{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-headers-7.3.0-10", "linux-headers-7.3.0-10-generic", "linux-image-7.3.0-10-generic", "linux-main-modules-v4l2loopback-7.3.0-10-generic", "linux-main-modules-zfs-7.3.0-10-generic", "linux-modules-7.3.0-10-generic", "linux-tools-7.3.0-10", "linux-tools-7.3.0-10-generic" ], "removed": [ "linux-headers-7.3.0-9", "linux-headers-7.3.0-9-generic", "linux-image-7.3.0-9-generic", "linux-main-modules-v4l2loopback-7.3.0-9-generic", "linux-main-modules-zfs-7.3.0-9-generic", "linux-modules-7.3.0-9-generic", "linux-tools-7.3.0-9", "linux-tools-7.3.0-9-generic" ], "diff": [ "apt", "base-files", "bind9-dnsutils", "bind9-host", "bind9-libs", "bpftool", "libapt-pkg7.0", "libbrotli1", "libmspack0t64", "libpcre2-8-0", "linux-headers-generic", "linux-headers-virtual", "linux-image-virtual", "linux-libc-dev", "linux-perf", "linux-tools-common", "linux-virtual", "motd-news-config", "python3-twisted" ] } }, "diff": { "deb": [ { "name": "apt", "from_version": { "source_package_name": "apt", "source_package_version": "3.3.3", "version": "3.3.3" }, "to_version": { "source_package_name": "apt", "source_package_version": "3.3.3ubuntu0.1", "version": "3.3.3ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Download verification bypass", " - methods/*.cc: Open target files exclusively", " - CVE-2026-109518", " * SECURITY UPDATE: Out-of-bounds accesses", " - debDebFileParser: reject .deb without a Version field", " - solver: Ensure workLess is a strict weak ordering", "" ], "package": "apt", "version": "3.3.3ubuntu0.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 02 Nov 2026 15:29:58 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "base-files", "from_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu2", "version": "14.2ubuntu2" }, "to_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu2.1", "version": "14.2ubuntu2.1" }, "cves": [], "launchpad_bugs_fixed": [ 2131303 ], "changes": [ { "cves": [], "log": [ "", " * debian/preinst: remove dangling multilib aliasing symlinks (/lib32,", " /libo32, /libx32) instead of failing (LP: #2131303)", "" ], "package": "base-files", "version": "14.2ubuntu2.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2131303 ], "author": "Nadzeya Hutsko ", "date": "Fri, 16 Oct 2026 11:20:11 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-dnsutils", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu3", "version": "1:9.20.24-1ubuntu3" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu3.1", "version": "1:9.20.24-1ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19668", "url": "https://ubuntu.com/security/CVE-2026-19668", "cve_description": "A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-76163", "url": "https://ubuntu.com/security/CVE-2026-76163", "cve_description": "If BIND is loaded with a \"`named.conf`\" file that contains no global \"`options`\" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77692", "url": "https://ubuntu.com/security/CVE-2026-77692", "cve_description": "An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19668", "url": "https://ubuntu.com/security/CVE-2026-19668", "cve_description": "A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-76163", "url": "https://ubuntu.com/security/CVE-2026-76163", "cve_description": "If BIND is loaded with a \"`named.conf`\" file that contains no global \"`options`\" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77692", "url": "https://ubuntu.com/security/CVE-2026-77692", "cve_description": "An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME", " records", " - debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in", " lib/dns/message.c.", " - debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated", " singleton records in a message in tests/dns/Makefile.am,", " tests/dns/message_test.c.", " - CVE-2026-75029", " * SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC", " proofs", " - debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser", " proof caching in lib/dns/include/dns/rdatalist.h,", " lib/dns/include/dns/rdataset.h, lib/dns/include/dns/rdataslab.h,", " lib/dns/qpcache.c, lib/dns/qpzone.c, lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/rdataset.c, lib/dns/rdataslab.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders", " alive in lib/dns/include/dns/rdataset.h, lib/dns/rdataslab.c.", " - debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader", " lifetime in tests/dns/qpdb_test.c.", " - CVE-2026-19662", " * SECURITY UPDATE: Excessive CPU usage validating crafted DNSSEC responses", " - debian/patches/CVE-2026-19668-2.patch: Make the exhausted DNSSEC", " validation quota terminal in lib/dns/resolver.c, lib/dns/validator.c.", " - debian/patches/CVE-2026-19668-3.patch: Bound the DS-to-DNSKEY matching", " during DNSSEC validation in lib/dns/include/dns/validator.h,", " lib/dns/validator.c.", " - CVE-2026-19668", " * SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers", " - debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the", " DNS64 filter64 path in lib/ns/query.c.", " - debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path", " against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,", " bin/tests/system/dns64/ns2/named.conf.j2, bin/tests/system/dns64/tests.sh.", " - CVE-2026-19666", " * SECURITY UPDATE: Unexpected exit via TKEY query without global options", " - debian/patches/CVE-2026-76163-1.patch: Always create the TKEY context in", " bin/named/include/named/tkeyconf.h, bin/named/server.c,", " bin/named/tkeyconf.c.", " - debian/patches/CVE-2026-76163-2.patch: Test TKEY queries without global", " options in bin/tests/system/tkey/nooptions/example.db,", " bin/tests/system/tkey/nooptions/named.conf,", " bin/tests/system/tkey/tests_no_options.py.", " - CVE-2026-76163", " * SECURITY UPDATE: Zone transfer data used before TSIG verification", " - debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in", " bin/tests/system/xfer/ans5/ans.py, lib/dns/xfrin.c.", " - CVE-2026-19033", " * SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof", " - debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from", " the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.", " - debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC", " wildcard proofs in bin/tests/system/Makefile.am,", " bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,", " bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys", " tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.", " - CVE-2026-19941", " * SECURITY UPDATE: Unexpected exit via SIG(0) over DNS-over-HTTPS", " - debian/patches/CVE-2026-77692-1.patch: Fix an unauthenticated crash on", " HTTPS using SIG(0) in lib/isc/netmgr/http.c, lib/isc/netmgr/netmgr-int.h,", " lib/isc/netmgr/netmgr.c.", " - debian/patches/CVE-2026-77692-2.patch: Test sending SIG(0)/DoH message and", " cut connection in bin/tests/system/sig0_https/ns1/named.conf.j2,", " bin/tests/system/sig0_https/tests_sig0_https.py.", " - CVE-2026-77692", " * SECURITY UPDATE: Out-of-zone records served as authoritative", " - debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex", " are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,", " bin/tests/system/outofzone_zonecut/ns1/example.db,", " bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns1/root.db,", " bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns2/nszone.db,", " bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns3/nszone.db,", " bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.", " - debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin", " in zone database lookups in lib/dns/qpzone.c, tests/dns/qpzone_test.c.", " - debian/patches/CVE-2026-78301-3.patch: Ignore nodes above the zone origin", " in RBT zone database lookups in lib/dns/rbt-zonedb.c.", " - CVE-2026-78301", " * SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS", " AliasMode additional-data errors in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/ns1/named.conf.j2,", " bin/tests/system/additional/ns2/root.db,", " bin/tests/system/additional/tests_https_alias.py.", " - debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB", " additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.", " - CVE-2026-81563", " * SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone", " - debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the", " insecure-referral proof in lib/dns/validator.c.", " - CVE-2026-77119", " * SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3", " proofs", " - debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection", " consistent in lib/dns/include/dns/rdatalist.h,", " lib/dns/include/dns/rdataset.h, lib/dns/include/dns/validator.h,", " lib/dns/rdatalist.c, lib/dns/rdataset.c, lib/dns/resolver.c,", " lib/dns/validator.c, tests/dns/qpdb_test.c.", " - debian/patches/CVE-2026-80274-2.patch: Test NOQNAME proof selection in the", " rdataset unit test in tests/dns/rdataset_test.c.", " - CVE-2026-80274", " * SECURITY UPDATE: Unexpected exit via oversized negative cache records", " - debian/patches/CVE-2026-19667-1.patch: Reject negative cache records that", " do not fit in a dns_rdata_t in lib/dns/ncache.c.", " - debian/patches/CVE-2026-19667-2.patch: Test that an oversized negative", " cache record is rejected in tests/dns/Makefile.am,", " tests/dns/ncache_test.c.", " - CVE-2026-19667", " * SECURITY UPDATE: Excessive CPU usage via cached HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81736-1.patch: Bound the total additional", " processing for a single query in lib/ns/client.c,", " lib/ns/include/ns/client.h, lib/ns/query.c.", " - debian/patches/CVE-2026-81736-2.patch: Add a system test for SVCB/HTTPS", " AliasMode additional processing in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/tests_https_alias.py,", " bin/tests/system/svcb_alias/ns1/named.conf.j2,", " bin/tests/system/svcb_alias/ns1/root.hint,", " bin/tests/system/svcb_alias/ns2/named.conf.j2,", " bin/tests/system/svcb_alias/ns2/root.db,", " bin/tests/system/svcb_alias/setup.sh,", " bin/tests/system/svcb_alias/tests_svcb_alias.py.", " - CVE-2026-81736", " * SECURITY UPDATE: Amplified resource exhaustion in inbound message processing", " - debian/patches/CVE-2026-19630.patch: Limit how many compression pointers a", " message may make us follow in