linux-gkeop (5.15.0-1098.106) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1098.106 -proposed tracker (LP: #2162498)

  [ Ubuntu: 5.15.0-191.201 ]

  * jammy/linux: 5.15.0-191.201 -proposed tracker (LP: #2163038)
  * Drop DEP-8 tests from kernel packages (LP: #2160302)
    - [Packaging] Drop DEP-8 tests from kernel source
  * CVE-2026-53131
    - netfilter: require Ethernet MAC header before using eth_hdr()
  * CVE-2026-53086
    - net: bcmgenet: fix racing timeout handler
  * CVE-2026-53225
    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
  * CVE-2026-53228
    - ipv6: sit: reload inner IPv6 header after GSO offloads
  * CVE-2026-43499
    - rtmutex: Use waiter::task instead of current in remove_waiter()
  * CVE-2026-46331
    - net/sched: fix pedit partial COW leading to page cache corruption
  * CVE-2026-53212
    - netfilter: nft_tunnel: fix use-after-free on object destroy
  * CVE-2026-53359
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role
  * CVE-2026-52989
    - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
  * CVE-2026-52924
    - sctp: purge outqueue on stale COOKIE-ECHO handling
  * CVE-2026-43378
    - smb: server: fix use-after-free in smb2_open()
  * CVE-2025-27558
    - wifi: prevent A-MSDU attacks in mesh networks
  * CVE-2026-53215
    - net: mvpp2: refill RX buffers before XDP or skb use
  * CVE-2026-53176
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
  * CVE-2026-46266
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
  * CVE-2026-43198
    - tcp: fix potential race in tcp_v6_syn_recv_sock()
  * CVE-2026-31705
    - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
  * CVE-2026-31448
    - ext4: avoid infinite loops caused by residual data
  * CVE-2026-31414
    - netfilter: nf_conntrack_expect: use expect->helper
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
    - [Packaging] resync retpoline extraction
  * CVE-2026-53246
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
    - sctp: delete the nested flexible array peer_init
  * CVE-2026-64531
    - net: openvswitch: reject oversized nested action attrs
  * CVE-2026-53224
    - sctp: validate embedded INIT chunk and address list lengths in cookie
  * Miscellaneous Ubuntu changes
    - SAUCE: Skip srv6_end_dt46_l3vpn_test::host_vpn_tests if iproute2 too old

 -- Ian Whitfield <ian.whitfield@canonical.com>  Tue, 11 Aug 2026 10:46:43 -0400

linux-gkeop (5.15.0-1097.105) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1097.105 -proposed tracker (LP: #2162255)

  [ Ubuntu: 5.15.0-190.200 ]

  * jammy/linux: 5.15.0-190.200 -proposed tracker (LP: #2163031)
  * CVE-2026-53246
    - sctp: delete the nested flexible array peer_init

  [ Ubuntu: 5.15.0-188.198 ]

  * jammy/linux: 5.15.0-188.198 -proposed tracker (LP: #2162294)
  * CVE-2026-64531
    - net: openvswitch: reject oversized nested action attrs
  * CVE-2026-53224
    - sctp: validate embedded INIT chunk and address list lengths in cookie
  * CVE-2026-53246
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

 -- Ian Whitfield <ian.whitfield@canonical.com>  Mon, 10 Aug 2026 21:32:31 -0400

linux-gkeop (5.15.0-1096.104) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1096.104 -proposed tracker (LP: #2160857)

  [ Ubuntu: 5.15.0-187.197 ]

  * jammy/linux: 5.15.0-187.197 -proposed tracker (LP: #2160896)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
    - [Packaging] resync retpoline extraction
  * CVE-2026-53086
    - net: bcmgenet: fix racing timeout handler
  * CVE-2026-53225
    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
  * CVE-2026-53228
    - ipv6: sit: reload inner IPv6 header after GSO offloads
  * CVE-2026-43499
    - rtmutex: Use waiter::task instead of current in remove_waiter()
  * CVE-2026-46331
    - net/sched: fix pedit partial COW leading to page cache corruption
  * CVE-2026-53212
    - netfilter: nft_tunnel: fix use-after-free on object destroy
  * CVE-2026-53359
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role
  * CVE-2026-52989
    - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
  * CVE-2026-52924
    - sctp: purge outqueue on stale COOKIE-ECHO handling
  * CVE-2026-43378
    - smb: server: fix use-after-free in smb2_open()
  * CVE-2025-27558
    - wifi: prevent A-MSDU attacks in mesh networks
  * CVE-2026-53215
    - net: mvpp2: refill RX buffers before XDP or skb use
  * CVE-2026-53176
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
  * CVE-2026-46266
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
  * CVE-2026-43198
    - tcp: fix potential race in tcp_v6_syn_recv_sock()
  * CVE-2026-31705
    - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
  * CVE-2026-31448
    - ext4: avoid infinite loops caused by residual data
  * CVE-2026-31414
    - netfilter: nf_conntrack_expect: use expect->helper

 -- Ian Whitfield <ian.whitfield@canonical.com>  Mon, 20 Jul 2026 16:49:30 -0400

linux-gkeop (5.15.0-1095.103) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1095.103 -proposed tracker (LP: #2157366)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync retpoline extraction

  [ Ubuntu: 5.15.0-186.196 ]

