/qcom: fix device leak on of_xlate()
    - iommu/sun50i: fix device leak on of_xlate()
    - iommu/tegra: fix device leak on probe_device()
    - HID: logitech-dj: Remove duplicate error logging
    - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
    - SAUCE: Revert "arm64: dts: ti: k3-j721e-sk: Add DT nodes for power
      regulators"
    - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power
      regulator
    - powerpc, mm: Fix mprotect on book3s 32-bit
    - leds: leds-lp50xx: Allow LED 0 to be added to module bank
    - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
    - leds: leds-lp50xx: Enable chip before any communication
    - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
    - mfd: max77620: Fix potential IRQ chip conflict when probing two devices
    - media: rc: st_rc: Fix reset control resource leak
    - parisc: entry.S: fix space adjustment on interruption for 64-bit
      userspace
    - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
    - powerpc/pseries/cmm: call balloon_devinfo_init() also without
      CONFIG_BALLOON_COMPACTION
    - firmware: stratix10-svc: Add mutex in stratix10 memory management
    - dm-ebs: Mark full buffer dirty even on partial write
    - dm-bufio: align write boundary on physical block size
    - fbdev: gbefb: fix to use physical address instead of dma address
    - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
    - fbdev: tcx.c fix mem_map to correct smem_start offset
    - media: cec: Fix debugfs leak on bus_register() failure
    - media: msp3400: Avoid possible out-of-bounds array accesses in
      msp3400c_thread()
    - media: renesas: rcar_drif: fix device node reference leak in
      rcar_drif_bond_enabled
    - media: samsung: exynos4-is: fix potential ABBA deadlock on init
    - media: TDA1997x: Remove redundant cancel_delayed_work in probe
    - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
    - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
    - media: vpif_capture: fix section mismatch
    - media: vpif_display: fix section mismatch
    - media: amphion: Cancel message work before releasing the VPU core
    - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
    - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
    - media: mediatek: vcodec: Fix a reference leak in
      mtk_vcodec_fw_vpu_init()
    - LoongArch: Add new PCI ID for pci_fixup_vgadev()
    - LoongArch: Correct the calculation logic of thread_count
    - LoongArch: Fix build errors for CONFIG_RANDSTRUCT
    - LoongArch: Use __pmd()/__pte() for swap entry conversions
    - LoongArch: Use unsigned long for _end and _text
    - compiler_types.h: add "auto" as a macro for "__auto_type"
    - kasan: refactor pcpu kasan vmalloc unpoison
    - idr: fix idr_alloc() returning an ID out of range
    - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
    - samples/ftrace: Adjust LoongArch register restore order in direct calls
    - fjes: Add missing iounmap in fjes_hw_init()
    - LoongArch: BPF: Zero-extend bpf_tail_call() index
    - nfsd: Drop the client reference in client_states_open()
    - net: usb: sr9700: fix incorrect command used to write single register
    - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to
      macb_open()
    - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
    - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
    - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
    - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
    - drm/mgag200: Fix big-endian support
    - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in
      prepare_fb
    - blk-mq: add helper for checking if one CPU is mapped to specified hctx
    - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in
      mptcp_do_fastclose().
    - ALSA: wavefront: Use standard print API
    - ALSA: wavefront: Use guard() for spin locks
    - ALSA: wavefront: Clear substream pointers on close
    - ext4: fix string copying in parse_apply_sb_mount_options()
    - jbd2: fix the inconsistency between checksum and data in memory for
      journal sb
    - btrfs: don't rewrite ret from inode_permission
    - mm/ksm: fix exec/fork inheritance support for prctl
    - usb: ohci-nxp: Use helper function devm_clk_get_enabled()
    - usb: ohci-nxp: fix device leak on probe failure
    - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error
    - f2fs: use f2fs_err_ratelimited() to avoid redundant logs
    - ARM: dts: microchip: sama7g5: fix uart fifo size to 32
    - fuse: fix readahead reclaim deadlock
    - PCI: brcmstb: Fix disabling L0s capability
    - lockd: fix vfs_test_lock() calls
    - mm: simplify folio_expected_ref_count()
    - mm: consider non-anon swap cache folios in folio_expected_ref_count()
    - pmdomain: imx: Fix reference count leak in imx_gpc_probe()
    - net: phy: mediatek: fix nvmem cell reference leak in
      mt798x_phy_calibration
    - drm/amdgpu: Forward VMID reservation errors
    - drm/mediatek: Fix probe memory leak
    - drm/mediatek: Fix probe resource leaks
    - drm/tilcdc: request and mapp iomem with devres
    - tty: introduce and use tty_port_tty_vhangup() helper
    - xhci: dbgtty: fix device unregister: fixup
    - usb: xhci: move link chain bit quirk checks into one helper function.
    - LoongArch: Refactor register restoration in ftrace_common_return
    - f2fs: remove unused GC_FAILURE_PIN
    - f2fs: keep POSIX_FADV_NOREUSE ranges
    - f2fs: drop inode from the donation list when the last file is closed
    - f2fs: fix to propagate error from f2fs_enable_checkpoint()
    - f2fs: fix to detect recoverable inode during dryrun of
      find_fsync_dnodes()
    - media: verisilicon: Fix CPU stalls on G2 bus error
    - mm/balloon_compaction: we cannot have isolated pages in the balloon list
    - mm/balloon_compaction: convert balloon_page_delete() to
      balloon_page_finalize()
    - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
    - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-
      Exit
    - media: amphion: Add a frame flush mode for decoder
    - media: amphion: Make some vpu_v4l2 functions static
    - media: amphion: Remove vpu_vb_is_codecconfig
    - mm/damon/tests/vaddr-kunit: handle alloc failures in
      damon_test_split_evenly_fail()
    - mm/damon/tests/vaddr-kunit: handle alloc failures on
      damon_do_test_apply_three_regions()
    - sched/fair: Small cleanup to sched_balance_newidle()
    - sched/fair: Small cleanup to update_newidle_cost()
    - sched/fair: Proportional newidle balance
    - RDMA/rxe: Fix the failure of ibv_query_device() and
      ibv_query_device_ex() tests
    - mm/damon/tests/vaddr-kunit: handle alloc failures on
      damon_test_split_evenly_succ()
    - mm/damon/tests/core-kunit: handle alloc failres in
      damon_test_new_filter()
    - mm/damon/tests/core-kunit: handle allocation failures in
      damon_test_regions()
    - mm/damon/tests/core-kunit: handle memory failure from
      damon_test_target()
    - mm/damon/tests/core-kunit: handle alloc failures on
      damon_test_split_regions_of()
    - mm/damon/tests/core-kunit: handle alloc failures on
      damos_test_filter_out()
    - mm/damon/tests/core-kunit: handle alloc failures in
      damon_test_set_regions()
    - mm/damon/tests/core-kunit: handle alloc failures in
      damon_test_ops_registration()
    - mm/damon/tests/core-kunit: handle alloc failure on
      damon_test_set_attrs()
    - virtio_console: fix order of fields cols and rows
    - pwm: stm32: Always program polarity
    - tty: fix tty_port_tty_*hangup() kernel-doc
    - firmware: arm_scmi: Fix unused notifier-block in unregister
    - ext4: filesystems without casefold feature cannot be mounted with
      siphash
    - drm/amdkfd: Fix GPU mappings for APU after prefetch
    - wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
    - smack: fix bug: setting task label silently ignores input garbage
    - wifi: ath10k: Avoid vdev delete timeout when firmware is already down
    - wifi: ath10k: Add missing include of export.h
    - wifi: ath10k: move recovery check logic into a new work
    - wifi: ath11k: restore register window after global reset
    - dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets
    - dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets
    - clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets
    - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule()
    - block/mq-deadline: Introduce dd_start_request()
    - block/mq-deadline: Switch back to a single dispatch list
    - perf annotate: Check return value of evsel__get_arch() properly
    - arm64: dts: exynos: gs101: fix sysreg_apm reg property
    - clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to
      other
    - soc: qcom: gsbi: fix double disable caused by devm
    - wifi: ath11k: fix VHT MCS assignment
    - arm64: dts: qcom: sm8650: set ufs as dma coherent
    - perf: Remove get_perf_callchain() init_nr argument
    - bpf: Refactor stack map trace depth calculation into helper function
    - perf/x86/intel/cstate: Remove PC3 support from LunarLake
    - drm/imagination: Fix reference to
      devm_platform_get_and_ioremap_resource()
    - power: supply: rt5033_charger: Fix device node reference leaks
    - power: supply: max17040: Check iio_read_channel_processed() return code
    - libbpf: Fix parsing of multi-split BTF
    - locktorture: Fix memory leak in param_set_cpumask()
    - crypto: iaa - Fix incorrect return value in save_iaa_wq()
    - drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
    - leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM
    - RAS: Report all ARM processor CPER information to userspace
    - vhost: Fix kthread worker cgroup failure handling
    - vfio/pci: Use RCU for error/request triggers to avoid circular locking
    - net: phy: aquantia: check for NVMEM deferral
    - perf tools: Mark split kallsyms DSOs as loaded
    - perf hist: In init, ensure mem_info is put on error paths
    - sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when
      the last task migrates out
    - platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
    - nfs/vfs: discard d_exact_alias()
    - NFS: Initialise verifiers for visible dentries in
      _nfs4_open_and_get_state
    - drm/plane: Fix IS_ERR() vs NULL check in
      drm_plane_create_hotspot_properties()
    - regulator: fixed: Rely on the core freeing the enable GPIO
    - drm/nouveau: refactor deprecated strcpy
    - drm/amdkfd: Use huge page size to check split svm range alignment
    - block: return unsigned int from queue_dma_alignment
    - fs/ntfs3: check for shutdown in fsync
    - wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
    - wifi: cfg80211: use cfg80211_leave() in iftype change
    - wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC
      load
    - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad"
    - Bluetooth: btusb: MT7922: Add VID/PID 0489/e170
    - Bluetooth: btusb: MT7920: Add VID/PID 0489/e135
    - Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT
    - netfilter: nf_nat: remove bogus direction check
    - iommufd/selftest: Add coverage for reporting max_pasid_log2 via
      IOMMU_HW_INFO
    - iommufd/selftest: Update hw_info coverage for an input data_type
    - iommufd/selftest: Make it clearer to gcc that the access is not out of
      bounds
    - hwmon: (dell-smm) Limit fan multiplier to avoid overflow
    - drm/xe: Restore engine registers before restarting schedulers after GT
      reset
    - mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds
    - scsi: ufs: host: mediatek: Fix shutdown/suspend race condition
    - scsi: smartpqi: Add support for Hurray Data new controller PCI device
    - exfat: zero out post-EOF page cache on file extension
    - x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA
