linux-vmware (6.8.0-1004.4) noble; urgency=medium

  * noble/linux-vmware: 6.8.0-1004.4 -proposed tracker (LP: #2158943)

 -- Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>  Wed, 01 Jul 2026 17:30:11 -0700

linux-vmware (6.8.0-1003.3) noble; urgency=medium

  * noble/linux-vmware: 6.8.0-1003.3 -proposed tracker (LP: #2158923)

  * dkms-build script issues parsing deb sources on LP builders (LP: #2097581)
    - [Packaging] vmware: dkms-build: Parse DEB822 sources

 -- Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>  Wed, 01 Jul 2026 11:36:22 -0700

linux-vmware (6.8.0-1002.2) noble; urgency=medium

  * noble/linux-vmware: 6.8.0-1002.2 -proposed tracker (LP: #2158660)

 -- Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>  Tue, 30 Jun 2026 07:47:56 -0700

linux-vmware (6.8.0-1001.1) noble; urgency=medium

  * noble/linux-vmware: <version to be filled> -proposed tracker (LP: #2157077)

  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
    - [Packaging] update update.conf
    - [Packaging] update Ubuntu.md
    - [Packaging] debian.vmware/dkms-versions -- update from kernel-versions
      (adhoc/d2026.06.15)

  * Miscellaneous Ubuntu changes
    - [Packaging] vmware: Initial commit
    - [Packaging] vmware: Initial packaging
    - [Config] vmware: Initial configuration

 -- Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>  Wed, 17 Jun 2026 22:23:09 -0700

linux-vmware (6.8.0-1000.0) noble; urgency=medium

  * Initial changelog entry.

 -- Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>  Wed, 17 Jun 2026 14:36:07 -0700

linux (6.8.0-130.130) noble; urgency=medium

  * noble/linux: 6.8.0-130.130 -proposed tracker (LP: #2154560)

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465)
    - Revert "UBUNTU: SAUCE: Fix skb_vlan_inet_prepare() usage"

  * Kernel regression (6.8.0-117.generic) (LP: #2153556)
    - net: bonding: update the slave array for broadcast mode
    - bonding: do not set usable_slaves for broadcast mode

  * perf_cpu_map__merge fails to compile on ppc46el, s390x on noble linux
    (LP: #2152194)
    - SAUCE: temporary fix attempt for size eceed

  * Some powerpc test from ubuntu_kernel_selftests timeout with 45 seconds
    (LP: #2141536)
    - selftests/powerpc: Lower run time of count_stcx_fail test
    - selftests/powerpc: Give all tests 2 minutes timeout