bin/tools/dnstap-read.c,", " fuzz/dns_name_fromwire.c, fuzz/dns_qpkey_name.c,", " fuzz/dns_rdata_fromwire_text.c, fuzz/old.c, fuzz/old.h,", " lib/dns/include/dns/compress.h, lib/dns/include/dns/message.h,", " lib/dns/include/dns/name.h, lib/dns/include/dns/rdata.h,", " lib/dns/include/dns/types.h, lib/dns/journal.c, lib/dns/master.c,", " lib/dns/message.c, lib/dns/name.c, lib/dns/nsec3.c, lib/dns/rdata.c,", " lib/dns/rdata/any_255/tsig_250.c, lib/dns/rdata/ch_3/a_1.c,", " lib/dns/rdata/generic/afsdb_18.c, lib/dns/rdata/generic/amtrelay_260.c,", " lib/dns/rdata/generic/cname_5.c, lib/dns/rdata/generic/dname_39.c,", " lib/dns/rdata/generic/dsync_66.c, lib/dns/rdata/generic/hip_55.c,", " lib/dns/rdata/generic/ipseckey_45.c, lib/dns/rdata/generic/lp_107.c,", " lib/dns/rdata/generic/mb_7.c, lib/dns/rdata/generic/md_3.c,", " lib/dns/rdata/generic/mf_4.c, lib/dns/rdata/generic/mg_8.c,", " lib/dns/rdata/generic/minfo_14.c, lib/dns/rdata/generic/mr_9.c,", " lib/dns/rdata/generic/mx_15.c, lib/dns/rdata/generic/naptr_35.c,", " lib/dns/rdata/generic/ns_2.c, lib/dns/rdata/generic/nsec_47.c,", " lib/dns/rdata/generic/nxt_30.c, lib/dns/rdata/generic/proforma.c,", " lib/dns/rdata/generic/ptr_12.c, lib/dns/rdata/generic/rp_17.c,", " lib/dns/rdata/generic/rrsig_46.c, lib/dns/rdata/generic/rt_21.c,", " lib/dns/rdata/generic/sig_24.c, lib/dns/rdata/generic/soa_6.c,", " lib/dns/rdata/generic/talink_58.c, lib/dns/rdata/generic/tkey_249.c,", " lib/dns/rdata/in_1/a6_38.c, lib/dns/rdata/in_1/apl_42.c,", " lib/dns/rdata/in_1/kx_36.c, lib/dns/rdata/in_1/nsap-ptr_23.c,", " lib/dns/rdata/in_1/px_26.c, lib/dns/rdata/in_1/srv_33.c,", " lib/dns/rdata/in_1/svcb_64.c, lib/dns/view.c,", " tests/bench/dns_name_fromwire.c, tests/dns/message_test.c,", " tests/dns/name_test.c, tests/dns/rdata_test.c.", " - CVE-2026-19630", " * SECURITY UPDATE: Concurrent GSS-TSIG messages corrupt memory", " - debian/patches/CVE-2026-94300.patch: Serialize access to the shared GSS-", " TSIG security context in lib/dns/gssapi_link.c.", " - CVE-2026-94300", " * SECURITY UPDATE: named may terminate unexpectedly when a redirect zone is", " used with strict QNAME minimization", " - debian/patches/CVE-2026-96888-1.patch: Add a test with qname-minimization", " strict and redirect in bin/tests/system/redirect/ns10/named.conf.j2,", " bin/tests/system/redirect/ns11/named.conf.j2,", " bin/tests/system/redirect/ns11/redirect.db,", " bin/tests/system/redirect/ns11/root.hints,", " bin/tests/system/redirect/ns9/sign.sh,", " bin/tests/system/redirect/tests_redirect_dns64.py,", " bin/tests/system/redirect/tests_redirect_qmin.py,", " bin/tests/system/redirect/tests_redirect_qminzone.py,", " bin/tests/system/redirect/tests_sh_redirect.py.", " - debian/patches/CVE-2026-96888-2.patch: Clear AD flag on redirect NXRRSET", " in lib/ns/query.c.", " - debian/patches/CVE-2026-96888-3.patch: Handle qname-minimization failures", " gracefully when redirecting in lib/ns/query.c.", " - CVE-2026-96888", " * SECURITY UPDATE: Specific RPZ configurations and query patterns may result", " in an unexpected exit", " - debian/patches/CVE-2026-97313-1.patch: Add a reproducer for CVE-2026-97313", " in bin/tests/system/rpzrecurse/ans7/ans.py,", " bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns2/db.nsdname,", " bin/tests/system/rpzrecurse/ns2/db.rpzip,", " bin/tests/system/rpzrecurse/ns2/named.cve-2026-97313.conf,", " bin/tests/system/rpzrecurse/tests.sh.", " - debian/patches/CVE-2026-97313-2.patch: Test view and RPZ matching after", " UDP client reuse in bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns8/named.args,", " bin/tests/system/rpzrecurse/ns8/named.conf.j2,", " bin/tests/system/rpzrecurse/ns8/nonrecursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/recursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/root.hint,", " bin/tests/system/rpzrecurse/tests_client_reuse.py.", " - debian/patches/CVE-2026-97313-3.patch: Tighten the conditions of the", " 'recursionok' flag reset in lib/ns/query.c.", " - CVE-2026-97313", "" ], "package": "bind9", "version": "1:9.20.24-1ubuntu3.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 30 Oct 2026 10:46:02 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-host", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu3", "version": "1:9.20.24-1ubuntu3" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu3.1", "version": "1:9.20.24-1ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19668", "url": "https://ubuntu.com/security/CVE-2026-19668", "cve_description": "A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-76163", "url": "https://ubuntu.com/security/CVE-2026-76163", "cve_description": "If BIND is loaded with a \"`named.conf`\" file that contains no global \"`options`\" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77692", "url": "https://ubuntu.com/security/CVE-2026-77692", "cve_description": "An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19668", "url": "https://ubuntu.com/security/CVE-2026-19668", "cve_description": "A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-76163", "url": "https://ubuntu.com/security/CVE-2026-76163", "cve_description": "If BIND is loaded with a \"`named.conf`\" file that contains no global \"`options`\" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77692", "url": "https://ubuntu.com/security/CVE-2026-77692", "cve_description": "An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME", " records", " - debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in", " lib/dns/message.c.", " - debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated", " singleton records in a message in tests/dns/Makefile.am,", " tests/dns/message_test.c.", " - CVE-2026-75029", " * SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC", " proofs", " - debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser", " proof caching in lib/dns/include/dns/rdatalist.h,", " lib/dns/include/dns/rdataset.h, lib/dns/include/dns/rdataslab.h,", " lib/dns/qpcache.c, lib/dns/qpzone.c, lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/rdataset.c, lib/dns/rdataslab.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders", " alive in lib/dns/include/dns/rdataset.h, lib/dns/rdataslab.c.", " - debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader", " lifetime in tests/dns/qpdb_test.c.", " - CVE-2026-19662", " * SECURITY UPDATE: Excessive CPU usage validating crafted DNSSEC responses", " - debian/patches/CVE-2026-19668-2.patch: Make the exhausted DNSSEC", " validation quota terminal in lib/dns/resolver.c, lib/dns/validator.c.", " - debian/patches/CVE-2026-19668-3.patch: Bound the DS-to-DNSKEY matching", " during DNSSEC validation in lib/dns/include/dns/validator.h,", " lib/dns/validator.c.", " - CVE-2026-19668", " * SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers", " - debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the", " DNS64 filter64 path in lib/ns/query.c.", " - debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path", " against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,", " bin/tests/system/dns64/ns2/named.conf.j2, bin/tests/system/dns64/tests.sh.", " - CVE-2026-19666", " * SECURITY UPDATE: Unexpected exit via TKEY query without global options", " - debian/patches/CVE-2026-76163-1.patch: Always create the TKEY context in", " bin/named/include/named/tkeyconf.h, bin/named/server.c,", " bin/named/tkeyconf.c.", " - debian/patches/CVE-2026-76163-2.patch: Test TKEY queries without global", " options in bin/tests/system/tkey/nooptions/example.db,", " bin/tests/system/tkey/nooptions/named.conf,", " bin/tests/system/tkey/tests_no_options.py.", " - CVE-2026-76163", " * SECURITY UPDATE: Zone transfer data used before TSIG verification", " - debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in", " bin/tests/system/xfer/ans5/ans.py, lib/dns/xfrin.c.", " - CVE-2026-19033", " * SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof", " - debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from", " the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.", " - debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC", " wildcard proofs in bin/tests/system/Makefile.am,", " bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,", " bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys", " tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.", " - CVE-2026-19941", " * SECURITY UPDATE: Unexpected exit via SIG(0) over DNS-over-HTTPS", " - debian/patches/CVE-2026-77692-1.patch: Fix an unauthenticated crash on", " HTTPS using SIG(0) in lib/isc/netmgr/http.c, lib/isc/netmgr/netmgr-int.h,", " lib/isc/netmgr/netmgr.c.", " - debian/patches/CVE-2026-77692-2.patch: Test sending SIG(0)/DoH message and", " cut connection in bin/tests/system/sig0_https/ns1/named.conf.j2,", " bin/tests/system/sig0_https/tests_sig0_https.py.", " - CVE-2026-77692", " * SECURITY UPDATE: Out-of-zone records served as authoritative", " - debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex", " are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,", " bin/tests/system/outofzone_zonecut/ns1/example.db,", " bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns1/root.db,", " bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns2/nszone.db,", " bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns3/nszone.db,", " bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.", " - debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin", " in zone database lookups in lib/dns/qpzone.c, tests/dns/qpzone_test.c.", " - debian/patches/CVE-2026-78301-3.patch: Ignore nodes above the zone origin", " in RBT zone database lookups in lib/dns/rbt-zonedb.c.", " - CVE-2026-78301", " * SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS", " AliasMode additional-data errors in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/ns1/named.conf.j2,", " bin/tests/system/additional/ns2/root.db,", " bin/tests/system/additional/tests_https_alias.py.", " - debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB", " additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.", " - CVE-2026-81563", " * SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone", " - debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the", " insecure-referral proof in lib/dns/validator.c.", " - CVE-2026-77119", " * SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3", " proofs", " - debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection", " consistent in lib/dns/include/dns/rdatalist.h,", " lib/dns/include/dns/rdataset.h, lib/dns/include/dns/validator.h,", " lib/dns/rdatalist.c, lib/dns/rdataset.c, lib/dns/resolver.c,", " lib/dns/validator.c, tests/dns/qpdb_test.c.", " - debian/patches/CVE-2026-80274-2.patch: Test NOQNAME proof selection in the", " rdataset unit test in tests/dns/rdataset_test.c.", " - CVE-2026-80274", " * SECURITY UPDATE: Unexpected exit via oversized negative cache records", " - debian/patches/CVE-2026-19667-1.patch: Reject negative cache records that", " do not fit in a dns_rdata_t in lib/dns/ncache.c.", " - debian/patches/CVE-2026-19667-2.patch: Test that an oversized negative", " cache record is rejected in tests/dns/Makefile.am,", " tests/dns/ncache_test.c.", " - CVE-2026-19667", " * SECURITY UPDATE: Excessive CPU usage via cached HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81736-1.patch: Bound the total additional", " processing for a single query in lib/ns/client.c,", " lib/ns/include/ns/client.h, lib/ns/query.c.", " - debian/patches/CVE-2026-81736-2.patch: Add a system test for SVCB/HTTPS", " AliasMode additional