  * jammy/linux: 5.15.0-186.196 -proposed tracker (LP: #2157405)
  * [Jammy] Priority inversion problem in epoll for rt kernel (LP: #2154194)
    - eventpoll: Replace rwlock with spinlock
  * CVE-2026-46137
    - mptcp: pm: ADD_ADDR rtx: fix potential data-race
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901)
    - Linux 5.15.208
    - ALSA: asihpi: avoid write overflow check warning
    - can: mcp251x: add error handling for power enable in open and resume
    - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
    - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
    - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
    - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW
      debouncer)
    - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
    - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
    - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
    - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching
    - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency
    - PCI: hv: Set default NUMA node to 0 for devices without affinity info
    - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
    - epoll: use refcount to reduce ep_mutex contention
    - tracing/probe: reject non-closed empty immediate strings
    - e1000: check return value of e1000_read_eeprom
    - gpio: tegra: fix irq_release_resources calling enable instead of disable
    - i3c: fix uninitialized variable use in i2c setup
    - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
    - mips: mm: Allocate tlb_vpn array atomically
    - MIPS: Always record SEGBITS in cpu_data.vmbits
    - MIPS: mm: Suppress TLB uniquification on EHINV hardware
    - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature
    - ALSA: usb-audio: Update for native DSD support quirks
    - usb: storage: Expand range of matched versions for VL817 quirks entry
    - USB: serial: option: add Telit Cinterion FN990A MBIM composition
    - fsl-mc: Use driver_set_override() instead of open-coding
    - checkpatch: add support for Assisted-by tag
    - gfs2: Improve gfs2_consist_inode() usage
    - PCI/ACPI: Restrict program_hpx_type2() to AER bits
    - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
    - powerpc64/bpf: do not increment tailcall count when prog is NULL
    - arm64: dts: imx8mq-librem5: Set the DVS voltages lower
    - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage to 0.81V
    - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
    - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
    - ocfs2: add inline inode consistency check to
      ocfs2_validate_inode_block()
    - rxrpc: Fix key quota calculation for multitoken keys
    - fs/ocfs2: fix comments mentioning i_mutex
    - MPTCP: fix lock class name family in pm_nl_create_listen_socket
    - Revert "nvme: nvme-fc: Ensure ->ioerr_work is cancelled in
      nvme_fc_delete_ctrl()"
    - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
    - s390/xor: Fix xor_xc_2() inline assembly constraints
    - net: add skb_header_pointer_careful() helper
    - x86/uprobes: Fix XOL allocation failure for 32-bit tasks
    - iio: imu: inv_icm42600: fix odr switch when turning buffer off
    - vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
    - net: usb: lan78xx: Fix double free issue with interrupt buffer
      allocation
    - SAUCE: Revert "fs/ntfs3: Fixed overflow check in mi_enum_attr()"
    - SAUCE: Revert "fs/ntfs3: Sequential field availability check in
      mi_enum_attr()"
    - SAUCE: Revert "ntfs3: Add bounds checking to mi_enum_attr()"
    - cpufreq: governor: Free dbs_data directly when gov->init() fails
    - scripts/dtc: Remove unused dts_version in dtc-lexer.l
    - rxrpc: Fix anonymous key handling
    - iommu: fix a reference count leak in iommu_sva_bind_device()
    - fuse: quiet down complaints in fuse_conn_limit_write
    - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
    - tty: n_gsm: fix flow control handling in tx path
    - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
    - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
    - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
    - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
    - ALSA: usb-audio: Evaluate packsize caps at the right place
    - firmware: google: framebuffer: Do not mark framebuffer as busy
    - device property: Make modifications of fwnode "flags" thread safe
    - driver core: Don't let a device probe until it's ready
    - um: drivers: call kernel_strrchr() explicitly in cow_user.c
    - Revert "ALSA: usb: Increase volume range that triggers a warning"
    - lib/ts_kmp: fix integer overflow in pattern length calculation
    - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
      imx219_probe()
    - ALSA: aoa: i2sbus: fix OF node lifetime handling
    - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
    - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
    - parisc: _llseek syscall is only available for 32-bit userspace
    - selftests/mqueue: Fix incorrectly named file
    - ALSA: caiaq: Fix control_put() result and cache rollback
    - ALSA: 6fire: Fix input volume change detection
    - iio: adc: ad7768-1: fix one-shot mode data acquisition
    - drm/arcpgu: fix device node leak
    - tpm: avoid -Wunused-but-set-variable
    - power: supply: axp288_charger: Do not cancel work before initializing it
    - mmc: block: use single block write in retry
    - tpm: tpm_tis: add error logging for data transfer
    - rtc: ntxec: fix OF node reference imbalance
    - userfaultfd: allow registration of ranges below mmap_min_addr
    - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
    - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
    - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
    - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
    - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
    - KVM: nSVM: Add missing consistency check for nCR3 validity
    - io_uring/poll: fix EPOLL_URING_WAKE sometimes not being honored
    - io_uring/poll: fix backport of io_poll_add() changes
    - mtd: docg3: Convert to platform remove callback returning void
    - taskstats: set version in TGID exit notifications
    - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
    - crypto: atmel-ecc - Release client on allocation failure
    - crypto: hisilicon - Fix dma_unmap_single() direction
    - IB/core: Fix zero dmac race in neighbor resolution
    - ktest: Fix the month in the name of the failure directory
    - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
    - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
    - ALSA: caiaq: Don't abort when no input device is available
    - drm/amdgpu: fix zero-size GDS range init on RDNA4
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure
    - ACPI: scan: Use acpi_dev_put() in object add error paths
    - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
    - ACPI: video: force native backlight on HP OMEN 16 (8A44)
    - spi: rockchip: fix controller deregistration
    - um: virt-pci: Fix build failure
    - ipmi:ssif: Fix a shutdown race
    - ipmi:ssif: Remove unnecessary indention
    - ipmi:ssif: NULL thread on error
    - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
    - USB: omap_udc: DMA: Don't enable burst 4 mode
    - USB: serial: option: add Telit Cinterion LE910Cx compositions
    - usb: ulpi: fix memory leak on ulpi_register() error paths
    - ALSA: firewire-tascam: Do not drop unread control events
    - xfrm: provide message size for XFRM_MSG_MAPPING
    - spi: zynqmp-gqspi: fix controller deregistration
    - parisc: Fix IRQ leak in LASI driver
    - hwmon: (ltc2992) Clamp threshold writes to hardware range
    - hwmon: (ltc2992) Fix u32 overflow in power read path
    - hwmon: (corsair-psu) Close HID device on probe errors
    - extcon: ptn5150: handle pending IRQ events during system resume
    - hv_sock: fix ARM64 support
    - udf: reject descriptors with oversized CRC length
    - thermal/drivers/sprd: Fix temperature clamping in
      sprd_thm_temp_to_rawdata
    - thermal/drivers/sprd: Fix raw temperature clamping in
      sprd_thm_rawdata_to_temp
    - cpuidle: powerpc: avoid double clear when breaking snooze
    - ASoC: fsl_easrc: fix comment typo
    - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
    - dm: don't report warning when doing deferred remove
    - dm-verity-fec: correctly reject too-small FEC devices
    - dm-verity-fec: correctly reject too-small hash devices
    - s390/debug: Reject zero-length input in debug_input_flush_fn()
    - PCI/AER: Clear only error bits in PCIe Device Status
    - PCI/AER: Stop ruling out unbound devices as error source
    - power: supply: max17042: avoid overflow when determining health
    - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
    - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
    - mptcp: sockopt: set timestamp flags on subflow socket, not msk
    - platform/x86: hp-wmi: Ignore backlight and FnLock events
    - media: uvcvideo: Enable VB2_DMABUF for metadata stream
    - media: i2c: ov8856: free control handler on error in
      ov8856_init_controls()
    - regulator: max77650: fix OF node reference imbalance
    - media: rc: streamzap: Error handling in probe
    - regulator: act8945a: fix OF node reference imbalance
    - regulator: bd9571mwv: fix OF node reference imbalance
    - media: dib8000: avoid division by 0 in dib8000_set_dds()
    - media: i2c: imx412: Assert reset GPIO during probe
    - spi: mtk-nor: fix controller deregistration
    - spi: imx: fix runtime pm leak on probe deferral
    - spi: orion: fix clock imbalance on registration failure
    - drm/radeon: add missing revision check for CI
    - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
    - drm/amdgpu/pm: add missing revision check for CI
    - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
    - drm/amdgpu/vcn3: Avoid overflow on msg bound check
    - bcache: fix uninitialized closure object
    - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
    - drbd: Balance RCU calls in drbd_adm_dump_devices()
    - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
    - pstore/ram: fix resource leak when ioremap() fails
    - devres: fix missing node debug info in devm_krealloc()
    - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
    - debugfs: check for NULL pointer in debugfs_create_str()
    - irqchip/irq-pic32-evic: Address warning related to wrong printf()
      formatter
    - locking: Fix rwlock support in <linux/spinlock_up.h>
    - firmware: dmi: Correct an indexing error in dmi.h
    - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
    - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
      irq_prepare_bcn_tasklet
    - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
    - [Config] Disable FSL_DPAA2_SWITCH on armhf, ppc64el
    - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
    - kernel: param: rename locate_module_kobject
    - kernel: globalize lookup_or_create_module_kobject()
    - params: Replace __modinit with __init_or_module
    - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
    - bpf, devmap: Remove unnecessary if check in for loop
    - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
    - r8152: fix incorrect register write to USB_UPHY_XTAL
    - powerpc/crash: fix backup region offset update to elfcorehdr
    - macvlan: annotate data-races around port->bc_queue_len_used
    - wifi: brcmfmac: Fix error pointer dereference
    - bpf-lsm: Make bpf_lsm_userns_create() sleepable
    - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable
      hooks
    - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
    - netfilter: xt_socket: enable defrag after all other checks
    - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
    - 6pack: propagage new tty types
    - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
    - net/rds: Optimize rds_ib_laddr_check
    - net/rds: Restrict use of RDS/IB to the initial network namespace
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
    - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
    - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds
      MTU
    - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
    - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
    - net: phy: qcom: at803x: Use the correct bit to disable extended next
      page
    - sctp: fix missing encap_port propagation for GSO fragments
    - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
    - drm/komeda: fix integer overflow in AFBC framebuffer size check
    - ASoC: sti: Return errors from regmap_field_alloc()
    - ASoC: sti: use managed regmap_field allocations
    - dm cache: fix null-deref with concurrent writes in passthrough mode
    - dm cache: fix write path cache coherency in passthrough mode
    - dm cache policy smq: fix missing locks in invalidating cache blocks
    - dm cache: fix concurrent write failure in passthrough mode
    - dm cache: support shrinking the origin device
    - dm cache: fix dirty mapping checking in passthrough mode switching
    - dm cache metadata: fix memory leak on metadata abort retry
    - dm log: fix out-of-bounds write due to region_count overflow
    - spi: fsl-qspi: Use reinit_completion() for repeated operations
    - drm/sun4i: Fix resource leaks
    - dm init: ensure device probing has finished in dm-mod.waitfor=
    - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
      break
    - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
    - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
    - drm/panel: simple: Correct G190EAN01 prepare timing
    - ALSA: core: Validate compress device numbers without dynamic minors
    - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
    - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
    - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
    - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
    - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
    - drm/amd/pm/ci: Fill DW8 fields from SMC
    - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
    - ALSA: hda/realtek: Whitespace fix
    - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
      '}')
    - drm/msm/a6xx: Fix HLSQ register dumping
    - drm/msm/a6xx: Use barriers while updating HFI Q headers
    - pmdomain: ti: omap_prm: Fix a reference leak on device node
    - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
    - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
    - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
    - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
    - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
    - ASoC: fsl_easrc: Change the type for iec958 channel status controls
    - PCI: Enable AtomicOps only if Root Port supports them
    - Documentation: fix a hugetlbfs reservation statement
    - selftest: memcg: skip memcg_sock test if address family not supported
    - PCI: Add PCIE_PME_TO_L2_TIMEOUT_US L2 ready timeout value
    - PCI: tegra194: Fix polling delay for L2 state
    - PCI: tegra194: Increase LTSSM poll time on surprise link down
    - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
      down
    - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-
      select"
    - PCI: tegra194: Disable direct speed change for Endpoint mode
    - ALSA: sc6000: Use standard print API
    - ALSA: sc6000: Keep the programmed board state in card-private data
    - ktest: Avoid undef warning when WARNINGS_FILE is unset
    - ktest: Honor empty per-test option overrides
    - ktest: Run POST_KTEST hooks on failure and cancellation
    - quota: Fix race of dquot_scan_active() with quota deactivation
    - gfs2: add some missing log locking
    - gfs2: prevent NULL pointer dereference during unmount
    - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
    - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
    - ARM: dts: mediatek: mt7623: fix efuse fallback compatible
    - memory: tegra124-emc: Fix dll_change check
    - memory: tegra30-emc: Fix dll_change check
    - soc: qcom: ocmem: use scoped device node handling to simplify error
      paths
    - soc: qcom: ocmem: register reasons for probe deferrals
    - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
    - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
      during boot
    - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts()
      failure
    - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
    - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
    - soc: qcom: aoss: compare against normalized cooling state
    - ocfs2: fix listxattr handling when the buffer is full
    - ocfs2: validate bg_bits during freefrag scan
    - ocfs2: validate group add input before caching
    - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
      function
    - dmaengine: mxs-dma: Fix missing return value from
      of_dma_controller_register()
    - tracing: Rebuild full_name on each hist_field_name() call
    - ima: check return value of crypto_shash_final() in boot aggregate
    - HID: asus: make asus_resume adhere to linux kernel coding standards
    - HID: asus: do not abort probe when not necessary
    - mtd: physmap_of_gemini: Fix disabled pinctrl state check
    - mtd: spi-nor: core: correct the op.dummy.nbytes when check read
      operations
    - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
    - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
    - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
    - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
    - HID: usbhid: fix deadlock in hid_post_reset()
    - pinctrl: pinctrl-pic32: Fix resource leak
    - perf branch: Avoid incrementing NULL
    - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE
      trace
    - pinctrl: abx500: Fix type of 'argument' variable
    - perf expr: Return -EINVAL for syntax error in expr__find_ids()
    - perf util: Kill die() prototype, dead for a long time
    - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
    - driver core: device.h: remove extern from function prototypes
    - driver core: Move dev_err_probe() to where it belogs
    - dev_printk: add new dev_err_probe() helpers
    - backlight: sky81452-backlight: Check return value of
      devm_gpiod_get_optional() in sky81452_bl_parse_dt()
    - platform/surface: surfacepro3_button: Drop wakeup source on remove
    - leds: lgm-sso: Remove duplicate assignments for priv->mmap
    - tty: hvc: remove HVC_IUCV_MAGIC
    - tty: hvc_iucv: fix off-by-one in number of supported devices
    - platform/x86: panasonic-laptop: Fix OPTD notifier registration and
      cleanup
    - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
    - nfs/blocklayout: Fix compilation error (`make W=1`) in
      bl_write_pagelist()
    - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
    - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
    - platform/x86: dell-wmi-sysman: bound enumeration string aggregation
    - RDMA/core: Prefer NLA_NUL_STRING
    - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
    - scsi: target: core: Fix integer overflow in UNMAP bounds check
    - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
    - clk: qcom: gcc-sc8180x: Add missing GDSCs
    - clk: qcom: gcc-sc8180x: Use retention for USB power domains
    - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
    - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
    - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
    - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
    - clk: imx: imx6q: Fix device node reference leak in
      of_assigned_ldb_sels()
    - clk: imx8mq: Correct the CSI PHY sels
    - clk: qoriq: avoid format string warning
    - clk: xgene: Fix mapping leak in xgene_pllclk_init()
    - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets
    - clk: qcom: dispcc-sc7180: Add missing MDSS resets
    - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
    - crypto: sa2ul - Fix AEAD fallback algorithm names
    - crypto: ccp - copy IV using skcipher ivsize
    - PCMCIA: Fix garbled log messages for KERN_CONT
    - net/sched: sch_cake: fix NAT destination port not being updated in
      cake_update_flowkeys
    - nexthop: fix IPv6 route referencing IPv4 nexthop
    - net/sched: taprio: stop going through private ops for dequeue and peek
    - net/sched: taprio: replace safety precautions with comments
    - net/sched: taprio: continue with other TXQs if one dequeue() failed
    - net/sched: taprio: refactor one skb dequeue from TXQ to separate
      function
    - net/sched: taprio: rename close_time to end_time
    - net/sched: taprio: fix use-after-free in advance_sched() on schedule
      switch
    - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
    - i40e: don't advertise IFF_SUPP_NOFCS
    - e1000e: Unroll PTP in probe error handling
    - ipv6: fix possible UAF in icmpv6_rcv()
    - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
    - dissector: do not set invalid PPP protocol
    - flow_dissector: Add number of vlan tags dissector
    - flow_dissector: Add PPPoE dissectors
    - pppoe: drop PFC frames
    - netfilter: nft_osf: restrict it to ipv4
    - netfilter: conntrack: remove sprintf usage
    - netfilter: xtables: restrict several matches to inet family
    - ipvs: fix MTU check for GSO packets in tunnel mode
    - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
    - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
    - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number
    - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
    - ksmbd: scope conn->binding slowpath to bound sessions only
    - net/rds: zero per-item info buffer before handing it to visitors
    - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
    - net/sched: sch_pie: annotate data-races in pie_dump_stats()
    - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
    - net: sched: gred/red: remove unused variables in struct red_stats
    - net/sched: sch_red: annotate data-races in red_dump_stats()
    - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
    - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
    - tipc: fix double-free in tipc_buf_append()
    - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
    - fs/adfs: validate nzones in adfs_validate_bblk()
    - rtc: abx80x: Disable alarm feature if no interrupt attached
    - fbdev: offb: fix PCI device reference leak on probe failure
    - mailbox: mailbox-test: free channels on probe error
    - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
    - mailbox: add sanity check for channel array
    - mailbox: mailbox-test: don't free the reused channel
    - mailbox: mailbox-test: initialize struct earlier
    - mailbox: mailbox-test: make data_ready a per-instance variable
    - btrfs: fix double-decrement of bytes_may_use in
      submit_one_async_extent()
    - tracing: branch: Fix inverted check on stat tracer registration
    - drm/amdgpu: fix spelling typos
    - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
    - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
    - netfilter: xt_policy: fix strict mode inbound policy matching
    - netfilter: nf_conntrack_sip: don't use simple_strtoul
    - scsi: sr: Add memory allocation failure handling for get_capabilities()
    - cdrom, scsi: sr: propagate read-only status to block layer via
      set_disk_ro()
    - netdevsim: zero initialize struct iphdr in dummy sk_buff
    - net: sched: sch_netem: Refactor code in 4-state loss generator
    - net/sched: netem: fix probability gaps in 4-state loss model
    - net/sched: netem: fix queue limit check to include reordered packets
    - net/sched: netem: validate slot configuration
    - net: sched: choke: remove unused variables in struct choke_sched_data
    - net/sched: sch_choke: annotate data-races in choke_dump_stats()
    - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
    - vrf: Fix a potential NPD when removing a port from a VRF
    - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
    - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
    - NFC: trf7970a: Ignore antenna noise when checking for RF field
    - net: phy: dp83869: fix setting CLK_O_SEL field.
    - ASoC: codecs: ab8500: Fix casting of private data
    - netfilter: skip recording stale or retransmitted INIT
    - sctp: discard stale INIT after handshake completion
    - ipv4: rename and move ip_route_output_tunnel()
    - ipv4: remove "proto" argument from udp_tunnel_dst_lookup()
    - ipv4: add new arguments to udp_tunnel_dst_lookup()
    - ipv6: rename and move ip6_dst_lookup_tunnel()
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
    - ALSA: hda/conexant: add a new hda codec SN6140
    - ALSA: hda/conexant: fix some typos
    - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87
    - ALSA: hda/conexant: Fix missing error check for jack detection
    - drm/amd/display: Allow DCE link encoder without AUX registers
    - drm/amd/display: Read EDID from VBIOS embedded panel info
    - btrfs: tracepoints: fix sleep while in atomic context in
      btrfs_sync_file()
    - flow_dissector: do not dissect PPPoE PFC frames
    - flow_dissector: Do not count vlan tags inside tunnel payload
    - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
    - crypto: af_alg - Cap AEAD AD length to 0x80000000
    - i40e: Cleanup PTP pins on probe failure
    - audit: fix incorrect inheritable capability in CAPSET records
    - netfilter: nft_ct: fix missing expect put in obj eval
    - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
    - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
    - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
    - KVM: x86: Fix Xen hypercall tracepoint argument assignment
    - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
    - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
    - ceph: fix a buffer leak in __ceph_setxattr()
    - powerpc/warp: Fix error handling in pika_dtm_thread
    - libceph: Fix potential out-of-bounds access in osdmap_decode()
    - libceph: Fix potential null-ptr-deref in decode_choose_args()
    - libceph: Fix potential out-of-bounds access in crush_decode()
    - libceph: handle rbtree insertion error in decode_choose_args()
    - iommu/vt-d: Disable DMAR for Intel Q35 IGFX
    - drm/i915: skip __i915_request_skip() for already signaled requests
    - drm/panfrost: Fix wait_bo ioctl leaking positive return from
      dma_resv_wait_timeout()
    - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
    - s390/debug: Reject zero-length input before trimming a newline
    - Revert "x86/vdso: Fix output operand size of RDPID"
    - sysfs: don't remove existing directory on update failure
    - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
    - ALSA: ua101: Reject too-short USB descriptors
    - ALSA: asihpi: Fix potential OOB array access at reading cache
    - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    - Bluetooth: bnep: Fix UAF read of dev->name
    - phonet/pep: disable BH around forwarded sk_receive_skb()
    - net: bcmgenet: keep RBUF EEE/PM disabled
    - netfilter: ip6t_hbh: reject oversized option lists
    - netfilter: nf_queue: hold bridge skb->dev while queued
    - netfilter: ipset: stop hash:* range iteration at end
    - ring-buffer: Fix reporting of missed events in iterator
    - vsock/vmci: fix UAF when peer resets connection during handshake
    - wifi: ath11k: clear shared SRNG pointer state on restart
    - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
    - ixgbevf: fix use-after-free in VEPA multicast source pruning
    - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    - scsi: isci: Fix use-after-free in device removal path
    - spi: sprd: fix error pointer deref after DMA setup failure
    - spi: ti-qspi: fix use-after-free after DMA setup failure
    - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
    - device property: set fwnode->secondary to NULL in fwnode_init()
    - drm/bridge: it66121: acquire reset GPIO in probe
    - drm/bridge: megachips: remove bridge when irq request fails
    - drm/amd/display: Fix integer overflow in bios_get_image()
    - drm/amd/display: Validate payload length and link_index in
      dc_process_dmub_aux_transfer_async
    - batman-adv: mcast: fix use-after-free in orig_node RCU release
    - batman-adv: clear current gateway during teardown
    - batman-adv: dat: handle forward allocation error
    - batman-adv: fix fragment reassembly length accounting
    - batman-adv: fix tp_meter counter underflow during shutdown
    - batman-adv: frag: disallow unicast fragment in fragment
    - batman-adv: bla: fix report_work leak on backbone_gw purge
    - batman-adv: tp_meter: avoid use of uninit sender vars
    - batman-adv: tt: fix negative last_changeset_len
    - batman-adv: tt: fix negative tt_buff_len
    - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
    - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
      buffer
    - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
    - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
      get_multiple
    - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
    - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
    - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
      accessors
    - firmware: arm_ffa: Check for NULL FF-A ID table while driver
      registration
    - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    - kunit: config: Enable KUNIT_DEBUGFS by default
    - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    - ARM: integrator: Fix early initialization
    - netfilter: x_tables: unregister the templates first
    - tcp: Fix imbalanced icsk_accept_queue count.
    - ice: fix locking in ice_dcb_rebuild()
    - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
      access
    - irqchip/ath79-cpu: Remove unused function
    - net: ethernet: cortina: Make RX SKB per-port
    - net: ethernet: cortina: Drop half-assembled SKB
    - net: ethernet: cortina: Carry over frag counter
    - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
    - wifi: ath11k: fix error path leaks in some WMI WOW calls
    - HID: quirks: really enable the intended work around for appledisplay
    - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
    - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
    - net: tls: prevent chain-after-chain in plain text SG
    - drm/msm/snapshot: fix dumping of the unaligned regions
    - net: dsa: mt7530: sync driver-specific behavior of MT7531 variants
    - net: dsa: mt7530: fix FDB entries not aging out with short timeout
    - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw
    - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
    - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    - net: bridge: Flush multicast groups when snooping is disabled
    - bridge: mcast: Fix a possible use-after-free when removing a bridge port
    - tracing: Avoid NULL return from hist_field_name() on truncation
    - net: ag71xx: check error for platform_get_irq
    - string: add mem_is_zero() helper to check if memory area is all zeros
    - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n)
    - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
    - net: mana: validate rx_req_idx to prevent out-of-bounds array access
    - Linux 5.15.209
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46275
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init
      paths
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-23141
    - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory
      accesses
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43052
    - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-22107
    - net: dsa: sja1105: fix kasan out-of-bounds warning in
      sja1105_table_delete_entry()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-21863
    - io_uring: prevent opcode speculation
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46274
    - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45846
    - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45844
    - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45843
    - slip: bound decode() reads against the compressed packet length
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45842
    - slip: reject VJ receive packets on instances with no rstate array
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45841
    - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45840
    - openvswitch: cap upcall PID array size and pre-size vport replies
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46319
    - net/sched: act_ct: Only release RCU read lock after ct_ft
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45839
    - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45838
    - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46214
    - vsock/virtio: fix accept queue count leak on transport mismatch
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46234
    - vsock: fix buffer size clamping order
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45836
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46231
    - batman-adv: bla: put backbone reference on failed claim hash insert
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46233
    - batman-adv: bla: only purge non-released claims
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46212
    - batman-adv: bla: prevent use-after-free when deleting claims
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46238
    - batman-adv: stop caching unowned originator pointers in BAT IV
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46206
    - batman-adv: reject new tp_meter sessions during teardown
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46198
    - batman-adv: fix integer overflow on buff_pos
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46227
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in
      SCTP_SENDALL
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46220
    - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46197
    - drm/amdkfd: validate SVM ioctl nattr against buffer size
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46209
    - drm/gem: Fix inconsistent plane dimension calculation in
      drm_gem_fb_init_with_funcs()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46230
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46219
    - spi: mpc52xx: fix use-after-free on unbind
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46236
    - media: rc: xbox_remote: heed DMA restrictions
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46205
    - staging: media: atomisp: Disallow all private IOCTLs
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46168
    - mptcp: fix scheduling with atomic in timestamp sockopt
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46189
    - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46133
    - RDMA/rxe: Reject unknown opcodes before ICRC processing
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46127
    - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46178
    - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46112
    - RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46304
    - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46161
    - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46124
    - isofs: validate block number from NFS file handle in isofs_export_iget
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46303
    - isofs: validate Rock Ridge CE continuation extent against volume size
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46294
    - dm: fix a buffer overflow in ioctl processing
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46107
    - dm-thin: fix metadata refcount underflow
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46301
    - spi: topcliff-pch: fix use-after-free on unbind
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46273
    - ibmveth: Disable GSO for packets with small MSS
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43502
    - net/rds: handle zerocopy send cleanup before the message is queued
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46120
    - ip6_gre: Use cached t->net in ip6erspan_changelink().
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46184
    - sound: ua101: fix division by zero at probe
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46132
    - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
      rtnl_fill_vfinfo
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46150
    - fanotify: fix false positive on permission events
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45834
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45835
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46186
    - Bluetooth: virtio_bt: validate rx pkt_type header length
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46123
    - Bluetooth: virtio_bt: clamp rx length before skb_put
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46172
    - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46146
    - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46167
    - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46151
    - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46122
    - wifi: b43: enforce bounds check on firmware key index in b43_rx()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46307
    - wifi: ath5k: do not access array OOB
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46187
    - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46163
    - wifi: b43legacy: enforce bounds check on firmware key index in RX path
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46044
    - ipmi:ssif: Clean up kthread on errors
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43496
    - net/sched: sch_red: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-56727
    - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31489
    - spi: meson-spicc: Fix double-put in remove path
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31476
    - ksmbd: do not expire session on binding failure
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43497
    - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46108
    - ipmi:si: Return state to normal if message allocation fails
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46128
    - ipmi: Check event message buffer response for bad data
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46177
    - ipmi: Add limits to event and receive message requests
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46149
    - scsi: target: configfs: Bound snprintf() return in
      tg_pt_gp_members_show()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46101
    - netfilter: reject zero shift in nft_bitwise
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46099
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46033
    - crypto: authencesn - reject short ahash digests during instance creation
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46062
    - ntfs3: fix integer overflow in run_unpack() volume boundary check
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46072
    - ntfs3: add buffer boundary checks to run_unpack()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46023
    - dm mirror: fix integer overflow in create_dirty_log()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46077
    - crypto: atmel-tdes - fix DMA sync direction
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45986
    - crypto: ccree - fix a memory leak in cc_mac_digest()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46019
    - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46015
    - tcp: call sk_data_ready() after listener migration
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46040
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked()
      fails
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46070
    - md/raid5: validate payload size before accessing journal metadata
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46051
    - md/raid5: fix soft lockup in retry_aligned_read()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46046
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46285
    - mtd: docg3: fix use-after-free in docg3_release()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46082
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45987
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46024
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46037
    - ipv4: icmp: validate reply type before using icmp_pointers
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46027
    - net/smc: avoid early lgr access in smc_clc_wait_msg
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46053
    - net: rds: fix MR cleanup on copy error
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46004
    - ALSA: caiaq: Handle probe errors properly
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46050
    - md/raid10: fix deadlock with check operation and nowait requests
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46049
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46002
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46047
    - net: qrtr: ns: Fix use-after-free in driver remove()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46009
    - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46102
    - net: strparser: fix skb_head leak in strp_abort_strp()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46098
    - net: caif: clear client service pointer on teardown
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46088
    - ALSA: control: Validate buf_len before strnlen() in
      snd_ctl_elem_init_enum_names()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46080
    - ocfs2: split transactions in dio completion to avoid credit exhaustion
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-21739
    - scsi: ufs: core: Fix use-after free in init error and remove paths
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46064
    - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-45994
    - ibmasm: fix OOB reads in command_file_write due to missing size checks
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46022
    - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46006
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-46018
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31696
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31697
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31698
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command
      failed
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31699
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
      failed
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31701
    - ALSA: caiaq: take a reference on the USB device in create_card()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31694
    - fuse: reject oversized dirents in page cache
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31716
    - fs/ntfs3: validate rec->used in journal-replay file record check
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31676
    - rxrpc: only handle RESPONSE during service challenge
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31409
    - ksmbd: unset conn->binding on failed binding request
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2023-53596
    - drivers: base: Free devm resources when unregistering a device
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-50012
    - cpufreq: Avoid a bad reference count on CPU node
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-38192
    - net: clear the dst when changing skb protocol
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-21712
    - md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43328
    - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
      path
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-23066
    - rxrpc: Fix recvmsg() unconditional requeue
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-50248
    - ntfs3: Add bounds checking to mi_enum_attr()
    - fs/ntfs3: Sequential field availability check in mi_enum_attr()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-27407
    - fs/ntfs3: Fixed overflow check in mi_enum_attr()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2023-45896
    - fs/ntfs3: Add more attributes checks in mi_enum_attr()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2023-52737
    - btrfs: lock the inode in shared mode before starting fiemap
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-38626
    - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-68307
    - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted
      URBs
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-46770
    - ice: Add netif_device_attach/detach into PF reset flow
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-38105
    - ALSA: usb-audio: Kill timer properly at removal