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809)
    - auxdisplay: arm-charlcd: fix release_mem_region() size
    - hfsplus: return error when node already exists in hfs_bnode_create
    - rcu: s/boost_kthread_mutex/kthread_mutex
    - rcu/exp: Move expedited kthread worker creation functions above
      rcutree_prepare_cpu()
    - rcu: Refactor expedited handling check in rcu_read_unlock_special()
    - rcu: Remove local_irq_save/restore() in
      rcu_preempt_deferred_qs_handler()
    - rcu: Fix rcu_read_unlock() deadloop due to softirq
    - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
    - i3c: Move device name assignment after i3c_bus_init
    - fs: add <linux/init_task.h> for 'init_fs'
    - i3c: master: Update hot-join flag only on success
    - gfs2: Retries missing in gfs2_{rename,exchange}
    - gfs2: Fix use-after-free in iomap inline data write path
    - i3c: dw: Initialize spinlock to avoid upsetting lockdep
    - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
    - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
    - btrfs: qgroup: return correct error when deleting qgroup relation item
    - btrfs: fix block_group_tree dirty_list corruption
    - smb: client: fix potential UAF and double free in smb2_open_file()
    - xen/virtio: Don't use grant-dma-ops when running as Dom0
    - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
    - io_uring/sync: validate passed in offset
    - cpuidle: menu: Cleanup after loadavg removal
    - cpuidle: governors: menu: Always check timers with tick stopped
    - md/raid10: fix any_working flag handling in raid10_sync_request
    - iomap: fix submission side handling of completion side errors
    - ublk: Validate SQE128 flag before accessing the cmd
    - x86/xen: make some functions static
    - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
    - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
    - perf: arm_spe: Properly set hw.state on failures
    - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
    - s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
    - crypto: qat - fix warning on adf_pfvf_pf_proto.c
    - selftests/bpf: veristat: fix printing order in output_stats()
    - libbpf: Fix OOB read in btf_dump_get_bitfield_value
    - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable
    - crypto: cavium - fix dma_free_coherent() size
    - crypto: octeontx - fix dma_free_coherent() size
    - crypto: hisilicon/zip - adjust the way to obtain the req in the callback
      function
    - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware
      queue unavailable
    - hrtimer: Fix trace oddity
    - bpf, sockmap: Fix incorrect copied_seq calculation
    - bpf, sockmap: Fix FIONREAD for sockmap
    - crypto: hisilicon/trng - modifying the order of header files
    - crypto: hisilicon/trng - support tfms sharing the device
    - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
    - scsi: efct: Use IRQF_ONESHOT and default primary handler
    - EDAC/altera: Remove IRQF_ONESHOT
    - mfd: wm8350-core: Use IRQF_ONESHOT
    - sched/rt: Skip currently executing CPU in rto_next_cpu()
    - pstore/ram: fix buffer overflow in persistent_ram_save_old()
    - soc: qcom: smem: handle ENOMEM error during probe
    - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
    - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
    - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
    - clk: qcom: Return correct error code in qcom_cc_probe_by_index()
    - arm64: dts: qcom: sdm630: fix gpu_speed_bin size
    - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
    - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
    - powerpc/uaccess: Move barrier_nospec() out of
      allow_read_{from/write}_user()
    - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
      cmd_db_dev_probe
    - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
    - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event
      handling
    - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells
    - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree
      node
    - arm64: dts: amlogic: axg: assign the MMC signal clocks
    - arm64: dts: amlogic: gx: assign the MMC signal clocks
    - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks
    - arm64: dts: amlogic: g12: assign the MMC A signal clock
    - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0
    - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1
    - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
    - workqueue: Factor out assign_rescuer_work()
    - workqueue: Only assign rescuer work when really needed
    - workqueue: Process rescuer work items one-by-one using a cursor
    - smack: /smack/doi must be > 0
    - smack: /smack/doi: accept previously used values
    - ASoC: nau8821: Consistently clear interrupts before unmasking
    - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
    - ASoC: nau8821: Fixup nau8821_enable_jack_detect()
    - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
    - drm/msm/disp/dpu: add merge3d support for sc7280
    - regulator: core: move supply check earlier in set_machine_constraints()
    - HID: playstation: Add missing check for input_ff_create_memless
    - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
    - media: ccs: Accommodate C-PHY into the calculation
    - drm/msm/a2xx: fix pixel shader start on A225
    - platform/chrome: cros_typec_switch: Don't touch struct
      fwnode_handle::dev
    - media: uvcvideo: Fix allocation for small frame sizes
    - platform/chrome: cros_ec_lightbar: Fix response size initialization
    - spi: tools: Add include folder to .gitignore
    - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
    - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
    - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
    - PCI/PM: Avoid redundant delays on D3hot->D3cold
    - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
    - Documentation: tracing: Add ring-buffer mapping
    - docs: fix WARNING document not included in any toctree
    - Documentation: trace: Refactor toctree
    - Documentation: tracing: Add PCI tracepoint documentation
    - PCI: Do not attempt to set ExtTag for VFs
    - PCI/portdrv: Fix potential resource leak
    - quota: fix livelock between quotactl and freeze_super
    - net: mctp-i2c: fix duplicate reception of old data
    - mctp i2c: initialise event handler read bytes
    - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
    - netfilter: nf_tables: reset table validation state on abort
    - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
    - netfilter: nf_conncount: increase the connection clean up limit to 64
    - netfilter: nft_compat: add more restrictions on netlink attributes
    - netfilter: nf_conncount: fix tracking of connections from localhost
    - module: add helper function for reading module_buildid()
    - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
    - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
    - iommu/vt-d: Flush cache for PASID table before using it
    - dm: use bio_clone_blkg_association
    - nfsd: never defer requests during idmap lookup
    - fat: avoid parent link count underflow in rmdir
    - tcp: tcp_tx_timestamp() must look at the rtx queue
    - wifi: ath10k: sdio: add missing lock protection in
      ath10k_sdio_fw_crashed_dump()
    - PCI: Initialize RCB from pci_configure_device()
    - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros
    - PCI: Add defines for bridge window indexing
    - PCI/ACPI: Restrict program_hpx_type2() to AER bits
    - ipc: don't audit capability check in ipc_permissions()
    - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
    - of: unittest: fix possible null-pointer dereferences in
      of_unittest_property_copy()
    - mptcp: fix receive space timestamp initialization
    - octeontx2-af: Fix PF driver crash with kexec kernel booting
    - bonding: only set speed/duplex to unknown, if getting speed failed
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
    - nfc: hci: shdlc: Stop timers and work before freeing context
    - netfilter: nft_set_hash: fix get operation on big endian
    - netfilter: nft_counter: fix reset of counters on 32bit archs
    - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
    - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
    - net: hns3: fix double free issue for tx spare buffer
    - procfs: fix missing RCU protection when reading real_parent in
      do_task_stat()
    - smb: client: correct value for smbd_max_fragmented_recv_size
    - net: sunhme: Fix sbus regression
    - net: Add skb_dstref_steal and skb_dstref_restore
    - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
      callers
    - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
    - serial: caif: fix use-after-free in caif_serial ldisc_close()
    - octeon_ep: disable per ring interrupts
    - octeon_ep: ensure dbell BADDR updation
    - ionic: Rate limit unknown xcvr type messages
    - octeontx2-pf: Unregister devlink on probe failure
    - RDMA/rtrs: server: remove dead code
    - IB/cache: update gid cache on client reregister event
    - RDMA/hns: Fix WQ_MEM_RECLAIM warning
    - RDMA/hns: Notify ULP of remaining soft-WCs during reset
    - power: supply: ab8500: Fix use-after-free in power_supply_changed()
    - power: supply: act8945a: Fix use-after-free in power_supply_changed()
    - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
    - power: supply: bq25980: Fix use-after-free in power_supply_changed()
    - power: supply: cpcap-battery: Fix use-after-free in
      power_supply_changed()
    - power: supply: goldfish: Fix use-after-free in power_supply_changed()
    - power: supply: rt9455: Fix use-after-free in power_supply_changed()
    - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
    - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
    - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
    - power: supply: wm97xx: Fix NULL pointer dereference in
      power_supply_changed()
    - RDMA/rtrs-srv: fix SG mapping
    - RDMA/rxe: Fix double free in rxe_srq_from_init
    - tools/power/x86/intel-speed-select: Fix file descriptor leak in
      isolate_cpus()
    - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
    - crypto: ccp - Add an S4 restore flow
    - crypto: ccp - Factor out ring destroy handling to a helper
    - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT
      fails
    - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
    - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
    - RDMA/rxe: Fix race condition in QP timer handlers
    - svcrdma: Increase the per-transport rw_ctx count
    - svcrdma: Reduce the number of rdma_rw contexts per-QP
    - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
    - cxl: Fix premature commit_end increment on decoder commit failure
    - mtd: parsers: ofpart: fix OF node refcount leak in
      parse_fixed_partitions()
    - mtd: spinand: Fix kernel doc
    - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
    - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
    - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
    - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
    - scsi: ufs: host: mediatek: Require CONFIG_PM
    - scsi: csiostor: Fix dereference of null pointer rn
    - nvdimm: virtio_pmem: serialize flush requests
    - fs/nfs: Fix readdir slow-start regression
    - tracing: Properly process error handling in event_hist_trigger_parse()
    - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
    - fbdev: of_display_timing: Fix device node reference leak in
      of_get_display_timings()
    - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
    - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
    - clk: qcom: rcg2: compute 2d using duty fraction directly
    - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
    - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
    - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
    - clk: qcom: gcc-ipq5018: flag sleep clock as critical
    - clk: Move clk_{save,restore}_context() to COMMON_CLK section
    - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
    - clk: qcom: gfx3d: add parent to parent request map
    - clk: mediatek: Fix error handling in runtime PM setup
    - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
    - dma: dma-axi-dmac: fix SW cyclic transfers
    - staging: greybus: lights: avoid NULL deref
    - serial: imx: change SERIAL_IMX_CONSOLE to bool
    - serial: SH_SCI: improve "DMA support" prompt
    - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
    - iio: pressure: mprls0025pa: fix scan_type struct
    - watchdog: starfive-wdt: Fix PM reference leak in probe error path
    - coresight: etm3x: Fix cpulocked warning on cpuhp
    - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
    - mfd: arizona: Fix regulator resource leak on
      wm5102_clear_write_sequencer() failure
    - mfd: simple-mfd-i2c: Add MAX77705 support
    - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
    - mfd: simple-mfd-i2c: Add SpacemiT P1 support
    - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
    - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
    - [Config] Disable new Delta TN48M CPLD support by default
    - drivers: iio: mpu3050: use dev_err_probe for regulator request
    - usb: bdc: fix sleep during atomic
    - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
    - ovl: Fix uninit-value in ovl_fill_real
    - iio: sca3000: Fix a resource leak in sca3000_probe()
    - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
    - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
    - leds: qcom-lpg: Check the return value of regmap_bulk_write()
    - backlight: qcom-wled: Support ovp values for PMI8994
    - backlight: qcom-wled: Change PM8950 WLED configurations
    - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
    - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
    - fs/ntfs3: prevent infinite loops caused by the next valid being the same
    - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
    - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
    - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
    - kbuild: Add objtool to top-level clean target
    - selftests/memfd: delete unused declarations
    - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT
    - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
    - cpuidle: Skip governor when only one idle state is available
    - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2
    - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
    - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
    - net: mscc: ocelot: split xmit into FDMA and register injection paths
    - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
    - ipv6: Fix out-of-bound access in fib6_add_rt2node().
    - net: sparx5/lan969x: fix PTP clock max_adj value
    - net: usb: catc: enable basic endpoint checking
    - xen-netback: reject zero-queue configuration from guest
    - net/rds: rds_sendmsg should not discard payload_len
    - net: bridge: mcast: always update mdb_n_entries for vlan contexts
    - selftests: forwarding: vxlan_bridge_1d: fix test failure with
      br_netfilter enabled
    - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with
      br_netfilter enabled
    - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
    - net: remove WARN_ON_ONCE when accessing forward path array
    - ipv6: fix a race in ip6_sock_set_v6only()
    - bpftool: Fix truncated netlink dumps
    - ping: annotate data-races in ping_lookup()