      systems
    - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister()
    - wifi: mt76: Fix DTS power-limits on little endian systems
    - usb: gadget: lpc32xx_udc: fix clock imbalance in error path
    - mei: gsc: add dependency on Xe driver
    - serial: sh-sci: Check that the DMA cookie is valid
    - powerpc: Add reloc_offset() to font bitmap pointer used for
      bootx_printf()
    - xfs: fix stupid compiler warning
    - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap
    - drm/amd/display: Fix scratch registers offsets for DCN35
    - drm/displayid: pass iter to drm_find_displayid_extension()
    - KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
    - soc: apple: mailbox: fix device leak on lookup
    - interconnect: qcom: sdx75: Drop QPIC interconnect and BCM nodes
    - i40e: validate ring_len parameter against hardware-specific values
    - idpf: reduce mbx_task schedule delay to 300us
    - platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event
      names
    - net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
    - vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
    - md: Fix static checker warning in analyze_sbs
    - ASoC: codecs: lpass-tx-macro: fix SM6115 support
    - iommu/amd: Propagate the error code returned by __modify_irte_ga() in
      modify_irte_ga()
    - mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
    - mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
    - mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
    - mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
    - mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
    - mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
    - mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
    - perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init()
      on error
    - mm/damon/tests/sysfs-kunit: handle alloc failures on
      damon_sysfs_test_add_targets()
    - mm/damon/tests/core-kunit: handle alloc failures on
      damon_test_split_at()
    - mm/damon/tests/core-kunit: handle memory alloc failure from
      damon_test_aggregate()
    - mm/damon/tests/core-kunit: handle alloc failures on
      dasmon_test_merge_regions_of()
    - mm/damon/tests/core-kunit: handle alloc failures on
      damon_test_merge_two()
    - mm/damon/tests/core-kunit: handle alloc failures in
      damon_test_update_monitoring_result()
    - kasan: unpoison vms[area] addresses with a common tag
    - drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
    - drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
    - drm/mediatek: Fix probe device leaks
    - drm/i915: Fix format string truncation warning
    - drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
    - drm/xe: Adjust long-running workload timeslices to reasonable values
    - drm/xe: Use usleep_range for accurate long-running workload timeslicing
    - drm/xe: Drop preempt-fences when destroying imported dma-bufs.
    - drm/imagination: Disallow exporting of PM/FW protected objects
    - gfs2: fix freeze error handling
    - sched/eevdf: Remove min_vruntime_copy
    - sched/eevdf: Fix min_vruntime vs avg_vruntime
    - serial: core: fix OF node leak
    - serial: core: Restore sysfs fwnode information
    - mptcp: pm: ignore unknown endpoint flags
    - f2fs: clear SBI_POR_DOING before initing inmem curseg
    - f2fs: add timeout in f2fs_enable_checkpoint()
    - f2fs: dump more information for f2fs_{enable,disable}_checkpoint()
    - gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list()
    - gpiolib: acpi: Handle deferred list via new API
    - gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter
    - gpiolib: acpi: Move quirks to a separate file
    - gpiolib: acpi: Add a quirk for Acer Nitro V15
    - gpiolib: acpi: Add quirk for ASUS ProArt PX13
    - gpiolib: acpi: Add quirk for Dell Precision 7780
    - serial: core: Fix serial device initialization
    - media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
    - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume
    - soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter
    - ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
    - vfio/pci: Disable qword access to the PCI ROM bar
    - iomap: allocate s_dio_done_wq for async reads as well
    - mptcp: ensure context reset on disconnect()
    - Upstream stable to v6.6.120, v6.12.62, v6.12.63, v6.12.64, v6.12.65
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2024-36347
    - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo
    - x86/microcode/AMD: Select which microcode patch to load
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-40164
    - usbnet: Fix using smp_processor_id() in preemptible code warnings
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-40325
    - md/raid10: wait barrier before returning discard request with REQ_NOWAIT
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68206
    - netfilter: nft_ct: add seqadj extension for natted connections
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71068
    - svcrdma: bound check rq_pages index in inline path
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71135
    - md/raid5: fix possible null-pointer dereferences in
      raid5_store_group_thread_cnt()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-38234
    - sched/rt: Fix race in push_rt_task
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68811
    - svcrdma: use rc_pageoff for memcpy byte offset
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68810
    - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71109
    - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32
      bits
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68770
    - bnxt_en: Fix XDP_TX path
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71072
    - shmem: fix recovery on rename failures
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68374