processing in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/tests_https_alias.py,", " bin/tests/system/svcb_alias/ns1/named.conf.j2,", " bin/tests/system/svcb_alias/ns1/root.hint,", " bin/tests/system/svcb_alias/ns2/named.conf.j2,", " bin/tests/system/svcb_alias/ns2/root.db,", " bin/tests/system/svcb_alias/setup.sh,", " bin/tests/system/svcb_alias/tests_svcb_alias.py.", " - CVE-2026-81736", " * SECURITY UPDATE: Amplified resource exhaustion in inbound message processing", " - debian/patches/CVE-2026-19630.patch: Limit how many compression pointers a", " message may make us follow in bin/tools/dnstap-read.c,", " fuzz/dns_name_fromwire.c, fuzz/dns_qpkey_name.c,", " fuzz/dns_rdata_fromwire_text.c, fuzz/old.c, fuzz/old.h,", " lib/dns/include/dns/compress.h, lib/dns/include/dns/message.h,", " lib/dns/include/dns/name.h, lib/dns/include/dns/rdata.h,", " lib/dns/include/dns/types.h, lib/dns/journal.c, lib/dns/master.c,", " lib/dns/message.c, lib/dns/name.c, lib/dns/nsec3.c, lib/dns/rdata.c,", " lib/dns/rdata/any_255/tsig_250.c, lib/dns/rdata/ch_3/a_1.c,", " lib/dns/rdata/generic/afsdb_18.c, lib/dns/rdata/generic/amtrelay_260.c,", " lib/dns/rdata/generic/cname_5.c, lib/dns/rdata/generic/dname_39.c,", " lib/dns/rdata/generic/dsync_66.c, lib/dns/rdata/generic/hip_55.c,", " lib/dns/rdata/generic/ipseckey_45.c, lib/dns/rdata/generic/lp_107.c,", " lib/dns/rdata/generic/mb_7.c, lib/dns/rdata/generic/md_3.c,", " lib/dns/rdata/generic/mf_4.c, lib/dns/rdata/generic/mg_8.c,", " lib/dns/rdata/generic/minfo_14.c, lib/dns/rdata/generic/mr_9.c,", " lib/dns/rdata/generic/mx_15.c, lib/dns/rdata/generic/naptr_35.c,", " lib/dns/rdata/generic/ns_2.c, lib/dns/rdata/generic/nsec_47.c,", " lib/dns/rdata/generic/nxt_30.c, lib/dns/rdata/generic/proforma.c,", " lib/dns/rdata/generic/ptr_12.c, lib/dns/rdata/generic/rp_17.c,", " lib/dns/rdata/generic/rrsig_46.c, lib/dns/rdata/generic/rt_21.c,", " lib/dns/rdata/generic/sig_24.c, lib/dns/rdata/generic/soa_6.c,", " lib/dns/rdata/generic/talink_58.c, lib/dns/rdata/generic/tkey_249.c,", " lib/dns/rdata/in_1/a6_38.c, lib/dns/rdata/in_1/apl_42.c,", " lib/dns/rdata/in_1/kx_36.c, lib/dns/rdata/in_1/nsap-ptr_23.c,", " lib/dns/rdata/in_1/px_26.c, lib/dns/rdata/in_1/srv_33.c,", " lib/dns/rdata/in_1/svcb_64.c, lib/dns/view.c,", " tests/bench/dns_name_fromwire.c, tests/dns/message_test.c,", " tests/dns/name_test.c, tests/dns/rdata_test.c.", " - CVE-2026-19630", " * SECURITY UPDATE: Concurrent GSS-TSIG messages corrupt memory", " - debian/patches/CVE-2026-94300.patch: Serialize access to the shared GSS-", " TSIG security context in lib/dns/gssapi_link.c.", " - CVE-2026-94300", " * SECURITY UPDATE: named may terminate unexpectedly when a redirect zone is", " used with strict QNAME minimization", " - debian/patches/CVE-2026-96888-1.patch: Add a test with qname-minimization", " strict and redirect in bin/tests/system/redirect/ns10/named.conf.j2,", " bin/tests/system/redirect/ns11/named.conf.j2,", " bin/tests/system/redirect/ns11/redirect.db,", " bin/tests/system/redirect/ns11/root.hints,", " bin/tests/system/redirect/ns9/sign.sh,", " bin/tests/system/redirect/tests_redirect_dns64.py,", " bin/tests/system/redirect/tests_redirect_qmin.py,", " bin/tests/system/redirect/tests_redirect_qminzone.py,", " bin/tests/system/redirect/tests_sh_redirect.py.", " - debian/patches/CVE-2026-96888-2.patch: Clear AD flag on redirect NXRRSET", " in lib/ns/query.c.", " - debian/patches/CVE-2026-96888-3.patch: Handle qname-minimization failures", " gracefully when redirecting in lib/ns/query.c.", " - CVE-2026-96888", " * SECURITY UPDATE: Specific RPZ configurations and query patterns may result", " in an unexpected exit", " - debian/patches/CVE-2026-97313-1.patch: Add a reproducer for CVE-2026-97313", " in bin/tests/system/rpzrecurse/ans7/ans.py,", " bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns2/db.nsdname,", " bin/tests/system/rpzrecurse/ns2/db.rpzip,", " bin/tests/system/rpzrecurse/ns2/named.cve-2026-97313.conf,", " bin/tests/system/rpzrecurse/tests.sh.", " - debian/patches/CVE-2026-97313-2.patch: Test view and RPZ matching after", " UDP client reuse in bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns8/named.args,", " bin/tests/system/rpzrecurse/ns8/named.conf.j2,", " bin/tests/system/rpzrecurse/ns8/nonrecursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/recursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/root.hint,", " bin/tests/system/rpzrecurse/tests_client_reuse.py.", " - debian/patches/CVE-2026-97313-3.patch: Tighten the conditions of the", " 'recursionok' flag reset in lib/ns/query.c.", " - CVE-2026-97313", "" ], "package": "bind9", "version": "1:9.20.24-1ubuntu3.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 30 Oct 2026 10:46:02 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-libs", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu3", "version": "1:9.20.24-1ubuntu3" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.20.24-1ubuntu3.1", "version": "1:9.20.24-1ubuntu3.1" }, "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19668", "url": "https://ubuntu.com/security/CVE-2026-19668", "cve_description": "A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-76163", "url": "https://ubuntu.com/security/CVE-2026-76163", "cve_description": "If BIND is loaded with a \"`named.conf`\" file that contains no global \"`options`\" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77692", "url": "https://ubuntu.com/security/CVE-2026-77692", "cve_description": "An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19668", "url": "https://ubuntu.com/security/CVE-2026-19668", "cve_description": "A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on \"max-records-per-type\" and \"max-types-per-name\" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-76163", "url": "https://ubuntu.com/security/CVE-2026-76163", "cve_description": "If BIND is loaded with a \"`named.conf`\" file that contains no global \"`options`\" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77692", "url": "https://ubuntu.com/security/CVE-2026-77692", "cve_description": "An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19630", "url": "https://ubuntu.com/security/CVE-2026-19630", "cve_description": "In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:18:00 UTC" }, { "cve": "CVE-2026-94300", "url": "https://ubuntu.com/security/CVE-2026-94300", "cve_description": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-96888", "url": "https://ubuntu.com/security/CVE-2026-96888", "cve_description": "A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" }, { "cve": "CVE-2026-97313", "url": "https://ubuntu.com/security/CVE-2026-97313", "cve_description": "A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.", "cve_priority": "medium", "cve_public_date": "2026-10-21 13:21:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME", " records", " - debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in", " lib/dns/message.c.", " - debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated", " singleton records in a message in tests/dns/Makefile.am,", " tests/dns/message_test.c.", " - CVE-2026-75029", " * SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC", " proofs", " - debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser", " proof caching in lib/dns/include/dns/rdatalist.h,", " lib/dns/include/dns/rdataset.h, lib/dns/include/dns/rdataslab.h,", " lib/dns/qpcache.c, lib/dns/qpzone.c, lib/dns/rbtdb.c, lib/dns/rdatalist.c,", " lib/dns/rdataset.c, lib/dns/rdataslab.c, lib/dns/resolver.c,", " lib/ns/query.c.", " - debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders", " alive in lib/dns/include/dns/rdataset.h, lib/dns/rdataslab.c.", " - debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader", " lifetime in tests/dns/qpdb_test.c.", " - CVE-2026-19662", " * SECURITY UPDATE: Excessive CPU usage validating crafted DNSSEC responses", " - debian/patches/CVE-2026-19668-2.patch: Make the exhausted DNSSEC", " validation quota terminal in lib/dns/resolver.c, lib/dns/validator.c.", " - debian/patches/CVE-2026-19668-3.patch: Bound the DS-to-DNSKEY matching", " during DNSSEC validation in lib/dns/include/dns/validator.h,", " lib/dns/validator.c.", " - CVE-2026-19668", " * SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers", " - debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the", " DNS64 filter64 path in lib/ns/query.c.", " - debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path", " against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,", " bin/tests/system/dns64/ns2/named.conf.j2, bin/tests/system/dns64/tests.sh.", " - CVE-2026-19666", " * SECURITY UPDATE: Unexpected exit via TKEY query without global options", " - debian/patches/CVE-2026-76163-1.patch: Always create the TKEY context in", " bin/named/include/named/tkeyconf.h, bin/named/server.c,", " bin/named/tkeyconf.c.", " - debian/patches/CVE-2026-76163-2.patch: Test TKEY queries without global", " options in bin/tests/system/tkey/nooptions/example.db,", " bin/tests/system/tkey/nooptions/named.conf,", " bin/tests/system/tkey/tests_no_options.py.", " - CVE-2026-76163", " * SECURITY UPDATE: Zone transfer data used before TSIG verification", " - debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in", " bin/tests/system/xfer/ans5/ans.py, lib/dns/xfrin.c.", " - CVE-2026-19033", " * SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof", " - debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from", " the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.", " - debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC", " wildcard proofs in bin/tests/system/Makefile.am,", " bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,", " bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys", " tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.", " - CVE-2026-19941", " * SECURITY UPDATE: Unexpected exit via SIG(0) over DNS-over-HTTPS", " - debian/patches/CVE-2026-77692-1.patch: Fix an unauthenticated crash on", " HTTPS using SIG(0) in lib/isc/netmgr/http.c, lib/isc/netmgr/netmgr-int.h,", " lib/isc/netmgr/netmgr.c.", " - debian/patches/CVE-2026-77692-2.patch: Test sending SIG(0)/DoH message and", " cut connection in bin/tests/system/sig0_https/ns1/named.conf.j2,", " bin/tests/system/sig0_https/tests_sig0_https.py.", " - CVE-2026-77692", " * SECURITY UPDATE: Out-of-zone records served as authoritative", " - debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex", " are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,", " bin/tests/system/outofzone_zonecut/ns1/example.db,", " bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns1/root.db,", " bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns2/nszone.db,", " bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns3/nszone.db,", " bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.", " - debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin", " in zone