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-27389
    - pstore: inode: Only d_invalidate() is needed
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2023-52682
    - f2fs: fix to wait on block writeback for post_read case
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-56719
    - net: stmmac: fix TSO DMA API usage causing oops
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-41079
    - nvmet: always initialize cqe.result
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2023-53545
    - drm/amdgpu: unmap and remove csa_va properly
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-68239
    - binfmt_misc: restore write access before closing files opened by
      open_exec()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-38659
    - gfs2: No more self recovery
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2022-49961
    - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-47809
    - dlm: fix possible lkb_resource null dereference
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-38250
    - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43281
    - mailbox: Prevent out-of-bounds access in of_mbox_index_xlate()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-23157
    - btrfs: do not strictly require dirty metadata threshold for metadata
      writepages
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-23141
    - btrfs: send: check for inline extents in range_is_hole_in_parent()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-40005
    - spi: cadence-quadspi: Implement refcount to handle unbind during busy
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2023-53629
    - fs: dlm: fix use after free in midcomms commit
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-71221
    - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-23204
    - net/sched: cls_u32: use skb_header_pointer_careful()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-71161
    - dm-verity: disable recursive forward error correction
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2022-50552
    - blk-mq: use quiesced elevator switch when reinitializing queues
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-36922
    - wifi: iwlwifi: read txq->read_ptr under lock
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-53221
    - f2fs: fix null-ptr-deref in f2fs_submit_page_bio()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-56657
    - ALSA: control: Avoid WARN() for symlink errors
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2022-49803
    - netdevsim: Fix memory leak of nsim_dev->fa_cookie
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2022-50116
    - tty: n_gsm: fix deadlock and link starvation in outgoing data path
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31586
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31598
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31642
    - rxrpc: Fix call removal to use RCU safe deletion
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31664
    - xfrm: clear trailing padding in build_polexpire()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43075
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43076
    - ocfs2: validate inline data i_size during inode read
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-23444
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2025-38710
    - gfs2: Validate i_depth for exhash directories
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-23442
    - ipv6: add NULL checks for idev in SRv6 paths
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31594
    - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2022-50073
    - net: tap: NULL pointer derefence in dev_parse_header_protocol when
      skb->dev is null
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31576
    - media: hackrf: fix to not free memory after the device is registered in
      hackrf_probe()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43058
    - media: vidtv: fix pass-by-value structs causing MSAN warnings
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31577
    - nilfs2: fix NULL i_assoc_inode dereference in
      nilfs_mdt_save_to_shadow_map
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31578
    - media: as102: fix to not free memory after the device is registered in
      as102_usb_probe()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31580
    - bcache: fix cached_dev.sb_bio use-after-free and crash
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31581
    - ALSA: 6fire: fix use-after-free on disconnect
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31583
    - media: em28xx: fix use-after-free in em28xx_v4l2_open()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31585
    - media: vidtv: fix nfeeds state corruption on start_streaming failure
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31686
    - mm/kasan: fix double free for kasan pXds
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31588
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31630
    - rxrpc: proc: size address buffers for %pISpc output
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-23399
    - nf_tables: nft_dynset: fix possible stateful expression memleak in error
      path
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2024-35865
    - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31590
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31596
    - ocfs2: handle invalid dinode in ocfs2_group_extend
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31597
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31599
    - media: vidtv: fix NULL pointer dereference in
      vidtv_channel_pmt_match_sections
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31602
    - ALSA: ctxfi: Limit PTP to a single page
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31603
    - staging: sm750fb: fix division by zero in ps_to_hz()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31605
    - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31615
    - usb: gadget: renesas_usb3: validate endpoint index in standard request
      handlers
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31616
    - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31617
    - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31618
    - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31619
    - ALSA: fireworks: bound device-supplied status before string array lookup
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31622
    - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31623
    - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31624
    - HID: core: clamp report_size in s32ton() to avoid undefined shift
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31625
    - HID: alps: fix NULL pointer dereference in alps_raw_event()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31626
    - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31627
    - i2c: s3c24xx: check the size of the SMBUS message before using it
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31532
    - can: raw: fix ro->uniq use-after-free in raw_rcv()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31629
    - nfc: llcp: add missing return after LLCP_CLOSED checks
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31407
    - netfilter: conntrack: add missing netlink policy validations
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43079
    - perf/x86/intel/uncore: Skip discovery table for offline dies
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43080
    - l2tp: Drop large packets with UDP encap
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31673
    - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31681
    - netfilter: xt_multiport: validate range encoding in checkentry
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43085
    - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43089
    - xfrm_user: fix info leak in build_mapping()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43093
    - xsk: tighten UMEM headroom validation to account for tailroom and min
      frame
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43098
    - nfc: s3fwrn5: allocate rx skb before consuming bytes
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43099
    - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43103
    - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-31684
    - net: sched: act_csum: validate nested VLAN headers
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43074
    - eventpoll: defer struct eventpoll free to RCU grace period
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43104
    - drm/vc4: Fix a memory leak in hang state error path
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43105
    - drm/vc4: Fix memory leak of BO array in hang state
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43110
    - wifi: brcmfmac: validate bsscfg indices in IF events
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43111
    - HID: roccat: fix use-after-free in roccat_report_event
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43112
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
  * Jammy update: v5.15.209 upstream stable release (LP: #2156901) //
    CVE-2026-43113
    - wifi: wl1251: validate packet IDs before indexing tx_frames
  * Jammy update: v5.15.207 upstream stable release (LP: #2156629)
    - Buffer overflow in drivers/xen/sys-hypervisor.c
    - xen/privcmd: fix double free via VMA splitting
    - Linux 5.15.204
    - Linux 5.15.205
    - Linux 5.15.206
    - Linux 5.15.207
  * Jammy update: v5.15.207 upstream stable release (LP: #2156629) //
    CVE-2025-54518 // CVE-2026-46174
    - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op
      cache
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550)
    - ARM: clean up the memset64() C wrapper
    - Revert "UBUNTU: SAUCE: Fix skb_vlan_inet_prepare() usage"
    - ip6_tunnel: Fix usage of skb_vlan_inet_prepare()
    - scsi: lpfc: Properly set WC for DPP mapping
    - scsi: ufs: core: Always initialize the UIC done completion
    - scsi: ufs: core: Move link recovery for hibern8 exit failure to
      wl_resume
    - ALSA: usb-audio: Cap the packet size pre-calculations
    - ALSA: usb-audio: Use inclusive terms
    - btrfs: fix incorrect key offset in error message in
      check_dev_extent_item()
    - memory: mtk-smi: Convert to platform remove callback returning void
    - ARM: OMAP2+: add missing of_node_put before break and return
    - ARM: omap2: Fix reference count leaks in omap_control_init()
    - scsi: ata: Call scsi_done() directly
    - ata: libata-scsi: drop DPRINTK calls for cdb translation
    - ata: libata: remove pointless VPRINTK() calls
    - ata: libata-scsi: refactor ata_scsi_translate()
    - drm/tegra: dsi: fix device leak on probe
    - mfd: qcom-pm8xxx: switch away from using chained IRQ handlers
    - mfd: qcom-pm8xxx: Convert to platform remove callback returning void
    - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
    - mfd: omap-usb-host: Convert to platform remove callback returning void
    - mfd: omap-usb-host: Fix OF populate on driver rebind
    - clk: tegra: tegra124-emc: fix device leak on set_rate()
    - usb: cdns3: remove redundant if branch
    - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
    - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
    - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
      induced race
    - fbcon: Use delayed work for cursor
    - fbcon: Extract fbcon_open/release helpers
    - fbcon: move more common code into fb_open()
    - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
    - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
    - eventpoll: Fix integer overflow in ep_loop_check_proc()
    - platform/x86: dell-wmi: Add audio/mic mute key codes
    - selftests: mptcp: more stable simult_flows tests
    - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
    - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling
      in ALE table
    - net: dpaa2: replace dpaa2_mac_is_type_fixed() with
      dpaa2_mac_is_type_phy()
    - net: dpaa2-switch: assign port_priv->mac after dpaa2_mac_connect() call
    - net: dpaa2-switch replace direct MAC access with
      dpaa2_switch_port_has_mac()
    - net: dpaa2-switch: serialize changes to priv->mac with a mutex
    - dpaa2-switch: do not clear any interrupts automatically
    - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ
      handler
    - indirect_call_wrapper: do not reevaluate function pointer
    - xen/acpi-processor: fix _CST detection using undersized evaluation
      buffer
    - amd-xgbe: fix sleep while atomic on suspend/resume
    - net: nfc: nci: Fix zero-length proprietary notifications
    - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
    - net: stmmac: Fix error handling in VLAN add and delete paths
    - ACPI: PM: Save NVS memory on Lenovo G70-35
    - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
    - scsi: ses: Fix devices attaching to different hosts
    - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
    - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
    - powerpc/uaccess: Fix inline assembly for clang build on PPC32
    - remoteproc: sysmon: Correct subsys_name_len type in QMI request
    - remoteproc: mediatek: Unprepare SCP clock during system suspend
    - powerpc: 83xx: km83xx: Fix keymile vendor prefix
    - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
    - ASoC: soc-core: drop delayed_work_pending() check before flush
    - ASoC: soc-core: accept zero format at snd_soc_runtime_set_dai_fmt()
    - ASoC: core: Exit all links before removing their components
    - ASoC: core: Do not call link_exit() on uninitialized rtd objects
    - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
      value
    - regulator: pca9450: Make IRQ optional
    - regulator: pca9450: Correct interrupt type
    - sched: idle: Make skipping governor callbacks more consistent
    - i40e: fix src IP mask checks and memcpy argument names in cloud filter
    - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
    - ASoC: detect empty DMI strings
    - octeontx2-af: devlink: fix NIX RAS reporter recovery condition
    - net: usb: lan78xx: fix silent drop of packets with checksum errors
    - net: usb: lan78xx: skip LTM configuration for LAN7850
    - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
    - usb: misc: uss720: properly clean up reference in uss720_probe()
    - usb: core: don't power off roothub PHYs if phy_set_mode() fails
    - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
    - USB: usbcore: Introduce usb_bulk_msg_killable()
    - usb: mdc800: handle signal and read racing
    - mm/tracing: rss_stat: ensure curr is false from kthread context
    - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
    - libceph: reject preamble if control segment is empty
    - libceph: admit message frames only in CEPH_CON_S_OPEN state
    - time: add kernel-doc in time.c
    - time/jiffies: Mark jiffies_64_to_clock_t() notrace
    - device property: Allow secondary lookup in fwnode_get_next_child_node()
    - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS
      supports
    - net: mana: Ring doorbell at 4 CQ wraparounds
    - ice: fix retry for AQ command 0x06EE
    - parisc: Increase initial mapping to 64 MB with KALLSYMS
    - parisc: Fix initial page table creation for boot
    - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
    - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
    - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
    - lib/bootconfig: fix snprintf truncation check in
      xbc_node_compose_key_after()
    - lib/bootconfig: check bounds before writing in __xbc_open_brace()
    - btrfs: abort transaction on failure to update root in the received
      subvol ioctl
    - iio: dac: ds4424: reject -128 RAW value
    - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
    - iio: potentiometer: mcp4131: fix double application of wiper shift
    - iio: chemical: bme680: Fix measurement wait duration calculation
    - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
    - iio: imu: inv_icm42600: fix odr switch to the same value
    - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
    - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
    - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
    - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
    - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
    - mmc: sdhci: fix timing selection for 1-bit bus width
    - mtd: rawnand: pl353: make sure optimal timings are applied
    - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
      cadence_nand_init()
    - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
    - serial: 8250_pci: add support for the AX99100
    - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
      BUSY
    - serial: uartlite: fix PM runtime usage count underflow on probe
    - drm/radeon: apply state adjust rules to some additional HAINAN vairants
    - mm/hugetlb: make detecting shared pte more reliable
    - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
    - mm/hugetlb: fix two comments related to huge_pmd_unshare()
    - mm/rmap: fix two comments related to huge_pmd_unshare()
    - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using
      mmu_gather
    - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz
    - net: Handle napi_schedule() calls from non-interrupt
    - ext4: always allocate blocks only from groups inode can use
    - wifi: cfg80211: move scan done work to wiphy work
    - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
    - mptcp: pm: avoid sending RM_ADDR over same subflow
    - btrfs: tree-checker: fix misleading root drop_level error message
    - of: Add cleanup.h based auto release via __free(device_node) markings
    - firmware: arm_scpi: Fix device_node reference leak in probe path
    - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
    - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
    - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
    - Bluetooth: qca: fix ROM version reading on WCN3998 chips
    - netfilter: xt_time: use unsigned int for monthday bit shift
    - net: bcmgenet: increase WoL poll timeout
    - net: mana: Improve the HWC error handling
    - sched: idle: Consolidate the handling of two special cases
    - igc: fix missing update of skb->tail in igc_xmit_frame()
    - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
      headroom
    - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
    - net: macb: fix uninitialized rx_fs_lock
    - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
    - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
    - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
    - mtd: rawnand: brcmnand: skip DMA during panic write
    - lib/bootconfig: check xbc_init_node() return in override path
    - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
    - sh: platform_early: remove pdev->driver_override check
    - bpf: Release module BTF IDR before module unload
    - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list
    - nvme-pci: cap queue creation to used queues
    - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16
      Gen 1
    - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
      touchscreen on SUPI S10
    - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
    - net: usb: r8152: add TRENDnet TUC-ET2G
    - HID: mcp2221: cancel last I2C command on read error
    - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()
    - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()
    - dma-buf: Include ioctl.h in UAPI header
    - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
    - xfrm: call xdo_dev_state_delete during state update
    - xfrm: Fix the usage of skb->sk
    - can: statistics: add missing atomic access in hot path
    - pinctrl: mediatek: common: Fix probe failure for devices without EINT
    - ionic: fix persistent MAC address override on PF
    - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
    - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen
    - net: enetc: fix the output issue of 'ethtool --show-ring'
    - dma-mapping: add missing `inline` for `dma_free_attrs`
    - netlink: introduce NLA_POLICY_MAX_BE
    - netfilter: nft_payload: reject out-of-range attributes via policy
    - netlink: hide validation union fields from kdoc
    - netlink: introduce bigendian integer types
    - netlink: allow be16 and be32 types in all uint policy checks
    - regmap: Synchronize cache for the page selector
    - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
    - RDMA/irdma: Update ibqp state to error if QP is already in error state
    - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
    - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
    - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
    - RDMA/irdma: Return EINVAL for invalid arp index error
    - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
    - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size
    - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
    - ASoC: Intel: catpt: Fix the device initialization
    - ACPICA: include/acpi/acpixf.h: Fix indentation
    - ACPICA: Allow address_space_handler Install and _REG execution as 2
      separate steps
    - ACPI: EC: Fix EC address space handler unregistration
    - ACPI: EC: Fix ECDT probe ordering issues
    - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
    - sysctl: fix uninitialized variable in proc_do_large_bitmap
    - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value
    - ASoC: adau1372: Fix clock leak on PLL lock failure
    - s390/barrier: Make array_index_mask_nospec() __always_inline
    - cpufreq: conservative: Reset requested_freq on limits change
    - alarmtimer: Fix argument order in alarm_timer_forward()
    - scsi: ses: Handle positive SCSI error from ses_recv_diag()
    - jbd2: gracefully abort on checkpointing state corruptions
    - ext4: make recently_deleted() properly work with lazy itable
      initialization
    - phy: ti: j721e-wiz: Fix device node reference leak in
      wiz_get_lane_phy_types()
    - dmaengine: xilinx: xilinx_dma: Fix dma_device directions
    - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
    - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction
    - btrfs: fix super block offset in error message in btrfs_validate_super()