    - icmp: move icmp_global.credit and icmp_global.stamp to per netns storage
    - icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns
    - icmp: prevent possible overflow in icmp_global_allow()
    - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more)
    - inet: move icmp_global_{credit,stamp} to a separate cache line
    - octeontx2-af: Fix default entries mcam entry action
    - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
    - net/mlx5: Fix multiport device check over light SFs
    - apparmor: fix NULL sock in aa_sock_file_perm
    - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
    - apparmor: fix rlimit for posix cpu timers
    - apparmor: remove apply_modes_to_perms from label_match
    - apparmor: make label_match return a consistent value
    - apparmor: fix invalid deref of rawdata when export_binary is unset
    - apparmor: fix aa_label to return state from compount and component match
    - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
    - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
    - drm/i915/acpi: free _DSM package when no connectors
    - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
    - drm/amdkfd: fix debug watchpoints for logical devices
    - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
    - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname()
    - spi: wpcm-fiu: Fix uninitialized res
    - spi: wpcm-fiu: Simplify with dev_err_probe()
    - spi: wpcm-fiu: Fix potential NULL pointer dereference in
      wpcm_fiu_probe()
    - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
    - efi: Fix reservation of unaccepted memory table
    - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
      found
    - x86/hyperv: Fix error pointer dereference
    - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk
    - drm/amd/display: Use same max plane scaling limits for all 64 bpp
      formats
    - MIPS: Work around LLVM bug when gp is used as global register variable
    - ext4: don't cache extent during splitting extent
    - ext4: fix memory leak in ext4_ext_shift_extents()
    - ext4: use optimized mballoc scanning regardless of inode format
    - ata: pata_ftide010: Fix some DMA timings
    - ata: libata-scsi: refactor ata_scsi_translate()
    - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
    - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
    - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
    - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
    - perf test stat: Update test expectations and events
    - perf test stat tests: Fix for virtualized machines
    - perf unwind-libdw: Fix invalid reference counts
    - perf callchain: Fix srcline printing with inlines
    - libsubcmd: Fix null intersection case in exclude_cmds()
    - libperf: Don't remove -g when EXTRA_CFLAGS are used
    - libperf build: Always place libperf includes first
    - rtc: interface: Alarm race handling should not discard preceding error
    - hfsplus: fix volume corruption issue for generic/498
    - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
    - hfsplus: pretend special inodes as regular files
    - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
    - minix: Add required sanity checking to minix_check_superblock()
    - btrfs: handle user interrupt properly in btrfs_trim_fs()
    - smb: client: add proper locking around ses->iface_last_update
    - gfs2: fiemap page fault fix
    - smb: client: prevent races in ->query_interfaces()
    - tools/power cpupower: Reset errno before strtoull()
    - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
    - perf/arm-cmn: Support CMN-600AE
    - arm64: Add support for TSV110 Spectre-BHB mitigation
    - rnbd-srv: Zero the rsp buffer before using it
    - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE
      is set
    - EFI/CPER: don't dump the entire memory region
    - APEI/GHES: ensure that won't go past CPER allocated record
    - EFI/CPER: don't go past the ARM processor CPER record buffer
    - ACPI: processor: Fix NULL-pointer dereference in
      acpi_processor_errata_piix4()
    - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
    - md-cluster: fix NULL pointer dereference in process_metadata_update
    - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
    - s390/perf: Disable register readout on sampling events
    - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
    - xenbus: Use .freeze/.thaw to handle xenbus devices
    - blk-mq-debugfs: add missing debugfs_mutex in
      blk_mq_debugfs_register_hctxs()
    - sparc: Synchronize user stack on fork and clone
    - sparc: don't reference obsolete termio struct for TC* constants
    - bpf: verifier improvement in 32bit shift sign extension pattern
    - clocksource/drivers/sh_tmu: Always leave device running after probe
    - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency
      on OF
    - PCI/MSI: Unmap MSI-X region on error
    - crypto: hisilicon/qm - move the barrier before writing to the mailbox
      register
    - mailbox: bcm-ferxrm-mailbox: Use default primary handler
    - char: tpm: cr50: Remove IRQF_ONESHOT
    - pstore: ram_core: fix incorrect success return when vmap() fails
    - arm64: tegra: smaug: Add usb-role-switch support
    - parisc: Prevent interrupts during reboot
    - drm/display/dp_mst: Add protection against 0 vcpi
    - spi-geni-qcom: initialize mode related registers to 0
    - spi-geni-qcom: use xfer->bits_per_word for can_dma()
    - media: dvb-core: dmxdevfilter must always flush bufs
    - spi: stm32: fix Overrun issue at < 8bpw
    - drm/v3d: Set DMA segment size to avoid debug warnings
    - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
    - media: omap3isp: isppreview: always clamp in preview_try_format()
    - media: omap3isp: set initial format
    - media: mediatek: vcodec: Don't try to decode 422/444 VP9
    - drm/amdgpu: add support for HDP IP version 6.1.1
    - drm/amdgpu: avoid a warning in timedout job handler
    - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
    - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
    - ASoC: wm8962: Don't report a microphone if it's shorted to ground on
      plug
    - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
    - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
    - media: adv7180: fix frame interval in progressive mode
    - media: pvrusb2: fix URB leak in pvr2_send_request_ex
    - media: solo6x10: Check for out of bounds chip_id
    - media: cx25821: Fix a resource leak in cx25821_dev_setup()
    - media: v4l2-async: Fix error handling on steps after finding a match
    - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
    - drm: Account property blob allocations to memcg
    - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
    - virt: vbox: uapi: Mark inner unions in packed structs as packed
    - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
    - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
      parts
    - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
    - media: rkisp1: Fix filter mode register configuration
    - HID: multitouch: add eGalaxTouch EXC3188 support
    - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
    - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
    - gpio: aspeed-sgpio: Change the macro to support deferred probe
    - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
    - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
    - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional()
      in max98390_i2c_probe()
    - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
    - hwmon: (f71882fg) Add F81968 support
    - ASoC: es8328: Add error unwind in resume
    - modpost: Amend ppc64 save/restfpr symnames for -Os build
    - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
    - jfs: Add missing set_freezable() for freezable kthread
    - jfs: nlink overflow in jfs_rename
    - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
    - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
    - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
    - dm: replace -EEXIST with -EBUSY
    - dm: remove fake timeout to avoid leak request
    - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
    - wifi: libertas: fix WARNING in usb_tx_block
    - iommu/amd: move wait_on_sem() out of spinlock
    - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
    - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
    - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
    - wifi: ath12k: fix preferred hardware mode calculation
    - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
    - ipv6: exthdrs: annotate data-race over multiple sysctl
    - ext4: mark group add fast-commit ineligible
    - ext4: move ext4_percpu_param_init() before ext4_mb_init()
    - ext4: mark group extend fast-commit ineligible
    - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
    - netfilter: xt_tcpmss: check remaining length before reading optlen
    - openrisc: define arch-specific version of nop()
    - net: usb: r8152: fix transmit queue timeout
    - wifi: iwlwifi: mvm: check the validity of noa_len
    - net/rds: No shortcut out of RDS_CONN_ERROR
    - gro: change the BUG_ON() in gro_pull_from_frag0()
    - ipv4: igmp: annotate data-races around idev->mr_maxdelay
    - net: hns3: extend HCLGE_FD_AD_QID to 11 bits
    - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
    - wifi: iwlegacy: add missing mutex protection in
      il3945_store_measurement()
    - ipv4: fib: Annotate access to struct fib_alias.fa_state.
    - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
    - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
    - Bluetooth: btusb: Add new VID/PID for RTL8852CE
    - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
    - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
    - wifi: rtw89: pci: restore LDO setting after device resume
    - wifi: ath10k: fix lock protection in
      ath10k_wmi_event_peer_sta_ps_state_chg()
    - net: usb: sr9700: remove code to drive nonexistent multicast filter
    - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
    - net/rds: Clear reconnect pending bit
    - PCI: Mark ASM1164 SATA controller to avoid bus reset
    - PCI: Fix pci_slot_lock () device locking
    - PCI: Enable ACS after configuring IOMMU for OF platforms
    - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
    - PCI: Mark Nvidia GB10 to avoid bus reset
    - myri10ge: avoid uninitialized variable use
    - nfc: nxp-nci: remove interrupt trigger type
    - RDMA/rtrs-clt: For conn rejection use actual err number
    - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
    - hisi_acc_vfio_pci: update status after RAS error
    - scsi: buslogic: Reduce stack usage
    - vhost: fix caching attributes of MMIO regions by setting them explicitly
    - tracing: Fix false sharing in hwlat get_sample()
    - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
      channel is uninitialized
    - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
    - mailbox: imx: Skip the suspend flag for i.MX7ULP
    - mailbox: sprd: mask interrupts that are not handled
    - remoteproc: mediatek: Break lock dependency to `prepare_lock`
    - mailbox: sprd: clear delivery flag before handling TX done
    - clk: microchip: core: correct return value on *_get_parent()
    - m68k: nommu: fix memmove() with differently aligned src and dest for
      68000
    - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of
      NUC15)
    - staging: rtl8723bs: fix missing status update on sdio_alloc_irq()
      failure
    - serial: 8250_dw: handle clock enable errors in runtime_resume
    - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
    - fpga: of-fpga-region: Fail if any bridge is missing
    - dmaengine: sun6i: Choose appropriate burst length under maxburst
    - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
    - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
    - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
    - staging: rtl8723bs: fix memory leak on failure path
    - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
      termination is done
    - fix it87_wdt early reboot by reporting running timer
    - binder: don't use %pK through printk
    - watchdog: imx7ulp_wdt: handle the nowayout option
    - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
    - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
    - Revert "mfd: da9052-spi: Change read-mask to write-mask"
    - iio: Use IRQF_NO_THREAD
    - iio: magnetometer: Remove IRQF_ONESHOT
    - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
    - fs/ntfs3: drop preallocated clusters for sparse and compressed files
    - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
      ntfs_read_run_nb_ra()
    - ceph: supply snapshot context in ceph_uninline_data()
    - libceph: define and enforce CEPH_MAX_KEY_LEN
    - thermal: int340x: Fix sysfs group leak on DLVR registration failure
    - include: uapi: netfilter_bridge.h: Cover for musl libc
    - ARM: 9467/1: mm: Don't use %pK through printk
    - drm/amd/display: Avoid updating surface with the same surface under MPO
    - drm/amdgpu: Adjust usleep_range in fence wait
    - ALSA: usb-audio: Update the number of packets properly at receiving
    - drm/amdgpu: Add HAINAN clock adjustment
    - drm/radeon: Add HAINAN clock adjustment
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing
    - btrfs: replace BUG() with error handling in __btrfs_balance()
    - drm/amd/display: Remove conditional for shaper 3DLUT power-on
    - rtc: zynqmp: correct frequency value
    - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
    - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
    - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
    - xfrm: skip templates check for packet offload tunnel mode
    - ipmi: ipmb: initialise event handler read bytes
    - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
    - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
    - net: usb: lan78xx: scan all MDIO addresses on LAN7801
    - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
    - net: ethernet: xscale: Check for PTP support properly
    - wifi: cfg80211: wext: fix IGTK key ID off-by-one
    - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
    - [Config] Remove WARN_ALL_UNSEEDED_RANDOM
    - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
    - Bluetooth: hci_qca: Cleanup on all setup failures
    - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
    - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
      L2CAP_ECRED_CONN_REQ
    - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
    - tipc: fix duplicate publication key in tipc_service_insert_publ()
    - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
    - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
    - RDMA/efa: Fix typo in efa_alloc_mr()
    - net: usb: pegasus: enable basic endpoint checking
    - RDMA/umem: Fix double dma_buf_unpin in failure path
    - net/mlx5: DR, Fix circular locking dependency in dump
    - net/mlx5: Fix missing devlink lock in SRIOV enable error path
    - net: consume xmit errors of GSO frames
    - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
    - rpmsg: core: fix race in driver_override_show() and use core helper
    - clk: renesas: rzg2l: Fix intin variable size
    - clk: renesas: rzg2l: Select correct div round macro
    - ASoC: SOF: ipc4-control: If there is no data do not send bytes update
    - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
    - ASoC: SOF: ipc4-control: Use the correct size for
