{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-image-7.0.0-43-generic", "linux-main-modules-zfs-7.0.0-43-generic", "linux-modules-7.0.0-43-generic" ], "removed": [ "linux-image-7.0.0-42-generic", "linux-main-modules-zfs-7.0.0-42-generic", "linux-modules-7.0.0-42-generic" ], "diff": [ "ca-certificates", "linux-image-virtual" ] } }, "diff": { "deb": [ { "name": "ca-certificates", "from_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.26.04.1", "version": "20260816ubuntu0.26.04.1" }, "to_version": { "source_package_name": "ca-certificates", "source_package_version": "20260816ubuntu0.26.04.2", "version": "20260816ubuntu0.26.04.2" }, "cves": [], "launchpad_bugs_fixed": [ 2061817 ], "changes": [ { "cves": [], "log": [ "", " * Run update-ca-certificates synchronously with hooks enabled during", " postinst configure so additions and removals are not lost before hooks", " run (LP: #2061817, Debian #1069251).", " * Forward --fresh to hook scripts, allowing ca-certificates-java to request", " a full reconciliation (Debian #866670).", " * Break ca-certificates-java versions older than the trigger-safe 20210218", " hook implementation.", " * Remove a stale deterministic temporary bundle before rebuilding it.", " * Document hook stdin, --fresh forwarding, and add-before-remove ordering.", "" ], "package": "ca-certificates", "version": "20260816ubuntu0.26.04.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [ 2061817 ], "author": "Vyom Yadav ", "date": "Mon, 02 Nov 2026 13:36:02 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-42.42", "version": "7.0.0-42.42" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.0.0-43.43", "version": "7.0.0-43.43" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-43.43", "" ], "package": "linux-meta", "version": "7.0.0-43.43", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Stefan Bader ", "date": "Fri, 23 Oct 2026 14:03:36 +0200" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-image-7.0.0-43-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-42.42", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-43.43", "version": "7.0.0-43.43" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-43.43", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "7.0.0-43.43", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013 ], "author": "Stefan Bader ", "date": "Fri, 23 Oct 2026 14:03:02 +0200" } ], "notes": "linux-image-7.0.0-43-generic version '7.0.0-43.43' (source package linux-signed version '7.0.0-43.43') was added. linux-image-7.0.0-43-generic version '7.0.0-43.43' has the same source package name, linux-signed, as removed package linux-image-7.0.0-42-generic. As such we can use the source package version of the removed package, '7.0.0-42.42', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.0.0-43-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-42.42", "version": null }, "to_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-43.43", "version": "7.0.0-43.43" }, "cves": [], "launchpad_bugs_fixed": [ 1786013, 2166733 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.0.0-39.39", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "", " * New upstream core24.60 release (LP: #2166733)", " - [Packaging] add bison/flex for iwlwifi", "", " * Miscellaneous Ubuntu changes", " - [Packaging]: lmm: Add the kernel version to the kernel variant", " - [Packaging] lmm: Add flavour migration support", " - [Packaging] Allow debpaths of additional formats", " - [Packaging] Remove compat file from lmg ancillary", " - [Packaging]: Update manifest file with new patches", "" ], "package": "linux-main-signed", "version": "7.0.0-39.39", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 1786013, 2166733 ], "author": "Stefan Bader ", "date": "Thu, 24 Sep 2026 11:54:56 +0200" } ], "notes": "linux-main-modules-zfs-7.0.0-43-generic version '7.0.0-43.43' (source package linux-main-signed version '7.0.0-43.43') was added. linux-main-modules-zfs-7.0.0-43-generic version '7.0.0-43.43' has the same source package name, linux-main-signed, as removed package linux-main-modules-zfs-7.0.0-42-generic. As such we can use the source package version of the removed package, '7.0.0-42.42', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-43-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-42.42", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.0.0-43.43", "version": "7.0.0-43.43" }, "cves": [ { "cve": "CVE-2026-98038", "url": "https://ubuntu.com/security/CVE-2026-98038", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs bpf_refcount_acquire() is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KF_RET_NULL on the return value unless the argument is an owning reference. An RCU-protected load of a local kptr is marked MEM_ALLOC, but it only receives NON_OWN_REF when the pointee contains a graph node. A refcounted object without a graph node consequently looks like an owning reference even though the loaded register has no acquired reference state. If the program drops the last real reference while remaining in the RCU critical section, refcount_inc_not_zero() returns NULL while the verifier treats the result as non-NULL. Only classify the argument as owning when it is backed by a verifier-tracked reference. This retains the non-NULL return for pointers from bpf_obj_new(), bpf_kptr_xchg(), or an earlier successful acquisition, while requiring a NULL check for borrowed RCU kptrs. [ kkd: Rewrote commit log ]", "cve_priority": "medium", "cve_public_date": "2026-09-25 11:17:00 UTC" }, { "cve": "CVE-2026-93175", "url": "https://ubuntu.com/security/CVE-2026-93175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpu_dm_crtc_reset_state() frees the old state before allocating a new one. If kzalloc() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory. Fix this by allocating the new state first. On allocation failure, the old state remains untouched and the function safely returns. Found by Linux Verification Center (linuxtesting.org) with SVACE. [adjust for movement around current amd-staging-drm-next]", "cve_priority": "high", "cve_public_date": "2026-09-17 17:18:00 UTC" }, { "cve": "CVE-2026-90317", "url": "https://ubuntu.com/security/CVE-2026-90317", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpf_spin_unlock() ends that protection, but the verifier leaves the pointer valid. Another CPU can then free the object before the pointer is used. A capability-limited runtime PoC triggered a task_struct use-after-free in __bpf_get_task_stack(). Record whether the program is in an RCU-protected context before releasing the lock. Invalidate RCU-protected pointers only when the unlock leaves the final such context. This preserves valid pointers in non-sleepable programs and inside an explicit RCU read-side section.", "cve_priority": "high", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90315", "url": "https://ubuntu.com/security/CVE-2026-90315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down. Commit eb627e17727e (\"PCI: Lock down BAR access when the kernel is locked down\") added the check to pci_write_config(), pci_mmap_resource(), and pci_write_resource_io() to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code, but did not cover the legacy handlers. As a result, root can still write arbitrary I/O ports and map the legacy I/O and memory spaces while the kernel is locked down, which is the same capability the lockdown is meant to remove. Add the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io(). These generic handlers cover both architectures that define HAVE_PCI_LEGACY (such as Alpha and PowerPC). [bhelgaas: add Link]", "cve_priority": "low", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90167", "url": "https://ubuntu.com/security/CVE-2026-90167", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pending_break wakes that waiter, but without serializing the close transition with bit acquisition it can become a new break owner through the test_and_set_bit() fast path. It can then overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for a dying opinfo. Make OPLOCK_CLOSING terminal once the opinfo is removed from the inode list. Serialize that transition, pending_break acquisition, and OPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses the race releases its ownership and returns -ENOENT. Explicitly wake pending_break waiters during close so they can observe the terminal state. Also prevent ACK and timeout paths from replacing OPLOCK_CLOSING with OPLOCK_STATE_NONE.", "cve_priority": "high", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90162", "url": "https://ubuntu.com/security/CVE-2026-90162", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid-batch granted locks are published to connection-wide (conn->lock_list) and file-wide (fp->lock_list) lists immediately upon vfs_lock_file() success, while also remaining tracked on the stack-local rollback_list. If a subsequent element in the same SMB2_LOCK request array fails validation or execution, the thread jumps to out: and walks rollback_list to undo previously granted locks. However, because the granted lock was already published to conn->lock_list, a concurrent UNLOCK request on the same connection can find the lock object and kfree() it before the rollback loop executes. When the granting thread subsequently walks rollback_list, it dereferences and frees the already-freed ksmbd_lock structure, resulting in a Use-After-Free and Double-Free (on both ksmbd_lock and struct file_lock). Fix this by deferring the publication of granted locks to conn->lock_list and fp->lock_list until after the entire array of lock elements has been processed without error. Mid-batch grants remain tracked exclusively on the request-local rollback_list until the whole batch succeeds, eliminating the race window.", "cve_priority": "critical", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90155", "url": "https://ubuntu.com/security/CVE-2026-90155", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A file_lock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flc_blocked_requests. The ksmbd_file reference count does not cover that graph. Both __ksmbd_close_fd() and the cross-request unlock path free these retained file_lock objects directly. If a dependent waiter is still attached, locks_release_private() hits BUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime mismatch can leave a freed ksmbd_lock reachable through its request-local llist. Detach the file_lock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locks_delete_block() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbd_lock no longer points into the submitting worker's stack.", "cve_priority": "high", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90144", "url": "https://ubuntu.com/security/CVE-2026-90144", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dpll_device_ops() during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpll_pin_on_pin_register(), the dpll object stays alive with an empty registration list. A pin notification queued before the unregister (e.g. ice reacting to zl3073x_i2c removal) then walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and dereferences the missing registration. dpll_lock cannot help because the notification work was queued before the unregistering driver took the lock. Treat the empty registration list as a legitimate transient state. Make dpll_priv() and dpll_device_ops() return NULL in that case and make every pin netlink path that resolves a device from a pin skip such dplls. dpll_cmd_pin_get_one() picks a ref with a live registration and returns -ENODEV when there is none, the pin dumpit skips such a pin instead of aborting the dump, dpll_msg_add_pin_dplls() and the frequency, esync, reference sync and phase adjust set paths skip dead refs, and dpll_pin_parent_device_set() validates the parent with dpll_device_get_by_id(). dpll_pin_register() is the last caller that dereferenced the device ops without a check, so move its frequency monitor validation under dpll_lock and tolerate a missing registration there as well. The empty registration list is equivalent to a cleared DPLL_REGISTERED mark, both transitions happen under dpll_lock in dpll_device_register() and dpll_device_unregister(). A pin notification for a pin whose dplls are all gone is now dropped with -ENODEV instead of crashing, all callers in the core ignore that return value. WARNING: drivers/dpll/dpll_core.c:1092 at dpll_device_ops+0x24/0x40, CPU#83: kworker/u576:3/23471 Modules linked in: ... ice ... zl3073x_i2c(-) ... zl3073x ... Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice] RIP: 0010:dpll_device_ops+0x24/0x40 Call Trace: dpll_cmd_pin_get_one+0x336/0x520 dpll_pin_event_send+0x82/0x140 dpll_pin_on_pin_unregister+0xbb/0x160 ice_dpll_pin_notify_work+0x1bc/0x1f0 [ice] process_one_work+0x19e/0x370 worker_thread+0x1a6/0x310 kthread+0xe4/0x120 ret_from_fork+0x1a1/0x270 ret_from_fork_asm+0x1a/0x30 ---[ end trace 0000000000000000 ]--- BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page", "cve_priority": "low", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-89907", "url": "https://ubuntu.com/security/CVE-2026-89907", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked against EIOINTC_IRQS. eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the 256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value >= 256 reads and writes memory past the end of those arrays, i.e. any process holding a VM fd can corrupt kernel memory beyond the allocation of loongarch_eiointc. Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC path is unaffected as it decodes the vector from the address and masks it.", "cve_priority": "high", "cve_public_date": "2026-09-16 11:16:00 UTC" }, { "cve": "CVE-2026-89709", "url": "https://ubuntu.com/security/CVE-2026-89709", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.", "cve_priority": "low", "cve_public_date": "2026-09-11 20:19:00 UTC" }, { "cve": "CVE-2026-89568", "url": "https://ubuntu.com/security/CVE-2026-89568", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: kho: fix size calculation in kho_preserved_memory_reserve() kho_preserved_memory_reserve() calculates the size of a preservation by doing 1 << (order + PAGE_SHIFT). Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it will only work for preservations up to 2 GiB. Larger preservations will trigger undefined behaviour. While preservations larger than 2 GiB can't be obtained via folios currently, they can be obtained via kho_preserve_pages(). For example, memblock reserve_mem uses kho_preserve_pages(). Reservations larger than 2 GiB are valid and will trigger this bug if properly aligned. Fix it by using 1UL for shifting.", "cve_priority": "low", "cve_public_date": "2026-09-11 20:19:00 UTC" }, { "cve": "CVE-2026-74568", "url": "https://ubuntu.com/security/CVE-2026-74568", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI xarray (dist->lpi_xa). When the reference count of an LPI structure drops to zero, vgic_release_lpi_locked() removes the structure from the xarray and frees it under the xarray lock. However, the release of an LPI can race with a concurrent LPI re-registration with the same INTID via vgic_add_lpi() on another CPU, since the reference count drop and the xarray eviction are not performed in a single atomic step. This can happen e.g. if the guest issues a DISCARD while the LPI is still referenced from a vCPU's active-pending list (ap_list), and the same INTID is re-mapped via MAPTI. Particularly, vgic_release_lpi_locked() is called from two distinct paths: direct release via vgic_put_irq(), and deferred release via vgic_release_deleted_lpis(). During direct release, the issue can result in deleting a newly registered LPI from the xarray: CPU0 (Releasing LPI) CPU1 (Adding new LPI) ==================== ===================== vgic_put_irq() __vgic_put_irq() refcount_dec_and_test() vgic_add_lpi() xa_lock_irqsave() old_irq = xa_load(.., intid) vgic_try_get_irq_ref(old_irq) == false new IRQ inserted --> __xa_store(.., intid, ..) xa_unlock_irqrestore() xa_lock_irqsave(); vgic_release_lpi_locked() __xa_erase(.., irq->intid) <-- BUG: new IRQ is erased kfree_rcu(old_irq) During the deferred release path, the old IRQ can be leaked: CPU0 (Releasing LPI) CPU1 (Adding new LPI) ==================== ===================== vgic_put_irq_norelease() __vgic_put_irq() refcount_dec_and_test() irq->pending_release = true vgic_add_lpi() xa_lock_irqsave() old_irq = xa_load(.., intid) vgic_try_get_irq_ref(oldirq) == false BUG: old IRQ overwritten --> __xa_store(.., intid, ..) xa_unlock_irqrestore() vgic_release_deleted_lpis() xa_lock_irqsave() xa_for_each() { .. } <-- old IRQ with pending_release = true is gone, so it cannot be released To fix the direct release path, move the reference count drop inside the xarray lock, making sure that vgic_add_lpi() never encounters the to-be-released LPI. In the deferred release path, the refcount drop must happen under a raw spinlock, so the xarray lock cannot be grabbed, and the same solution does not work. Instead, update vgic_add_lpi(), so that if it evicts an LPI from the xarray, it takes on the responsibility of freeing it. Consequently, an LPI may now be freed concurrently after a deferred release drops the refcount, so accessing the pending_release field is no longer safe from use-after-free. Delete all uses of the flag, and update vgic_release_deleted_lpis() to identify orphaned LPIs purely based on their refcount.", "cve_priority": "low", "cve_public_date": "2026-08-15 13:18:00 UTC" }, { "cve": "CVE-2026-74527", "url": "https://ubuntu.com/security/CVE-2026-74527", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.", "cve_priority": "low", "cve_public_date": "2026-08-15 13:17:00 UTC" }, { "cve": "CVE-2026-74466", "url": "https://ubuntu.com/security/CVE-2026-74466", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions (custom device node used, administrative load) this value is used as an array index after bounds checking, but without speculation barrier. Add the missing array_index_nospec() call to prevent speculative execution where this domain value is used.", "cve_priority": "low", "cve_public_date": "2026-08-15 13:17:00 UTC" }, { "cve": "CVE-2026-72497", "url": "https://ubuntu.com/security/CVE-2026-72497", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than the max supported and zero.", "cve_priority": "high", "cve_public_date": "2026-08-15 06:22:00 UTC" }, { "cve": "CVE-2026-72404", "url": "https://ubuntu.com/security/CVE-2026-72404", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() TIPC UDP media bearer teardown calls dst_cache_destroy() on its replicast caches before calling synchronize_net() to wait for concurrent RCU readers (transmitters) to finish: static void cleanup_bearer(struct work_struct *work) { ... \tlist_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) { \t\tdst_cache_destroy(&rcast->dst_cache); \t\tlist_del_rcu(&rcast->list); \t\tkfree_rcu(rcast, rcu); \t} ... \tdst_cache_destroy(&ub->rcast.dst_cache); \tudp_tunnel_sock_release(ub->sk); \tsynchronize_net(); ... } This is highly buggy because dst_cache_destroy() immediately frees the per-CPU cache memory (free_percpu()) and releases the cached dst entries without any synchronization. If a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another CPU under RCU protection, it can call dst_cache_get() concurrently, leading to: 1. Use-After-Free on the per-CPU cache pointer itself (crash). 2. \"rcuref - imbalanced put()\" warning if it attempts to release a dst that was concurrently released by dst_cache_destroy(). Furthermore, calling kfree(ub) immediately after synchronize_net() without closing the socket first (or waiting after closing it) leaves a window where a concurrent receiver (tipc_udp_recv()) could start after synchronize_net(), access ub, and suffer a UAF when kfree(ub) runs. To fix this, we must defer dst_cache_destroy() and kfree(ub) until after we have ensured that no more readers can see the bearer/socket and all existing readers have finished: 1. Defer rcast entry destruction (both dst_cache_destroy() and kfree()) to an RCU callback using call_rcu_hurry(). Using call_rcu_hurry() ensures the dst entries are released quickly. 2. Release the bearer socket using udp_tunnel_sock_release() (stops new receive readers). 3. Call synchronize_net() to wait for all outstanding RCU readers (both transmit and receive) to finish. 4. Now that it is safe, call dst_cache_destroy() on the main bearer cache, and free ub. Note: 3) and 4) can be changed later in net-next to also use call_rcu_hurry() and get rid of the synchronize_net() latency.", "cve_priority": "medium", "cve_public_date": "2026-08-15 06:22:00 UTC" }, { "cve": "CVE-2026-68305", "url": "https://ubuntu.com/security/CVE-2026-68305", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy) RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe] RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246 RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888 RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888 R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000 FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe] xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe] xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe] ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm] ttm_bo_release+0x29e/0x2d0 [ttm] ttm_bo_fini+0x39/0x70 [ttm] xe_gem_object_free+0x1f/0x30 [xe] drm_gem_object_free+0x1d/0x40 ttm_bo_vm_close+0x5f/0x90 [ttm] remove_vma+0x2c/0x70 tear_down_vmas+0x63/0xf0 exit_mmap+0x20d/0x3f0 __mmput+0x45/0x170 mmput+0x31/0x40 do_exit+0x2ba/0xac0 do_group_exit+0x2d/0xb0 __x64_sys_exit_group+0x18/0x20 x64_sys_call+0x14a0/0x2390 do_syscall_64+0xdd/0x640 ? count_memcg_events+0xea/0x240 ? handle_mm_fault+0x1ec/0x2f0 (cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)", "cve_priority": "low", "cve_public_date": "2026-08-10 13:20:00 UTC" }, { "cve": "CVE-2024-50169", "url": "https://ubuntu.com/security/CVE-2024-50169", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: vsock: Update rx_bytes on read_skb() Make sure virtio_transport_inc_rx_pkt() and virtio_transport_dec_rx_pkt() calls are balanced (i.e. virtio_vsock_sock::rx_bytes doesn't lie) after vsock_transport::read_skb(). While here, also inform the peer that we've freed up space and it has more credit. Failing to update rx_bytes after packet is dequeued leads to a warning on SOCK_STREAM recv(): [ 233.396654] rx_queue is empty, but rx_bytes is non-zero [ 233.396702] WARNING: CPU: 11 PID: 40601 at net/vmw_vsock/virtio_transport_common.c:589", "cve_priority": "medium", "cve_public_date": "2024-11-07 10:15:00 UTC" }, { "cve": "CVE-2026-89764", "url": "https://ubuntu.com/security/CVE-2026-89764", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the revoker that did may still be executing drop_in_place() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that drop_in_place() still references (e.g., Devres racing with SGTable freeing the backing sg_table and pages). Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the is_available swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.", "cve_priority": "low", "cve_public_date": "2026-09-11 20:20:00 UTC" } ], "launchpad_bugs_fixed": [ 2171676, 2167995, 2131181, 2170908, 2169023, 2169185, 2168944, 2169101, 2168705, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171596, 2171596 ], "changes": [ { "cves": [ { "cve": "CVE-2026-98038", "url": "https://ubuntu.com/security/CVE-2026-98038", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcount_acquire nullable for borrowed RCU kptrs bpf_refcount_acquire() is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KF_RET_NULL on the return value unless the argument is an owning reference. An RCU-protected load of a local kptr is marked MEM_ALLOC, but it only receives NON_OWN_REF when the pointee contains a graph node. A refcounted object without a graph node consequently looks like an owning reference even though the loaded register has no acquired reference state. If the program drops the last real reference while remaining in the RCU critical section, refcount_inc_not_zero() returns NULL while the verifier treats the result as non-NULL. Only classify the argument as owning when it is backed by a verifier-tracked reference. This retains the non-NULL return for pointers from bpf_obj_new(), bpf_kptr_xchg(), or an earlier successful acquisition, while requiring a NULL check for borrowed RCU kptrs. [ kkd: Rewrote commit log ]", "cve_priority": "medium", "cve_public_date": "2026-09-25 11:17:00 UTC" }, { "cve": "CVE-2026-93175", "url": "https://ubuntu.com/security/CVE-2026-93175", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpu_dm_crtc_reset_state() frees the old state before allocating a new one. If kzalloc() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory. Fix this by allocating the new state first. On allocation failure, the old state remains untouched and the function safely returns. Found by Linux Verification Center (linuxtesting.org) with SVACE. [adjust for movement around current amd-staging-drm-next]", "cve_priority": "high", "cve_public_date": "2026-09-17 17:18:00 UTC" }, { "cve": "CVE-2026-90317", "url": "https://ubuntu.com/security/CVE-2026-90317", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpf_spin_unlock() ends that protection, but the verifier leaves the pointer valid. Another CPU can then free the object before the pointer is used. A capability-limited runtime PoC triggered a task_struct use-after-free in __bpf_get_task_stack(). Record whether the program is in an RCU-protected context before releasing the lock. Invalidate RCU-protected pointers only when the unlock leaves the final such context. This preserves valid pointers in non-sleepable programs and inside an explicit RCU read-side section.", "cve_priority": "high", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90315", "url": "https://ubuntu.com/security/CVE-2026-90315", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down. Commit eb627e17727e (\"PCI: Lock down BAR access when the kernel is locked down\") added the check to pci_write_config(), pci_mmap_resource(), and pci_write_resource_io() to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code, but did not cover the legacy handlers. As a result, root can still write arbitrary I/O ports and map the legacy I/O and memory spaces while the kernel is locked down, which is the same capability the lockdown is meant to remove. Add the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io(). These generic handlers cover both architectures that define HAVE_PCI_LEGACY (such as Alpha and PowerPC). [bhelgaas: add Link]", "cve_priority": "low", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90167", "url": "https://ubuntu.com/security/CVE-2026-90167", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pending_break wakes that waiter, but without serializing the close transition with bit acquisition it can become a new break owner through the test_and_set_bit() fast path. It can then overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for a dying opinfo. Make OPLOCK_CLOSING terminal once the opinfo is removed from the inode list. Serialize that transition, pending_break acquisition, and OPLOCK_ACK_WAIT setup with an opinfo state lock. A breaker which loses the race releases its ownership and returns -ENOENT. Explicitly wake pending_break waiters during close so they can observe the terminal state. Also prevent ACK and timeout paths from replacing OPLOCK_CLOSING with OPLOCK_STATE_NONE.", "cve_priority": "high", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90162", "url": "https://ubuntu.com/security/CVE-2026-90162", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2_lock(), mid-batch granted locks are published to connection-wide (conn->lock_list) and file-wide (fp->lock_list) lists immediately upon vfs_lock_file() success, while also remaining tracked on the stack-local rollback_list. If a subsequent element in the same SMB2_LOCK request array fails validation or execution, the thread jumps to out: and walks rollback_list to undo previously granted locks. However, because the granted lock was already published to conn->lock_list, a concurrent UNLOCK request on the same connection can find the lock object and kfree() it before the rollback loop executes. When the granting thread subsequently walks rollback_list, it dereferences and frees the already-freed ksmbd_lock structure, resulting in a Use-After-Free and Double-Free (on both ksmbd_lock and struct file_lock). Fix this by deferring the publication of granted locks to conn->lock_list and fp->lock_list until after the entire array of lock elements has been processed without error. Mid-batch grants remain tracked exclusively on the request-local rollback_list until the whole batch succeeds, eliminating the race window.", "cve_priority": "critical", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90155", "url": "https://ubuntu.com/security/CVE-2026-90155", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A file_lock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flc_blocked_requests. The ksmbd_file reference count does not cover that graph. Both __ksmbd_close_fd() and the cross-request unlock path free these retained file_lock objects directly. If a dependent waiter is still attached, locks_release_private() hits BUG_ON(!list_empty(&flc->flc_blocked_requests)). The same lifetime mismatch can leave a freed ksmbd_lock reachable through its request-local llist. Detach the file_lock from the blocked-request graph before freeing it in the close, cross-request unlock, and rollback paths. locks_delete_block() also wakes requests chained below the object. Remove llist when a completed lock is published so a globally visible ksmbd_lock no longer points into the submitting worker's stack.", "cve_priority": "high", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-90144", "url": "https://ubuntu.com/security/CVE-2026-90144", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL deref in dpll_device_ops() during teardown race When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpll_pin_on_pin_register(), the dpll object stays alive with an empty registration list. A pin notification queued before the unregister (e.g. ice reacting to zl3073x_i2c removal) then walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and dereferences the missing registration. dpll_lock cannot help because the notification work was queued before the unregistering driver took the lock. Treat the empty registration list as a legitimate transient state. Make dpll_priv() and dpll_device_ops() return NULL in that case and make every pin netlink path that resolves a device from a pin skip such dplls. dpll_cmd_pin_get_one() picks a ref with a live registration and returns -ENODEV when there is none, the pin dumpit skips such a pin instead of aborting the dump, dpll_msg_add_pin_dplls() and the frequency, esync, reference sync and phase adjust set paths skip dead refs, and dpll_pin_parent_device_set() validates the parent with dpll_device_get_by_id(). dpll_pin_register() is the last caller that dereferenced the device ops without a check, so move its frequency monitor validation under dpll_lock and tolerate a missing registration there as well. The empty registration list is equivalent to a cleared DPLL_REGISTERED mark, both transitions happen under dpll_lock in dpll_device_register() and dpll_device_unregister(). A pin notification for a pin whose dplls are all gone is now dropped with -ENODEV instead of crashing, all callers in the core ignore that return value. WARNING: drivers/dpll/dpll_core.c:1092 at dpll_device_ops+0x24/0x40, CPU#83: kworker/u576:3/23471 Modules linked in: ... ice ... zl3073x_i2c(-) ... zl3073x ... Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice] RIP: 0010:dpll_device_ops+0x24/0x40 Call Trace: dpll_cmd_pin_get_one+0x336/0x520 dpll_pin_event_send+0x82/0x140 dpll_pin_on_pin_unregister+0xbb/0x160 ice_dpll_pin_notify_work+0x1bc/0x1f0 [ice] process_one_work+0x19e/0x370 worker_thread+0x1a6/0x310 kthread+0xe4/0x120 ret_from_fork+0x1a1/0x270 ret_from_fork_asm+0x1a/0x30 ---[ end trace 0000000000000000 ]--- BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page", "cve_priority": "low", "cve_public_date": "2026-09-17 17:17:00 UTC" }, { "cve": "CVE-2026-89907", "url": "https://ubuntu.com/security/CVE-2026-89907", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked against EIOINTC_IRQS. eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the 256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value >= 256 reads and writes memory past the end of those arrays, i.e. any process holding a VM fd can corrupt kernel memory beyond the allocation of loongarch_eiointc. Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC path is unaffected as it decodes the vector from the address and masks it.", "cve_priority": "high", "cve_public_date": "2026-09-16 11:16:00 UTC" }, { "cve": "CVE-2026-89709", "url": "https://ubuntu.com/security/CVE-2026-89709", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free. Declare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear via RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module *owner field to nlmsvc_binding and pin the module across indirect calls with try_module_get/module_put. When the binding is torn down, fall back to fput() to avoid leaking struct file references.", "cve_priority": "low", "cve_public_date": "2026-09-11 20:19:00 UTC" }, { "cve": "CVE-2026-89568", "url": "https://ubuntu.com/security/CVE-2026-89568", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: kho: fix size calculation in kho_preserved_memory_reserve() kho_preserved_memory_reserve() calculates the size of a preservation by doing 1 << (order + PAGE_SHIFT). Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it will only work for preservations up to 2 GiB. Larger preservations will trigger undefined behaviour. While preservations larger than 2 GiB can't be obtained via folios currently, they can be obtained via kho_preserve_pages(). For example, memblock reserve_mem uses kho_preserve_pages(). Reservations larger than 2 GiB are valid and will trigger this bug if properly aligned. Fix it by using 1UL for shifting.", "cve_priority": "low", "cve_public_date": "2026-09-11 20:19:00 UTC" }, { "cve": "CVE-2026-74568", "url": "https://ubuntu.com/security/CVE-2026-74568", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI xarray (dist->lpi_xa). When the reference count of an LPI structure drops to zero, vgic_release_lpi_locked() removes the structure from the xarray and frees it under the xarray lock. However, the release of an LPI can race with a concurrent LPI re-registration with the same INTID via vgic_add_lpi() on another CPU, since the reference count drop and the xarray eviction are not performed in a single atomic step. This can happen e.g. if the guest issues a DISCARD while the LPI is still referenced from a vCPU's active-pending list (ap_list), and the same INTID is re-mapped via MAPTI. Particularly, vgic_release_lpi_locked() is called from two distinct paths: direct release via vgic_put_irq(), and deferred release via vgic_release_deleted_lpis(). During direct release, the issue can result in deleting a newly registered LPI from the xarray: CPU0 (Releasing LPI) CPU1 (Adding new LPI) ==================== ===================== vgic_put_irq() __vgic_put_irq() refcount_dec_and_test() vgic_add_lpi() xa_lock_irqsave() old_irq = xa_load(.., intid) vgic_try_get_irq_ref(old_irq) == false new IRQ inserted --> __xa_store(.., intid, ..) xa_unlock_irqrestore() xa_lock_irqsave(); vgic_release_lpi_locked() __xa_erase(.., irq->intid) <-- BUG: new IRQ is erased kfree_rcu(old_irq) During the deferred release path, the old IRQ can be leaked: CPU0 (Releasing LPI) CPU1 (Adding new LPI) ==================== ===================== vgic_put_irq_norelease() __vgic_put_irq() refcount_dec_and_test() irq->pending_release = true vgic_add_lpi() xa_lock_irqsave() old_irq = xa_load(.., intid) vgic_try_get_irq_ref(oldirq) == false BUG: old IRQ overwritten --> __xa_store(.., intid, ..) xa_unlock_irqrestore() vgic_release_deleted_lpis() xa_lock_irqsave() xa_for_each() { .. } <-- old IRQ with pending_release = true is gone, so it cannot be released To fix the direct release path, move the reference count drop inside the xarray lock, making sure that vgic_add_lpi() never encounters the to-be-released LPI. In the deferred release path, the refcount drop must happen under a raw spinlock, so the xarray lock cannot be grabbed, and the same solution does not work. Instead, update vgic_add_lpi(), so that if it evicts an LPI from the xarray, it takes on the responsibility of freeing it. Consequently, an LPI may now be freed concurrently after a deferred release drops the refcount, so accessing the pending_release field is no longer safe from use-after-free. Delete all uses of the flag, and update vgic_release_deleted_lpis() to identify orphaned LPIs purely based on their refcount.", "cve_priority": "low", "cve_public_date": "2026-08-15 13:18:00 UTC" }, { "cve": "CVE-2026-74527", "url": "https://ubuntu.com/security/CVE-2026-74527", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.", "cve_priority": "low", "cve_public_date": "2026-08-15 13:17:00 UTC" }, { "cve": "CVE-2026-74466", "url": "https://ubuntu.com/security/CVE-2026-74466", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions (custom device node used, administrative load) this value is used as an array index after bounds checking, but without speculation barrier. Add the missing array_index_nospec() call to prevent speculative execution where this domain value is used.", "cve_priority": "low", "cve_public_date": "2026-08-15 13:17:00 UTC" }, { "cve": "CVE-2026-72497", "url": "https://ubuntu.com/security/CVE-2026-72497", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than the max supported and zero.", "cve_priority": "high", "cve_public_date": "2026-08-15 06:22:00 UTC" }, { "cve": "CVE-2026-72404", "url": "https://ubuntu.com/security/CVE-2026-72404", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() TIPC UDP media bearer teardown calls dst_cache_destroy() on its replicast caches before calling synchronize_net() to wait for concurrent RCU readers (transmitters) to finish: static void cleanup_bearer(struct work_struct *work) { ... \tlist_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) { \t\tdst_cache_destroy(&rcast->dst_cache); \t\tlist_del_rcu(&rcast->list); \t\tkfree_rcu(rcast, rcu); \t} ... \tdst_cache_destroy(&ub->rcast.dst_cache); \tudp_tunnel_sock_release(ub->sk); \tsynchronize_net(); ... } This is highly buggy because dst_cache_destroy() immediately frees the per-CPU cache memory (free_percpu()) and releases the cached dst entries without any synchronization. If a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another CPU under RCU protection, it can call dst_cache_get() concurrently, leading to: 1. Use-After-Free on the per-CPU cache pointer itself (crash). 2. \"rcuref - imbalanced put()\" warning if it attempts to release a dst that was concurrently released by dst_cache_destroy(). Furthermore, calling kfree(ub) immediately after synchronize_net() without closing the socket first (or waiting after closing it) leaves a window where a concurrent receiver (tipc_udp_recv()) could start after synchronize_net(), access ub, and suffer a UAF when kfree(ub) runs. To fix this, we must defer dst_cache_destroy() and kfree(ub) until after we have ensured that no more readers can see the bearer/socket and all existing readers have finished: 1. Defer rcast entry destruction (both dst_cache_destroy() and kfree()) to an RCU callback using call_rcu_hurry(). Using call_rcu_hurry() ensures the dst entries are released quickly. 2. Release the bearer socket using udp_tunnel_sock_release() (stops new receive readers). 3. Call synchronize_net() to wait for all outstanding RCU readers (both transmit and receive) to finish. 4. Now that it is safe, call dst_cache_destroy() on the main bearer cache, and free ub. Note: 3) and 4) can be changed later in net-next to also use call_rcu_hurry() and get rid of the synchronize_net() latency.", "cve_priority": "medium", "cve_public_date": "2026-08-15 06:22:00 UTC" }, { "cve": "CVE-2026-68305", "url": "https://ubuntu.com/security/CVE-2026-68305", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy) RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe] RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246 RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888 RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888 R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000 FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe] xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe] xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe] ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm] ttm_bo_release+0x29e/0x2d0 [ttm] ttm_bo_fini+0x39/0x70 [ttm] xe_gem_object_free+0x1f/0x30 [xe] drm_gem_object_free+0x1d/0x40 ttm_bo_vm_close+0x5f/0x90 [ttm] remove_vma+0x2c/0x70 tear_down_vmas+0x63/0xf0 exit_mmap+0x20d/0x3f0 __mmput+0x45/0x170 mmput+0x31/0x40 do_exit+0x2ba/0xac0 do_group_exit+0x2d/0xb0 __x64_sys_exit_group+0x18/0x20 x64_sys_call+0x14a0/0x2390 do_syscall_64+0xdd/0x640 ? count_memcg_events+0xea/0x240 ? handle_mm_fault+0x1ec/0x2f0 (cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)", "cve_priority": "low", "cve_public_date": "2026-08-10 13:20:00 UTC" }, { "cve": "CVE-2024-50169", "url": "https://ubuntu.com/security/CVE-2024-50169", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: vsock: Update rx_bytes on read_skb() Make sure virtio_transport_inc_rx_pkt() and virtio_transport_dec_rx_pkt() calls are balanced (i.e. virtio_vsock_sock::rx_bytes doesn't lie) after vsock_transport::read_skb(). While here, also inform the peer that we've freed up space and it has more credit. Failing to update rx_bytes after packet is dequeued leads to a warning on SOCK_STREAM recv(): [ 233.396654] rx_queue is empty, but rx_bytes is non-zero [ 233.396702] WARNING: CPU: 11 PID: 40601 at net/vmw_vsock/virtio_transport_common.c:589", "cve_priority": "medium", "cve_public_date": "2024-11-07 10:15:00 UTC" }, { "cve": "CVE-2026-89764", "url": "https://ubuntu.com/security/CVE-2026-89764", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the revoker that did may still be executing drop_in_place() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that drop_in_place() still references (e.g., Devres racing with SGTable freeing the backing sg_table and pages). Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the is_available swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.", "cve_priority": "low", "cve_public_date": "2026-09-11 20:20:00 UTC" } ], "log": [ "", " * resolute/linux: 7.0.0-43.43 -proposed tracker (LP: #2171676)", "", " * HMC error triggers cascading PF resets and tears down RDMA connections", " (LP: #2167995)", " - RDMA/irdma: Suppress PF reset on HMC error", "", " * Loading certificate with --import enrolls it into the platform keyring", " instead of the machine keyring (LP: #2131181)", " - SAUCE: integrity: Load MokListRT certs into the machine keyring", "", " * Intel Bluetooth stops working on some cold boots on Dell systems", " (LP: #2170908)", " - Bluetooth: btintel_pcie: treat boot stage bit 12 as warning", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Dell XPS 13 9340: OV02C10 front camera image upside down (missing ipu-", " bridge DMI quirk) (LP: #2169185)", " - SAUCE: media: ipu-bridge: fix rotation quirk for XPS 13 9340/14 9440", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * ath12k: WCN7850 MLO double DMA-unmap/free of REO queue buffer on firmware", " restart corrupts memory (needs upstream 4a1b53417739) (LP: #2169101)", " - wifi: ath12k: prepare REO update element only for primary link", "", " * amdkfd kernel crash when KFD procfs creation fails after execve", " (LP: #2168705)", " - drm/amdkfd: fix kernel crash on releasing NULL sysfs entry", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601)", " - bnxt_en: fix DMA mapping length for padded small packets", " - fs: Free any excess xarray nodes in clear_inode()", " - net/mlx5e: Prevent stale XSK buffer release on refill retry", " - net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry", " - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()", " - net: mana: Skip WQ object destruction for uninitialized RXQ", " - accel/amdxdna: Bound the sync_bo flush range to the BO size", " - net: dsa: mt7530: fix .get_stats64 sleeping in atomic context", " - ipv6: Fix redirect exception creation for UDP/RAW sockets", " - ipv4: validate checksum_start before completing checksum", " - rust_binder: reschedule node refcount update on thread exit", " - ipv4: stop PMTU walk when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: do not warn on route notification size race", " - ipv6: do not warn on route notification size race", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - arm64: irq: exclude the softirq stack switch from KCOV", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: scrub: fix local_root reference leak in", " scrub_print_warning_inode()", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - cipso: adjust cached option offsets when removing CIPSO", " - dm ioctl: don't let data_start run past the buffer", " - usb: f81604: fix struct f81604_int_data size mismatch", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7996: fix uninitialized buf read in", " mt7996_variant_fem_init()", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - wireguard: noise: reject response consumption after intermediate", " initiation", " - workqueue: Fix NULL current_pwq deref in chained work check", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - strparser: make sure __strp_recv isn't running before tearing down the", " parser", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - tcp: reject net_iov in zerocopy receive mapping hints", " - tipc: destroy topsrv workqueues before closing connections", " - tipc: hold a reference to nodes found by link name", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - selinux: fix data race on AVC latest_notif", " - selinux: preserve NATIVE_LABELS on already-initialized sb in", " set_mnt_opts", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus()", " when !streamoute", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - gpio: xilinx: fix runtime PM leak on request error path", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak when rings are stopped", " - gve: fix XSK buffer leak on error descriptor", " - ibmveth: h_free logical LAN on open-fail after register", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ice: fix use-after-free in dynamic port cleanup", " - ice: fix metadata_dst refcount handling on representor teardown", " - keys: finalize persistent keyring timeout after link attempt", " - KEYS: Fix add_key() race with keyring restriction", " - memstick: core: wait for request completion before freeing card", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping", " them", " - mm: don't schedule deferred kernel page table freeing while booting", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - mmc: sdhci-sprd: disable runtime PM on remove", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - net/smc: protect clcsock lifetime in smc_getname", " - net: bridge: avoid recursive multicast port cleanup", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - net: team: stop reusing skb after queue override", " - net: team: free skb when broadcast has no txable port", " - nvme: fix swapped ZRASF zone state values for full and read only", " - openvswitch: fix soft lockup in the netlink flow dump", " - optee: register TEE devices only once fully initialized", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - scsi: qedi: Initialize callback state before registration", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - riscv: futex: untag the user pointer before the atomic access", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi", " header", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/imagination: Size page table preallocation by device address", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - drm/vmwgfx: validate pitch coming from userspace", " - drm/xe: Fix shrinker accounting double-subtraction on nested external", " pins", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - mount: keep a copied mount unbindable", " - fs: don't silently unmount busy mounts", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - namespace: don't copy an unmounted mount tree", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: queue a mount only once for mount notifications", " - namespace: check a submount for references right before unmounting it", " - namespace: check a recursive bind mount for mount namespace loops", " - namespace: look at the topmost mount for a mount namespace file", " - namespace: remove the fsnotify marks of a mount namespace in process", " context", " - namespace: check the mounts before reading their parents in pivot_root()", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: don't let a pseudo dentry become the root of a mount", " - namespace: unhash a dentry before detaching the mounts on it", " - namei: don't reveal overmounted entries in refwalk", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namespace: refuse an automount below a mount that is in no namespace", " - namespace: never expire a locked mount", " - namespace: handle mount locking for automounts correctly", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - accel/amdxdna: Fix NULL pointer dereference of mgmt_chann", " - accel/amdxdna: Refactor GEM BO handling and add helper APIs for address", " retrieval", " - netfilter: nft_fwd_netdev: add device and headroom validate with neigh", " forwarding", " - s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code", " - drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length", " - NTB: core: Add .get_dma_dev() callback to ntb_dev_ops", " - NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers", " - svcrdma: Add Write chunk WRs to the RPC's Send WR chain", " - svcrdma: wake sq waiters when the transport closes", " - blk-cgroup: delay freeing policy data after rcu grace period", " - ring-buffer: Skip invalid sub-buffers when validating persistent ring", " buffer", " - ipv6: mcast: annotate data-races around mca_users", " - arm64: dts: lx2160a: fix incorrect pinmux", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - fs: don't let a migrating task hide its reference from do_umount()", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - gpio: exar: initialize the ID before registering its cleanup", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/vc4: Free the BO cache size list on teardown", " - net/sched: em_text: reject unterminated algo before autoload", " - amt: send the relay's General Query directly from the receive path", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - tee: optee: fix kernel-doc warnings", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - nvmet: use the local P2P device on metadata allocation failure", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - zloop: zero out only the unread tail of short reads", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: fix xattr replace when multiple xattrs are packed in the same", " item", " - btrfs: fix lost error return value in btrfs_listxattr()", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: vector: Fix output operands in context save", " - wifi: mt76: don't return TXQ when exceeding max non-AQL packets", " - wifi: mac80211: add AQL support for multicast packets", " - wifi: mac80211: add ieee80211_txq_aql_pending()", " - wifi: mt76: add PS buffering support for HW-managed TIM drivers", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: route nullfunc frames to PSD/ALTX queue", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - Revert \"wifi: ath12k: add panic handler\"", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - spi: sg2044-nor: Return transfer errors", " - spi: sg2044-nor: Honor SPI clock limits", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in", " cpuset_handle_hotplug()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net/sched: cls_route: reject change with no routing attribute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state", " modification\"", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - pfcp: make sure the SEID is linear before reading it", " - bnxt_en: Add bnxt_clear_bars() helper", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Delay for 5 seconds after AER DPC for all chips", " - bnxt_en: Drop pci_save_state() after pci_restore_state()", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - ptp: ocp: fix PCIe delay estimation calculation", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - drm/panthor: validate userspace queue count against initialized firmware", " slot count", " - s390/zcrypt: Improve CCA CPRB length and overflow checks", " - s390/zcrypt: Improve EP11 CPRB length and overflow checks", " - s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing", " - s390/zcrypt: Pad trailing CCA or EP11 message with zeros", " - xfs: remove duplicate INO1_WRITTEN check", " - xfs: stop exchanging reflink flags when exchanging mappings", " - xfs: fix exchange-range-to-eof file size exchange", " - can: fix unique skb identifier regression under RPS", " - SUNRPC: Add Kconfig dependency on CRYPTO_KRB5", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - sched_ext: Generate qseq from a per-task counter", " - HID: steam: Fully unregister controller when hidraw is opened", " - HID: steam: Rearrange teardown sequence", " - HID: steam: Refactor registration", " - HID: steam: Clean up locking", " - ipv4: udp: Create exceptions before socket matching", " - ipv6: udp: Create exceptions before socket matching", " - can: dev: init_can_skb(): restore skb header initialization", " - e1000e: add system to disable K1 list", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test", " - iavf: send MAC change request synchronously", " - io_uring/register: don't exempt disabled rings from task restrictions", " - ip6_tunnel: do not use dst6_mtu() in ip4ip6_err() and", " ip6erspan_tunnel_xmit()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - mm/vma: introduce vma_test[_any[_mask]](), and make inlining