    - md: fix rcu protection in md_wakeup_thread
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68378
    - bpf: Fix stackmap overflow check in __bpf_get_stackid()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2024-57795
    - RDMA/rxe: Remove the direct link to net_device
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-38022
    - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device"
      problem
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71140
    - media: mediatek: vcodec: Use spinlock for context list protection lock
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71105
    - f2fs: use global inline_xattr_slab instead of per-sb slab cache
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68772
    - f2fs: fix to avoid updating compression context during writeback
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-22111
    - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-22022
    - usb: xhci: Apply the link chain quirk on NEC isoc endpoints
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71141
    - drm/tilcdc: Fix removal actions in case of failed probe
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71127
    - wifi: mac80211: Discard Beacon frames to non-broadcast address
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71088
    - mptcp: fallback earlier on simult connection
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71065
    - f2fs: fix to avoid potential deadlock
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68345
    - ALSA: hda: cs35l41: Fix NULL pointer dereference in
      cs35l41_hda_read_acpi()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68344
    - ALSA: wavefront: Fix integer overflow in sample size validation
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71077
    - tpm: Cap the number of PCR banks
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71130
    - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71138
    - drm/msm/dpu: Add missing NULL pointer check for pingpong interface
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71083
    - drm/ttm: Avoid NULL pointer deref for evicted BOs
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71079
    - net: nfc: fix deadlock between nfc_unregister_device and
      rfkill_fop_write
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71129
    - LoongArch: BPF: Sign extend kfunc call arguments
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71093
    - e1000: fix OOB in e1000_tbi_should_accept()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71084
    - RDMA/cm: Fix leaking the multicast GID table reference
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71096
    - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71136
    - media: adv7842: Avoid possible out-of-bounds array accesses in
      adv7842_cp_log_status()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71143
    - clk: samsung: exynos-clkout: Assign .num before accessing .hws
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71078
    - powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71089
    - iommu: disable SVA when CONFIG_X86 is set
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71081
    - ASoC: stm32: sai: fix OF node leak on probe
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71153
    - ksmbd: Fix memory leak in get_file_all_info()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71133
    - RDMA/irdma: avoid invalid read in irdma_net_event
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71086
    - net: rose: fix invalid array index in rose_kill_by_device()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71097
    - ipv4: Fix reference count leak when using error routes with nexthop
      objects
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71085
    - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71095
    - net: stmmac: fix the crash issue for zero copy XDP_TX action
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71137
    - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71101
    - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package
      parsing
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71094
    - net: usb: asix: validate PHY address before use
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71132
    - smc91x: fix broken irq-context in PREEMPT_RT
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71154
    - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71091
    - team: fix check for port enabled in
      team_queue_override_port_prio_changed()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71098
    - ip6_gre: make ip6gre_header() robust
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71082
    - Bluetooth: btusb: revert use of devm_kzalloc in btusb
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71131
    - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71087
    - iavf: fix off-by-one issues in iavf_config_rss_reg()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71071
    - iommu/mediatek: fix use-after-free on probe deferral
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71111
    - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71113
    - crypto: af_alg - zero initialize memory allocated via sock_kmalloc
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71149
    - io_uring/poll: correctly handle io_poll_add() return value on update
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68778
    - btrfs: don't log conflicting inode if it's a dir moved in the current
      transaction
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71119
    - powerpc/kexec: Enable SMT before waking offline CPUs
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71120
    - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in
      gss_read_proxy_verf
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71148