    - btrfs: fix lost error when running device stats on multiple devices fs
    - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API
    - dmaengine: idxd: Fix freeing the allocated ida too late
    - dmaengine: xilinx_dma: Program interrupt delay timeout
    - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
    - btrfs: don't take device_list_mutex when querying zone info
    - objtool: Fix Clang jump table detection
    - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix
      common property warning
    - tg3: Fix race for querying speed/duplex
    - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
    - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
    - net/mlx5: Avoid "No data available" when FW version queries fail
    - net: hsr: fix VLAN add unwind on slave errors
    - hwmon: (pxe1610) Check return value of page-select write in probe
    - hwmon: (tps53679) Fix device ID comparison and printing in
      tps53676_identify()
    - hwmon: (occ) Fix missing newline in occ_show_extended()
    - riscv: kgdb: fix several debug register assignment bugs
    - USB: serial: option: add MeiG Smart SRM825WN
    - MIPS: Fix the GCC version check for `__multi3' workaround
    - drm/ast: dp501: Fix initialization of SCU2C
    - USB: serial: io_edgeport: add support for Blackbox IC135A
    - USB: serial: option: add support for Rolling Wireless RW135R-GL
    - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
    - Input: synaptics-rmi4 - fix a locking bug in an error path
    - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk
      table
    - Input: xpad - add support for Razer Wolverine V3 Pro
    - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
    - iio: light: vcnl4035: fix scan buffer on big-endian
    - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
    - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
    - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
    - usb: ehci-brcm: fix sleep during atomic
    - nvmet-tcp: fix use-before-check of sg in bounds validation
    - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
    - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
    - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver
      data
    - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
    - cdc-acm: new quirk for EPSON HMD
    - thunderbolt: Fix property read in nhi_wake_supported()
    - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
      partial transfer
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
      usb_submit_urb() error
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
    - Input: uinput - take event lock when submitting FF request "event"
    - media: uvcvideo: Use heuristic to find stream entity
    - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
    - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
    - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation
      failure
    - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
    - netlink: add nla be16/32 types to minlen array
    - xen/privcmd: unregister xenstore notifier on module exit
    - Revert "mptcp: add needs_id for netlink appending addr"
    - ext4: fix the might_sleep() warnings in kvfree()
    - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
    - dmaengine: sh: rz-dmac: Protect the driver specific lists
    - net: macb: Move devm_{free,request}_irq() out of spin lock area
    - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
    - i2c: cp2615: replace deprecated strncpy with strscpy
    - io_uring/poll: correctly handle io_poll_add() return value on update
    - Linux 5.15.203
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-71150
    - ksmbd: Fix refcount leak when invalid session is found on session lookup
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23395
    - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31549
    - i2c: cp2615: fix serial string NULL-deref at probe
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31433
    - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31480
    - tracing: Fix potential deadlock in cpu hotplug with osnoise
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31466
    - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43054
    - scsi: target: tcm_loop: Drain commands in target_reset handler
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23401
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO
      SPTE
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31454
    - xfs: save ailp before dropping the AIL lock in push callbacks
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31446
    - ext4: fix use-after-free in update_super_work when racing with umount
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31450
    - ext4: publish jinode after initialization
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31726
    - usb: gadget: uvc: fix NULL pointer dereference during unbind race
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31728
    - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31721
    - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31670
    - net: rfkill: prevent unlimited numbers of rfkill events from being
      created
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31634
    - rxrpc: fix reference count leak in rxrpc_server_keyring()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31651
    - mmc: vub300: fix NULL-deref on disconnect
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31656
    - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31658
    - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31660
    - nfc: pn533: allocate rx skb before consuming bytes
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31661
    - wifi: brcmsmac: Fix dma_free_coherent() size
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31662
    - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31665
    - netfilter: nft_ct: fix use-after-free in timeout object destroy
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2024-56557
    - iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2024-36898
    - gpiolib: cdev: fix uninitialised kfifo
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-40016
    - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31667
    - Input: uinput - fix circular locking dependency with ff-core
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31671
    - xfrm_user: fix info leak in build_report()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31672
    - wifi: rt2x00usb: fix devres lifetime
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43336
    - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31695
    - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2024-56584
    - io_uring/tctx: work around xa_store() allocation error issue
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31720
    - usb: gadget: f_uac1_legacy: validate control request size
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43342
    - usb: gadget: f_rndis: Protect RNDIS options with mutex
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43343
    - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-68256
    - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-40103
    - smb: client: Fix refcount leak for cifs_sb_tlink
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-38006
    - net: mctp: Don't access ifa_index when missing
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-40323
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23031
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43324
    - USB: dummy-hcd: Fix interrupt synchronization error
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43327
    - USB: dummy-hcd: Fix locking/synchronization error
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31737
    - net: ftgmac100: fix ring allocation unwind on open failure
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31738
    - vxlan: validate ND option lengths in vxlan_na_create
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31747
    - comedi: me4000: Fix potential overrun of firmware buffer
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31748
    - comedi: me_daq: Fix potential overrun of firmware buffer
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31749
    - comedi: ni_atmio16d: Fix invalid clean-up after failed attach
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43340
    - comedi: Reinit dev->spinlock between attachments to low-level drivers
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31751
    - comedi: dt2815: add hardware detection to prevent crash
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31752
    - bridge: br_nd_send: validate ND option lengths
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31754
    - usb: cdns3: gadget: fix state inconsistency on gadget init failure
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31755
    - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31756
    - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in
      dwc2_hsotg_udc_stop()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31758
    - usb: usbtmc: Flush anchored URBs in usbtmc_release
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31759
    - usb: ulpi: fix double free in ulpi_register_interface() error path
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31761
    - iio: gyro: mpu3050: Move iio_device_register() to correct location
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31762
    - iio: gyro: mpu3050: Fix irq resource leak
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31763
    - iio: gyro: mpu3050: Fix incorrect free_irq() variable
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31770
    - hwmon: (occ) Fix division by zero in occ_show_power_1()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43334
    - Bluetooth: SMP: force responder MITM requirements before building the
      pairing response
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31773
    - Bluetooth: SMP: derive legacy responder STK authentication from MITM
      state
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31776
    - ALSA: ctxfi: Fix missing SPDIFI1 index handling
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31778
    - ALSA: caiaq: fix stack out-of-bounds read in init_card
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31780
    - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31781
    - drm/ioc32: stop speculation on the drm_compat_ioctl path
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43333
    - bpf: reject direct access to nullable PTR_TO_BUF pointers
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31415
    - ipv6: avoid overflows in ip6_datagram_send_ctl()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31422
    - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31421
    - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31417
    - net/x25: Fix overflow when accumulating packets
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43014
    - net: macb: properly unregister fixed rate clocks
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43015
    - net: macb: fix clk handling on PCI glue driver removal
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31425
    - rds: ib: reject FRMR registration before IB connection is established
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43020
    - Bluetooth: MGMT: validate LTK enc_size on load
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43024
    - netfilter: nf_tables: reject immediate NF_QUEUE verdict
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31424
    - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
      for NFPROTO_ARP
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43026
    - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43027
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43028
    - netfilter: x_tables: ensure names are nul-terminated
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31416
    - netfilter: nfnetlink_log: account for netlink header size
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43329
    - netfilter: flowtable: strictly check for maximum number of actions
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31680
    - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43030
    - bpf: Fix regsafe() for pointers to packet
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43032
    - NFC: pn533: bound the UART receive buffer
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43035
    - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to
      zero to prevent an info-leak
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43339
    - ipv6: prevent possible UaF in addrconf_permanent_addr()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31423
    - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43040
    - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX
      fields to zero to prevent an info-leak
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43041
    - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory
      leak
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43043
    - crypto: af-alg - fix NULL pointer dereference in scatterwalk
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43046
    - btrfs: reject root items with drop_progress and zero drop_level
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43047
    - HID: multitouch: Check to ensure report responses match the request
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43050
    - atm: lec: fix use-after-free in sock_def_readable()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43051
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31555
    - futex: Clear stale exiting pointer in futex_lock_pi() retry path
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43065
    - ext4: always drain queued discard work in ext4_mb_release()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43066
    - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31447
    - ext4: reject mount if bigalloc with s_first_data_block != 0
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43068
    - ext4: avoid allocate block from corrupted group in
      ext4_mb_find_by_goal()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31452
    - ext4: convert inline data to extents when truncate exceeds inline size
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31455
    - xfs: stop reclaim before pushing AIL during unmount
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31464
    - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31467
    - erofs: add GFP_NOIO in the bio completion if needed
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31469
    - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
      napi_tx is false
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31473
    - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31570
    - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31483
    - s390/syscalls: Add spectre boundary for syscall dispatch table
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31485
    - spi: spi-fsl-lpspi: fix teardown order issue (UAF)
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31565
    - RDMA/irdma: Fix deadlock during netdev reset with active connections
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31494
    - net: macb: use the current queue number for stats
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31495
    - netfilter: ctnetlink: use netlink policy range checks
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31427
    - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
      process_sdp
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31674
    - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31428
    - netfilter: nfnetlink_log: fix uninitialized padding leak in
      NFULA_PAYLOAD
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31497
    - Bluetooth: btusb: clamp SCO altsetting table indices
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31498
    - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31507
    - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice
      pipe buffer
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31679
    - openvswitch: validate MPLS set/set_masked payload length
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31508
    - net: openvswitch: Avoid releasing netdev before teardown completes
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31509
    - nfc: nci: fix circular locking dependency in nci_close_device
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31510
    - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43069
    - Bluetooth: hci_ll: Fix firmware leak on error path
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31408
    - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
      sock_hold
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31512
    - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
      l2cap_ecred_data_rcv()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31515
    - af_key: validate families in pfkey_send_migrate()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31518
    - esp: fix skb leak with espintcp and async crypto
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31521
    - module: Fix kernel panic when a symbol st_shndx is out of bounds
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31522
    - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31523
    - nvme-pci: ensure we're polling a polled queue
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31524
    - HID: asus: avoid memory leak in asus_report_fixup()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31788
    - xen/privcmd: restrict usage in unprivileged domU
    - xen/privcmd: add boot control for restricted usage in domU
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31540
    - drm/i915/gt: Check set_default_submission() before deferencing
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23434
    - mtd: rawnand: serialize lock/unlock against other NAND operations
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23398
    - icmp: fix NULL pointer dereference in icmp_tag_validation()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23438
    - net: mvpp2: guard flow control update with global_tx_fc in buffer
      switching
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23397
    - nfnetlink_osf: validate individual option lengths in fingerprints
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31546
    - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23439
    - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23396
    - wifi: mac80211: fix NULL deref in mesh_matches_local()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23446
    - net: usb: aqc111: Do not perform PM inside suspend callback
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23452
    - PM: runtime: Fix a race condition related to device removal
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23454
    - net: mana: fix use-after-free in mana_hwc_destroy_channel() by
      reordering teardown
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23391
    - netfilter: xt_CT: drop pending enqueued packets on template removal
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43060
    - netfilter: nft_ct: drop pending enqueued packets on removal
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-68206
    - netfilter: nft_ct: add seqadj extension for natted connections
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23456
    - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23457
    - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
      sip_help_tcp()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23458
    - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-39764
    - netfilter: ctnetlink: remove refcounting in expectation dumpers
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23460
    - net/rose: fix NULL pointer dereference in rose_transmit_link on
      reconnect
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23462
    - Bluetooth: HIDP: Fix possible UAF
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31551
    - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23463
    - soc: fsl: qbman: fix race condition in qman_destroy_fq
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31683
    - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31550
    - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23368
    - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23303
    - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23335
    - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23336
    - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23281
    - wifi: libertas: fix use-after-free in lbs_free_adapter()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-38562
    - ksmbd: fix null pointer dereference error in generate_encryptionkey
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-45920
    - ext4: fix dirtyclusters double decrement on fs shutdown
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-45899
    - ext4: drop extent cache when splitting extent fails
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-45985
    - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
      I/O
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-45924
    - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23227
    - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
      variables related to memory alloc/free
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-45958
    - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-45956
    - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in
      vidi_connection_ioctl()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23100
    - mm/hugetlb: fix hugetlb_pmd_shared()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43061
    - serial: 8250: Fix TX deadlock when using DMA
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23474
    - mtd: Avoid boot crash in RedBoot partition table parser
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31393
    - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43062
    - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31396
    - net: macb: fix use-after-free access to PTP clock
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31545
    - NFC: nxp-nci: allow GPIOs to sleep
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31399