consistent", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - power: sequencing: pcie-m2: Fix leaking array from", " of_regulator_bulk_get_all()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: core: Avoid unsafe MMIO reads in", " ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - drm/xe/i2c: cancel the client work on remove", " - drm/amd/display: disable self-refresh on tearing flips", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - namespace: don't reconfigure internal superblocks via remount and umount", " - unshare: don't drop active namespace references that were never taken", " - nullfs: don't update the access time", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - scsi: ufs: core: Hold a clock reference across the probe", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net: stmmac: propagate PTP addend and system time programming errors", " - bonding: fix the program leak when XDP is replaced", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - drm/xe: Do not emit Wa_16010904313 twice", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - Revert \"net: stmmac: propagate PTP addend and system time programming", " errors\"", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - ASoC: sdw_utils: Add codec info for CS35L62", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - bareudp: set the inner protocol to the protocol of the packet", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - drm/vc4: Use devm_request_irq() for automatic cleanup", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring/memmap: account the pages a compound region really uses", " - io_uring/zcrx: use better name for RQ region", " - io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring()", " - io_uring/zcrx: use correct mmap off constants", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - Upstream stable to v6.18.57, v7.2.11", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-98038", " - bpf: Keep refcount_acquire nullable for borrowed RCU kptrs", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-93175", " - drm/amd/display: Fix dangling pointer in CRTC reset function", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-90317", " - bpf: Invalidate RCU pointers after final spin unlock", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-90315", " - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-90167", " - ksmbd: serialize oplock close with pending break ownership", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-90162", " - ksmbd: defer publishing granted locks to prevent UAF/double-free race", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-90155", " - ksmbd: detach blocked lock requests before freeing", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-90144", " - dpll: fix NULL deref in dpll_device_ops() during teardown race", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-89907", " - LoongArch: KVM: Validate MSI data before routing it to EIOINTC", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-89709", " - lockd, nfsd: RCU-protect nlmsvc_ops dispatch", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-89568", " - kho: fix size calculation in kho_preserved_memory_reserve()", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-74568", " - KVM: arm64: vgic: Fix race between LPI release and re-registration", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-74527", " - octeontx2-af: Block VFs from clobbering special CGX PKIND state", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-74466", " - s390/zcrypt: Close speculative mem read possibility", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-72497", " - RDMA/bnxt_re: Add a max slot check for SQ", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-72404", " - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2026-68305", " - drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers", "", " * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) //", " CVE-2024-50169.", " - vsock/virtio: account only unread bytes in read_skb()", "", " * Resolute update: upstream stable patchset 2026-10-20 (LP: #2171596)", " - selftests/mm: hugetlb-mremap: add setup of HugeTLB pages", " - mm/execmem: make the populate and alloc atomic", " - ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture", " - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table", " - smb/client: pass cifs_open_info_data to SMB2_open()", " - ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices", " - audit: fix exe mark UAF in kill_rules()", " - crypto: x86/aes-gcm - fix always true check for last AAD segment", " - HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request", " - HID: multitouch: stop the release timer from being rearmed on remove", " - io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full", " - io_uring/zcrx: requeue multishot receives stopped by a local resource", " - kasan: unpoison task stack below watermark only in generic mode", " - kprobes: Skip disarmed probes when checking optkprobe overlap", " - octeontx2-pf: Fix RSS indirection table size", " - of/irq: Fix remaining refcount leaks in of_irq_init()", " - of/overlay: put property on deadprops only after changeset add succeeds", " - of/overlay: only treat a positive changeset id as registered", " - net: fix checksum offsets in skb_splice_from_iter()", " - net: phy: aquantia: fix system interface type not updated in forced mode", " - netfilter: nft_flow_offload: drop flowtable reference on init error path", " - net/packet: prevent TX_RING byte count overflow", " - r8169: disable EEE on RTL8168h/8111h", " - rtc: ac100: Assign .num before accessing .hws", " - rtc: spear: initialize IRQ state before requesting alarm IRQ", " - sctp: check RCV_SHUTDOWN after the sendmsg connect wait", " - tpm: Disable TPM on null key name mismatch", " - netfs: zero gaps in read-gaps folio to avoid writing back stale data", " - module: fix lost error code from codetag_load_module()", " - virt: vmgenid: remap memory as decrypted", " - virt: vmgenid: set driver_data before registering notification handlers", " - mm: shmem: ignore sysfs configs for shmem forced collapse", " - rds_tcp: close NULL deref window in rds_tcp_set_callbacks", " - vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF", " - vt: selection: Fix unsigned underflow and slab-out-of-bounds read in", " paste_selection()", " - vt: skip screen update for DEC alignment test on backgroup consoles", " - wifi: wlcore: Fix runtime PM leak in wlcore_remove()", " - ALSA: caiaq: unregister the input device when probe fails", " - ALSA: line6: reject oversized playback packets", " - random: vDSO: avoid call to memset() when zeroing reserved parameter", " - [Config] Add CC_OPT_INLINE_MEMSET compiler option", " - mm/damon/core: don't skip damos_adjust_quota() while esz is not zero", " - iio: dac: rohm-bd79703: Do not allow writing SCALE", " - iio: light: rohm-bu27034: Fix error return", " - iio: accel: kionix-kx022a: Fix array boundary check", " - mtd: core: call _get_device() with the master MTD", " - nvmet: preserve device path on allocation failure", " - random: fix vgetrandom_opaque_params kernel-doc", " - of/overlay: don't leak fragment references when changeset init fails", " - of/overlay: don't create \"//\" paths for fragments targeting the root", " - ASoC: wm8903: Move the DRC QR threshold to the register that holds it", " - wifi: wfx: validate MIB read length before copying to caller", " - ASoC: tegra: Fix ASRC Stream6 input threshold control", " - wifi: mac80211: drop oversized fragments to avoid extra_len overflow", " - wifi: ath11k: reset ar->num_stations on hardware start", " - wifi: ath9k: reject short WMI command responses", " - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE", " - rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak", " - rtc: ac100: Fix clock provider use-after-free on probe failure", " - rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()", " - wifi: cfg80211: preserve hidden-group beacon IE ownership", " - wifi: mac80211: Add multicast to unicast support for 802.3 path", " - wifi: mac80211: Add 802.3 multicast encapsulation offload support", " - wifi: mac80211: prevent AP VLAN tx from other interfaces", " - ASoC: codecs: rt286: Revert delay value for jack setup", " - ASoC: codecs: rt274: Fix format setting for 44100 rate", " - block: reject polled dio with user integrity metadata", " - blk-mq: set RQF_USE_SCHED when the operation is known", " - Bluetooth: hci_core: free the HCI ID if naming fails", " - Bluetooth: btintel: validate DDC record lengths", " - arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz", " - ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer", " - net/mctp: publish the mctp_dev only after it is initialised", " - net/sched: cls_api: reclaim an empty proto on the error path", " - net: bcmgenet: allocate RX buffers as page fragments", " - ipv6: fix prefix route expiry in modify_prefix_route()", " - netfilter: ipset: do not update comments from kernel-side adds", " - Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister", " - net: systemport: Fix buffer overflow in bcm_sysport_get_stats()", " - net: systemport: Fix RUNT MIB counter register offset calculation", " - net/mlx5: Fix slab-out-of-bounds when handling team device events", " - octeontx2-af: mcs: Fix SC resource cleanup loop", " - tipc: prevent GCM nonce reuse on peer key changes", " - net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()", " - net: stmmac: fix rx Scatter-Gather support", " - net: restrict SO_RESERVE_MEM to TCP sockets and cap max value", " - gve: DQO: accept TSO packets with non-protocol gso_type bits", " - net/sched: fq_codel: match the no-drop threshold to the packet size", " - net/sched: sch_codel: match the no-drop threshold to the packet size", " - virtio_blk: set the zone write granularity", " - net: pcs: rzn1-miic: Clear MIIC protection state before unprotect", " sequence", " - net: bcmgenet: fix NULL dereference in set_coalesce before first open", " - net: cap skb->queue_mapping when the tx queue is picked", " - net: ethernet: mtk_eth_soc: allocate dummy netdev sooner", " - net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values", " - net: sparx5: move netdev and notifier block registration to probe", " - net: sparx5: move VCAP initialization to probe", " - net: sparx5: move MAC table initialization and add deinit function", " - net: sparx5: move stats initialization and add deinit function", " - net: sparx5: move PTP IRQ handling out of sparx5_start()", " - net: sparx5: skip ptp deinit if init was skipped", " - tcp: refresh TS.Recent for accepted old ACKs", " - ipvs: fix missing counter decrement in lblc", " - ipvs: do not create invisible templates", " - ipvs: filter some flags received in the backup server", " - netfilter: bpf: reject invalid NAT manipulation types", " - netfilter: flowtable: generalize pending status bit", " - net: microchip: vcap: stop scanning after deleting