database lookups in lib/dns/qpzone.c, tests/dns/qpzone_test.c.", " - debian/patches/CVE-2026-78301-3.patch: Ignore nodes above the zone origin", " in RBT zone database lookups in lib/dns/rbt-zonedb.c.", " - CVE-2026-78301", " * SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS", " AliasMode additional-data errors in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/ns1/named.conf.j2,", " bin/tests/system/additional/ns2/root.db,", " bin/tests/system/additional/tests_https_alias.py.", " - debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB", " additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.", " - CVE-2026-81563", " * SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone", " - debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the", " insecure-referral proof in lib/dns/validator.c.", " - CVE-2026-77119", " * SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3", " proofs", " - debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection", " consistent in lib/dns/include/dns/rdatalist.h,", " lib/dns/include/dns/rdataset.h, lib/dns/include/dns/validator.h,", " lib/dns/rdatalist.c, lib/dns/rdataset.c, lib/dns/resolver.c,", " lib/dns/validator.c, tests/dns/qpdb_test.c.", " - debian/patches/CVE-2026-80274-2.patch: Test NOQNAME proof selection in the", " rdataset unit test in tests/dns/rdataset_test.c.", " - CVE-2026-80274", " * SECURITY UPDATE: Unexpected exit via oversized negative cache records", " - debian/patches/CVE-2026-19667-1.patch: Reject negative cache records that", " do not fit in a dns_rdata_t in lib/dns/ncache.c.", " - debian/patches/CVE-2026-19667-2.patch: Test that an oversized negative", " cache record is rejected in tests/dns/Makefile.am,", " tests/dns/ncache_test.c.", " - CVE-2026-19667", " * SECURITY UPDATE: Excessive CPU usage via cached HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81736-1.patch: Bound the total additional", " processing for a single query in lib/ns/client.c,", " lib/ns/include/ns/client.h, lib/ns/query.c.", " - debian/patches/CVE-2026-81736-2.patch: Add a system test for SVCB/HTTPS", " AliasMode additional processing in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/tests_https_alias.py,", " bin/tests/system/svcb_alias/ns1/named.conf.j2,", " bin/tests/system/svcb_alias/ns1/root.hint,", " bin/tests/system/svcb_alias/ns2/named.conf.j2,", " bin/tests/system/svcb_alias/ns2/root.db,", " bin/tests/system/svcb_alias/setup.sh,", " bin/tests/system/svcb_alias/tests_svcb_alias.py.", " - CVE-2026-81736", " * SECURITY UPDATE: Amplified resource exhaustion in inbound message processing", " - debian/patches/CVE-2026-19630.patch: Limit how many compression pointers a", " message may make us follow in bin/tools/dnstap-read.c,", " fuzz/dns_name_fromwire.c, fuzz/dns_qpkey_name.c,", " fuzz/dns_rdata_fromwire_text.c, fuzz/old.c, fuzz/old.h,", " lib/dns/include/dns/compress.h, lib/dns/include/dns/message.h,", " lib/dns/include/dns/name.h, lib/dns/include/dns/rdata.h,", " lib/dns/include/dns/types.h, lib/dns/journal.c, lib/dns/master.c,", " lib/dns/message.c, lib/dns/name.c, lib/dns/nsec3.c, lib/dns/rdata.c,", " lib/dns/rdata/any_255/tsig_250.c, lib/dns/rdata/ch_3/a_1.c,", " lib/dns/rdata/generic/afsdb_18.c, lib/dns/rdata/generic/amtrelay_260.c,", " lib/dns/rdata/generic/cname_5.c, lib/dns/rdata/generic/dname_39.c,", " lib/dns/rdata/generic/dsync_66.c, lib/dns/rdata/generic/hip_55.c,", " lib/dns/rdata/generic/ipseckey_45.c, lib/dns/rdata/generic/lp_107.c,", " lib/dns/rdata/generic/mb_7.c, lib/dns/rdata/generic/md_3.c,", " lib/dns/rdata/generic/mf_4.c, lib/dns/rdata/generic/mg_8.c,", " lib/dns/rdata/generic/minfo_14.c, lib/dns/rdata/generic/mr_9.c,", " lib/dns/rdata/generic/mx_15.c, lib/dns/rdata/generic/naptr_35.c,", " lib/dns/rdata/generic/ns_2.c, lib/dns/rdata/generic/nsec_47.c,", " lib/dns/rdata/generic/nxt_30.c, lib/dns/rdata/generic/proforma.c,", " lib/dns/rdata/generic/ptr_12.c, lib/dns/rdata/generic/rp_17.c,", " lib/dns/rdata/generic/rrsig_46.c, lib/dns/rdata/generic/rt_21.c,", " lib/dns/rdata/generic/sig_24.c, lib/dns/rdata/generic/soa_6.c,", " lib/dns/rdata/generic/talink_58.c, lib/dns/rdata/generic/tkey_249.c,", " lib/dns/rdata/in_1/a6_38.c, lib/dns/rdata/in_1/apl_42.c,", " lib/dns/rdata/in_1/kx_36.c, lib/dns/rdata/in_1/nsap-ptr_23.c,", " lib/dns/rdata/in_1/px_26.c, lib/dns/rdata/in_1/srv_33.c,", " lib/dns/rdata/in_1/svcb_64.c, lib/dns/view.c,", " tests/bench/dns_name_fromwire.c, tests/dns/message_test.c,", " tests/dns/name_test.c, tests/dns/rdata_test.c.", " - CVE-2026-19630", " * SECURITY UPDATE: Concurrent GSS-TSIG messages corrupt memory", " - debian/patches/CVE-2026-94300.patch: Serialize access to the shared GSS-", " TSIG security context in lib/dns/gssapi_link.c.", " - CVE-2026-94300", " * SECURITY UPDATE: named may terminate unexpectedly when a redirect zone is", " used with strict QNAME minimization", " - debian/patches/CVE-2026-96888-1.patch: Add a test with qname-minimization", " strict and redirect in bin/tests/system/redirect/ns10/named.conf.j2,", " bin/tests/system/redirect/ns11/named.conf.j2,", " bin/tests/system/redirect/ns11/redirect.db,", " bin/tests/system/redirect/ns11/root.hints,", " bin/tests/system/redirect/ns9/sign.sh,", " bin/tests/system/redirect/tests_redirect_dns64.py,", " bin/tests/system/redirect/tests_redirect_qmin.py,", " bin/tests/system/redirect/tests_redirect_qminzone.py,", " bin/tests/system/redirect/tests_sh_redirect.py.", " - debian/patches/CVE-2026-96888-2.patch: Clear AD flag on redirect NXRRSET", " in lib/ns/query.c.", " - debian/patches/CVE-2026-96888-3.patch: Handle qname-minimization failures", " gracefully when redirecting in lib/ns/query.c.", " - CVE-2026-96888", " * SECURITY UPDATE: Specific RPZ configurations and query patterns may result", " in an unexpected exit", " - debian/patches/CVE-2026-97313-1.patch: Add a reproducer for CVE-2026-97313", " in bin/tests/system/rpzrecurse/ans7/ans.py,", " bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns2/db.nsdname,", " bin/tests/system/rpzrecurse/ns2/db.rpzip,", " bin/tests/system/rpzrecurse/ns2/named.cve-2026-97313.conf,", " bin/tests/system/rpzrecurse/tests.sh.", " - debian/patches/CVE-2026-97313-2.patch: Test view and RPZ matching after", " UDP client reuse in bin/tests/system/rpzrecurse/ns1/root.db,", " bin/tests/system/rpzrecurse/ns8/named.args,", " bin/tests/system/rpzrecurse/ns8/named.conf.j2,", " bin/tests/system/rpzrecurse/ns8/nonrecursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/recursive-policy.db,", " bin/tests/system/rpzrecurse/ns8/root.hint,", " bin/tests/system/rpzrecurse/tests_client_reuse.py.", " - debian/patches/CVE-2026-97313-3.patch: Tighten the conditions of the", " 'recursionok' flag reset in lib/ns/query.c.", " - CVE-2026-97313", "" ], "package": "bind9", "version": "1:9.20.24-1ubuntu3.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Fri, 30 Oct 2026 10:46:02 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "bpftool", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.8.0+7.3.0-9.9" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.8.0+7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libapt-pkg7.0", "from_version": { "source_package_name": "apt", "source_package_version": "3.3.3", "version": "3.3.3" }, "to_version": { "source_package_name": "apt", "source_package_version": "3.3.3ubuntu0.1", "version": "3.3.3ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-109518", "url": "https://ubuntu.com/security/CVE-2026-109518", "cve_description": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.", "cve_priority": "high", "cve_public_date": "2026-11-04 12:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Download verification bypass", " - methods/*.cc: Open target files exclusively", " - CVE-2026-109518", " * SECURITY UPDATE: Out-of-bounds accesses", " - debDebFileParser: reject .deb without a Version field", " - solver: Ensure workLess is a strict weak ordering", "" ], "package": "apt", "version": "3.3.3ubuntu0.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Mon, 02 Nov 2026 15:29:58 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libbrotli1", "from_version": { "source_package_name": "brotli", "source_package_version": "1.2.0-4", "version": "1.2.0-4" }, "to_version": { "source_package_name": "brotli", "source_package_version": "1.2.0-4ubuntu0.1", "version": "1.2.0-4ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-111497", "url": "https://ubuntu.com/security/CVE-2026-111497", "cve_description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "cve_priority": "high", "cve_public_date": "2026-10-22 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-111497", "url": "https://ubuntu.com/security/CVE-2026-111497", "cve_description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "cve_priority": "high", "cve_public_date": "2026-10-22 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: DoS or code exec via buffer overflow", " - debian/patches/CVE-2026-111497.patch: Detect and report invalid stream", " earlier. in c/dec/decode.c, c/include/brotli/decode.h.", " - CVE-2026-111497", "" ], "package": "brotli", "version": "1.2.0-4ubuntu0.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Sun, 25 Oct 2026 13:46:04 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libmspack0t64", "from_version": { "source_package_name": "libmspack", "source_package_version": "0.11-1.1build2", "version": "0.11-1.1build2" }, "to_version": { "source_package_name": "libmspack", "source_package_version": "0.11-1.1ubuntu0.26.10.1", "version": "0.11-1.1ubuntu0.26.10.1" }, "cves": [ { "cve": "CVE-2026-110602", "url": "https://ubuntu.com/security/CVE-2026-110602", "cve_description": "libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.", "cve_priority": "medium", "cve_public_date": "2026-10-14 15:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-110602", "url": "https://ubuntu.com/security/CVE-2026-110602", "cve_description": "libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive.", "cve_priority": "medium", "cve_public_date": "2026-10-14 15:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: uninitialized pointer issue", " - debian/patches/CVE-2026-110602.patch: kwajd_read_headers(): initialise", " pointers before returning any error in mspack/kwajd.c.", " - CVE-2026-110602", "" ], "package": "libmspack", "version": "0.11-1.1ubuntu0.26.10.