    - net/handshake: restore destructor on submit failure
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68788
    - fsnotify: do not generate ACCESS/MODIFY events on child for special
      files
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71125
    - tracing: Do not register unsupported perf events
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71104
    - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV
      timer
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71116
    - libceph: make decode_pool() more resilient against corrupted osdmaps
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71121
    - parisc: Do not reprogram affinitiy on ASP chip
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71102
    - scs: fix a wrong parameter in __scs_magic
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68804
    - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68771
    - ocfs2: fix kernel BUG in ocfs2_find_victim_chain
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68808
    - media: vidtv: initialize local pointers upon transfer of memory
      ownership
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68769
    - f2fs: fix return value of f2fs_recover_fsync_data()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71069
    - f2fs: invalidate dentry cache on failed whiteout creation
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68796
    - f2fs: fix to avoid updating zero-sized extent in extent cache
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71107
    - f2fs: ensure node page reads complete before f2fs_put_super() finishes
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68782
    - scsi: target: Reset t_task_cdb pointer in error case
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71075
    - scsi: aic94xx: fix use-after-free in device removal path
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68818
    - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in
      abort path"
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68797
    - char: applicom: fix NULL pointer dereference in ac_ioctl
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68819
    - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71126
    - mptcp: avoid deadlock on fallback while reinjecting
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68820
    - ext4: xattr: fix null pointer deref in ext4_raw_inode()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68814
    - io_uring: fix filename leak in __io_openat_prep()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71147
    - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71151
    - cifs: Fix memory and information leak in smb3_reconfigure()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71108
    - usb: typec: ucsi: Handle incorrect num_connectors capability
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71114
    - via_wdt: fix critical boot hang due to unnamed resource allocation
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68783
    - ALSA: usb-mixer: us16x08: validate meter packet indices
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68776
    - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68773
    - spi: fsl-cpm: Check length parity before switching to 16 bit mode
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68777
    - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68806
    - ksmbd: fix buffer validation by including null terminator size in EA
      length
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71150
    - ksmbd: Fix refcount leak when invalid session is found on session lookup
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68786
    - ksmbd: skip lock-range check on equal size to avoid size==0 underflow
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68789
    - hwmon: (ibmpex) fix use-after-free in high/low store
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71112
    - net: hns3: add VLAN id validation before using
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71064
    - net: hns3: using the num_tqps in the vf driver to apply for resources
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68775
    - net/handshake: duplicate handshake cancellations leak socket
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68816
    - net/mlx5: fw_tracer, Validate format string parameters
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68795
    - ethtool: Avoid overflowing userspace buffer on stats query
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71122
    - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68815
    - net/sched: ets: Remove drr class from the active list if it changes to
      strict
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68799
    - caif: fix integer underflow in cffrml_receive()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68813
    - ipvs: fix ipv4 null-ptr-deref in route error path
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68785
    - net: openvswitch: fix middle attribute validation in push_nsh() action
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68800
    - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route
      stats
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68801
    - mlxsw: spectrum_router: Fix neighbour use-after-free
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71066
    - net/sched: ets: Always remove class from active list before deleting in
      ets_qdisc_change
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68787
    - netrom: Fix memory leak in nr_sendmsg()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68809
    - ksmbd: vfs: fix race on m_flags in vfs_cache
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68817
    - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68767
    - hfsplus: Verify inode mode when loading from disk
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68774
    - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71067
    - ntfs: set dummy blocksize to read boot_block when mounting
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-71118
    - ACPICA: Avoid walking the Namespace if start_node is NULL
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68780
    - sched/deadline: only set free_cpus for online runqueues
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68798
    - perf/x86/amd: Check event before enable to avoid GPF
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68794
    - iomap: adjust read range correctly for non-block-aligned positions
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68346
    - ALSA: dice: fix buffer overflow in detect_stream_formats()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68766
    - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68756
    - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of
      set->tag_list_lock
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68753
    - ALSA: firewire-motu: add bounds check in put_user loop for DSP events
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68347
    - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68764
    - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68349
    - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in
      pnfs_mark_layout_stateid_invalid
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68325
    - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68354
    - regulator: core: Protect regulator_supply_alias_list with
      regulator_list_mutex
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68758
    - backlight: led-bl: Add devlink to supplier LEDs
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68765
    - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68763
    - crypto: starfive - Correctly handle return of sg_nents_for_len
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68740
    - ima: Handle error code returned by ima_filter_rule_match()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68362
    - wifi: rtl818x: rtl8187: Fix potential buffer underflow in
      rtl8187_rx_cb()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68741
    - scsi: qla2xxx: Fix improper freeing of purex item
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68742
    - bpf: Fix invalid prog->stats access when update_effective_progs fails
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68759
    - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68363
    - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68744
    - bpf: Free special fields when update [lru_,]percpu_hash maps
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68364
    - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68366
    - nbd: defer config unlock in nbd_genl_connect
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68367
    - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68755
    - staging: most: remove broken i2c driver
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68371
    - scsi: smartpqi: Fix device resources accessed after device removal
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68372
    - nbd: defer config put in recv_work
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68746
    - spi: tegra210-quad: Fix timeout handling
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68379
    - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68380
    - wifi: ath11k: fix peer HE MCS assignment
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68724
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68727
    - ntfs3: Fix uninit buffer allocated by __getname()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68728
    - ntfs3: fix uninit memory after failed mi_read in mi_format_new
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68757
    - drm/vgem-fence: Fix potential deadlock on release
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68732
    - gpu: host1x: Fix race in syncpt alloc/free
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68733
    - smack: fix bug: unprivileged task can create labels
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68254
    - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68255
    - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68256
    - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68257
    - comedi: check device's attached status in compat ioctls
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68258
    - comedi: multiq3: sanitize config options in multiq3_attach()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68332
    - comedi: c6xdigio: Fix invalid PNP driver unregistration
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68265
    - nvme: fix admin request_queue lifetime
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68266
    - bfs: Reconstruct file type when loading from disk
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68259
    - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68335
    - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68261
    - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68336
    - locking/spinlock/debug: Fix data-race in do_raw_write_lock
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68263
    - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68264
    - ext4: refresh inline data size before write operations
  * Noble update: upstream stable patchset 2026-03-04 (LP: #2142789) //
    CVE-2025-68337
    - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system
      corrupted
  * CVE-2026-23111
    - netfilter: nf_tables: fix inverted genmask check in
      nft_map_catchall_activate()
  * CVE-2026-23209
    - macvlan: fix error recovery in macvlan_common_newlink()
  * CVE-2026-23074
    - net/sched: Enforce that teql can only be used as root qdisc
  * CVE-2026-23060
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
      spec