key field", " - of: Put coreboot node after compatibility check", " - net: sparx5: make ports inherit the switch base mac address type", " - net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference", " - ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()", " - net: mvneta: clear XDP pfmemalloc flag between frames", " - i2c: at91: release DMA channels when probe defers", " - perf: Fix race between perf_event_exit_task() and perf_pending_task()", " - ALSA: core: Define auto-cleanup for snd_card_free()", " - ALSA: ice1712: Fix the error handling via auto-cleanup at probe", " - spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260", " - PCI: Accept AtomicOps already enabled by the hypervisor", " - drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend", " - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC", " - drm/amd/pm/si: Fix updating clock limits on AC/DC", " - drm/amdgpu/gfx6: fix firmware leak on teardown", " - drm/radeon: Read the VRAM VBIOS signature with readb()", " - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device", " - drm/mediatek: Fix ovl adaptor platform device leak", " - drm/mediatek: Fix pdev reference leak in mtk_drm_bind()", " - drm/amdgpu: fix IP instance memory leak on kobject add failure", " - drm/amdgpu: fix ACP MFD device leak on init failure", " - drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU", " - binder: fix is_failure flag for superseded transaction cleanup", " - binder: fix leaked fd fixups on TF_UPDATE_TXN supersede", " - kgdboc: Fix tty driver reference leak in configure_kgdboc()", " - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11", " - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410", " - Input: s6sy761 - fix resume ordering and restore sensing", " - Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490", " - Input: synaptics - limit T440p InterTouch quirk to LEN0036", " - nitro_enclaves: fix use-after-free on SLOT_ALLOC failure", " - rust_binder: cancel deferred work items in thread exit", " - soc: qcom: geni-se: Correct QUP Core ICC vote constants", " - USB: cdc-acm: fix racy TIOCMIWAIT implementation", " - USB: cdc-acm: skip URB restart in port_shutdown if disconnected", " - USB: serial: fix port tear down use-after-free", " - usb: storage: sierra_ms: reject short SWoC info transfers", " - usb: hub: use shorter 120ms post resume hold for SS root hubs", " - usb: octeon-hcd: fix the FIFO-flush timeout computation", " - usb: ohci-da8xx: disable controller wakeup on cleanup", " - usb: ohci-s3c2410: disable controller wakeup on removal", " - usb: ohci-spear: disable controller wakeup on removal", " - usb: ohci-st: disable controller wakeup on removal", " - usb: gadget: midi2: Fix the jack descriptor array sizes", " - usb: gadget: f_uac1_legacy: validate bRequest index in", " generic_{set,get}_cmd", " - usb: typec: anx7411 - stop the IRQ before destroying the workqueue", " - usb: typec: port-mapper: Only match USB4 port if host interface is", " available", " - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path", " - usb: gadget: aspeed-vhub: cancel wake work on device removal", " - USB: gadget: dummy-hcd: Fix wait for outstanding request completions", " - usb: gadget: f_fs: Fix NULL pointer dereference in", " FUNCTIONFS_ENDPOINT_DESC", " - usb: chipidea: tegra: disable runtime PM on resume failure", " - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints", " - USB: dwc2: shut down wakeup timer before freeing HCD state", " - usb: typec: tcpm: recover after failure to start the frs ams", " - usb: typec: tipd: don't send GAID when probe fails in APP mode", " - usb: typec: tipd: fix uninitialized typec_partner_desc in", " tps6598x_connect()", " - usb: typec: tipd: fix uninitialized typec_partner_desc in", " cd321x_update_work()", " - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove", " - usb: typec: ucsi: Get the connector fwnode based on reg value", " - usb: typec: ucsi: displayport: Current CAM OOB index fixup", " - usb: cdns3: fix use-after-free in cdns3_gadget_exit()", " - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe", " - tty: vt: fix memory leak in vc_allocate()", " - tty: amiserial: fix broken TIOCMIWAIT", " - tty: vcc: zero-initialize control packet in vcc_send_ctl()", " - tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup", " - tty: tty_port: restore TTY_IO_ERROR on activation failure", " - tty: port: fix tty_port_tty_vhangup() race", " - tty: serial: qcom_geni_serial: Keep console RX functional after deep", " idle", " - tty: abort break signalling on hangup", " - tty: serial: max3100: shut down timer before freeing port", " - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()", " - serial: 8250_omap: fix wake irq cleared during suspend", " - serial: revert guards in uart_wait_modem_status()", " - serial: fix TIOCMIWAIT race", " - serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()", " - serial: tegra: don't clear the Tx FIFO on an Rx-only reset", " - serial: vt8500: Fix clock reference leak in vt8500_serial_probe()", " - serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-", " around", " - serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL", " - arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only", " systems", " - ASoC: codecs: max98363: fix uninitialized stream_config->type", " - ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type", " - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints", " - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194", " - ALSA: seq: Serialize compat port-info ioctls", " - ALSA: ua101: reject mismatched capture/playback packet sizes", " - ALSA: hda/realtek: Fix square wave output on ASUS Strix G615LR", " - ALSA: hda/realtek: Fix silent speaker on Higole F9B", " - EDAC/versalnet: Drop remote processor handle refcount on driver removal", " - EDAC/altera: Do not allow driver unbinding", " - EDAC/altera: Drop __init from ECC setup paths for re-probe safety", " - EDAC/altera: Fix memory leak on dci allocation failure", " - EDAC/altera: Fix use-after-free in error paths", " - EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup", " - i2c: xiic: preserve PEC byte length in SMBus block read setup", " - i2c: xiic: don't clobber msg->len to signal block-read completion", " - Bluetooth: RFCOMM: Fix initial port reference race", " - Bluetooth: hci_sync: Fix inquiry cache use-after-free", " - Bluetooth: hci_conn: Lock parent access during enhanced SCO setup", " - Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems", " - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion", " - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown", " - Bluetooth: hci_core: Serialize fragmented ISO packet queueing", " - Bluetooth: btintel: fix buffer over-read in btintel_hw_error()", " - Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()", " - x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h", " - x86/mm: Drop unnecessary PMD page copy when freeing", " - mm/damon/core: do non-safe region walk on kdamond_apply_schemes()", " - fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()", " - io_uring: fix task_work add use-after-free with SQPOLL", " - ipvs: bound LBLCR and LBLC cache growth", " - net: extend IPv6 exthdr detection of tunneled packets", " - tpm: fix off-by-four bounds check in tpm2_get_random()", " - nvme-multipath: fix underflow in ANA log bounds checks", " - nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT", " - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()", " - nvmet: pci-epf: reject too-short SGL segments", " - mtd: block2mtd: Fix divide error when erase_size is zero", " - mtd: mtd_intel_dg: reset poll counter for each erase", " - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ", " - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of", " OOB", " - mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive()", " - mtd: spinand: Enable QE on all dies", " - mtd: spinand: fix zero oobavail when no ECC engine is used", " - mtd: spinand: Do not update the QE bit on devices without one", " - KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are", " modified", " - KVM: SEV: Nullify \"have run CPUs\" mask pointer when freeing it", " - KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV", " state", " - KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy", " - KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs", " - KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor", " - wifi: cfg80211: fix RTS threshold setting for single-radio PHY", " - wifi: cw1200: fix TX padding OOB read leaking heap data to device", " - wifi: iwlegacy: 3945: free EEPROM data on remove", " - wifi: mac80211: keep paired old chanctx alive", " - wifi: mac80211: shut down RX BA session timer on teardown", " - wifi: mac80211: drain PS delivery work during station teardown", " - wifi: mac80211: account proxy paths against the mesh path limit", " - wifi: mac80211: keep fallback association elements alive", " - wifi: mac80211: minstrel_ht: validate fixed rate index", " - wifi: mac80211: reject invalid 320 MHz CSA bandwidth", " - wifi: mac80211: release mesh path quota on failed additions", " - wifi: mac80211: fix mesh fast xmit path deletion UAF", " - wifi: mac80211: handle empty FILS association request payload", " - USB: serial: cp210x: add Corsair AX1500i Power Supply", " - USB: serial: quatech2: fix baud rate overflow", " - USB: serial: ssu100: fix baud rate overflow", " - USB: serial: fix dynamic id driver deregistration race", " - USB: serial: fix driver deregistration order", " - USB: serial: fix ioctl hangup race", " - USB: serial: option: add support for SIMCom SIM8260C", " - USB: serial: option: add Quectel EG060W", " - USB: serial: option: add Compal EXM-G1x support", " - USB: serial: option: add Quectel RG660QB", " - USB: serial: option: add Compal EXC-T1 support", " - thunderbolt: Fix KASAN reported use-after-free when request is canceled", " - thunderbolt: Hold a router reference for each allocated HopID", " - thunderbolt: Mark discovered tunnels as active", " - thunderbolt: Tear down inactive DP tunnels when the domain is stopped", " - thunderbolt: Fix domain reference leak when DPRX read is canceled", " - thunderbolt: Disable CL states for the Anker Prime TB5 dock", " - thunderbolt: Reject oversized XDomain properties responses", " - smb: client: discard post-EOF pagecache when extending a file via zero", " range", " - smb: client: discard post-EOF pagecache when extending a file via copy", " range", " - smb: client: flush and commit data before querying allocated ranges", " - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races", " - iio: accel: kionix-kx022a: Prevent memory leak and fix state", " - iio: accel: kxcjk-1013: reject duplicate event disable", " - iio: accel: sca3000: fix frequency divider condition check", " - iio: adc: ad7173: Fix digital filter configuration", " - iio: adc: ad_sigma_delta: fix