    - nvdimm/bus: Fix potential use after free in asynchronous initialization
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31400
    - sunrpc: fix cache_request leak in cache_release
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2024-46715
    - driver: iio: add missing checks on iio_info's callback access
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23113
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-39748
    - bpf: Forget ranges when refining tnum after JSET
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43357
    - iio: gyro: mpu3050-core: fix pm_runtime error handling
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43476
    - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43363
    - x86/apic: Disable x2apic on resume if the kernel expects so
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43365
    - xfs: fix undersized l_iclog_roundoff values
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43370
    - drm/amdgpu: Fix use-after-free race in VM acquire
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43373
    - net: ncsi: fix skb leak in error paths
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43380
    - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43381
    - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43382
    - batman-adv: Avoid double-rtnl_lock ELP metric worker
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-31405
    - media: dvb-net: fix OOB access in ULE extension header tables
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43387
    - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43386
    - staging: rtl8723bs: fix potential out-of-bounds read in
      rtw_restruct_wmm_ie
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43420
    - ceph: fix i_nlink underrun during async unlink
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43405
    - libceph: Use u32 for non-negative values in ceph_monmap_decode()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43411
    - tipc: fix divide-by-zero in tipc_sk_filter_connect()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43484
    - mmc: core: Avoid bitfield RMW for claim/retune flags
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43425
    - usb: image: mdc800: kill download URB on timeout
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43426
    - usb: renesas_usbhs: fix use-after-free in ISR during device removal
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43427
    - usb: class: cdc-wdm: fix reordering issue in read code path
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43428
    - USB: core: Limit the length of unkillable synchronous timeouts
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43429
    - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43430
    - usb: yurex: fix race in probe
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43432
    - usb: xhci: Fix memory leak in xhci_disable_slot()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43439
    - cgroup: fix race between task migration and iteration
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43480
    - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
      acquisition
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43445
    - e1000/e1000e: Fix leak in DMA error cleanup
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43449
    - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43450
    - netfilter: nfnetlink_cthelper: fix OOB read in
      nfnl_cthelper_dump_table()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43451
    - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43452
    - netfilter: x_tables: guard option walkers against 1-byte tail reads
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43453
    - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43458
    - serial: caif: hold tty->link reference in ldisc_open and ser_release
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43459
    - ASoC: soc-core: flush delayed work before removing DAIs and widgets
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23277
    - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
      slave xmit
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43466
    - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43469
    - xprtrdma: Decrement re_receiving on the early exit paths
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-54505 // CVE-2026-31628
    - x86/CPU: Fix FPDSS on Zen1
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43472
    - unshare: fix unshare_fs() handling
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43473
    - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43475
    - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23270
    - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
      blocks
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23300
    - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23293
    - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23381
    - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23372
    - nfc: rawsock: cancel tx_work before socket teardown
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23339
    - nfc: nci: free skb on nci_transceive early error paths
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23340
    - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless
      qdiscs
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23304
    - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23420
    - wifi: wlcore: Fix a locking bug
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23357
    - can: mcp251x: fix deadlock in error path of mcp251x_open
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23362
    - can: bcm: fix locking for bcm_op runtime updates
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23286
    - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23296
    - scsi: core: Fix refcount leak for tagset_refcnt
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23356
    - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23388
    - Squashfs: check metadata block offset is within range
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23379
    - net/sched: ets: fix divide by zero in the offload path
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23289
    - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23279
    - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23367
    - wifi: radiotap: reject radiotap with unknown bits
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23318
    - ALSA: usb-audio: Use correct version for UAC3 header validation
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23370
    - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23352
    - x86/efi: defer freeing of boot services memory
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23382
    - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23324
    - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23298
    - can: ucan: Fix infinite loop from zero-length messages
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23307
    - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
      message
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23290
    - net: usb: pegasus: validate USB endpoints
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23365
    - net: usb: kalmia: validate USB endpoints
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23312
    - net: usb: kaweth: validate USB endpoints
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23291
    - nfc: pn533: properly drop the usb interface reference on disconnect
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23253
    - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-43123
    - fbcon: check return value of con2fb_acquire_newinfo()
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23220
    - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
      paths
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-45911
    - usb: cdns3: fix role switching during resume
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2025-71287
    - memory: mtk-smi: fix device leak on larb probe
  * Jammy update: v5.15.203 upstream stable release (LP: #2156550) //
    CVE-2026-23359
    - bpf: Fix stack-out-of-bounds write in devmap
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272)
    - auxdisplay: arm-charlcd: fix release_mem_region() size
    - i3c: remove i2c board info from i2c_dev_desc
    - i3c: Move device name assignment after i3c_bus_init
    - fs: add <linux/init_task.h> for 'init_fs'
    - gfs2: Add metapath_dibh helper
    - btrfs: qgroup: return correct error when deleting qgroup relation item
    - md/raid10: fix any_working flag handling in raid10_sync_request
    - iomap: fix submission side handling of completion side errors
    - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
    - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
    - libbpf: Fix dumping big-endian bitfields
    - libbpf: Fix OOB read in btf_dump_get_bitfield_value
    - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable
    - crypto: cavium - fix dma_free_coherent() size
    - crypto: octeontx - fix dma_free_coherent() size
    - hrtimer: Fix trace oddity
    - crypto: hisilicon/trng - modifying the order of header files
    - crypto: hisilicon/trng - support tfms sharing the device
    - scsi: efct: Use IRQF_ONESHOT and default primary handler
    - EDAC/altera: Remove IRQF_ONESHOT
    - mfd: wm8350-core: Use IRQF_ONESHOT
    - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
    - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
    - clk: qcom: Return correct error code in qcom_cc_probe_by_index()
    - arm64: dts: qcom: sdm630: correct QFPROM byte offsets
    - arm64: dts: qcom: sdm630: fix gpu_speed_bin size
    - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
    - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
    - powerpc/uaccess: Move barrier_nospec() out of
      allow_read_{from/write}_user()
    - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
      cmd_db_dev_probe
    - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells
    - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree
      node
    - arm64: dts: amlogic: axg: assign the MMC signal clocks
    - arm64: dts: amlogic: gx: assign the MMC signal clocks
    - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks
    - arm64: dts: amlogic: g12: assign the MMC A signal clock
    - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1
    - smack: /smack/doi must be > 0
    - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
    - regulator: core: move supply check earlier in set_machine_constraints()
    - media: ccs: Accommodate C-PHY into the calculation
    - media: uvcvideo: Fix allocation for small frame sizes
    - platform/chrome: cros_ec_lightbar: Fix response size initialization
    - spi: tools: Add include folder to .gitignore
    - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
    - PCI: Do not attempt to set ExtTag for VFs
    - PCI/portdrv: Fix potential resource leak
    - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
    - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
    - tcp: tcp_tx_timestamp() must look at the rtx queue
    - wifi: ath10k: sdio: add missing lock protection in
      ath10k_sdio_fw_crashed_dump()
    - PCI: Initialize RCB from pci_configure_device()
    - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
    - bonding: only set speed/duplex to unknown, if getting speed failed
    - netfilter: nft_set_hash: fix get operation on big endian
    - ethtool: add support to set/get tx copybreak buf size via ethtool
    - net: hns3: add support to set/get tx copybreak buf size via ethtool for
      hns3 driver
    - net: hns3: remove the way to set tx spare buf via module parameter
    - net: hns3: fix ethtool tx copybreak buf size indicating not aligned
      issue
    - net: hns3: add max order judgement for tx spare buffer
    - ionic: Rate limit unknown xcvr type messages
    - octeontx2-pf: Unregister devlink on probe failure
    - RDMA/rtrs: server: remove dead code
    - IB/cache: update gid cache on client reregister event
    - RDMA/hns: Notify ULP of remaining soft-WCs during reset
    - power: supply: ab8500_bmdata: Use standard phandle
    - power: supply: ab8500: Use core battery parser
    - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
    - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
    - RDMA/rtrs-srv: Refactor the handling of failure case in map_cont_bufs
    - RDMA/rtrs-srv: Correct the checking of ib_map_mr_sg
    - RDMA/rtrs-srv: fix SG mapping
    - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
    - crypto: ccp - Add an S4 restore flow
    - RDMA/core: Fix a couple of obvious typos in comments
    - svcrdma: Remove queue-shortening warnings
    - svcrdma: Clean up comment in svc_rdma_accept()
    - svcrdma: Increase the per-transport rw_ctx count
    - svcrdma: Reduce the number of rdma_rw contexts per-QP
    - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
    - mtd: parsers: ofpart: fix OF node refcount leak in
      parse_fixed_partitions()
    - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
    - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
    - nvdimm: virtio_pmem: serialize flush requests
    - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
    - clk: qcom: rcg2: compute 2d using duty fraction directly
    - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
    - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
    - clk: Move clk_{save,restore}_context() to COMMON_CLK section
    - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
    - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
    - dma: dma-axi-dmac: fix SW cyclic transfers
    - serial: imx: change SERIAL_IMX_CONSOLE to bool
    - serial: SH_SCI: improve "DMA support" prompt
    - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
    - coresight: etm3x: Fix cpulocked warning on cpuhp
    - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
    - drivers: iio: mpu3050: use dev_err_probe for regulator request
    - usb: bdc: fix sleep during atomic
    - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
    - ovl: Fix uninit-value in ovl_fill_real
    - pinctrl: qcom: Update macro name to LPI specific
    - pinctrl: qcom: Update lpi pin group custiom functions with framework
      generic functions
    - pinctrl: qcom: Extract chip specific LPASS LPI code
    - [Config] Enable CONFIG_PINCTRL_SM8250_LPASS_LPI=m
    - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
    - backlight: qcom-wled: Support ovp values for PMI8994
    - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
    - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2
    - net/rds: rds_sendmsg should not discard payload_len
    - selftests: forwarding: vxlan_bridge_1d: fix test failure with
      br_netfilter enabled
    - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
    - ipv6: fix a race in ip6_sock_set_v6only()
    - bpftool: Fix truncated netlink dumps
    - octeontx2-af: Fix default entries mcam entry action
    - apparmor: fix rlimit for posix cpu timers
    - drm/i915/acpi: free _DSM package when no connectors
    - ext4: use optimized mballoc scanning regardless of inode format
    - ata: pata_ftide010: Fix some DMA timings
    - perf callchain: Fix srcline printing with inlines
    - libperf: Don't remove -g when EXTRA_CFLAGS are used
    - libperf build: Always place libperf includes first
    - rtc: interface: Alarm race handling should not discard preceding error
    - hfsplus: fix volume corruption issue for generic/498
    - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
    - tools/power cpupower: Reset errno before strtoull()
    - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
    - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE
      is set
    - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
    - s390/perf: Disable register readout on sampling events
    - xenbus: Use .freeze/.thaw to handle xenbus devices
    - blk-mq-debugfs: add missing debugfs_mutex in
      blk_mq_debugfs_register_hctxs()
    - sparc: Synchronize user stack on fork and clone
    - sparc: don't reference obsolete termio struct for TC* constants
    - bpf: verifier improvement in 32bit shift sign extension pattern
    - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency
      on OF
    - mailbox: bcm-ferxrm-mailbox: Use default primary handler
    - char: tpm: cr50: Remove IRQF_ONESHOT
    - arm64: tegra: smaug: Add usb-role-switch support
    - parisc: Prevent interrupts during reboot
    - media: dvb-core: dmxdevfilter must always flush bufs
    - spi: stm32: fix Overrun issue at < 8bpw
    - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
    - media: omap3isp: isppreview: always clamp in preview_try_format()
    - media: omap3isp: set initial format
    - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
    - ASoC: wm8962: Don't report a microphone if it's shorted to ground on
      plug
    - media: adv7180: fix frame interval in progressive mode
    - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
    - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
    - virt: vbox: uapi: Mark inner unions in packed structs as packed
    - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
      parts
    - HID: multitouch: add eGalaxTouch EXC3188 support
    - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
    - gpio: aspeed-sgpio: Change the macro to support deferred probe
    - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
    - ASoC: es8328: Add error unwind in resume
    - modpost: Amend ppc64 save/restfpr symnames for -Os build
    - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
    - jfs: Add missing set_freezable() for freezable kthread
    - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
    - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
    - ipv6: exthdrs: annotate data-race over multiple sysctl
    - ext4: mark group add fast-commit ineligible
    - ext4: mark group extend fast-commit ineligible
    - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
    - openrisc: define arch-specific version of nop()
    - net: usb: r8152: fix transmit queue timeout
    - net: hns3: extend HCLGE_FD_AD_QID to 11 bits
    - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
    - wifi: iwlegacy: add missing mutex protection in
      il3945_store_measurement()
    - ipv4: fib: Annotate access to struct fib_alias.fa_state.
    - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
    - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
    - wifi: ath10k: fix lock protection in
      ath10k_wmi_event_peer_sta_ps_state_chg()
    - net: usb: sr9700: remove code to drive nonexistent multicast filter
    - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
    - PCI: Mark ASM1164 SATA controller to avoid bus reset
    - PCI/AER: Clear stale errors on reporting agents upon probe
    - PCI: Fix pci_slot_lock () device locking
    - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
    - PCI: Mark Nvidia GB10 to avoid bus reset
    - myri10ge: avoid uninitialized variable use
    - nfc: nxp-nci: remove interrupt trigger type
    - RDMA/rtrs-clt: For conn rejection use actual err number
    - scsi: buslogic: Reduce stack usage
    - tracing: Fix false sharing in hwlat get_sample()
    - mailbox: sprd: mask interrupts that are not handled
    - remoteproc: mediatek: Break lock dependency to `prepare_lock`
    - mailbox: sprd: clear delivery flag before handling TX done
    - clk: microchip: core: correct return value on *_get_parent()
    - m68k: nommu: fix memmove() with differently aligned src and dest for
      68000
    - staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
      failure
    - serial: 8250_dw: handle clock enable errors in runtime_resume
    - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
    - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
      termination is done
    - fix it87_wdt early reboot by reporting running timer
    - binder: don't use %pK through printk
    - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
    - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
    - Revert "mfd: da9052-spi: Change read-mask to write-mask"
    - iio: Use IRQF_NO_THREAD
    - iio: magnetometer: Remove IRQF_ONESHOT
    - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
    - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
      ntfs_read_run_nb_ra()
    - include: uapi: netfilter_bridge.h: Cover for musl libc
    - ARM: 9467/1: mm: Don't use %pK through printk
    - drm/amd/display: Avoid updating surface with the same surface under MPO
    - drm/amdgpu: Adjust usleep_range in fence wait
    - ALSA: usb-audio: Update the number of packets properly at receiving
    - drm/amdgpu: Add HAINAN clock adjustment
    - drm/radeon: Add HAINAN clock adjustment
    - btrfs: replace BUG() with error handling in __btrfs_balance()
    - lan78xx: Fix memory allocation bug
    - net: usb: lan78xx: scan all MDIO addresses on LAN7801
    - wifi: cfg80211: wext: fix IGTK key ID off-by-one
    - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
    - Bluetooth: hci_qca: Cleanup on all setup failures
    - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
    - tipc: fix duplicate publication key in tipc_service_insert_publ()
    - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
    - RDMA/efa: Fix typo in efa_alloc_mr()
    - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
    - arm64: Disable branch profiling for all arm64 code
    - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
    - media: i2c: ov5647: Correct pixel array offset
    - media: i2c: ov5647: Correct minimum VBLANK value
    - media: i2c: ov5647: Sensor should report RAW color space
    - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
    - media: i2c: ov5647: use our own mutex for the ctrl lock
    - dm-integrity: fix a typo in the code for write/discard race
    - clk: tegra: tegra124-emc: Fix potential memory leak in
      tegra124_clk_register_emc()
    - s390/pci: Handle futile config accesses of disabled devices directly
    - dm-unstripe: fix mapping bug when there are multiple targets in a table
    - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
    - media: venus: vdec: fix error state assignment for zero bytesused
    - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
    - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
    - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
    - xfs: mark data structures corrupt on EIO and ENODATA
    - xfs: fix remote xattr valuelblk check
    - nfsd: fix return error code for nfsd_map_name_to_[ug]id
    - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
    - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
    - dm mpath: make pg_init_delay_msecs settable
    - iio: gyro: itg3200: Fix unchecked return value in read_raw
    - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
    - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
    - btrfs: continue trimming remaining devices on failure
    - usb: dwc2: fix resume failure if dr_mode is host
    - mtd: rawnand: pl353: Fix software ECC support
    - tipc: fix RCU dereference race in tipc_aead_users_dec()
    - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe()
      error path
    - parisc: kernel: replace kfree() with put_device() in create_tree_node()
    - MIPS: rb532: Fix MMIO UART resource registration
    - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
    - tracing: Fix to set write permission to per-cpu buffer_size_kb
    - net: intel: fix PCI device ID conflict between i40e and ipw2200
    - fbdev: ffb: fix corrupted video output on Sun FFB1
    - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
    - NTB: ntb_transport: Fix too small buffer for debugfs_name
    - Linux 5.15.202
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43291
    - net: nfc: nci: Fix parameter validation for packet data
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43283
    - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43264
    - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43202
    - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43203
    - atm: fore200e: fix use-after-free in tasklets during device removal
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43149
    - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43273
    - ceph: supply snapshot context in ceph_zero_partial_object()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43159
    - staging: rtl8723bs: fix null dereference in find_network
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43211
    - PCI: Fix pci_slot_trylock() error handling
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43206
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43275
    - scsi: ufs: core: Flush exception handling work when RPM level is zero
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43145
    - remoteproc: imx_rproc: Fix invalid loaded resource table detection
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43147
    - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
      SR-IOV"
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43289
    - kexec: derive purgatory entry from symbol
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43168
    - ocfs2: fix reflink preserve cleanup issue
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43295
    - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43148
    - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43163
    - md/bitmap: fix GPF in write_page caused by resize race
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43200
    - PCI: endpoint: Fix swapped parameters in
      pci_{primary/secondary}_epc_epf_unlink() functions
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43158
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43187
    - xfs: delete attr leaf freemap entries when empty
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43130
    - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
      scalable mode
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43133
    - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43196
    - soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43242
    - soc: ti: k3-socinfo: Fix regmap leak on probe failure
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43278
    - dm: clear cloned request bio pointer when last clone bio completes
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43312
    - media: i2c: ov5647: Initialize subdev before controls
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43182
    - media: ccs: Avoid possible division by zero
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43246
    - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43218
    - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43135
    - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43257
    - media: cx88: Add missing unmap in snd_cx88_hw_params()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43231
    - media: radio-keene: fix memory leak in error path
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43136
    - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43251
    - HID: prodikeys: Check presence of pm->input_ep82
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43140
    - HID: magicmouse: Do not crash on missing msc->input
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43152
    - HID: hid-pl: handle probe errors
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43315
    - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
      succeeding
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43270
    - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43207
    - media: mtk-mdp: Fix error handling in probe function
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43132
    - dm-verity: correctly handle dm_bufio_client_create() failure
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2025-71274
    - rpmsg: core: fix race in driver_override_show() and use core helper
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43233
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43205
    - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43194
    - net: consume xmit errors of GSO frames
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43156
    - net: usb: pegasus: enable basic endpoint checking
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43232
    - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43134
    - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43180
    - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43139
    - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43141
    - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43241
    - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43279
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2025-71267
    - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2025-71265
    - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
      metadata
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2025-71266
    - fs: ntfs3: check return value of indx_find to avoid infinite loop
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43225
    - staging: rtl8723bs: fix memory leak on failure path
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43230
    - net/rds: Clear reconnect pending bit
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43296
    - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43226
    - net/rds: No shortcut out of RDS_CONN_ERROR
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43190
    - netfilter: xt_tcpmss: check remaining length before reading optlen
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43255
    - wifi: libertas: fix WARNING in usb_tx_block
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43314
    - dm: remove fake timeout to avoid leak request
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2025-71292
    - jfs: nlink overflow in jfs_rename
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43236
    - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43269
    - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43287
    - drm: Account property blob allocations to memcg
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43183
    - media: cx25821: Fix a resource leak in cx25821_dev_setup()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43316
    - media: solo6x10: Check for out of bounds chip_id
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43223
    - media: pvrusb2: fix URB leak in pvr2_send_request_ex
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43302
    - drm/v3d: Set DMA segment size to avoid debug warnings
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43124
    - pstore: ram_core: fix incorrect success return when vmap() fails
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43227
    - clocksource/drivers/sh_tmu: Always leave device running after probe
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43313
    - ACPI: processor: Fix NULL-pointer dereference in
      acpi_processor_errata_piix4()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43266
    - EFI/CPER: don't go past the ARM processor CPER record buffer
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43277
    - APEI/GHES: ensure that won't go past CPER allocated record
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43171
    - EFI/CPER: don't dump the entire memory region
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43184
    - rnbd-srv: Zero the rsp buffer before using it
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43261
    - arm64: Add support for TSV110 Spectre-BHB mitigation
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43262
    - gfs2: fiemap page fault fix
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43209
    - minix: Add required sanity checking to minix_check_superblock()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-43268
    - hfsplus: pretend special inodes as regular files
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-23241
    - audit: add missing syscalls to read class
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2025-71239
    - audit: add fchmodat2() to change attributes class
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45964
    - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45870
    - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45948
    - ext4: fix memory leak in ext4_ext_shift_extents()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45912
    - ext4: don't cache extent during splitting extent
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-46250
    - MIPS: Work around LLVM bug when gp is used as global register variable
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45974
    - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
      found
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45965
    - apparmor: fix invalid deref of rawdata when export_binary is unset
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45848
    - apparmor: fix NULL sock in aa_sock_file_perm
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45970
    - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45847
    - net: remove WARN_ON_ONCE when accessing forward path array
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45890
    - xen-netback: reject zero-queue configuration from guest
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45968
    - cpuidle: Skip governor when only one idle state is available
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45935
    - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45864
    - fs/ntfs3: prevent infinite loops caused by the next valid being the same
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45868
    - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45883
    - iio: sca3000: Fix a resource leak in sca3000_probe()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45875
    - mfd: arizona: Fix regulator resource leak on
      wm5102_clear_write_sequencer() failure
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45978
    - staging: greybus: lights: avoid NULL deref
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45954
    - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45857
    - scsi: csiostor: Fix dereference of null pointer rn
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45856
    - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45852
    - RDMA/rxe: Fix double free in rxe_srq_from_init
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45869
    - power: supply: wm97xx: Fix NULL pointer dereference in
      power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45916
    - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-46270
    - power: supply: rt9455: Fix use-after-free in power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45936
    - power: supply: goldfish: Fix use-after-free in power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45885
    - power: supply: cpcap-battery: Fix use-after-free in
      power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45879
    - power: supply: bq25980: Fix use-after-free in power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45902
    - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45867
    - power: supply: act8945a: Fix use-after-free in power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45946
    - power: supply: ab8500: Fix use-after-free in power_supply_changed()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45866
    - serial: caif: fix use-after-free in caif_serial ldisc_close()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-31411
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-46259
    - procfs: fix missing RCU protection when reading real_parent in
      do_task_stat()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45891
    - net: hns3: fix double free issue for tx spare buffer
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45873
    - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-46267
    - nfc: hci: shdlc: Stop timers and work before freeing context
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-46249
    - octeontx2-af: Fix PF driver crash with kexec kernel booting
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45915
    - fat: avoid parent link count underflow in rmdir
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45983
    - nfsd: never defer requests during idmap lookup
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45862
    - iommu/vt-d: Flush cache for PASID table before using it
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45860
    - netfilter: nf_conncount: increase the connection clean up limit to 64
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45969
    - HID: playstation: Add missing check for input_ff_create_memless
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2025-71304
    - smack: /smack/doi: accept previously used values
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45904
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event
      handling
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-46253
    - pstore/ram: fix buffer overflow in persistent_ram_save_old()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45919
    - sched/rt: Skip currently executing CPU in rto_next_cpu()
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45871
    - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45941
    - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45984
    - gfs2: Fix use-after-free in iomap inline data write path
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-45960
    - hfsplus: return error when node already exists in hfs_bnode_create
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-23243
    - RDMA/umad: Reject negative data_len in ib_umad_write
  * Jammy update: v5.15.202 upstream stable release (LP: #2156272) //
    CVE-2026-23242
    - RDMA/siw: Fix potential NULL pointer dereference in header processing
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198)
    - crypto: octeontx - Fix length check to avoid truncation in
      ucode_load_store
    - scsi: qla2xxx: Query FW again before proceeding with login
    - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    - gpio: sprd: Change sprd_gpio lock to raw_spin_lock
    - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used
    - platform/x86: panasonic-laptop: Fix sysfs group leak in error path
    - gpiolib: acpi: Fix gpio count with string references
    - Revert "wireguard: device: enable threaded NAPI"
    - selftests: mptcp: pm: ensure unknown flags are ignored
    - crypto: virtio - Remove duplicated virtqueue_kick in
      virtio_crypto_skcipher_crypt_req
    - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show
      functions
    - scsi: qla2xxx: Use named initializers for port_[d]state_str
    - scsi: qla2xxx: Remove dead code (GNN ID)
    - scsi: qla2xxx: Reduce fabric scan duplicate code
    - PCI: endpoint: Automatically create a function specific attributes group
    - PCI: endpoint: Remove unused field in struct pci_epf_group
    - USB: serial: option: add Telit FN920C04 RNDIS compositions
    - Linux 5.15.201
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23235
    - f2fs: fix out-of-bounds access in sysfs attribute read/write
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23234
    - f2fs: fix to avoid UAF in f2fs_write_end_io()
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23236
    - fbdev: smscufx: properly copy ioctl memory to kernelspace
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23266
    - fbdev: rivafb: fix divide error in nv3_arb()
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2025-71233
    - PCI: endpoint: Avoid creating sub-groups asynchronously
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2025-71232
    - scsi: qla2xxx: Free sp in error path to fix system crash
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2025-71238
    - scsi: qla2xxx: Fix bsg_done() causing double free
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23221
    - bus: fsl-mc: fix use-after-free in driver_override_show()
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23228
    - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23169
    - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2025-37786
    - net: dsa: free routing table on probe failure
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2025-68358
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23237
    - platform/x86: classmate-laptop: Add missing NULL pointer checks
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23238
    - romfs: check sb_set_blocksize() return value
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-31687
    - gpio: omap: do not register driver in probe()
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2025-71235
    - scsi: qla2xxx: Delay module unload while fabric scan in progress
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2025-71236
    - scsi: qla2xxx: Validate sp before freeing associated memory
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2025-71237
    - nilfs2: Fix potential block overflow that cause system hang
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23229
    - crypto: virtio - Add spinlock protection with virtqueue notification
  * Jammy update: v5.15.201 upstream stable release (LP: #2155198) //
    CVE-2026-23222
    - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
  * CVE-2026-23392
    - netfilter: nf_tables: register hooks last when adding new
      chain/flowtable
    - netfilter: nf_tables: release flowtable after rcu grace period on error
  * CVE-2026-45988
    - rxrpc: Fix re-decryption of RESPONSE packets
  * CVE-2026-46195
    - smb: client: validate dacloffset before building DACL pointers
  * CVE-2026-46135
    - nvmet-tcp: fix race between ICReq handling and queue teardown
  * CVE-2026-31402
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  * CVE-2026-43071
    - dcache: Limit the minimal number of bucket to two
  * CVE-2026-46119
    - libceph: Fix slab-out-of-bounds access in auth message processing
  * CVE-2026-43501
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
  * CVE-2026-46043
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
  * CVE-2026-43493
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  * CVE-2026-31637
    - rxrpc: reject undecryptable rxkad response tickets
  * CVE-2026-31657
    - batman-adv: hold claim backbone gateways by reference
  * CVE-2026-31685
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets
  * CVE-2026-43117
    - btrfs: tracepoints: get correct superblock from dentry in event
      btrfs_sync_file()
  * CVE-2026-43114
    - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on
      expiry
  * CVE-2026-31478
    - ksmbd: replace hardcoded hdr2_len with offsetof() in
      smb2_calc_max_out_buf_len()
  * CVE-2026-31668
    - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  * CVE-2026-31659
    - batman-adv: reject oversized global TT response buffers
  * CVE-2026-31649
    - net: stmmac: fix integer underflow in chain mode
  * CVE-2026-31669
    - mptcp: fix slab-use-after-free in __inet_lookup_established
  * CVE-2026-43011
    - net/x25: Fix potential double free of skb
  * CVE-2026-43037
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  * CVE-2026-43038
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
  * CVE-2026-31682
    - bridge: br_nd_send: linearize skb before parsing ND options
  * CVE-2026-23450
    - net/smc: Only save the original clcsock callback functions
    - net/smc: Fix slab-out-of-bounds issue in fallback
    - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
  * CVE-2026-23428
    - ksmbd: fix use-after-free of share_conf in compound request
  * CVE-2026-23455
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
  * CVE-2026-43186
    - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
  * CVE-2026-43185
    - ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
  * CVE-2026-43341
    - net/ipv6: ioam6: prevent schema length wraparound in trace fill
  * CVE-2026-31607
    - usbip: validate number_of_packets in usbip_pack_ret_submit()
  * CVE-2026-43383
    - net/tcp-md5: Fix MAC comparison to be constant-time
  * CVE-2025-68263
    - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
  * CVE-2026-46243
    - smb: client: reject userspace cifs.spnego descriptions
  * CVE-2026-43414
    - scsi: qla2xxx: Completely fix fcport double free
  * CVE-2026-43407
    - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  * CVE-2026-43406
    - libceph: prevent potential out-of-bounds reads in
      process_message_header()
  * CVE-2026-43304
    - libceph: define and enforce CEPH_MAX_KEY_LEN
  * CVE-2025-37924
    - ksmbd: fix use-after-free in kerberos authentication
  * CVE-2025-37778
    - ksmbd: Fix dangling pointer in krb_authenticate