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 27 Oct 2026 15:05:06 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpcre2-8-0", "from_version": { "source_package_name": "pcre2", "source_package_version": "10.46-1build1", "version": "10.46-1build1" }, "to_version": { "source_package_name": "pcre2", "source_package_version": "10.46-1ubuntu1", "version": "10.46-1ubuntu1" }, "cves": [ { "cve": "CVE-2026-103111", "url": "https://ubuntu.com/security/CVE-2026-103111", "cve_description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "cve_priority": "medium", "cve_public_date": "2026-09-30 05:16:00 UTC" }, { "cve": "CVE-2026-86145", "url": "https://ubuntu.com/security/CVE-2026-86145", "cve_description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "cve_priority": "medium", "cve_public_date": "2026-09-05 06:17:00 UTC" }, { "cve": "CVE-2026-89156", "url": "https://ubuntu.com/security/CVE-2026-89156", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89157", "url": "https://ubuntu.com/security/CVE-2026-89157", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89158", "url": "https://ubuntu.com/security/CVE-2026-89158", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89160", "url": "https://ubuntu.com/security/CVE-2026-89160", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89161", "url": "https://ubuntu.com/security/CVE-2026-89161", "cve_description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89162", "url": "https://ubuntu.com/security/CVE-2026-89162", "cve_description": "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "cve_priority": "medium", "cve_public_date": "2026-09-11 05:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-103111", "url": "https://ubuntu.com/security/CVE-2026-103111", "cve_description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "cve_priority": "medium", "cve_public_date": "2026-09-30 05:16:00 UTC" }, { "cve": "CVE-2026-86145", "url": "https://ubuntu.com/security/CVE-2026-86145", "cve_description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "cve_priority": "medium", "cve_public_date": "2026-09-05 06:17:00 UTC" }, { "cve": "CVE-2026-89156", "url": "https://ubuntu.com/security/CVE-2026-89156", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89157", "url": "https://ubuntu.com/security/CVE-2026-89157", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89158", "url": "https://ubuntu.com/security/CVE-2026-89158", "cve_description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89160", "url": "https://ubuntu.com/security/CVE-2026-89160", "cve_description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89161", "url": "https://ubuntu.com/security/CVE-2026-89161", "cve_description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "cve_priority": "medium", "cve_public_date": "2026-09-11 04:18:00 UTC" }, { "cve": "CVE-2026-89162", "url": "https://ubuntu.com/security/CVE-2026-89162", "cve_description": "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.", "cve_priority": "medium", "cve_public_date": "2026-09-11 05:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Fix large JIT stack allocation.", " - src/pcre2_jit_compile.c: Track oversized stack allocations and compute", " the growth threshold from the stack top instead of assuming the stack", " starts near its base, preventing an out-of-bounds write.", " - Authors: Zoltan Herczeg, Nicholas Wilson", " - 2b4038298072684b0fae29b15bedfb1a75bda46d", " - 6f9d7c1373262c541324a16a358785b33ef116cf", " - CVE-2026-103111", " * SECURITY UPDATE: Fix DFA workspace overflows", " - src/pcre2_dfa_match.c: Size new workspace blocks to fit the current", " ovector request and stop reusing a next block that is too small,", " preventing workspace overflow past the heap limit.", " - testdata/testinput6, testdata/testoutput6: Regression tests for the", " workspace overflow cases.", " - Author: Nicholas Wilson", " - c932e70451eafef922ebef364ac25042f0031135", " - CVE-2026-86145", " * SECURITY UPDATE: Fix pcre2_match to check for JIT support before JIT", " validation & execution", " - src/pcre2_internal.h: Declare the new jit_check_exec() helper.", " - src/pcre2_jit_misc.c: Add jit_check_exec() to verify the requested", " matching mode is compiled in before running JIT code.", " - src/pcre2_match.c: Gate the JIT fast path on jit_check_exec() so a", " missing JIT mode falls through to the interpreter's own UTF validation", " instead of skipping it.", " - Author: Zoltan Herczeg", " - f67db227af31bba7cdf2a7a00b97af91b588c2f5", " - CVE-2026-89156", " * SECURITY UPDATE: Use CU2BYTES for byte sizing in two allocation sites", " - src/pcre2_convert.c, src/pcre2_substring.c: Size allocations with", " CU2BYTES() instead of multiplying by PCRE2_CODE_UNIT_WIDTH, and reject", " lengths that would overflow the size calculation.", " - Author: Ilia Alshanetsky", " - 8156b3989a82f2ddf9504d8248496e9b124be7f3", " - CVE-2026-89157", " * SECURITY UPDATE: Fix compiler integer overflows", " - src/pcre2_compile.c: Guard pattern length accumulation against", " OFLOW_MAX and MAX_PATTERN_SIZE overflow.", " - src/pcre2_compile_class.c: Fix class list sizing overflow.", " - Author: Nicholas Wilson", " - ec9c286d5c10cf1c388b58a442ccefded42254fd", " - CVE-2026-89158", " * SECURITY UPDATE: Fix invalid UTF backwards-scan reads", " - src/pcre2_extuni.c, src/pcre2_match.c: Bound backwards scans at", " check_subject rather than start_subject so they cannot read into an", " invalid UTF prefix before it has been validated.", " - testdata/testinput10, testdata/testoutput10, testdata/testinput12,", " testdata/testoutput12-16, testdata/testoutput12-32: Regression tests", " for backwards scans over invalid UTF prefixes.", " - Author: Nicholas Wilson", " - 4889caf31a4c5a6b3c051f0031bf2dbd78f2c287", " - CVE-2026-89160", " * SECURITY UPDATE: Fix leak & stale PCRE2_MD_COPIED_SUBJECT if", " pcre2_jit_match used with existing match context.", " - src/pcre2_jit_match.c: Free a previously copied subject and clear the", " PCRE2_MD_COPIED_SUBJECT flag before reusing a match data block.", " - src/pcre2test.c: Detect a wrongly-set or wrongly-cleared copied-subject", " state after a JIT match.", " - doc/pcre2jit.3, doc/pcre2.txt, doc/html/pcre2jit.html: Document the", " pcre2_jit_match() fast-path limitations.", " - testdata/testinput17, testdata/testoutput17: Test the copied-subject", " handling on the JIT fast path.", " - Author: Nicholas Wilson", " - 1dcd0cf42a6a7cb62cc9a7c024196733abcfda95", " - CVE-2026-89161", " * SECURITY UPDATE: Write padding values to ensure pcre2_serialize_encode()", " outputs defined values.", " - src/pcre2_compile_class.c: Initialize the class-list alignment padding", " so serialized output contains no uninitialized bytes.", " - src/pcre2test.c: Verify the compiled pattern serializes without", " undefined memory.", " - Author: Nicholas Wilson", " - edc111a6831591f68b5355a08cc9df8be8f35304", " - CVE-2026-89162", "" ], "package": "pcre2", "version": "10.46-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Tue, 13 Oct 2026 12:56:49 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-10.10", "" ], "package": "linux-meta", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 09:20:30 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-10.10", "" ], "package": "linux-meta", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 09:20:30 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-10.10", "" ], "package": "linux-meta", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 09:20:30 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-libc-dev", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-perf", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-common", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-10.10", "" ], "package": "linux-meta", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 09:20:30 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "motd-news-config", "from_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu2", "version": "14.2ubuntu2" }, "to_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu2.1", "version": "14.2ubuntu2.1" }, "cves": [], "launchpad_bugs_fixed": [ 2131303 ], "changes": [ { "cves": [], "log": [ "", " * debian/preinst: remove dangling multilib aliasing symlinks (/lib32,", " /libo32, /libx32) instead of failing (LP: #2131303)", "" ], "package": "base-files", "version": "14.2ubuntu2.1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2131303 ], "author": "Nadzeya Hutsko ", "date": "Fri, 16 Oct 2026 11:20:11 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-twisted", "from_version": { "source_package_name": "twisted", "source_package_version": "26.4.0-4", "version": "26.4.0-4" }, "to_version": { "source_package_name": "twisted", "source_package_version": "26.4.0-4ubuntu0.1", "version": "26.4.0-4ubuntu0.1" }, "cves": [ { "cve": "CVE-2026-106454", "url": "https://ubuntu.com/security/CVE-2026-106454", "cve_description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.", "cve_priority": "medium", "cve_public_date": "2026-10-06 20:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106454", "url": "https://ubuntu.com/security/CVE-2026-106454", "cve_description": "Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly to re.compile(), allowing nested or otherwise expensive regular expression constructs to cause catastrophic backtracking when matched against mailbox names. Because Twisted uses a cooperative single-threaded reactor, the blocking match suspends all server input and output for the duration of the match. No fixed release is available as of this review.", "cve_priority": "medium", "cve_public_date": "2026-10-06 20:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: DoS in wildcardToRegexp()", " - debian/patches/CVE-2026-106454-1.patch: add a type annotation since we're", " about to make changes in src/twisted/mail/imap4.py.", " - debian/patches/CVE-2026-106454-2.patch: make it pass by escaping", " everything else in src/twisted/mail/imap4.py.", " - debian/patches/CVE-2026-106454-3.patch: failing test that uses a python", " regexp in src/twisted/mail/test/test_imap.py.", " - debian/patches/CVE-2026-106454-4.patch: add more potential matches to", " exclude to be sure in src/twisted/mail/test/test_imap.py.", " - debian/patches/CVE-2026-106454-5.patch: per code review test some more", " cases in src/twisted/mail/test/test_imap.py.", " - debian/patches/CVE-2026-106454-6.patch: per code review, docstring for", " wildcardToRegexp in src/twisted/mail/imap4.py.", " - CVE-2026-106454", "" ], "package": "twisted", "version": "26.4.0-4ubuntu0.1", "urgency": "medium", "distributions": "stonking-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 15 Oct 2026 11:16:12 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-headers-7.3.0-10", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": "linux-headers-7.3.0-10 version '7.3.0-10.10' (source package linux version '7.3.0-10.10') was added. linux-headers-7.3.0-10 version '7.3.0-10.10' has the same source package name, linux, as removed package linux-headers-7.3.0-9. As such we can use the source package version of the removed package, '7.3.0-9.9', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-headers-7.3.0-10-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": "linux-headers-7.3.0-10-generic version '7.3.0-10.10' (source package linux version '7.3.0-10.10') was added. linux-headers-7.3.0-10-generic version '7.3.0-10.10' has the same source package name, linux, as removed package linux-headers-7.3.0-9. As such we can