use-after-free on unbind", " - iio: adc: ade9000: fix NULL pointer dereference in clkout registration", " - iio: adc: ade9000: fix overlapping scan_index for current and voltage", " channels", " - iio: adc: ade9000: handle Phase C dip events in IRQ1 handler", " - iio: adc: ade9000: request interrupts after powering the device", " - iio: adc: axp288: Add TS bias override for Haier HV103H", " - iio: adc: max1363: sign-extend bipolar differential channel reads", " - iio: adc: pac1934: check ACPI label duplication", " - iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop", " - iio: adc: rohm-bd79124: Fix channel initialization", " - iio: adc: rohm-bd79124: Fix GPIO mask check", " - iio: adc: rohm-bd79124: Fix rising alarm", " - iio: adc: stm32-adc: fix check on internal channel availability", " - iio: adc: stm32-adc: fix possible division by zero in processed channel", " - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure", " - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls", " - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on", " unbind", " - iio: admv1013: initialize callback mutex before registering notifier", " - iio: buffer: serialize buffer teardown with mode claims", " - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.", " - iio: cdc: ad7150: fix OF matching and publish module aliases", " - iio: frequency: admv1013: fix wrong channel field used in", " admv1013_read_raw()", " - iio: gyro: adis16136: fix unprotected debugfs reads", " - iio: health: max30102: fix NULL dereference in interrupt handler", " - iio: imu: adis16400: fix unprotected debugfs reads", " - iio: imu: adis16480: fix unprotected debugfs reads", " - iio: light: gp2ap020a00f: drain irq_work after free_irq", " - iio: light: rohm-bu27034: Fix infinite delay on error", " - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency", " lookup", " - iio: pressure: rohm-bm1390: Return error when read fails", " - iio: proximity: aw96103: validate firmware data length", " - iio: proximity: isl29501: Fix return type of isl29501_register_write", " - iio: proximity: pulsedlight: fix iio_device left registered on PM setup", " failure", " - iio: proximity: sx9324: Correct proximity channel resolution", " - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler", " - iio: proximity: vl53l0x-i2c: claim direct mode for raw reads", " - iio: trigger: cancel reenable_work before freeing trigger", " - mptcp: fix msk->timer_ival reset", " - mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages", " - pfcp: fix socket lifetime on netdevice registration failure", " - netfs: clear post-EOF pagecache when extending a file via write", " - mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc", " - rust: devres: ensure revocation is complete before device finishes", " unbinding", " - rust: irq: pass RegistrationInner as cookie to request_irq", " - Bluetooth: Serialize SMP remote OOB data access", " - nvmet-tcp: Don't error if TLS is enabed on a reset", " - nvmet: copy the hostid into the ctrl before creating PR pc_refs", " - nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known", " - mtd: spinand: fix NULL pointer dereference with no ECC engine", " - wifi: mac80211: count only matching reservations in reserved switch", " - wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()", " - wifi: mac80211: set info->band for 802.3 encap offload frames", " - thunderbolt: Don't access a DP tunnel after its DPRX read was canceled", " - smb: client: flush dirty data before zeroing a range", " - smb: client: distinguish real EOF from a stale remote_i_size on read", " - iio: adc: aspeed: propagate reset deassert errors", " - smb: client: only require read lease for size-extending preallocate", " - iio: adc: ad4030: fix invalid oversampling_ratio validation", " - drm/amd/display: Mark DCE 6.4 as not APU", " - drm/amd/display: Preserve eDP mode on initial ASSR failure", " - drm/amdgpu: reset VI ASIC on MacBookPro15,1", " - drm/amdgpu: reset VI ASIC on MacBookPro14,3", " - drm/amd/display: Fix fast updates on DCE 8.1", " - usb: dwc3: gadget: fix IRQ storm on invalid event buffer count", " - tty: n_gsm: fix missing modem controls after DLCI open in convergence", " layer type 2", " - usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41", " - tty: fix saved termios reset race", " - perf: Replace perf_event_header__init_id with full header init", " - perf/core: Check kernel access when kernel callchains are requested", " - perf: Require kernel access for text poke events", " - arm64: mm: Fix the break-before-make flush range for erratum 2645198", " - arm64: errata: Factor out broken AMU const counter cap", " - [Config] Enable ARM64_WORKAROUND_BROKEN_AMU_CONSTCNT", " - arm64: errata: Add Cortex-A725 erratum 3821522 workaround", " - [Config] Enable ARM64_ERRATUM_3821522", " - KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h", " - KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT", " - KVM: arm64: Use stage-1 leaf size for VM_PFNMAP", " - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is", " intercepted", " - KVM: move TSS constants from kvm_host.h to tss.h", " - KVM: x86: Add static calls for nested virtualization ops", " - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails", " - net: usb: qmi_wwan: add Quectel EG120K-EA", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: mana: remove double CQ cleanup in mana_create_rxq error path", " - iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs", " - iio: adc: adi-axi-adc: Initialize state mutex", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - drm/xe/i2c: Keep the i2c controller always enabled", " - selftests/cgroup: account for zswap shrinker writeback", " - KVM: x86: Move nested_run_pending to kvm_vcpu_arch", " - KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages()", " error paths", " - net: gso: limit recursive IP-in-IP segmentation", " - sysctl: Negate before converting in the int read path", " - time/jiffies: Saturate in mult_hz() instead of wrapping", " - netfs: zero the tail of a short DIO/unbuffered read", " - ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270)", " - ext4: don't enable large folios on encrypted inodes", " - mtd: core: avoid double-free of OTP NVMEM device", " - wifi: ath9k: Clean up device initialisation guards", " - wifi: mac80211: validate TX status rate metadata", " - mm/slab: handle the !allow_spin case in kfree_rcu_sheaf()", " - mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()", " - ASoC: SDCA: Set suspended flag after resuming within system suspend", " - ASoC: SDCA: Add better pm_runtime error handling in func probe", " - bpf: Fix overflow of jump offset in constant blinding", " - nvme: fix command effects log lifetime for multipath heads", " - bpf: Hold map BTF for the memory allocator destructor record", " - wifi: mac80211: fix slab-out-of-bounds read in", " ieee80211_monitor_select_queue()", " - drm/xe/pf: Refactor VF LMEM BAR resize helper function", " - drm/xe/pf: Keep VF LMEM BAR size low if no VFs enabled", " - drm/mediatek: mtk_hdmi_v2: fix VID_DOWNSAMPLE_CONFIG register offset", " - octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled", " - seg6: ensure packet data is writable before modifying SRH and IPv6 DA", " - net: ethtool: let tsconfig reach a PHY-only timestamp provider", " - bpf: Wait for an RCU tasks grace period before freeing trampoline progs", " - bpf: Skip detached progs in trampoline images that are still in use", " - bpf: Factor out __do_call_rcu_ttrace()", " - bpf: Fix objects stuck in free_by_rcu_ttrace", " - drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe()", " - futex: Fix private hash use-after-free on resize", " - drm/amd/display: guard dc_sink dereferences in MST mode validation", " - drm/amd/display: Fix fast updates on DCE 6.x", " - drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub()", " - drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()", " - drm/i915/vrr: Disable DC balance by default", " - drm/amdgpu: drop userq callback assignment for sdma 7.1", " - binderfs: fix UAF write in binder_add_device", " - clk: spacemit: k3: add CPU PLL rate tables", " - serial: core: fix NULL pointer dereference in", " serial_core_unregister_port()", " - ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after", " enabling clocks", " - ALSA: hda/realtek: Add quirk for Acer Nitro ANV15-41", " - ALSA: hda/realtek: Update Acer Nitro ANV15-41 quirk to enable mute LED", " - ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72", " - Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()", " - KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN", " - KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN", " succeeded", " - KVM: arm64: vgic: Allow last_lr_irq to be NULL when LRs are not", " overflowing", " - KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq", " - thunderbolt: Make the DP tunnel activation callback mandatory", " - smb: client: discard post-EOF pagecache when extending a file via clone", " range", " - smb: client: only require read lease for size-extending zero range", " - smb: client: drain and invalidate before server-side copy/clone", " - smb: client: require stable pages for signed connections", " - iio: frequency: adf4377: Fully initialize clk_init_data and", " clk_parent_data", " - Upstream stable to v6.18.56, v7.2.10", "", " * Resolute update: upstream stable patchset 2026-10-20 (LP: #2171596) //", " CVE-2026-89764", " - rust: devres: fix race between concurrent revokers", "" ], "package": "linux", "version": "7.0.0-43.43", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2171676, 2167995, 2131181, 2170908, 2169023, 2169185, 2168944, 2169101, 2168705, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171601, 2171596, 2171596 ], "author": "Stefan Bader ", "date": "Fri, 23 Oct 2026 13:56:57 +0200" } ], "notes": "linux-modules-7.0.0-43-generic version '7.0.0-43.43' (source package linux version '7.0.0-43.43') was added. linux-modules-7.0.0-43-generic version '7.0.0-43.43' has the same source package name, linux, as removed package linux-modules-7.0.0-42-generic. As such we can use the source package version of the removed package, '7.0.0-42.42', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-image-7.0.0-42-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.0.0-42.42", "version": "7.0.0-42.42" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.0.0-42-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.0.0-42.42", "version": "7.0.0-42.42" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.0.0-42-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.0.0-42.42", "version": "7.0.0-42.42" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.04 resolute image from daily image serial 20261105 to 20261107", "from_series": "resolute", "to_series": "resolute", "from_serial": "20261105", "to_serial": "20261107", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }