linux (7.2.0-5.5) stonking; urgency=medium

  * stonking/linux: 7.2.0-5.5 -proposed tracker (LP: #2163667)

  * Miscellaneous Ubuntu changes
    - [Config] toolchain version update

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 18 Aug 2026 16:59:30 +0300

linux-unstable (7.2.0-4.4) stonking; urgency=medium

  * stonking/linux-unstable: 7.2.0-4.4 -proposed tracker (LP: #2163401)

  * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)
    - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED

  * unconfined profile denies userns_create for chromium based processes
    (LP: #1990064)
    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS

  * FFe: add network interface mediation to 26.04 (LP: #2144679)
    - SAUCE: apparmor5.1.0 [60/61]: apparmor: skb: add the ability to use
      interface in network mediation.
    - SAUCE: apparmor5.1.0 [61/61]: apparmor: skb: switch to using sk_ctx crit
      section

  * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile
    (LP: #2142956)
    - SAUCE: apparmor5.1.0 [59/61]: apparmor: skb: fix
      apparmor_secmark_check() when !inet and secmark defined.

  * update apparmor and LSM stacking patch set (LP: #2028253)
    - SAUCE: apparmor5.1.0 [1/61]: apparmor-next: apparmor: fix net.h and
      policy.h circular include pattern
    - SAUCE: apparmor5.1.0 [2/61]: apparmor-next: apparmor: make include
      headers self-contained
    - SAUCE: apparmor5.1.0 [3/61]: apparmor-next: apparmor: Initial support
      for compressed policies
    - SAUCE: apparmor5.1.0 [4/61]: apparmor-next: apparmor: fix alternate
      loaders ability to load compressed policy
    - SAUCE: apparmor5.1.0 [5/61]: apparmor-next: apparmor: replace
      decompress_zstd() prototype with its entity
    - SAUCE: apparmor5.1.0 [6/61]: apparmor-next: apparmor: leverage
      audit_log_n_untrustedstring() when possible
    - SAUCE: apparmor5.1.0 [7/61]: apparmor-next: apparmor: switch website
      link to https
    - SAUCE: apparmor5.1.0 [8/61]: apparmor-next: apparmor: compressed_data
      not described in aa_get_data_from_compressed
    - SAUCE: apparmor5.1.0 [9/61]: apparmor-next: apparmor: Fix build failure
      when ZSTD_DECOMPRESS is not enabled
    - SAUCE: apparmor5.1.0 [10/61]: apparmor-next: apparmor: fix implicit
      declaration of function 'decompress_zstd'
    - SAUCE: apparmor5.1.0 [11/61]: apparmor-next: apparmor: Fix warning:
      'decompress_zstd' defined but not used
    - SAUCE: apparmor5.1.0 [12/61]: apparmor-next: apparmor: use
      SEND_SIG_NOINFO instead of NULL in aa_audit()
    - SAUCE: apparmor5.1.0 [13/61]: apparmor-next: apparmor: fix cred UAF
      caused by begin_current_label_crit_section()
    - SAUCE: apparmor5.1.0 [14/61]: apparmor-next: apparmor: optimize
      current_label_crit_section() with needput
    - SAUCE: apparmor5.1.0 [15/61]: apparmor-next: apparmor: fix integer
      overflow in verify_tags() bounds check
    - SAUCE: apparmor5.1.0 [16/61]: apparmor-next: apparmor: fix out-of-bounds
      write when null terminating a label vec
    - SAUCE: apparmor5.1.0 [17/61]: apparmor-next: apparmor: fix error
      handling for copy_from_user in policy_update
    - SAUCE: apparmor5.1.0 [18/61]: apparmor-next: apparmor: make
      MEDIATES_AF_UNIX its own fn
    - SAUCE: apparmor5.1.0 [19/61]: apparmor-next: apparmor: refactor network
      sock mediation in preparation for inet mediation
    - SAUCE: apparmor5.1.0 [20/61]: apparmor-next: apparmor: push inet
      mediation into profile callbacks, and improve auditing
    - SAUCE: apparmor5.1.0 [21/61]: apparmor-next: apparmor: refactor network
      socket mediation to support compatibility
    - SAUCE: apparmor5.1.0 [22/61]: apparmor-next: apparmor: move netfilter
      functions next to the LSM network operations
    - SAUCE: apparmor5.1.0 [23/61]: apparmor-next: apparmor: move
      sock_rcv_skb() next to inet_conn_request
    - SAUCE: apparmor5.1.0 [24/61]: apparmor-next: apparmor: reserve mediation
      class for packet mediation