use the source package version of the removed package, '7.3.0-9.9', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-7.3.0-10-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-9.9", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-10.10", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 09:20:37 +0300" } ], "notes": "linux-image-7.3.0-10-generic version '7.3.0-10.10' (source package linux-signed version '7.3.0-10.10') was added. linux-image-7.3.0-10-generic version '7.3.0-10.10' has the same source package name, linux-signed, as removed package linux-image-7.3.0-9-generic. As such we can use the source package version of the removed package, '7.3.0-9.9', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-v4l2loopback-7.3.0-10-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-9.9", "version": null }, "to_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-10.10+1", "version": "7.3.0-10.10+1" }, "cves": [], "launchpad_bugs_fixed": [ 1786013, 2166733 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-7.7", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/d2026.09.28)", "" ], "package": "linux-main-signed", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 18:14:13 +0200" }, { "cves": [], "log": [ "", "", " * New upstream core24.60 release (LP: #2166733)", " - [Packaging] add bison/flex for iwlwifi", "", " * Miscellaneous Ubuntu changes", " - [Packaging]: lmm: Add the kernel version to the kernel variant", " - [Packaging] lmm: Add flavour migration support", " - [Packaging] Allow debpaths of additional formats", " - [Packaging] Remove compat file from lmg ancillary", " - [Packaging]: Update manifest file with new patches", "" ], "package": "linux-main-signed", "version": "7.3.0-6.6+1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166733 ], "author": "Paolo Pisati ", "date": "Tue, 22 Sep 2026 09:33:03 +0200" } ], "notes": "linux-main-modules-v4l2loopback-7.3.0-10-generic version '7.3.0-10.10+1' (source package linux-main-signed version '7.3.0-10.10+1') was added. linux-main-modules-v4l2loopback-7.3.0-10-generic version '7.3.0-10.10+1' has the same source package name, linux-main-signed, as removed package linux-main-modules-v4l2loopback-7.3.0-9-generic. As such we can use the source package version of the removed package, '7.3.0-9.9', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.3.0-10-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-9.9", "version": null }, "to_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-10.10+1", "version": "7.3.0-10.10+1" }, "cves": [], "launchpad_bugs_fixed": [ 1786013, 2166733 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-7.7", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/d2026.09.28)", "" ], "package": "linux-main-signed", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 18:14:13 +0200" }, { "cves": [], "log": [ "", "", " * New upstream core24.60 release (LP: #2166733)", " - [Packaging] add bison/flex for iwlwifi", "", " * Miscellaneous Ubuntu changes", " - [Packaging]: lmm: Add the kernel version to the kernel variant", " - [Packaging] lmm: Add flavour migration support", " - [Packaging] Allow debpaths of additional formats", " - [Packaging] Remove compat file from lmg ancillary", " - [Packaging]: Update manifest file with new patches", "" ], "package": "linux-main-signed", "version": "7.3.0-6.6+1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166733 ], "author": "Paolo Pisati ", "date": "Tue, 22 Sep 2026 09:33:03 +0200" } ], "notes": "linux-main-modules-zfs-7.3.0-10-generic version '7.3.0-10.10+1' (source package linux-main-signed version '7.3.0-10.10+1') was added. linux-main-modules-zfs-7.3.0-10-generic version '7.3.0-10.10+1' has the same source package name, linux-main-signed, as removed package linux-main-modules-v4l2loopback-7.3.0-9-generic. As such we can use the source package version of the removed package, '7.3.0-9.9', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.3.0-10-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": "linux-modules-7.3.0-10-generic version '7.3.0-10.10' (source package linux version '7.3.0-10.10') was added. linux-modules-7.3.0-10-generic version '7.3.0-10.10' has the same source package name, linux, as removed package linux-headers-7.3.0-9. As such we can use the source package version of the removed package, '7.3.0-9.9', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-10", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": "linux-tools-7.3.0-10 version '7.3.0-10.10' (source package linux version '7.3.0-10.10') was added. linux-tools-7.3.0-10 version '7.3.0-10.10' has the same source package name, linux, as removed package linux-headers-7.3.0-9. As such we can use the source package version of the removed package, '7.3.0-9.9', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-10-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-10.10", "version": "7.3.0-10.10" }, "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2171639, 2169765 ], "changes": [ { "cves": [ { "cve": "CVE-2026-99999", "url": "https://ubuntu.com/security/CVE-2026-99999", "cve_description": "In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.", "cve_priority": "medium", "cve_public_date": "2026-10-15 13:17:00 UTC" } ], "log": [ "", " * stonking/linux: 7.3.0-10.10 -proposed tracker (LP: #2171639)", "", " * Rebase to v7.3 final (LP: #2169765)", " CVE-2026-99999", " - Linux 7.3", " - firewire: core: fix race condition in split transaction handling", " - x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()", " - PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV", " - PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe", " - printk: Postpone kthread startup", " - wifi: atk9k: Revert \"wifi: ath9k: reject short WMI command responses\"", " - Revert \"namei: don't reveal overmounted entries in refwalk\"", " - perf: Update cgroup time when rotating multiplexed events", " - perf: Fix perf_pmu_migrate_context() leaving events behind", " - perf: Track the perf mlock gift separately", " - sched/fair: Avoid overflow in place_entity()", " - perf/x86/intel/uncore: Fix DMR CXL CM invert filter", " - tracing: Check operator stack capacity before pushing", " - tracing: Keep the predicate limit separate from program capacity", " - tracing: Fix crash in print_graph_function_event()", " - spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()", " - spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible", " - spi: imx: fix slab corruption from undersized DMA bounce buffers", " - i2c: xiic: restore non-managed runtime PM to fix clk WARN flood", " - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang", " - drm/amdgpu: keep the eviction fence until the last handle is closed", " - drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions", " - drm/amdgpu/userq: actually validate userq BOs", " - drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES", " - drm/amdgpu: free the userptr ranges when a CS fails after parser_bos", " - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr", " - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl", " - drm/amd/pm: add zero fan stop temperature support on smu 14.0.2", " - drm/amdgpu: destroy mutex when tearing down ttm buffer entity", " - drm/amdgpu: fix sched entity leak in ttm buffer entity init", " - drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set", " - net: stmmac: dwmac1000: clear the RGMII status interrupt", " - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", " - ring-buffer: Use subbuf_order in available memory estimation", " - gpio: mxc: fix race between gpiochip registration and IRQ domain setup", " - gpio: mxc: fix wakeup_pads bit operations", " - gpio: mxc: fix both_edges bit operations", " - gpio: mxc: fix race between chained IRQ handler install and probe completion", " - gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths", " - gpio: kunit: fix GPIO device reference leak with __free()", " - gpio: shared: gracefully handle no-device lookup of shared GPIOs", " - gpio: shared: fix use-after-free bug when adding shared proxies", " - net/sched: fix use-after-free in __tcf_action_put()", " - calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()", " - net: bcmgenet: unshare the skb before writing the control block", " - microchip: lan865x: move setting of netops to fix crash", " - net: ti: icssm-prueth: Move setting of netops to fix crash", " - net: ethernet: aeroflex: move setting of netops to fix crash", " - net: ethoc: move setting of netops to fix crash", " - net: au1000: move setting of netops to fix crash", " - net: mv643xx: move setting of netops to fix crash", " - net: ethernet: adi: Move setting of netops to fix crash", " - net: ethernet: actions: Move setting of netops to fix crash", " - net: hisilicon: hip04_eth: Move setting of netops to fix crash", " - net: hisilicon: hisi_femac: Move setting of netops to fix crash", " - netlink: avoid hashing the network namespace pointer", " - scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies", " - scsi: libsas: Fix SMP IO deadlock during HA resume", " - tracing: probes: error if BTF is required but unavailable", " - ring-buffer: Skip si_mem_available() for persistent and remote buffers", " - eventfs: Free the eventfs_inode after an rcu grace period too", " - tracing: Do not initialize tracefs work if tracing is disabled", " - tracing: Fix hist trigger timestamps for buffered events", " - tracing: Fix ignored return value of resize_buffer_duplicate_size()", " - ring-buffer: Fix false warning in ring_buffer_map_get_reader()", " - tracing: Fix simple_ring_buffer undef check on sparc64", " - tracing: Fix simple_ring_buffer undef check on parisc", " - tracing: Fix empty symbol names in simple_ring_buffer undef check", " - ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", " - tracing: Fix the shift out of bounds in the log2 histogram modifier", " - ring-buffer: Do not show buffer_meta for CPUs without a buffer", " - tracing: Take trace_types_lock when dropping the buffer_meta reference", " - tracing: Fix NULL dereference when copying keys for a field variable", " - selftests/filesystems: test that a mntns file can't take over a lock", " - fs: let idle threads share init_fs", " - namespace: a mount that copy_tree() leaves out can't take over a lock", " - namei: test for a negative dentry the way traverse_mounts() does", " - fs: pass flags to copy_fs()", " - ovl: reject lowerdir ending with unescaped backslash", " - fsnotify: prevent mark additions during connector teardown", " - pid_namespace: make zap_pid_ns_processes() freezable", " - fs: drop the smp_mb()s that mnt_get_count() made redundant", " - autofs: ignore notification errors from a replaced pipe", " - ntfs3: free replaced mount options after a grace period", " - ntfs3: free the sbi after a grace period", " - unicode: free the map after a grace period", " - ipc: drop the mqueue mount with kern_unmount() on setup