 -- Ian Whitfield <ian.whitfield@canonical.com>  Wed, 01 Jul 2026 22:02:23 -0400

linux-gkeop (5.15.0-1094.102) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1094.102 -proposed tracker (LP: #2157215)

  [ Ubuntu: 5.15.0-185.195 ]

  * jammy/linux: 5.15.0-185.195 -proposed tracker (LP: #2157253)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
    - [Packaging] resync retpoline extraction
  * CVE-2026-45988
    - rxrpc: Fix re-decryption of RESPONSE packets
  * CVE-2026-46195
    - smb: client: validate dacloffset before building DACL pointers
  * CVE-2026-46135
    - nvmet-tcp: fix race between ICReq handling and queue teardown
  * CVE-2026-31402
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  * CVE-2026-43071
    - dcache: Limit the minimal number of bucket to two
  * CVE-2026-46119
    - libceph: Fix slab-out-of-bounds access in auth message processing
  * CVE-2026-43501
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
  * CVE-2026-46043
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
  * CVE-2026-43493
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
  * CVE-2026-31637
    - rxrpc: reject undecryptable rxkad response tickets
  * CVE-2026-31657
    - batman-adv: hold claim backbone gateways by reference
  * CVE-2026-31685
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets
  * CVE-2026-43117
    - btrfs: tracepoints: get correct superblock from dentry in event
      btrfs_sync_file()
  * CVE-2026-43114
    - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on
      expiry
  * CVE-2026-31478
    - ksmbd: replace hardcoded hdr2_len with offsetof() in
      smb2_calc_max_out_buf_len()
  * CVE-2026-31668
    - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  * CVE-2026-31659
    - batman-adv: reject oversized global TT response buffers
  * CVE-2026-31649
    - net: stmmac: fix integer underflow in chain mode
  * CVE-2026-31669
    - mptcp: fix slab-use-after-free in __inet_lookup_established
  * CVE-2026-43011
    - net/x25: Fix potential double free of skb
  * CVE-2026-43037
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  * CVE-2026-43038
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
  * CVE-2026-31682
    - bridge: br_nd_send: linearize skb before parsing ND options
  * CVE-2026-23450
    - net/smc: Only save the original clcsock callback functions
    - net/smc: Fix slab-out-of-bounds issue in fallback
    - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
  * CVE-2026-23428
    - ksmbd: fix use-after-free of share_conf in compound request
  * CVE-2026-23455
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
  * CVE-2026-43186
    - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
  * CVE-2026-43185
    - ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
  * CVE-2026-43341
    - net/ipv6: ioam6: prevent schema length wraparound in trace fill
  * CVE-2026-31607
    - usbip: validate number_of_packets in usbip_pack_ret_submit()
  * CVE-2026-43383
    - net/tcp-md5: Fix MAC comparison to be constant-time
  * CVE-2025-68263
    - ksmbd: ipc: fix use-after-free in ipc_msg_send_request
  * CVE-2026-46243
    - smb: client: reject userspace cifs.spnego descriptions
  * CVE-2026-43414
    - scsi: qla2xxx: Completely fix fcport double free
  * CVE-2026-43407
    - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  * CVE-2026-43406
    - libceph: prevent potential out-of-bounds reads in
      process_message_header()
  * CVE-2026-43304
    - libceph: define and enforce CEPH_MAX_KEY_LEN
  * CVE-2025-37924
    - ksmbd: fix use-after-free in kerberos authentication
  * CVE-2025-37778
    - ksmbd: Fix dangling pointer in krb_authenticate

 -- Ian Whitfield <ian.whitfield@canonical.com>  Mon, 22 Jun 2026 22:22:52 -0400

linux-gkeop (5.15.0-1093.101) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1093.101 -proposed tracker (LP: #2151969)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync retpoline extraction

  [ Ubuntu: 5.15.0-184.194 ]

  * jammy/linux: 5.15.0-184.194 -proposed tracker (LP: #2154219)
  * Kernel regression (6.8.0-117.generic) (LP: #2153556)
    - net: bonding: update the slave array for broadcast mode
    - bonding: do not set usable_slaves for broadcast mode
  * kernel null pointer BUG in 5.15 when disconnecting from cifs share
    (LP: #2150730)
    - SAUCE: cifs: fix null pointer dereference in find_ipc_from_server_path
  * SUNRPC: System wide grep leads to NULL pointer deference in sysfs reads
    (LP: #2149767)
    - SUNRPC: Check if the xprt is connected before handling sysfs reads
    - SUNRPC: Do not dereference non-socket transports in sysfs
  * SUNRPC: System wide grep leads to NULL pointer deference in sysfs reads
    (LP: #2149767) // CVE-2022-48816
    - SUNRPC: lock against ->sock changing during sysfs read
  * iptables connlimit traffic loss (LP: #2149872)
    - netfilter: nf_conncount: fix tracking of connections from localhost
  * Some powerpc test from ubuntu_kernel_selftests timeout with 45 seconds
    (LP: #2141536)
    - selftests/powerpc: Lower run time of count_stcx_fail test
    - selftests/powerpc: Give all tests 2 minutes timeout
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598)
    - x86/kfence: fix booting on 32bit non-PAE systems
    - platform/x86: intel_telemetry: Fix swapped arrays in PSS output
    - rbd: check for EOD after exclusive lock is ensured to be held
    - ARM: 9468/1: fix memset64() on big-endian
    - mm/kfence: randomize the freelist on initialization
    - Documentation: Remove bogus claim about del_timer_sync()
    - timers: Get rid of del_singleshot_timer_sync()
    - Documentation: Replace del_timer/del_timer_sync()
    - timers: Update the documentation to reflect on the new timer_shutdown()
      API
    - Bluetooth: hci_qca: Fix the teardown problem for real
    - binderfs: fix ida_alloc_max() upper bound
    - net: usb: sr9700: support devices with virtual driver CD
    - block,bfq: fix aux stat accumulation destination
    - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
    - HID: intel-ish-hid: Reset enum_devices_done before enumeration
    - HID: playstation: Center initial joystick axes to prevent spurious
      events
    - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
    - netfilter: replace -EEXIST with -EBUSY
    - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
    - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
    - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
    - wifi: mac80211: collect station statistics earlier when disconnect
    - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
    - ASoC: tlv320adcx140: Propagate error codes during probe
    - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
    - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
    - platform/x86: intel_telemetry: Fix PSS event register mask
    - tipc: use kfree_sensitive() for session key material
    - hwmon: (occ) Mark occ_init_attribute() as __printf
    - nvmet-tcp: add an helper to free the cmd buffers
    - nvmet-tcp: fix memory leak when performing a controller reset
    - nvmet-tcp: fix regression in data_digest calculation
    - nvmet-tcp: don't map pages which can't come from HIGHMEM
    - tracing: Fix ftrace event field alignments
    - gve: Correct ethtool rx_dropped calculation
    - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed
      transfer
    - spi: tegra210-quad: Move curr_xfer read inside spinlock
    - spi: tegra210-quad: Protect curr_xfer assignment in
      tegra_qspi_setup_transfer_one
    - spi: tegra210-quad: Protect curr_xfer clearing in
      tegra_qspi_non_combined_seq_xfer
    - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page()
    - riscv: Replace function-like macro by static inline function
    - Linux 5.15.200
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23182
    - spi: tegra: Fix a memory leak in tegra_slink_probe()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23202
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-71089
    - iommu: disable SVA when CONFIG_X86 is set
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2023-53673
    - Bluetooth: hci_event: call disconnect callback before deleting conn
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23262
    - gve: Fix stats report corruption on queue count change
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-40082
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-37822
    - riscv: uprobes: Add missing fence.i after building the XOL buffer
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23190
    - ASoC: amd: fix memory leak in acp3x pdm dma ops
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23111
    - netfilter: nf_tables: fix inverted genmask check in
      nft_map_catchall_activate()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23180
    - dpaa2-switch: add bounds check for if_id in IRQ handler
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23256
    - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23257
    - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23258
    - net: liquidio: Initialize netdev pointer before queue setup
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23206
    - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23176
    - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23216
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23193
    - scsi: target: iscsi: Fix use-after-free in
      iscsit_dec_session_usage_count()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-71220
    - smb/server: call ksmbd_session_rpc_close() on error path in
      create_smb2_pipe()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-71222
    - wifi: wlcore: ensure skb headroom before skb_push
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-71224
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-68214
    - timers: Fix NULL function pointer race in timer_shutdown_sync()
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2025-38201
    - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  * Jammy update: v5.15.200 upstream stable release (LP: #2147598) //
    CVE-2026-23198
    - KVM: Don't clobber irqfd routing type when deassigning irqfd
  * CVE-2026-23272
    - netfilter: nf_tables: always increment set element count
    - netfilter: nf_tables: fix set size with rbtree backend
    - netfilter: nf_tables: unconditionally bump set->nelems before insertion
  * CVE-2026-31418
    - netfilter: ipset: drop logically empty buckets in mtype_del
  * CVE-2026-23278
    - netfilter: nf_tables: always walk all pending catchall elements
  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails
  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic
  * CVE-2026-43500
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags
    - xfrm: esp: ipv4: fix up flags setting
  * CVE-2026-31419
    - net: bonding: fix use-after-free in bond_xmit_broadcast()
  * CVE-2026-31431
    - crypto: scatterwalk - Backport memcpy_sglist()
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
    - crypto: algif_aead - Revert to operating out-of-place
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: authenc - use memcpy_sglist() instead of null skcipher
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
      decryption
    - crypto: authencesn - Fix src offset when decrypting in-place
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
    - crypto: algif_aead - Fix minimum RX size check for decryption
  * CVE-2026-31533
    - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
  * CVE-2026-31504
    - net: fix fanout UAF in packet_release() via NETDEV_UP race

 -- Ian Whitfield <ian.whitfield@canonical.com>  Fri, 29 May 2026 21:43:19 -0400

linux-gkeop (5.15.0-1092.100) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1092.100 -proposed tracker (LP: #2153641)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync retpoline extraction

  [ Ubuntu: 5.15.0-181.191 ]

  * jammy/linux: 5.15.0-181.191 -proposed tracker (LP: #2153680)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
    - [Packaging] resync retpoline extraction
  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails
  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic
  * CVE-2026-43500
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags
    - xfrm: esp: ipv4: fix up flags setting

 -- Edoardo Canepa <edoardo.canepa@canonical.com>  Mon, 25 May 2026 23:36:08 +0200

linux-gkeop (5.15.0-1091.99) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1091.99 -proposed tracker (LP: #2150976)

  [ Ubuntu: 5.15.0-179.189 ]

  * jammy/linux: 5.15.0-179.189 -proposed tracker (LP: #2151014)
  * CVE-2026-31419
    - net: bonding: fix use-after-free in bond_xmit_broadcast()
  * CVE-2026-31431
    - crypto: scatterwalk - Backport memcpy_sglist()
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
    - crypto: algif_aead - Revert to operating out-of-place
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: authenc - use memcpy_sglist() instead of null skcipher
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
      decryption
    - crypto: authencesn - Fix src offset when decrypting in-place
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
    - crypto: algif_aead - Fix minimum RX size check for decryption
  * CVE-2026-31533
    - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
  * CVE-2026-31504
    - net: fix fanout UAF in packet_release() via NETDEV_UP race

 -- Tim Whisonant <tim.whisonant@canonical.com>  Wed, 06 May 2026 09:29:59 -0700

linux-gkeop (5.15.0-1090.98) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1090.98 -proposed tracker (LP: #2148417)

  [ Ubuntu: 5.15.0-178.188 ]

  * jammy/linux: 5.15.0-178.188 -proposed tracker (LP: #2148097)
  * Canonical Kmod 2025 key rotation (LP: #2147447)
    - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing
      extensible
    - [Packaging] ubuntu-compatible-signing -- allow consumption of positive
      certs
    - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key
    - [Config] prepare for Canonical Kmod key rotation
    - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key
  * ADATA SU680 causes repeated SATA resets and I/O errors on Ubuntu unless
    link power management is forced to max_performance (LP: #2144060)
    - ata: libata-core: disable LPM on ADATA SU680 SSD
  * CVE-2024-50060
    - io_uring: check if we need to reschedule during overflow flush
  * CVE-2024-35862
    - smb: client: fix potential UAF in smb2_is_network_name_deleted()
  * CVE-2026-23274
    - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
  * CVE-2026-23351
    - netfilter: nf_tables: de-constify set commit ops function argument
    - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
  * macvlan: observe an RCU grace period in macvlan_common_newlink() error
    path (LP: #2144380) // CVE-2026-23209
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path
  * CVE-2023-2640 // CVE-2023-32629
    - SAUCE: overlayfs: default to userxattr when mounted from non initial
      user namespace
  * CVE-2023-2640 // CVE-2023-2640 and CVE-2023-32629. // CVE-2023-32629
    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Skip permission checking for
      trusted.overlayfs.* xattrs"
  * CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

 -- Tim Whisonant <tim.whisonant@canonical.com>  Wed, 15 Apr 2026 13:49:40 -0700

linux-gkeop (5.15.0-1089.97) jammy; urgency=medium

  * jammy/linux-gkeop: 5.15.0-1089.97 -proposed tracker (LP: #2147800)

  [ Ubuntu: 5.15.0-177.187 ]

  * jammy/linux: 5.15.0-177.187 -proposed tracker (LP: #2147840)
  * macvlan: observe an RCU grace period in macvlan_common_newlink() error
    path (LP: #2144380) // CVE-2026-23209
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path
  * CVE-2023-2640 // CVE-2023-32629
    - SAUCE: Revert "UBUNTU: SAUCE: overlayfs: Skip permission checking for
      trusted.overlayfs.* xattrs"
    - SAUCE: overlayfs: default to userxattr when mounted from non initial
      user namespace
  * CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

 -- Tim Whisonant <tim.whisonant@canonical.com>  Tue, 14 Apr 2026 11:19:50 -0700

# For older changelog entries, run 'apt-get changelog linux-headers-5.15.0-1098-gkeop'