      scontrol->ipc_control_data
    - ASoC: SOF: ipc4-control: Keep the payload size up to date
    - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
    - dm-verity: correctly handle dm_bufio_client_create() failure
    - media: mediatek: encoder: Fix uninitialized scalar variable issue
    - media: mtk-mdp: Fix error handling in probe function
    - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
    - media: verisilicon: AV1: Fix enable cdef computation
    - media: verisilicon: AV1: Fix tx mode bit setting
    - ARM: omap2: Fix reference count leaks in omap_control_init()
    - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
      succeeding
    - arm64: Disable branch profiling for all arm64 code
    - HID: hid-pl: handle probe errors
    - HID: magicmouse: Do not crash on missing msc->input
    - HID: prodikeys: Check presence of pm->input_ep82
    - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
    - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on
    - media: verisilicon: AV1: Set IDR flag for intra_only frame type
    - media: radio-keene: fix memory leak in error path
    - media: cx88: Add missing unmap in snd_cx88_hw_params()
    - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
    - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
    - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
    - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
    - media: i2c: ov01a10: Fix the horizontal flip control
    - media: i2c: ov01a10: Fix reported pixel-rate value
    - media: i2c: ov01a10: Fix analogue gain range
    - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
    - media: i2c: ov01a10: Fix test-pattern disabling
    - media: qcom: camss: vfe: Fix out-of-bounds access in
      vfe_isr_reg_update()
    - media: ccs: Avoid possible division by zero
    - media: i2c: ov5647: Initialize subdev before controls
    - media: i2c: ov5647: Correct pixel array offset
    - media: i2c: ov5647: Correct minimum VBLANK value
    - media: i2c: ov5647: Sensor should report RAW color space
    - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
    - media: i2c: ov5647: use our own mutex for the ctrl lock
    - dm-integrity: fix a typo in the code for write/discard race
    - dm: clear cloned request bio pointer when last clone bio completes
    - soc: ti: k3-socinfo: Fix regmap leak on probe failure
    - soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
    - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
    - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
    - media: i2c: ov01a10: Fix digital gain range
    - clk: tegra: tegra124-emc: Fix potential memory leak in
      tegra124_clk_register_emc()
    - s390/pci: Handle futile config accesses of disabled devices directly
    - dm-integrity: fix recalculation in bitmap mode
    - dm-unstripe: fix mapping bug when there are multiple targets in a table
    - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
    - media: venus: vdec: fix error state assignment for zero bytesused
    - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
    - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
    - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
    - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
    - xfs: mark data structures corrupt on EIO and ENODATA
    - media: verisilicon: AV1: Fix tile info buffer size
    - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
      scalable mode
    - mfd: core: Add locking around 'mfd_of_node_list'
    - xfs: delete attr leaf freemap entries when empty
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks
    - xfs: fix remote xattr valuelblk check
    - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
    - PCI: endpoint: Fix swapped parameters in
      pci_{primary/secondary}_epc_epf_unlink() functions
    - md/bitmap: fix GPF in write_page caused by resize race
    - nfsd: fix return error code for nfsd_map_name_to_[ug]id
    - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
    - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
    - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
    - dm mpath: make pg_init_delay_msecs settable
    - tools: Fix bitfield dependency failure
    - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()
    - iio: gyro: itg3200: Fix unchecked return value in read_raw
    - mm/highmem: fix __kmap_to_page() build error
    - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
    - ocfs2: fix reflink preserve cleanup issue
    - kexec: derive purgatory entry from symbol
    - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
      SR-IOV"
    - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
    - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
    - btrfs: continue trimming remaining devices on failure
    - remoteproc: imx_rproc: Fix invalid loaded resource table detection
    - perf/arm-cmn: Reject unsupported hardware configurations
    - scsi: ufs: core: Flush exception handling work when RPM level is zero
    - usb: dwc3: gadget: Move vbus draw to workqueue context
    - usb: dwc2: fix resume failure if dr_mode is host
    - mtd: rawnand: pl353: Fix software ECC support
    - tipc: fix RCU dereference race in tipc_aead_users_dec()
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
    - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe()
      error path
    - PCI: Fix pci_slot_trylock() error handling
    - parisc: kernel: replace kfree() with put_device() in create_tree_node()
    - staging: rtl8723bs: fix null dereference in find_network
    - cifs: Fix locking usage for tcon fields
    - MIPS: rb532: Fix MMIO UART resource registration
    - ceph: supply snapshot context in ceph_zero_partial_object()
    - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE
    - LoongArch: Prefer top-down allocation after arch_mem_init()
    - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT
    - LoongArch: Disable instrumentation for setup_ptwalker()
    - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
    - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
    - octeontx2-af: CGX: fix bitmap leaks
    - net: macb: Fix tx/rx malfunction after phy link down and up
    - tracing: Fix to set write permission to per-cpu buffer_size_kb
    - io_uring/filetable: clamp alloc_hint to the configured alloc range
    - net: intel: fix PCI device ID conflict between i40e and ipw2200
    - atm: fore200e: fix use-after-free in tasklets during device removal
    - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
    - fbcon: check return value of con2fb_acquire_newinfo()
    - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
    - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
    - fbdev: ffb: fix corrupted video output on Sun FFB1
    - fbcon: Remove struct fbcon_display.inverse
    - cifs: some missing initializations on replay
    - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
    - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
    - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
    - x86/kexec: Copy ACPI root pointer address from config table
    - arm64: Force the use of CNTVCT_EL0 in __delay()
    - net: nfc: nci: Fix parameter validation for packet data
    - tracing: Fix checking of freed trace_event_file for hist files
    - tracing: Wake up poll waiters for hist files when removing an event
    - NTB: ntb_transport: Fix too small buffer for debugfs_name
    - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
    - arm64: Fix sampling the "stable" virtual counter in preemptible section
    - gfs2: Fix slab-use-after-free in qd_put
    - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
    - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
    - OPP: Return correct value in dev_pm_opp_get_level
    - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
    - perf/x86/core: Do not set bit width for unavailable counters
    - genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
    - platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
    - media: pci: mg4b: Use IRQF_NO_THREAD
    - firmware: arm_ffa: Correct 32-bit response handling in
      NOTIFICATION_INFO_GET
    - arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
      AD7147
    - arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
    - arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
    - arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models)
    - media: chips-media: wave5: Fix memory leak on codec_info allocation
      failure
    - drm/amd: Drop "amdgpu kernel modesetting enabled" message
    - drm/amdkfd: Fix signal_eviction_fence() bool return value
    - drm/xe: Unregister drm device on probe error
    - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
    - wifi: cfg80211: Fix use_for flag update on BSS refresh
    - PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
    - netfilter: nfnetlink_queue: optimize verdict lookup with hash table
    - netfilter: nfnetlink_queue: do shared-unconfirmed check before
      segmentation
    - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
      interval
    - power: supply: pm8916_bms_vm: Fix use-after-free in
      power_supply_changed()
    - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
    - RDMA/mlx5: Fix UMR hang in LAG error state unload
    - IB/mlx5: Fix port speed query for representors
    - platform/x86/amd/pmf: Prevent TEE errors after hibernate
    - crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
    - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
    - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
    - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
    - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
    - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
    - iio: pressure: mprls0025pa: fix interrupt flag
    - objpool: fix the overestimation of object pooling metadata size
    - ipvs: do not keep dest_dst if dev is going down
    - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
    - AppArmor: Allow apparmor to handle unaligned dfa tables
    - apparmor: Fix & Optimize table creation from possibly unaligned memory
    - apparmor: avoid per-cpu hold underflow in aa_get_buffer
    - drm/amd/display: Fix out-of-bounds stream encoder index v3
    - btrfs: use the correct type to initialize block reserve for delayed refs
    - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
    - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
    - APEI/GHES: ARM processor Error: don't go past allocated memory
    - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
    - powercap: intel_rapl: Add PL4 support for Ice Lake
    - alpha: fix user-space corruption during memory compaction
    - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
    - ACPI: battery: fix incorrect charging status when current is zero
    - perf/x86/msr: Add Airmont NP
    - perf/x86/cstate: Add Airmont NP
    - bpf: Recognize special arithmetic shift in the verifier
    - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
    - gpu/panel-edp: add AUO panel entry for B140HAN06.4
    - drm/amdgpu: fix NULL pointer issue buffer funcs
    - ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET
    - media: chips-media: wave5: Fix conditional in start_streaming
    - media: chips-media: wave5: Process ready frames when CMD_STOP sent to
      Encoder
    - drm/amd/display: Fix dsc eDP issue
    - drm/panel: Fix a possible null-pointer dereference in
      jdi_panel_dsi_remove()
    - media: mt9m114: Avoid a reset low spike during probe()
    - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
    - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
    - PCI: Add Intel Nova Lake audio Device ID
    - drm/amd/display: Disable FEC when powering down encoders
    - drm/amd/display: avoid dig reg access timeout on usb4 link training fail
    - hwmon: (dell-smm) Add support for Dell OptiPlex 7080
    - HID: logitech-hidpp: Add support for Logitech K980
    - ASoC: SOF: Intel: hda: Fix NULL pointer dereference
    - spi: geni-qcom: Fix abort sequence execution for serial engine errors
    - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
    - wifi: rtw89: 8922a: set random mac if efuse contains zeroes
    - wifi: rtw89: ser: enable error IMR after recovering from L1
    - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
    - wifi: rtw89: mac: correct page number for CSI response
    - wifi: ath11k: Fix failure to connect to a 6 GHz AP
    - ipv6: annotate data-races over sysctl.flowlabel_reflect
    - ext4: use reserved metadata blocks when splitting extent on endio
    - Bluetooth: btusb: Add support for MediaTek7920 0489:e158
    - net: sfp: add quirk for Lantech 8330-265D
    - PCI/AER: Clear stale errors on reporting agents upon probe
    - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
    - riscv: vector: init vector context with proper vlenb
    - HID: i2c-hid: Add FocalTech FT8112
    - 9p/xen: protect xen_9pfs_front_free against concurrent calls
    - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
    - most: remove usage of the deprecated ida_simple_xx() API
    - most: core: fix resource leak in most_register_interface error paths
    - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
    - serial: 8250: 8250_omap.c: Add support for handling UART error
      conditions
    - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
    - ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
    - drm/amd/display: Fix writeback on DCN 3.2+
    - drm/amd/display: Fix system resume lag issue
    - drm/amd/display: bypass post csc for additional color spaces in dal
    - spi: spidev: fix lock inversion between spi_lock and buf_lock
    - Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings
    - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too
      short
    - kcm: fix zero-frag skb in frag_list on partial sendmsg error
    - net/mlx5: E-switch, Clear legacy flag when moving to switchdev
    - net/mlx5e: Separate address related variables to be in struct
    - net/mlx5e: Support routed networks during IPsec MACs initialization
    - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
    - drm/tests: shmem: Swap names of export tests
    - KVM: x86: Return "unsupported" instead of "invalid" on access to
      unsupported PV MSR
    - media: amphion: Drop min_queued_buffers assignment
    - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
    - media: i2c: ov01a10: Fix passing stream instead of pad to
      v4l2_subdev_state_get_format()
    - media: ccs: Fix setting initial sub-device state
    - platform/x86: ISST: Add missing write block check
    - bus: omap-ocp2scp: fix OF populate on driver rebind
    - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
    - drm/buddy: Prevent BUG_ON by validating rounded allocation
    - xfs: remove xfs_attr_leaf_hasname
    - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
    - mfd: omap-usb-host: Fix OF populate on driver rebind
    - xfs: fix the xattr scrub to detect freemap/entries array collisions
    - pinctrl: intel: Add code name documentation
    - vhost: move vdpa group bound check to vhost_vdpa
    - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
    - mm/slab: use unsigned long for orig_size to ensure proper metadata align
    - drm/amd/display: Increase DCN35 SR enter/exit latency
    - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
    - mm: numa_memblks: Identify the accurate NUMA ID of CFMW
    - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
    - most: core: fix leak on early registration failure
    - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
    - Upstream stable to v6.6.128, v6.12.75