    - SAUCE: apparmor5.1.0 [25/61]: apparmor-next: apparmor: fix unconfined
      user namespace restriction forced stack
    - SAUCE: apparmor5.1.0 [26/61]: apparmor-next: apparmor: refactor xattr
      attachment, to take the file path
    - SAUCE: apparmor5.1.0 [27/61]: apparmor-next: apparmor: fix race
      condition in label replacement
    - SAUCE: apparmor5.1.0 [28/61]: apparmor-next: apparmor: make table entry
      count last enum for static tables
    - SAUCE: apparmor5.1.0 [29/61]: apparmor-next: apparmor: fix error debug
      output in fn_label_build
    - SAUCE: apparmor5.1.0 [30/61]: apparmor-next: apparmor: mark static
      tables and structs as read only
    - SAUCE: apparmor5.1.0 [31/61]: apparmor-next: apparmor: add audit mode to
      provide a mechanism to silence complain messages
    - SAUCE: apparmor5.1.0 [32/61]: apparmor-next: apparmor: fix auditing of
      mount binary data
    - SAUCE: apparmor5.1.0 [33/61]: apparmor-next: apparmor: refactory mount
      to use check_perms
    - SAUCE: apparmor5.1.0 [34/61]: apparmor-next: apparmor: drop use of
      _confined variant for iteration
    - SAUCE: apparmor5.1.0 [35/61]: apparmor-next: apparmor: constify aa_perms
      parameters that are read-only
    - SAUCE: apparmor5.1.0 [36/61]: apparmor-next: apparmor: constify
      aa_profile parameters on read-only compute paths
    - SAUCE: apparmor5.1.0 [37/61]: apparmor-next: apparmor: constify aa_dfa
      parameters on read-only compute paths
    - SAUCE: apparmor5.1.0 [38/61]: apparmor-next: apparmor: constify aa_label
      parameters on read-only query helpers
    - SAUCE: apparmor5.1.0 [39/61]: apparmor-next-next: apparmor: setup slab
      cache for audit data
    - SAUCE: apparmor5.1.0 [40/61]: apparmor-next-next: apparmor: add the
      ability for profiles to have a learning cache
    - SAUCE: apparmor5.1.0 [41/61]: Stacking: LSM: Single calls in secid hooks
    - SAUCE: apparmor5.1.0 [42/61]: Stacking: LSM: Exclusive secmark usage
    - SAUCE: apparmor5.1.0 [43/61]: Stacking: AppArmor: Remove the exclusive
      flag
    - SAUCE: apparmor5.1.0 [44/61]: Revert "apparmor: fix dbus permission
      queries to v9 ABI"
    - SAUCE: apparmor5.1.0 [45/61]: apparmor: net: patch to provide
      compatibility with v2.x net rules
    - SAUCE: apparmor5.1.0 [46/61]: apparmor: net: add fine grained ipv4/ipv6
      mediation
    - SAUCE: apparmor5.1.0 [47/61]: apparmor: userns: add unprivileged user ns
      mediation
    - SAUCE: apparmor5.1.0 [48/61]: apparmor: userns: Add sysctls for
      additional controls of unpriv userns restrictions
    - SAUCE: apparmor5.1.0 [50/61]: apparmor: userns: open userns related
      sysctl so lxc can check if restriction are in place
    - SAUCE: apparmor5.1.0 [51/61]: apparmor: userns: allow profile to be
      transitioned when a userns is created
    - SAUCE: apparmor5.1.0 [52/61]: apparmor: mqueue: call
      security_inode_init_security on inode creation
    - SAUCE: apparmor5.1.0 [53/61]: apparmor: mqueue: add fine grained
      mediation of posix mqueues
    - SAUCE: apparmor5.1.0 [54/61]: apparmor: mqueue: prevent
      profile->disconnected double free in aa_free_profile
    - SAUCE: apparmor5.1.0 [55/61]: apparmor: uring: add io_uring mediation
    - SAUCE: apparmor5.1.0 [58/61]: apparmor: prompt: enable userspace upcall
      for mediation

  * update apparmor and LSM stacking patch set (LP: #2028253) // Installation
    of AppArmor on a 6.14 kernel produces error message "Illegal number: yes"
    (LP: #2102680)
    - SAUCE: apparmor5.1.0 [56/61]: apparmor: create an
      AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant
    - SAUCE: apparmor5.1.0 [57/61]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT
      for userns and io_uring sysctls

  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in
    mantic (LP: #2032602)
    - SAUCE: apparmor5.1.0 [49/61]: apparmor: userns - make it so special
      unconfined profiles can mediate user namespaces

  * Drop DEP-8 tests from kernel packages (LP: #2160302)
    - [Packaging] Drop DEP-8 tests from kernel source

  * Miscellaneous Ubuntu changes
    - [Config] updateconfigs after rebase to v7.2-rc6
    - [Config] Enable SECURITY_APPARMOR_COMPRESSED_POLICY
    - [Config] toolchain version update

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Fri, 14 Aug 2026 15:46:26 +0300

linux-unstable (7.2.0-2.2) stonking; urgency=medium

  * stonking/linux-unstable: 7.2.0-2.2 -proposed tracker (LP: #2161304)

  * Miscellaneous Ubuntu changes
    - Changes.md: dropping reboot=pci quirks for sandy bridge hw

 -- Paolo Pisati <paolo.pisati@canonical.com>  Tue, 21 Jul 2026 13:29:36 +0200

linux-unstable (7.2.0-1.1) stonking; urgency=medium

  * stonking/linux-unstable: 7.2.0-1.1 -proposed tracker (LP: #2160497)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants

 -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 13 Jul 2026 14:07:35 +0200

linux-unstable (7.2.0-0.0) stonking; urgency=medium

  * stonking/linux-unstable: 7.2.0-0.0 -proposed tracker (LP: #2159617)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
    - [Packaging] update annotations scripts

  * Miscellaneous Ubuntu changes
    - Update Changes.md after v7.2-rc1 rebase
    - [Config] updateconfigs after v7.2-rc1 rebase
    - SAUCE: thunderbolt: fixup move of pci_device out of tb_nhi
    - [Packaging] integrate SBOM generation into the build
    - SAUCE: fixup s/strncpy/strscpy/ in compat_uts_machine= kernel command
      line override
    - SAUCE: igh-ecat: replace strncpy with strscpy
    - SAUCE: igh-ecat: replace strncpy with strscpy
    - SAUCE: igh-ecat: replace strncpy with strscpy
    - SAUCE: media: venus: core: guard SC8280XP/SM8350 resources behind !IRIS

 -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 06 Jul 2026 14:01:01 +0200

linux (7.1.0-5.5) stonking; urgency=medium

  * stonking/linux: 7.1.0-5.5 -proposed tracker (LP: #2156849)

  * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260
    renders upside-down (LP: #2155837)
    - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14
      Premium PA14260

  * ov08x40 module mounted upside down on a certain DELL platforms
    (LP: #2146517)
    - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with
      upside down sensors
    - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside
      down sensors

  * AppArmor Vulnerabilities  (LP: #2151747)
    - SAUCE: apparmor: pass big_resp to handler
    - SAUCE: apparmor: remove redundant kref_init for listener->count
    - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47337
    - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47334
    - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47333
    - SAUCE: apparmor: fix dfa unpacking size of the notification filter

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47332
    - SAUCE: apparmor: fix size check against type instead of pointer

  * apparmor: LLVM/clang build failure due to uninitialized variable in
    notify.c (LP: #2148809) // CVE-2026-47330
    - SAUCE: apparmor: initialize variable used in uninitialized context

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47329
    - SAUCE: apparmor: fix name validation bypass on notification

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47327 //
    CVE-2026-47328
    - SAUCE: apparmor: fix glob memory leak after kstrdup

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47326
    - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer

  * unconfined profile denies userns_create for chromium based processes
    (LP: #1990064)
    - [Config] disable CONFIG_SECURITY_APPARMOR_RESTRICT_USERNS

  * FFe: add network interface mediation to 26.04 (LP: #2144679)
    - SAUCE: apparmor5.0.0 [57/57]: apparmor: add the ability to use interface
      in network mediation.

  * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile
    (LP: #2142956)
    - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation
      sock_file_perm
    - SAUCE: apparmor5.0.0 [32/57]: apparmor-next 7.1: apparmor: enable
      differential encoding
    - SAUCE: apparmor5.0.0 [33/57]: apparmor-next 7.1: apparmor: propagate
      -ENOMEM correctly in unpack_table
    - SAUCE: apparmor5.0.0 [36/57]: apparmor-next 7.1: apparmor: use
      __label_make_stale in __aa_proxy_redirect
    - SAUCE: apparmor5.0.0 [37/57]: apparmor-next 7.1: apparmor: fix net.h and
      policy.h circular include pattern
    - SAUCE: apparmor5.0.0 [39/57]: apparmor-next 7.1: apparmor: make include
      headers self-contained
    - SAUCE: apparmor5.0.0 [41/57]: apparmor-next 7.1: apparmor: fix
      rawdata_f_data implicit flex array
    - SAUCE: apparmor5.0.0 [42/57]: apparmor-next 7.1: apparmor: free rawdata
      as soon as possible
    - SAUCE: apparmor5.0.0 [43/57]: apparmor-next 7.1: apparmor: Initial
      support for compressed policies
    - SAUCE: apparmor5.0.0 [44/57]: apparmor-next 7.1: apparmor: fix potential
      UAF in aa_replace_profiles
    - SAUCE: apparmor5.0.0 [45/57]: apparmor-next 7.1: apparmor: hide unused
      get_loaddata_common_ref() function
    - SAUCE: apparmor5.0.0 [47/57]: apparmor: fix packed tag on v5 header
      struct
    - SAUCE: apparmor5.0.0 [48/57]: apparmor: add temporal caching to audit
      responses.
    - SAUCE: apparmor5.0.0 [49/57]: apparmor: change fn_label_build() call to
      not return NULL
    - SAUCE: apparmor5.0.0 [50/57]: apparmor: make fn_label_build() capable of
      handling not supported
    - SAUCE: apparmor5.0.0 [51/57]: apparmor: move netfilter functions next to
      the LSM network operations
    - SAUCE: apparmor5.0.0 [52/57]: apparmor: move sock_rvc_skb() next to
      inet_conn_request
    - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation
      binding
    - SAUCE: apparmor5.0.0 [54/57]: cleanups of apparmor af_unix mediation
    - SAUCE: apparmor5.0.0 [55/57]: apparmor: fix apparmor_secmark_check()
      when !inet and secmark defined.
    - SAUCE: apparmor5.0.0 [56/57]: apparmor: fix auditing of non-mediation
      falures

  * snap service cannot change apparmor hat (LP: #2139664) // Jellyfin Desktop
    Flatpak doesn't work with the current AppArmor profile (LP: #2142956)
    - SAUCE: apparmor5.0.0 [38/57]: apparmor-next 7.1: apparmor: grab ns lock
      and refresh when looking up changehat child profiles

  * AppArmor blocks write(2) to network sockets with Linux 6.19 (LP: #2141298)
    - SAUCE: apparmor5.0.0 [28/57]: apparmor: fix aa_label_sk_perm to check
      for RULE_MEDIATES_NET

  * update apparmor and LSM stacking patch set (LP: #2028253)
    - SAUCE: apparmor5.0.0 [1/57]: Stacking: LSM: Single calls in secid hooks
    - SAUCE: apparmor5.0.0 [2/57]: Stacking: LSM: Exclusive secmark usage
    - SAUCE: apparmor5.0.0 [3/57]: Stacking: AppArmor: Remove the exclusive
      flag
    - SAUCE: apparmor5.0.0 [4/57]: Revert "apparmor: fix dbus permission
      queries to v9 ABI"
    - SAUCE: apparmor5.0.0 [5/57]: Revert "apparmor: gate make fine grained
      unix mediation behind v9 abi"
    - SAUCE: apparmor5.0.0 [6/57]: apparmor: net: patch to provide
      compatibility with v2.x net rules
    - SAUCE: apparmor5.0.0 [7/57]: apparmor: net: add fine grained ipv4/ipv6
      mediation
    - SAUCE: apparmor5.0.0 [8/57]: apparmor: lift compatibility check out of
      profile_af_perm
    - SAUCE: apparmor5.0.0 [9/57]: apparmor: userns: add unprivileged user ns
      mediation
    - SAUCE: apparmor5.0.0 [10/57]: apparmor: userns: Add sysctls for
      additional controls of unpriv userns restrictions
    - SAUCE: apparmor5.0.0 [12/57]: apparmor: userns: open userns related
      sysctl so lxc can check if restriction are in place
    - SAUCE: apparmor5.0.0 [13/57]: apparmor: userns: allow profile to be
      transitioned when a userns is created
    - SAUCE: apparmor5.0.0 [14/57]: apparmor: mqueue: call
      security_inode_init_security on inode creation
    - SAUCE: apparmor5.0.0 [15/57]: apparmor: mqueue: add fine grained
      mediation of posix mqueues
    - SAUCE: apparmor5.0.0 [16/57]: apparmor: uring: add io_uring mediation
    - SAUCE: apparmor5.0.0 [19/57]: apparmor: prompt: setup slab cache for
      audit data
    - SAUCE: apparmor5.0.0 [20/57]: apparmor: prompt: add the ability for
      profiles to have a learning cache
    - SAUCE: apparmor5.0.0 [21/57]: apparmor: prompt: enable userspace upcall
      for mediation
    - SAUCE: apparmor5.0.0 [22/57]: apparmor: prompt: pass prompt boolean
      through into path_name as well
    - SAUCE: apparmor5.0.0 [23/57]: apparmor: check for supported version in
      notification messages.
    - SAUCE: apparmor5.0.0 [24/57]: apparmor: refactor building notice so it
      is easier to extend
    - SAUCE: apparmor5.0.0 [25/57]: apparmor: switch from ENOTSUPP to
      EPROTONOSUPPORT
    - SAUCE: apparmor5.0.0 [26/57]: apparmor: add support for meta data tags
    - SAUCE: apparmor5.0.0 [27/57]: apparmor: prevent profile->disconnected
      double free in aa_free_profile