 -- John Cabaj <john.cabaj@canonical.com>  Tue, 31 Mar 2026 10:12:10 -0500

linux-azure (6.8.0-1052.58) noble; urgency=medium

  * noble/linux-azure: 6.8.0-1052.58 -proposed tracker (LP: #2144230)

  [ Ubuntu: 6.8.0-107.107 ]

  * noble/linux: 6.8.0-107.107 -proposed tracker (LP: #2144267)
  * CVE-2026-23074
    - net/sched: Enforce that teql can only be used as root qdisc
  * CVE-2026-23060
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN
      spec
  * CVE-2026-23111
    - netfilter: nf_tables: fix inverted genmask check in
      nft_map_catchall_activate()

 -- John Cabaj <john.cabaj@canonical.com>  Tue, 24 Mar 2026 15:54:44 -0500

linux-azure (6.8.0-1051.57) noble; urgency=medium

  [ Ubuntu: 6.8.0-106.106 ]

  * Miscellaneous upstream changes
    - apparmor: validate DFA start states are in bounds in unpack_pdb
    - apparmor: fix memory leak in verify_header
    - apparmor: replace recursive profile removal with iterative approach
    - apparmor: fix: limit the number of levels of policy namespaces
    - apparmor: fix side-effect bug in match_char() macro usage
    - apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
    - apparmor: Fix double free of ns_name in aa_replace_profiles()
    - apparmor: fix unprivileged local user can do privileged policy
      management
    - apparmor: fix differential encoding verification
    - apparmor: fix race on rawdata dereference
    - apparmor: fix race between freeing data and fs accessing it

 -- Mehmet Basaran <mehmet.basaran@canonical.com>  Fri, 06 Mar 2026 13:09:45 +0300

linux-azure (6.8.0-1049.55) noble; urgency=medium

  * noble/linux-azure: 6.8.0-1049.55 -proposed tracker (LP: #2141849)

  [ Ubuntu: 6.8.0-104.104 ]

  * noble/linux: 6.8.0-104.104 -proposed tracker (LP: #2141774)
  * Change of ABI in 6.8.0 kernel breaks some OTT modules (LP: #2141778)
    - Revert "net: tls: Cancel RX async resync request on rcd_delta overflow"
    - Revert "net: tls: Change async resync helpers argument"

 -- Edoardo Canepa <edoardo.canepa@canonical.com>  Sun, 15 Feb 2026 08:46:44 +0100

# For older changelog entries, run 'apt-get changelog linux-azure-headers-6.8.0-1059'