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2026-23249
    - xfs: check for deleted cursors when revalidating two btrees

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2025-71267
    - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2025-71265
    - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
      metadata

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2025-71266
    - fs: ntfs3: check return value of indx_find to avoid infinite loop

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2026-23241
    - audit: add missing syscalls to read class

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2025-71239
    - audit: add fchmodat2() to change attributes class

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2026-31411
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2026-23243
    - RDMA/umad: Reject negative data_len in ib_umad_write

  * Noble update: upstream stable patchset 2026-05-01 (LP: #2150809) //
    CVE-2026-23242
    - RDMA/siw: Fix potential NULL pointer dereference in header processing

  * Noble update: upstream stable patchset 2026-04-17 (LP: #2148714)
    - scsi: qla2xxx: Fix bsg_done() causing double free
    - PCI: endpoint: Remove unused field in struct pci_epf_group
    - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show
      functions
    - bus: fsl-mc: fix use-after-free in driver_override_show()
    - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list
    - gpio: sprd: Change sprd_gpio lock to raw_spin_lock
    - ALSA: hda/realtek: Add quirk for Inspur S14-G1
    - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel
    - romfs: check sb_set_blocksize() return value
    - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used
    - platform/x86: classmate-laptop: Add missing NULL pointer checks
    - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9
    - ASoC: amd: yc: Add quirk for HP 200 G2a 16
    - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro
    - platform/x86: panasonic-laptop: Fix sysfs group leak in error path
    - ASoC: cs42l43: Correct handling of 3-pole jack load detection
    - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()
    - gpiolib: acpi: Fix gpio count with string references
    - LoongArch: Rework KASAN initialization for PTW-enabled systems
    - Revert "wireguard: device: enable threaded NAPI"
    - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
    - mm/hugetlb: fix hugetlb_pmd_shared()
    - mm/hugetlb: fix two comments related to huge_pmd_unshare()
    - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using
      mmu_gather
    - cpuset: Fix missing adaptation for cpuset_is_populated
    - LoongArch: Add writecombine support for DMW-based ioremap()
    - fbdev: rivafb: fix divide error in nv3_arb()
    - fbdev: smscufx: properly copy ioctl memory to kernelspace
    - f2fs: fix to add gc count stat in f2fs_gc_range
    - f2fs: fix out-of-bounds access in sysfs attribute read/write
    - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent
      atomic commit and checkpoint writes
    - f2fs: fix to avoid UAF in f2fs_write_end_io()
    - f2fs: fix to avoid mapping wrong physical block for swapfile
    - USB: serial: option: add Telit FN920C04 RNDIS compositions
    - bnxt_en: Change FW message timeout warning
    - bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code
    - ALSA: hda/realtek: Enable headset mic for Acer Nitro 5
    - drm/amd/display: remove assert around dpp_base replacement
    - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
    - Upstream stable to v6.6.126, v6.6.127, v6.12.73, v6.12.74

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260)
    - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
    - crypto: octeontx - Fix length check to avoid truncation in
      ucode_load_store
    - crypto: virtio - Remove duplicated virtqueue_kick in
      virtio_crypto_skcipher_crypt_req
    - scsi: qla2xxx: Allow recovery for tape devices
    - scsi: qla2xxx: Query FW again before proceeding with login
    - Revert "netfilter: nf_tables: missing objects with no memcg accounting"
    - netfilter: nf_tables: missing objects with no memcg accounting
    - vsock/test: verify socket options after setting them
    - selftests: mptcp: pm: ensure unknown flags are ignored
    - gpio: omap: do not register driver in probe()
    - net: tunnel: make skb_vlan_inet_prepare() return drop reasons
    - Upstream stable to v6.6.125, v6.12.71, v6.12.72

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2025-71233
    - PCI: endpoint: Avoid creating sub-groups asynchronously

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2025-71231
    - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2026-23169
    - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2025-40005
    - spi: cadence-quadspi: Implement refcount to handle unbind during busy

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2025-71232
    - scsi: qla2xxx: Free sp in error path to fix system crash

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2025-71235
    - scsi: qla2xxx: Delay module unload while fabric scan in progress

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2025-71236
    - scsi: qla2xxx: Validate sp before freeing associated memory

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2025-71229
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2025-71237
    - nilfs2: Fix potential block overflow that cause system hang

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2026-23229
    - crypto: virtio - Add spinlock protection with virtqueue notification

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2026-23222
    - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2026-23228
    - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2026-23220
    - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error
      paths

  * Noble update: upstream stable patchset 2026-04-13 (LP: #2148260) //
    CVE-2026-23230
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races

  * CVE-2026-23272
    - netfilter: nf_tables: unconditionally bump set->nelems before insertion

  * CVE-2026-31418
    - netfilter: ipset: drop logically empty buckets in mtype_del

  * CVE-2026-23392
    - netfilter: nf_tables: release flowtable after rcu grace period on error

  * CVE-2026-23278
    - netfilter: nf_tables: always walk all pending catchall elements

  * GRO managed-frag use-after-free leading to local privilege escalation
    (LP: #2154172)
    - net: gro: don't merge zcopy skbs

  * AppArmor Vulnerabilities  (LP: #2151747)
    - apparmor: Fix incorrect profile->signal range check
    - SAUCE: apparmor: pass big_resp to handler
    - SAUCE: apparmor: remove redundant kref_init for listener->count
    - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47337
    - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47336
    - SAUCE: apparmor: fix use of unintialized variable in net opt level

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47335
    - SAUCE: apparmor: fix possible NULL pointer dereference by adding a NULL
      check

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47334
    - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47333
    - SAUCE: apparmor: fix dfa unpacking size of the notification filter

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47332
    - SAUCE: apparmor: fix size check against type instead of pointer

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47331
    - SAUCE: apparmor: fix changing rules list without a lock

  * apparmor: LLVM/clang build failure due to uninitialized variable in
    notify.c (LP: #2148809) // CVE-2026-47330
    - SAUCE: apparmor: initialize variable used in uninitialized context

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47329
    - SAUCE: apparmor: fix name validation bypass on notification

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47327 //
    CVE-2026-47328
    - SAUCE: apparmor: fix glob memory leak after kstrdup

  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47326
    - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer

  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers

  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails

  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic

  * CVE-2026-43500
    - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
    - rxrpc: Parse received packets before dealing with timeouts
    - rxrpc: Fix potential UAF after skb_unshare() failure
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

  * CVE-2026-31676 // CVE-2026-43500
    - rxrpc: only handle RESPONSE during service challenge

  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags

  * CVE-2026-31419
    - net: bonding: fix use-after-free in bond_xmit_broadcast()

  * CVE-2026-31431
    - crypto: scatterwalk - Backport memcpy_sglist()
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
    - crypto: algif_aead - Revert to operating out-of-place
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: authenc - use memcpy_sglist() instead of null skcipher
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
      decryption
    - crypto: authencesn - Fix src offset when decrypting in-place
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
    - crypto: algif_aead - Fix minimum RX size check for decryption

  * CVE-2026-31533
    - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption

  * CVE-2026-31504
    - net: fix fanout UAF in packet_release() via NETDEV_UP race

 -- Edoardo Canepa <edoardo.canepa@canonical.com>  Fri, 29 May 2026 13:19:56 +0200

linux (6.8.0-116.116) noble; urgency=medium

  * noble/linux: 6.8.0-116.116 -proposed tracker (LP: #2150048)

  * Linux kernel  6.17.0-22.22  breaks amdxdna (LP: #2149766)
    - Revert "iommu: disable SVA when CONFIG_X86 is set"

  * Revert "netfilter: conntrack: fix erronous removal of offload bit"
    (LP: #2149762)
    - Revert "netfilter: conntrack: fix erronous removal of offload bit"

 -- Mehmet Basaran <mehmet.basaran@canonical.com>  Thu, 23 Apr 2026 00:33:23 +0300

linux (6.8.0-114.114) noble; urgency=medium

  * noble/linux: 6.8.0-114.114 -proposed tracker (LP: #2148397)

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465)
    - SAUCE: Fix skb_vlan_inet_prepare() usage

 -- Mehmet Basaran <mehmet.basaran@canonical.com>  Wed, 15 Apr 2026 13:37:36 +0300

linux (6.8.0-112.112) noble; urgency=medium

  * noble/linux: 6.8.0-112.112 -proposed tracker (LP: #2147982)

  * Canonical Kmod 2025 key rotation (LP: #2147447)
    - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing
      extensible
    - [Packaging] ubuntu-compatible-signing -- allow consumption of positive
      certs
    - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key
    - [Config] prepare for Canonical Kmod key rotation
    - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key

  * Remount ext4 to readonly with data=journal mode may dump call trace
    (LP: #2147400)
    - ext4: fix stale xarray tags after writeback

  * Compile error due to nonexistent struct member with CONFIG_PCI_EPF_TEST
    (LP: #2147065)
    - SAUCE: Revert "PCI: endpoint: pci-epf-test: Limit PCIe BAR size for
      fixed BARs"

  * BUG: kernel NULL pointer dereference in amdgpu (LP: #2144577)
    - drm/amdgpu: validate the flush_gpu_tlb_pasid()
    - drm/amdgpu: Fix validating flush_gpu_tlb_pasid()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841)
    - x86/kfence: fix booting on 32bit non-PAE systems
    - platform/x86: intel_telemetry: Fix swapped arrays in PSS output
    - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest
      state
    - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup
    - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset
    - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system
      wakeup
    - rbd: check for EOD after exclusive lock is ensured to be held
    - ARM: 9468/1: fix memset64() on big-endian
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
    - binder: fix BR_FROZEN_REPLY error log
    - binderfs: fix ida_alloc_max() upper bound
    - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test
      failures
    - tracing: Fix ftrace event field alignments
    - net: usb: sr9700: support devices with virtual driver CD
    - block,bfq: fix aux stat accumulation destination
    - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED
    - HID: intel-ish-hid: Update ishtp bus match to support device ID table
    - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL
    - HID: intel-ish-hid: Reset enum_devices_done before enumeration
    - HID: playstation: Center initial joystick axes to prevent spurious
      events
    - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk
    - netfilter: replace -EEXIST with -EBUSY
    - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list
    - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)
    - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free
    - wifi: mac80211: collect station statistics earlier when disconnect
    - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe
    - ASoC: amd: yc: Fix microphone on ASUS M6500RE
    - ASoC: tlv320adcx140: Propagate error codes during probe
    - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs
      initialization
    - wifi: cfg80211: Fix bitrate calculation overflow for HE rates
    - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
    - wifi: mac80211: correctly check if CSA is active
    - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice
    - platform/x86: intel_telemetry: Fix PSS event register mask
    - platform/x86: hp-bioscfg: Skip empty attribute names
    - net: add skb_header_pointer_careful() helper
    - net: don't touch dev->stats in BPF redirect paths
    - tipc: use kfree_sensitive() for session key material
    - net: ethernet: adi: adin1110: Check return value of
      devm_gpiod_get_optional() in adin1110_check_spi()
    - drm/mgag200: fix mgag200_bmc_stop_scanout()
    - hwmon: (occ) Mark occ_init_attribute() as __printf
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF
    - gve: Correct ethtool rx_dropped calculation
    - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed
      transfer
    - spi: tegra210-quad: Move curr_xfer read inside spinlock
    - spi: tegra210-quad: Protect curr_xfer assignment in
      tegra_qspi_setup_transfer_one
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
    - spi: tegra210-quad: Protect curr_xfer clearing in
      tegra_qspi_non_combined_seq_xfer
    - spi: tegra114: Preserve SPI mode bits in def_command1_reg
    - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU.
    - PCI/ERR: Ensure error recoverability at all times
    - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55
    - PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
    - HID: logitech: add HID++ support for Logitech MX Anywhere 3S
    - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio
    - net: phy: add phy_interface_weight()
    - net: phy: add phy_interface_copy()
    - net: sfp: pre-parse the module support
    - net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module
    - net: sfp: convert sfp quirks to modify struct sfp_module_support
    - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module
    - drm/amd/display: fix wrong color value mapping on MCM shaper LUT
    - drm/xe/query: Fix topology query pointer advance
    - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()
    - gpiolib-acpi: Update file references in the Documentation and
      MAINTAINERS
    - Upstream stable to v6.6.124, v6.12.70

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23214
    - btrfs: reject new transactions if the fs is fully read-only

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23213
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71225
    - md: suspend array while updating raid_disks via sysfs

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-68823
    - ublk: fix deadlock when reading partition table

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23191
    - ALSA: aloop: Fix racy access at PCM trigger

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23215
    - x86/vmware: Fix hypercall clobbers

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23182
    - spi: tegra: Fix a memory leak in tegra_slink_probe()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23190
    - ASoC: amd: fix memory leak in acp3x pdm dma ops

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23254
    - net: gro: fix outer network offset

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23180
    - dpaa2-switch: add bounds check for if_id in IRQ handler

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23256
    - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23257
    - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23258
    - net: liquidio: Initialize netdev pointer before queue setup

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23206
    - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23204
    - net/sched: cls_u32: use skb_header_pointer_careful()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23205
    - smb/client: fix memory leak in smb2_open_file()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23176
    - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23216
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23193
    - scsi: target: iscsi: Fix use-after-free in
      iscsit_dec_session_usage_count()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23260
    - regmap: maple: free entry on mas_store_gfp() failure

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23179
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23261
    - nvme-fc: release admin tagset if init fails

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23178
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71268
    - btrfs: fix reservation leak in some error paths when inserting inline
      extent

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71270
    - LoongArch: Enable exception fixup for specific ADE subcode

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71220
    - smb/server: call ksmbd_session_rpc_close() on error path in
      create_smb2_pipe()

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71222
    - wifi: wlcore: ensure skb headroom before skb_push

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-71224
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23262
    - gve: Fix stats report corruption on queue count change

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2025-38201
    - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23198
    - KVM: Don't clobber irqfd routing type when deassigning irqfd

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23264
    - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"

  * Noble update: upstream stable patchset 2026-04-10 (LP: #2147841) //
    CVE-2026-23187
    - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543)
    - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
    - net: bcmasp: fix early exit leak with fixed phy
    - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
    - ipv6: use the right ifindex when replying to icmpv6 from localhost
    - ice: stop counting UDP csum mismatch as rx_errors
    - net/mlx5e: Report rx_discards_phy via rx_dropped
    - net/mlx5e: Account for netdev stats in ndo_get_stats64
    - net: bridge: fix static key check
    - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload
    - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
    - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
    - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
    - dma/pool: distinguish between missing and exhausted atomic pools
    - pinctrl: meson: mark the GPIO controller as sleeping
    - riscv: compat: fix COMPAT_UTS_MACHINE definition
    - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target
    - ASoC: fsl: imx-card: Do not force slot width to sample width
    - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
    - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
    - gpio: pca953x: mask interrupts in irq shutdown
    - scsi: qla2xxx: edif: Fix dma_free_coherent() size
    - mptcp: only reset subflow errors when propagated
    - selftests: mptcp: check no dup close events after error
    - selftests: mptcp: check subflow errors in close events
    - selftests: mptcp: join: fix local endp not being tracked
    - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
    - drm/amdgpu/soc21: fix xclk for APUs
    - drm/amdgpu/gfx10: fix wptr reset in KGQ init
    - drm/amdgpu/gfx11: fix wptr reset in KGQ init
    - mm/kfence: randomize the freelist on initialization
    - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state
    - arm64/fpsimd: signal: Consistently read FPSIMD context
    - btrfs: prevent use-after-free on page private data in
      btrfs_subpage_clear_uptodate()
    - net/sched: act_ife: convert comma to semicolon
    - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
    - drm/msm/a6xx: fix bogus hwcg register updates
    - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
    - mptcp: avoid dup SUB_CLOSED events after disconnect
    - ksmbd: fix recursive locking in RPC handle list access
    - bpf/selftests: test_select_reuseport_kern: Remove unused header
    - can: at91_can: Fix memory leak in at91_can_probe()
    - net: phy: micrel: fix clk warning when removing the driver
    - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect
    - net/mlx5: Initialize events outside devlink lock
    - net/mlx5: Fix vhca_id access call trace use before alloc
    - bcache: fix improper use of bi_end_io
    - bcache: use bio cloning for detached device requests
    - bcache: fix I/O accounting leak in detached_dev_do_request
    - gpio: rockchip: Stop calling pinctrl for set_direction
    - mm/memory-failure: improve memory failure action_result messages
    - mm/memory-failure: fix redundant updates for already poisoned pages
    - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison
    - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail
      page pfn
    - gpiolib: acpi: Fix potential out-of-boundary left shift
    - rust: kbuild: support `-Cjump-tables=n` for Rust 1.93.0
    - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR
      TX pins
    - [Config] remove PINCTRL_SM8350_LPASS_LPI
    - Upstream stable to v6.6.123, v6.12.69

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23148
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23166
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23151
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23163
    - drm/amdgpu: fix NULL pointer dereference in
      amdgpu_gmc_filter_faults_remove

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23159
    - perf: sched: Fix perf crash with new is_user_task() helper

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2024-58096
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2025-40039
    - ksmbd: Fix race condition in RPC handle list access

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23093
    - ksmbd: smbd: fix dma_unmap_sg() nents

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23102
    - arm64/fpsimd: signal: Fix restoration of SVE context

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23170
    - drm/imx/tve: fix probe device leak

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23168
    - flex_proportions: make fprop_new_period() hardirq safe

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23156
    - efivarfs: fix error propagation in efivar_entry_get()

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23167
    - nfc: nci: Fix race between rfkill and nci_unregister_device().

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23173
    - net/mlx5e: TC, delete flows only for existing peers

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23150
    - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23164
    - rocker: fix memory leak in rocker_world_port_post_fini()

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23172
    - net: wwan: t7xx: fix potential skb->frags overflow in RX path

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23212
    - bonding: annotate data-races around slave->last_rx

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23160
    - octeon_ep: Fix memory leak in octep_device_setup()

  * Noble update: upstream stable patchset 2026-04-08 (LP: #2147543) //
    CVE-2026-23146
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work

  * CVE-2026-23394
    - af_unix: Give up GC if MSG_PEEK intervened.

  * [SRU] MIPI camera is not working after upgrading to 6.17-oem
    (LP: #2145171)
    - SAUCE: ACPI: respect items already in honor_dep before skipping

  * ADATA SU680 causes repeated SATA resets and I/O errors on Ubuntu unless
    link power management is forced to max_performance (LP: #2144060)
    - ata: libata-core: disable LPM on ADATA SU680 SSD

  *  intel_idle: add Clearwater Forest SoC support (LP: #2144006)
    - intel_idle: add Clearwater Forest SoC support

  * Noble kernel 6.8.0-108 does not compile when KASAN enabled (LP: #2144914)
    - mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN

  * Generic noble linux throws warning from file tegra-i2c.c (LP: #2143152)
    - i2c: tegra: Use internal reset when reset property is not available

  * [SRU] Duplicated entries in /proc/<pid>/mountinfo (LP: #2143083)
    - namespace: fix proc mount iteration

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465)
    - firmware: imx: scu-irq: Set mu_resource_id before get handle
    - efi/cper: Fix cper_bits_to_str buffer handling and return value
    - ASoC: codecs: wsa884x: fix codec initialisation
    - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
    - net: bridge: annotate data-races around fdb->{updated,used}
    - net: update netdev_lock_{type,name}
    - vsock/test: add a final full barrier after run all tests
    - net/mlx5e: Restore destroying state bit after profile cleanup
    - btrfs: store fs_info in space_info
    - btrfs: factor out init_space_info() from create_space_info()
    - btrfs: factor out check_removing_space_info() from
      btrfs_free_block_groups()
    - btrfs: introduce btrfs_space_info sub-group
    - btrfs: fix memory leaks in create_space_info() error paths
    - selftests: drv-net: fix RPS mask handling for high CPU numbers
    - ASoC: tlv320adcx140: fix word length
    - textsearch: describe @list member in ts_ops search
    - mm, kfence: describe @slab parameter in __kfence_obj_info()
    - dmaengine: xilinx_dma: Fix uninitialized addr_width when
      "xlnx,addrwidth" property is missing
    - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it
    - phy: phy-snps-eusb2: refactor constructs names
    - phy: drop probe registration printks
    - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
    - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA
    - HID: usbhid: paper over wrong bNumDescriptor field
    - scsi: core: Fix error handler encryption support
    - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
    - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
    - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
    - phy: rockchip: inno-usb2: fix communication disruption in gadget mode
    - phy: freescale: imx8m-pcie: assert phy reset during power on
    - phy: rockchip: inno-usb2: fix disconnection in gadget mode
    - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
    - usb: dwc3: Check for USB4 IP_NAME
    - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
    - USB: OHCI/UHCI: Add soft dependencies on ehci_platform
    - USB: serial: option: add Telit LE910 MBIM composition
    - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
    - nvme-pci: disable secondary temp for Wodposit WPBSNM8
    - hrtimer: Fix softirq base check in update_needs_ipi()
    - EDAC/x38: Fix a resource leak in x38_probe1()
    - EDAC/i3200: Fix a resource leak in i3200_probe1()
    - tcpm: allow looking for role_sw device in the main node
    - x86/resctrl: Add missing resctrl initialization for Hygon
    - x86/resctrl: Fix memory bandwidth counter width for Hygon
    - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
    - LoongArch: Fix PMU counter allocation for mixed-type event groups
    - drm/amd/display: Bump the HDMI clock to 340MHz
    - drm/amd: Clean up kfd node on surprise disconnect
    - drm/amdkfd: fix a memory leak in device_queue_manager_init()
    - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
    - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
    - dmaengine: apple-admac: Add "apple,t8103-admac" compatible
    - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
    - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
    - dmaengine: ti: k3-udma: fix device leak on udma lookup
    - io_uring: move local task_work in exit cancel loop
    - posix-clock: Store file pointer in struct posix_clock_context
    - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
    - selftest/ptp: update ptp selftest to exercise the gettimex options
    - testptp: Add option to open PHC in readonly mode
    - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
    - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_*
    - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump()
    - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
    - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains
    - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner
    - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions
    - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
    - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
    - ata: libata: Add cpr_log to ata_dev_print_features() early return
    - ata: libata-core: Introduce ata_dev_config_lpm()
    - ata: libata: Call ata_dev_config_lpm() for ATAPI devices
    - ata: libata: Print features also for ATAPI devices
    - ice: initialize ring_stats->syncp
    - ice: Avoid detrimental cleanup for bond during interface stop
    - igc: fix race condition in TX timestamp read for register 0
    - net: usb: dm9601: remove broken SR9700 support
    - selftests: net: fib-onlink-tests: Convert to use namespaces by default
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on
      usb_submit_urb() error
    - amd-xgbe: avoid misleading per-packet error log
    - tools: ynl: Specify --no-line-number in ynl-regen.sh.
    - veth: fix data race in veth_get_ethtool_stats
    - octeontx2: cn10k: fix RX flowid TCAM mask handling
    - serial: 8250_pci: Fix broken RS485 for F81504/508/512
    - comedi: dmm32at: serialize use of paged registers
    - w1: fix redundant counter decrement in w1_attach_slave_device()
    - Revert "nfc/nci: Add the inconsistency check between the input data
      length and count"
    - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
    - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
    - scsi: storvsc: Process unsupported MODE_SENSE_10
    - arm64: dts: rockchip: remove dangerous max-link-speed from helios64
    - arm64: dts: rockchip: Fix voltage threshold for volume keys for
      Pinephone Pro
    - x86/kfence: avoid writing L1TF-vulnerable PTEs
    - comedi: Fix getting range information for subdevices 16 to 255
    - iio: adc: ad7280a: handle spi_setup() errors in probe()
    - kconfig: fix static linking of nconf
    - riscv: clocksource: Fix stimecmp update hazard on RV32
    - ALSA: usb: Increase volume range that triggers a warning
    - net: hns3: fix data race in hns3_fetch_stats
    - be2net: fix data race in be_get_new_eqd
    - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
    - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
    - usbnet: limit max_mtu based on device's hard_mtu
    - drm/amd/pm: Don't clear SI SMC table when setting power limit
    - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
    - selftests: net: amt: wait longer for connection before sending packets
    - net: dsa: fix off-by-one in maximum bridge ID determination
    - octeontx2-af: Fix error handling
    - net: openvswitch: fix data race in ovs_vport_get_upcall_stats
    - vsock/test: fix seqpacket message bounds test
    - x86: make page fault handling disable interrupts properly
    - of: fix reference count leak in of_alias_scan()
    - of: platform: Use default match table for /firmware
    - iio: accel: iis328dq: fix gain values
    - iio: adc: ad9467: fix ad9434 vref mask
    - iio: chemical: scd4x: fix reported channel endianness
    - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
    - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
    - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
    - octeontx2: Fix otx2_dma_map_page() error return code
    - slimbus: core: fix runtime PM imbalance on report present
    - platform/x86: hp-bioscfg: Fix automatic module loading
    - perf/x86/intel: Do not enable BTS for guests
    - selftests/bpf: Check for timeout in perf_link test
    - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup
      failure
    - iio: core: add missing mutex_destroy in iio_dev_release()
    - iio: core: add separate lockdep class for info_exist_lock
    - mm/rmap: fix two comments related to huge_pmd_unshare()
    - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
    - iio: adc: exynos_adc: fix OF populate on driver rebind
    - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
    - mm: kmsan: fix poisoning of high-order non-compound pages
    - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
    - ASoC: codecs: wsa881x: Drop unused version readout
    - ASoC: codecs: wsa881x: fix unnecessary initialisation
    - ASoC: codecs: wsa883x: fix unnecessary initialisation
    - nvme-fc: rename free_ctrl callback to match name pattern
    - nvme-pci: do not directly handle subsys reset fallout
    - nvme: fix PCIe subsystem reset controller state transition
    - net: phy: fix phy_uses_state_machine()
    - pnfs/blocklayout: Fix memory leak in bl_parse_scsi()
    - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions
    - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip
    - ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type
    - selftests/landlock: Fix TCP bind(AF_UNSPEC) test case
    - xfs: Fix the return value of xfs_rtcopy_summary()
    - phy: ti: gmii-sel: fix regmap leak on probe failure
    - LoongArch: dts: loongson-2k0500: Add default interrupt controller
      address cells
    - LoongArch: dts: loongson-2k1000: Add default interrupt controller
      address cells
    - LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names
    - LoongArch: dts: loongson-2k2000: Add default interrupt controller
      address cells
    - HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume
      blocking
    - HID: intel-ish-hid: Fix -Wcast-function-type-strict in
      devm_ishtp_alloc_workqueue()
    - xfs: set max_agbno to allow sparse alloc of last full inode chunk
    - selftests/bpf: Test invalid narrower ctx load
    - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection
    - mm/page_alloc: batch page freeing in decay_pcp_high
    - ata: libata-sata: Improve link_power_management_supported sysfs
      attribute
    - igc: Restore default Qbv schedule when changing channels
    - vsock/virtio: Coalesce only linear skb
    - platform/x86/amd: Fix memory leak in wbrf_record()
    - drm/imagination: Wait for FW trace update command completion
    - ice: Fix persistent failure in ice_get_rxfh
    - sched/fair: Fix pelt clock sync when entering idle
    - drm/nouveau: add missing DCB connector types
    - drm/nouveau: implement missing DCB connector types; gracefully handle
      unknown connectors
    - dpll: Prevent duplicate registrations
    - mei: trace: treat reg parameter as string
    - s390/ap: Fix wrong APQN fill calculation
    - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick
    - gpio: cdev: Correct return code on memory allocation failure
    - dmaengine: ti: k3-udma: Enable second resource range for BCDMA and
      PKTDMA
    - exfat: fix refcount leak in exfat_find
    - accel/ivpu: Fix race condition when unbinding BOs
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
    - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put()
    - vsock/virtio: Rename virtio_vsock_alloc_skb()
    - vsock/virtio: Move SKB allocation lower-bound check to callers
    - vsock/virtio: Rename virtio_vsock_skb_rx_put()
    - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers
    - vsock/virtio: Allocate nonlinear SKBs for handling large transmit
      buffers
    - net: Introduce skb_copy_datagram_from_iter_full()
    - vsock/virtio: Fix message iterator handling on transmit path
    - Upstream stable to v6.6.122, v6.12.67, v6.12.68

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-38591
    - bpf: Reject narrower access to pointer ctx fields

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23035
    - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-22996
    - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23000
    - net/mlx5e: Fix crash on profile change rollback failure

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23053
    - NFS: Fix a deadlock involving nfs_release_folio()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23050
    - pNFS: Fix a deadlock when returning a delegation during open()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23005
    - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2024-58097
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-68365
    - fs/ntfs3: Initialize allocated memory before use

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-37926
    - ksmbd: fix use-after-free in ksmbd_session_rpc_open

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23030
    - phy: rockchip: inno-usb2: Fix a double free bug in
      rockchip_usb2phy_probe()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23025
    - mm/page_alloc: prevent pcp corruption with SMP=n

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71186
    - dmaengine: stm32: dmamux: fix device leak on route allocation

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23078
    - ALSA: scarlett2: Fix buffer overflow in config retrieval

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23142
    - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir
      setup failure

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23075
    - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-68725
    - bpf: Do not let BPF test infra emit invalid GSO types to stack

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23097
    - migrate: correct lock ordering for hugetlb file folios

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23108
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23080
    - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23061
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23058
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23085
    - irqchip/gic-v3-its: Avoid truncating memory addresses

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23116
    - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23098
    - netrom: fix double-free in nr_route_frame()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23063
    - uacce: ensure safe queue release with state management

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23056
    - uacce: implement mremap in uacce_vm_ops to return -EPERM

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23094
    - uacce: fix isolate sysfs check condition

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23096
    - uacce: fix cdev handling in the cleanup path

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23091
    - intel_th: fix device leak on output open()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23088
    - tracing: Fix crash on synthetic stacktrace field usage

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23090
    - slimbus: core: fix device reference leak on report present

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23128
    - arm64: Set __nocfi on swsusp_arch_resume()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23107
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23073
    - wifi: rsi: Fix memory corruption due to not set vif driver data size