  * update apparmor and LSM stacking patch set (LP: #2028253) // Installation
    of AppArmor on a 6.14 kernel produces error message "Illegal number: yes"
    (LP: #2102680)
    - SAUCE: apparmor5.0.0 [17/57]: apparmor: create an
      AA_SFS_TYPE_BOOLEAN_INTPRINT sysctl variant
    - SAUCE: apparmor5.0.0 [18/57]: apparmor: Use AA_SFS_FILE_BOOLEAN_INTPRINT
      for userns and io_uring sysctls

  * update apparmor and LSM stacking patch set (LP: #2028253) // [FFe]
    apparmor-4.0.0-alpha2 for unprivileged user namespace restrictions in
    mantic (LP: #2032602)
    - SAUCE: apparmor5.0.0 [11/57]: apparmor: userns - make it so special
      unconfined profiles can mediate user namespaces

  * Miscellaneous Ubuntu changes
    - [Config] enable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED
    - [Packaging] Fix cross-builds
    - [Config] updateconfigs after v7.1 rebase

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 16 Jun 2026 11:38:33 +0300

linux (7.1.0-1.1) stonking; urgency=medium

  * stonking/linux: 7.1.0-1.1 -proposed tracker (LP: #2154256)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants

  * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue
    (LP: #2154174)
    - SAUCE: selftests/seccomp fix compilation issue for amd64

  * Kernel 6.19-rc8 does not include GPIB driver (LP: #2152714)
    - [Config] Enable CONFIG_GPIB for amd64

  * Miscellaneous Ubuntu changes
    - Update Changes.md after v7.1-rc4 rebase
    - [packaging] Install gdb scripts again
    - [Config] updateconfigs after v7.1-rc5 rebase
    - [Packaging] templates: Use a for-loop for run-parts
    - [Packaging] Remove dead debian.master/rules.d/x32.mk
    - [Packaging] Remove orphaned debian/v4l2loopback-modules.ignore
    - [Packaging] Remove orphaned debian/zfs-modules.ignore
    - [Packaging] Remove deprecated linux-doc transitional stub
    - [Packaging] Remove dead comment referencing gcc-4.7 in control.stub.in
    - [Packaging] Remove dead comment in ppc64el.mk
    - [Packaging] Remove stale legacy code
    - [Packaging] rules: Drop an obsolete check for do_zstd_ko
    - [Config] toolchain version update
    - [Packaging] update Ubuntu.md

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 26 May 2026 16:08:55 +0300

linux (7.1.0-0.0) stonking; urgency=medium

  * Dummy entry.

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 26 May 2026 09:59:13 +0300

linux (7.0.0-15.15) resolute; urgency=medium

  * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)

  * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown
    (LP: #2149808)
    - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes

  * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest
    Resolute kernels, breaking Secure Boot systems  (LP: #2148718)
    - [packaging] add intel-ipu7 to signature inclusion list

 -- Paolo Pisati <paolo.pisati@canonical.com>  Wed, 22 Apr 2026 16:02:19 +0200

linux (7.0.0-14.14) resolute; urgency=medium

  * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)

  * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)
    - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471

  * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)
    - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED

  * System doesn't response with mt76 call trace (LP: #2137448)
    - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations

  * The second tbt storage plugged on the dock will not be recognized
    (LP: #2139572)
    - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan

  * dma-buf filesystem flags fix (LP: #2139656)
    - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem

  * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17
    (LP: #2145164)
    - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on
      enumeration failure

  * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during
    long HPD pulse (LP: #2143879)
    - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port
      during long HPD pulse

  * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)
    - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug
      message

  * Miscellaneous Ubuntu changes
    - [Packaging] Add support for per-flavour depends
    - [Packaging] Don't hard-code lmm zfs dependency
    - [Config] updateconfigs following v7.0 release

 -- Paolo Pisati <paolo.pisati@canonical.com>  Mon, 13 Apr 2026 10:12:22 +0200

# For older changelog entries, run 'apt-get changelog linux-cloud-tools-7.2.0-5'