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23135
    - wifi: ath12k: fix dma_free_coherent() pointer

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23133
    - wifi: ath10k: fix dma_free_coherent() pointer

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71200
    - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400
      mode

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23089
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23076
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71199
    - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc
      driver

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23101
    - leds: led-class: Only Add LED to leds_list when it is fully ready

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23064
    - net/sched: act_ife: avoid possible NULL deref

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23086
    - vsock/virtio: cap TX credit to local buffer size

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23069
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23119
    - bonding: provide a net pointer to __skb_flow_dissect()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23084
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23124
    - ipv6: annotate data-race in ndisc_router_discovery()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23121
    - mISDN: annotate data-race around dev->work

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23126
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs
      list

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23059
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23110
    - scsi: core: Wake up the error handler when final completions race
      against each other

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23071
    - regmap: Fix race condition in hwspinlock irqsave routine

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23068
    - spi: spi-sprd-adi: Fix double free in probe error path

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23123
    - interconnect: debugfs: initialize src_node and dst_node to empty strings

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71198
    - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event
      detection

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23113
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23062
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23131
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23087
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71197
    - w1: therm: Fix off-by-one buffer overflow in alarms_store

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23105
    - net/sched: qfq: Use cl_is_active to determine whether class is active in
      qfq_rm_from_ag

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23103
    - ipvlan: Make the addrs_lock be per port

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23120
    - l2tp: avoid one data-race in l2tp_tunnel_del_work()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23083
    - fou: Don't allow 0 for FOU_ATTR_IPPROTO.

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23095
    - gue: Fix skb memleak with inner IP protocol 0.

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23125
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23099
    - bonding: limit BOND_MODE_8023AD to Ethernet devices

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71194
    - btrfs: fix deadlock in wait_current_trans() due to ignored transaction
      type

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71185
    - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23026
    - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71188
    - dmaengine: lpc18xx-dmamux: fix device leak on route allocation

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71163
    - dmaengine: idxd: fix device leaks on compat bind and unbind

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71189
    - dmaengine: dw: dmamux: fix OF node leak on route allocation failure

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71190
    - dmaengine: bcm-sba-raid: fix device leak on probe

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71191
    - dmaengine: at_hdmac: fix device leak on of_dma_xlate()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23049
    - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23144
    - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23145
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-22997
    - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session
      upon receiving the second rts

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23031
    - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23032
    - null_blk: fix kmemleak by releasing references to fault configfs items

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23033
    - dmaengine: omap-dma: fix dma_pool resource leak in error paths

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71196
    - phy: stm32-usphyc: Fix off by one in probe()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71193
    - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71162
    - dmaengine: tegra-adma: Fix use-after-free

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2025-71195
    - dmaengine: xilinx: xdma: Fix regmap max_register

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23006
    - ASoC: tlv320adcx140: fix null pointer

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-22999
    - net/sched: sch_qfq: do not free existing class in qfq_change_class()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23010
    - ipv6: Fix use-after-free in inet6_addr_del().

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23054
    - net: hv_netvsc: reject RSS hash key programming without RX indirection
      table

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23011
    - ipv4: ip_gre: make ipgre_header() robust

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23001
    - macvlan: fix possible UAF in macvlan_forward_source()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23003
    - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23141
    - btrfs: send: check for inline extents in range_is_hole_in_parent()

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-22998
    - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23037
    - can: etas_es58x: allow partial RX URB allocation to succeed

  * Noble update: upstream stable patchset 2026-03-26 (LP: #2146465) //
    CVE-2026-23038
    - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058)
    - NFSD: Fix permission check for read access to executable-only files
    - atm: Fix dma_free_coherent() size
    - mei: me: add nova lake point S DID
    - lib/crypto: aes: Fix missing MMU protection for AES S-box
    - counter: 104-quad-8: Fix incorrect return value in IRQ handler
    - drm/pl111: Fix error handling in pl111_amba_probe
    - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]
    - gpio: rockchip: mark the GPIO controller as sleeping
    - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
    - net: Add locking to protect skb->dev access in ip_output
    - nfsd: Fix a regression in nfsd_setattr()
    - nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr()
    - nfsd: set security label during create operations
    - csky: fix csky_cmpxchg_fixup not working
    - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
    - alpha: don't reference obsolete termio struct for TC* constants
    - dm-snapshot: fix 'scheduling while atomic' on real-time kernels
    - NFSv4: ensure the open stateid seqid doesn't go backwards
    - NFS: Fix up the automount fs_context to use the correct cred
    - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
    - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
    - smb/client: fix NT_STATUS_NO_DATA_DETECTED value
    - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
    - scsi: ufs: core: Fix EH failure after W-LUN resume error
    - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
      failure scanned in again after probe failed"
    - arm64: dts: add off-on-delay-us for usdhc2 regulator
    - ARM: dts: imx6q-ba16: fix RTC interrupt level
    - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics
      i.MX8M Plus DHCOM
    - netfilter: nft_synproxy: avoid possible data-race on update operation
    - gpio: pca953x: Add support for level-triggered interrupts
    - gpio: pca953x: handle short interrupt pulses on PCAL devices
    - netfilter: nf_tables: fix memory leak in nf_tables_newrule()
    - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
    - inet: ping: Fix icmp out counting
    - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
    - net/mlx5e: Don't print error message due to invalid module
    - net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
    - bnxt_en: Fix potential data corruption with HW GRO/LRO
    - net: enetc: fix build warning when PAGE_SIZE is greater than 128K
    - arp: do not assume dev_hard_header() does not change skb->head
    - ALSA: ac97bus: Use guard() for mutex locks
    - NFS: trace: show TIMEDOUT instead of 0x6e
    - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno
    - NFSD: Remove NFSERR_EAGAIN
    - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than
      4K
    - bpf: Make variables in bpf_prog_test_run_xdp less confusing
    - bpf: Support specifying linear xdp packet data size for
      BPF_PROG_TEST_RUN
    - powercap: fix race condition in register_control_type()
    - powercap: fix sscanf() error return value handling
    - ALSA: usb-audio: Update for native DSD support quirks
    - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025
    - ASoC: fsl_sai: Add missing registers to cache default
    - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout
    - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
    - ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
    - btrfs: tracepoints: use btrfs_root_id() to get the id of a root
    - crypto: qat - fix duplicate restarting msg during AER error
    - netfilter: nft_set_pipapo: fix range overlap detection
    - vsock: Make accept()ed sockets use custom setsockopt()
    - btrfs: only enforce free space tree if v1 cache is required for bs < ps
      cases
    - riscv: pgtable: Cleanup useless VA_USER_XXX definitions
    - idpf: keep the netdev when a reset fails
    - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant
    - ata: libata-core: Disable LPM on ST2000DM008-2FR102
    - drm/amd/display: Fix DP no audio issue
    - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL
    - spi: cadence-quadspi: Prevent lost complete() call during indirect read
    - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
    - Upstream stable to v6.6.121, v6.12.66

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71184
    - btrfs: fix NULL dereference on root when tracing inode eviction

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71182
    - can: j1939: make j1939_session_activate() fail if device is no longer
      registered

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71160
    - netfilter: nf_tables: avoid chain re-validation if possible

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22994
    - bpf: Fix reference count leak in bpf_prog_test_run_xdp()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23140
    - bpf, test_run: Subtract size of xdp_frame from allowed metadata size

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71192
    - ALSA: ac97: fix a double free in snd_ac97_controller_register()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23021
    - net: usb: pegasus: fix memory leak in update_eth_regs_async()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22976
    - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate
      in qfq_reset

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22979
    - net: fix memory leak in skb_segment_list for GRO packets

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22977
    - net: sock: fix hardened usercopy panic in sock_recv_errqueue

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22982
    - net: mscc: ocelot: Fix crash when adding interface under a lag

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23019
    - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23139
    - netfilter: nf_conncount: update last_gc only when GC has been performed

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-40149
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-68803
    - NFSD: NFSv4 file creation neglects setting ACL

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23047
    - libceph: make calc_target() set t->paused, not just clear it

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23136
    - libceph: reset sparse-read state in osd_fault()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22992
    - libceph: return the handler error from mon_handle_auth_done()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22991
    - libceph: make free_choose_arg_map() resilient to partial allocation

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22990
    - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22984
    - libceph: prevent potential out-of-bounds reads in handle_auth_done()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22978
    - wifi: avoid kernel-infoleak from struct iw_point

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71180
    - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2025-71183
    - btrfs: always detect conflicting inodes when logging inode refs

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-23020
    - net: 3com: 3c59x: fix possible null dereference in vortex_probe1()

  * Noble update: upstream stable patchset 2026-03-12 (LP: #2144058) //
    CVE-2026-22980
    - nfsd: provide locking for v4_end_grace

  * CVE-2024-50004
    - drm/amd/display: update DML2 policy
      EnhancedPrefetchScheduleAccelerationFinal DCN35

  * CVE-2026-23274
    - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels

  * CVE-2026-23351
    - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase

  * CVE-2026-23231
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

  * macvlan: observe an RCU grace period in macvlan_common_newlink() error
    path (LP: #2144380) // CVE-2026-23209
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error
      path

  * CVE-2026-23112
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

 -- Mehmet Basaran <mehmet.basaran@canonical.com>  Sun, 12 Apr 2026 06:19:35 +0300

linux (6.8.0-110.110) noble; urgency=medium

  * noble/linux: 6.8.0-110.110 -proposed tracker (LP: #2144887)

  * ITS mitigation is not enabled on affected CPUs (LP: #2144730)
    - x86/bugs: Rename CONFIG_RETPOLINE => CONFIG_MITIGATION_RETPOLINE
    - x86/bugs: Rename CONFIG_RETHUNK => CONFIG_MITIGATION_RETHUNK
    - [Config] rename config options RETHUNK and RETPOLINE

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 19 Mar 2026 12:44:28 +0100

# For older changelog entries, run 'apt-get changelog linux-vmware-tools-6.8.0-1004'