failure", " - eventfs: free the eventfs_inode after an rcu grace period too", " - 9p: free the session after a grace period", " - watch_queue: Fix note pool publication race in watch_queue_set_size()", " - afs: free the super info after a grace period", " - pipe: preserve existing fasync readers on writer setup failure", " - ext4: free the sbi after a grace period", " - exit: fix lost-update race on the child_subreaper bitfields", " - samples: pidfd: fix userprogs typo", " - ocfs2/dlm: Protect the recovery list during debugfs reads", " - drm/panthor: fix immortalis condition", " - drm/i915/cx0_phy: Fix ARL-S host bridge detection", " - drm/i915/dmc: Add sanity check for DMC load address", " - drm/i915/dmc: Harden DMC firmware payload parsing", " - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry", " - x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context", " - iommupt/kunit: Use if_changed_rule for the kunit", " - Revert \"iommu/amd: Remove redundant check in irq_remapping_select()\"", " - entry: Account the deferred hrtimer rearm as hardirq context for lockdep", " - futex: Fix mm reuse handling for FUT_OFF_MMSHARED", " - sched/core: Call wakeup_preempt() for queued tasks during class change", " - printk: fix kernel-doc name for nbcon_write_context_is_braille", " - drm/exec: don't immediately add prelocked obj to array of locked objs", " - nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()", " - scsi: libiscsi: Validate the task named by a management response", " - scsi: libiscsi: Validate the ITT reflected in a Reject PDU", " - scsi: libiscsi: Reject a negative task index from parse_pdu_itt", " - scsi: target: iscsi: Fix race in discovery auth updates", " - scsi: target: Disable interrupts while holding delayed_cmd_lock", " - scsi: st: Fix use-after-free race between st_remove() and st_open()", " - scsi: st: Save the visited block for the partition the drive is in", " - scsi: xen/scsifront: Check for a NULL shadow entry on a backend response", " - nios2: fix __wsum type degradation in csum_fold()", " - drm/virtio: Reset device before deleting virtqueues on freeze", " - spi: tegra114: assert CS GPIO for every transfer in a message", " - sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs", " - sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching()", " - drm/xe: Bump LRU for external objects on exec and rebind", " - drm/xe/oa: Zero OA buffer at allocation", " - drm/xe: skip eviction of a BO with no resource", " - Revert \"dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels\"", " - ASoC: amd: yc: disable MSI on resume", " - net/mlx5: HWS, fix flow meter offset within its bulk", " - net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool", " - accel/rocket: search every core slot when looking up a scheduler", " - accel/rocket: search every core slot when a core is removed", " - accel/rocket: clear rdev on device init failure", " - i2c: qcom-cci: Fix HALT_ACK reset request being dropped", " - netlink: reset skb headers before unicast and multicast filtering", " - sctp: revalidate output stream after association connect wait", " - regmap: Fix cache lifecycle locking and teardown", " - regmap: Drop map lock during cache init and exit", " - regmap: Remove debugfs before cache teardown", " - i2c: qcom-geni: Restore the source-clock selection policy", " - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()", " - PCI: dw-rockchip: Move INTx IRQ setup to probe", " - PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave", " - ASoC: Fix controls that write another control's bits", " - ASoC: nau8822: Fix the 128x oversampling switch bits", " - ASoC: wm8978: Fix the 128x oversampling switch bits", " - ASoC: max98371: Fix the Speaker DHT Min Volume bits", " - ASoC: pcm3168a: Fix the DAC zero flag polarity bit", " - ASoC: cs42l52: Fix the NG Type Switch bit", " - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register", " - sched_ext: idle: Respect task affinity in restricted CPU selection", " - sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor", " - sched_ext: Propagate every bypass depth change to the descendants", " - ASoC: stm32: spdifrx: fix synchronization state check", " - ASoC: Intel: avs: Reset the stream unless it is already prepared", " - KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes", " - accel/amdxdna: Fix Kconfig invalid configuration", " - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure", " - net: rds: fix uninitialized trans dereference in CM event handler", " - drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change", " - vsock: treat TCP_CLOSING as once-established", " - tools: gpio: fix building from the top level with O=", " - gpio: nct6694: Mark the GPIO controller as sleeping", " - power: sequencing: qcom-wcn: power off WLAN at probe", " - drm/vc4: hdmi: Move packet RAM enable to PM runtime", " - x86/kcfi: Emit the FineIBT paranoid \"cs\" prefix as a byte", " - x86/kcfi: Decode the kCFI check from the trap address", " - pinctrl: sunxi: dt: do not accumulate npins across probe attempts", " - bootconfig: give the footer size static_assert a message", " - Linux 7.3-rc7", " - Revert \"drm/virtio: Add pixel blend mode property to cursor plane\"", " - landlock: Drop __counted_by from landlock_domain.handled_masks", " - xfs: fix exchange-range-to-eof file size exchange", " - xfs: stop exchanging reflink flags when exchanging mappings", " - sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue", " - sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ", " - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox", " - Input: xpad - add support for Corsair Novablade Pro", " - Input: ati_remote2 - fix type confusion in device attribute handlers", " - lib/crypto: tests: Add Poly1305 split-update carry regression test", " - lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state", " - lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()", " - io_uring/cancel: don't spin on local work the task can't run", " - io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6", " - io_uring/register: don't exempt disabled rings from task restrictions", " - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK", " - drm/nouveau: Skip the Turing CE workaround object for non-GR channels", " - PCI/AER: Skip error recovery on false alarms", " - drm/vc4: Fix binner slot allocation failing on an idle GPU", " - drm/vc4: Disable the V3D interrupt across runtime suspend", " - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK", " - net: macb: copy shared skbs before appending the FCS", " - net: macb: check TX ring before modifying skb", " - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", " - wireguard: noise: reject response consumption after intermediate initiation", " - wireguard: queueing: preserve tstamp_type when encapsulating packet", " - net: openvswitch: validate transport header presence in set_ipv6_addr", " - net/smc: protect clcsock lifetime in smc_getname", " - ipv6: do not warn on route notification size race", " - ipv4: do not warn on route notification size race", " - ipv4: validate checksum_start before completing checksum", " - ptp: ocp: fix PCIe delay estimation calculation", " - xen/netfront: don't leak the skb when xennet_fill_frags() fails", " - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb", " - xen/netfront: drop RX packets with a short Ethernet header", " - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()", " - net: sparx5: free the matchall entry on destroy", " - selftests: mlxsw: Test port range occupancy on template create", " - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()", " - net: dsa: microchip: fix KSZ8765 fiber detection", " - net/mlx5e: Order ICOSQ cc update after CQ doorbell", " - selftests: net: veth: test peer ndo-xmit after GRO toggle while down", " - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down", " - net: mana: reserve RX buffer headroom to fix forwarding performance", " - ext4: mark data=journal as deprecated and will be removed in January 2028.", " - swiotlb: fix default_swiotlb_limit() for non-growable default pool", " - ASoC: SOF: sof-client: Use event-handler mutex consistently", " - ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture", " - drm/imagination: Size page table preallocation by device address", " - drm/imagination: Fix reference and vm_bo handling in remap()", " - spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi", " - riscv: fix load_unaligned_zeropad() fixup for RV32", " - cipso: adjust cached option offsets when removing CIPSO", " - bareudp: set the inner protocol to the protocol of the packet", " - e1000e: add system to disable K1 list", " - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp", " - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()", " - bnxt_en: fix DMA mapping length for padded small packets", " - bnxt_en: Re-write the BARs following any type of PCIe errors", " - bnxt_en: Fix driver init in kdump kernel", " - bnxt_en: Add bnxt_clear_bars() helper", " - net: usb: ax88179_178a: fix rx frame length for non-last packets", " - Revert \"wifi: libertas: reject short monitor TX frames\"", " - workqueue: Fix NULL current_pwq deref in mem-reclaim helper", " - drm/amdgpu: make Mac FB workaround generic", " - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info", " - drm/amd/display: Don't replace a sink mode that shares the native totals", " - drm/amdkfd: align SDMA doorbell base for shader doorbell writes", " - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks", " - drm/amdgpu: serialize vblank counter reads against GPU reset", " - drm/amd/display: disable self-refresh on tearing flips", " - drm/amdgpu/userq: return the memdup_user() error for the user MQD", " - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell", " - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs", " - riscv: ptrace: Zero-initialize regset buffers before copyin", " - riscv: ptrace: reject CFI regset access when extensions are absent", " - riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds", " - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", " - riscv: futex: untag the user pointer before the atomic access", " - ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts", " - ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA", " - drm/xe/i2c: cancel the client work on remove", " - pinctrl: amd: Clear S4 wake bits when firmware has _AEI", " - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback", " - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI", " - ASoC: cs35l56: Add DAI for SDCA OT25 stream", " - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", " - wifi: mac80211: don't estimate airtime for unsupported rate widths", " - arm64: irq: exclude the softirq stack switch from KCOV", " - pfcp: make sure the SEID is linear before reading it", " - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET", " - strparser: make sure __strp_recv isn't running before tearing down the parser", " - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute", " - Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"", " - selftests: tc-testing: add cls_route no-routing-attribute change tests", " - net/sched: cls_route: reject change with no routing attribute", " - net: team: free skb when broadcast has no txable port", " - net: team: stop reusing skb after queue override", " - devlink: fix devlink_rel reference leak when notify work is pending", " - net: sparx5: start the TOD counters on non-PTP lan969x variants", " - mailmap: update entry for Andy Yan", " - drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly", " - selftests/mm: cleanup -Wformat issues in hugetlb-mmap", " - mm: don't schedule deferred kernel page table freeing while booting", " - mailmap: update addresses for John Garry", " - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP", " - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge", " - ipv4: stop route notification sizing when nexthop group shrinks", " - ipv4: stop exception dump when nexthop group shrinks", " - ipv4: stop PMTU walk when nexthop group shrinks", " - vsock/virtio: account only unread bytes in read_skb()", " - ip6_gre: remove obsolete ERSPAN PMTU update", " - namespace: simplify disconnect_mount()", " - selftests/filesystems: test covered mounts", " - namespace: rework connected mounts", " - nullfs: add an empty immutable regular file", " - selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM", " - net: always dissect GSO packets in __virtio_net_hdr_to_skb()", " - flow_dissector: avoid u16 truncation of skb->len when computing thoff", " - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()", " - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers", " - spi: sg2044-nor: Honor SPI clock limits", " - spi: sg2044-nor: Return transfer errors", " - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM", " - ASoC: adau1372: two small bugfixes for the codec", " - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes", " - ASoC: adau1372: allow sleepy powerdown GPIOs", " - Revert \"wifi: ath12k: add panic handler\"", " - wifi: nxpwifi: do not delete Rx reorder entries under RCU", " - wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion", " - wifi: nxpwifi: handle authentication frame allocation failures", " - wifi: nxpwifi: fix the authentication frame length handling", " - wifi: nxpwifi: zero the channel statistics array", " - wifi: nxpwifi: free the aggregation buffer when the RA list disappears", " - wifi: nxpwifi: wait for the wakeup timer before the adapter is freed", " - wifi: nxpwifi: delete the station entry on the uAP deauth event", " - wifi: nxpwifi: protect sta_list against concurrent add and delete", " - drm/xe/sysctrl: Fix mailbox header handling", " - drm/i915/gt: Unmask interrupts only when ACTIVE is true", " - drm/i915/gem: Prevent overstepping exec array boundary", " - drm/gud: don't keep a connector without a CRTC as connector_state", " - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()", " - wifi: mt76: mt792x: pick the SAR table layout from the table itself", " - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit", " - wifi: mt76: mt7603: initialize global station WCID", " - wifi: mt76: mt7925: don't put the band auto marker in TGID", " - wifi: mt76: mt7915: disable rx napi when removing device", " - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout", " - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown", " - wifi: mt76: use ALTX queue for packets to disassociated stations", " - wifi: mt76: account non-AQL frames per peer rather than per link", " - wifi: mt76: mt7996: take over connection monitoring", " - pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12", " - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ", " - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()", " - scsi: ch: Do not keep references to data transfer element devices", " - scsi: ufs: mediatek: Handle mPHY power-on failures", " - Revert \"net: stmmac: propagate PTP addend and system time programming errors\"", " - riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts", " - riscv: patch: fix handling of bpf-jit execmem addresses", " - RISC-V: Clear HSTATUS.HU on CPU initialization", " - RISC-V: errata: Add SiFive MAL-9092 workaround", " - riscv: vector: Fix output operands in context save", " - riscv: vector: Fix data pointer constraints in context save/restore", " - riscv: limit sifive errata to CONFIG_64BIT", " - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header", " - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()", " - gve: fix napi_disable deadlock when attempting to disable XSK pools", " - gve: fix XSK buffer leak on error descriptor", " - gve: fix XSK buffer leak when rings are stopped", " - net: stmmac: Disable S-Tag processing on dwmac4", " - net: stmmac: Do not advertise S-VLAN stripping when it is disabled", " - net: stmmac: Rename double VLAN references to svlan", " - net: stmmac: Stop toggling the EDVLP bit", " - net: stmmac: Remove VLAN perfect matching dead code", " - ipv4: free inet_opt and ireq_opt after an RCU grace period", " - net/mlx5: Lag, split aggregate speed into oper and max helpers", " - net: make dev_xdp_sb_prog_count() see programs attached through a link", " - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin", " - drm/xe: Fix shrinker accounting double-subtraction on nested external pins", " - drm/xe: Do not emit Wa_16010904313 twice", " - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums", " - EDAC/amd64: Mask UMC chip select to the four implemented selects", " - x86/CPU/AMD: Fix AMD TLBI Erratum #1718", " - Bluetooth: ISO: Serialize concurrent connect calls", " - Bluetooth: ISO: Reject concurrent BIS listener setup", " - Bluetooth: hci_sync: Fix command skb lifetime during scan setup", " - Bluetooth: hci_sock: Serialize dead-device detachment", " - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)", " - btrfs: fix lost error return value in btrfs_listxattr()", " - btrfs: fix xattr replace when multiple xattrs are packed in the same item", " - btrfs: don't stash io_uring encoded data across -EAGAIN", " - btrfs: unlock inode and extent in caller when io_uring read extent fails", " - btrfs: free iov when btrfs_uring_read_extent() fails", " - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio", " - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", " - btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()", " - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"", " - zloop: zero out only the unread tail of short reads", " - i2c: qcom-geni: release runtime PM reference when set_rate fails", " - fsverity: RCU-delay the freeing of struct fsverity_info", " - openvswitch: fix soft lockup in the netlink flow dump", " - net: bridge: avoid recursive multicast port cleanup", " - spi: cadence-qspi: Fix status polling with octal DTR chips", " - spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock", " - KEYS: Fix add_key() race with keyring restriction", " - keys: finalize persistent keyring timeout after link attempt", " - power: supply: core: prevent unregistering a power supply while a callback runs", " - regulator: of: Fixes to of_regulator_bulk_get_all()", " - regulator: of: state who owns the array from of_regulator_bulk_get_all()", " - regulator: of: fill in supply names in of_regulator_bulk_get_all()", " - power: supply: generic-adc-battery: Fix temperature IIO channel conversion", " - selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody", " - selftests/filesystems: add a helper that holds a readdir in a page fault", " - readdir: take no inode lock on an immutable directory", " - nullfs: refuse file locks", " - fsnotify: let a filesystem refuse marks on its objects", " - namespace: nothing is mounted on or written through knullfs", " - namespace: keep the private nullfs instance in knullfs", " - fhandle: decide the subtree check under mount_lock", " - selftests/filesystems: check that an automount below an overlay layer is refused", " - selftests/filesystems: check the atime of the empty mount namespace root", " - selftests/filesystems: check that a lock lands on the right mount and stays", " - namespace: keep the lock on a mount that a propagated copy is moved beneath", " - namespace: never expire a locked mount", " - nullfs: don't update the access time", " - namespace: handle mount locking for automounts correctly", " - namespace: refuse an automount below a mount that is in no namespace", " - selftests/filesystems: check that an immutable inode takes no write hint", " - fcntl: refuse F_SET_RW_HINT on an immutable inode", " - namei: don't reveal overmounted entries in refwalk", " - namespace: unhash a dentry before detaching the mounts on it", " - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3", " - sched_ext: Generate qseq from a per-task counter", " - turbostat 2026.09.28", " - tools/power turbostat: Fix add_counter issue if > 24 counters.", " - tools/power turbostat: Fix PMT error path fd handling", " - tools/power turbostat: Fix CWF PMT off-by-one", " - tools/power turbostat: Fix fd_perf leak on reset", " - tools/power turbostat: Sanity check GFX%rc6 and SAM%mc6 percentages", " - tools/power turbostat: add NULL check after calloc()", " - tools/power turbostat: Warn, but don't Err on out-dated perf systems", " - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)", " - ALSA: hda/tas2781: Accept V1 calibration data without CRC", " - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers", " - ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H", " - ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers", " - nvmet: use the local P2P device on metadata allocation failure", " - nvme-multipath: revalidate head zones after unfreezing the head queue", " - nvme: fix swapped ZRASF zone state values for full and read only", " - nvmet: return Invalid Field for invalid NSIDs feature 82h", " - ice: fix metadata_dst refcount handling on representor teardown", " - ice: Restore Ordered MMIO Writes for Tx Doorbells", " - ice: fix use-after-free in dynamic port cleanup", " - tcp: reject net_iov in zerocopy receive mapping hints", " - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop", " - bonding: fix the program leak when XDP is replaced", " - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()", " - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown", " - Bluetooth: btintel_pcie: use managed IRQ teardown", " - tee: optee: ffa: support shared memory offsets on large-page kernels", " - optee: register TEE devices only once fully initialized", " - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()", " - net: allwinner: remove dmaengine_desc_free()", " - net: stmmac: propagate PTP addend and system time programming errors", " - wifi: mt76: mt7996: program a link again if the driver holds it", " - cxgb4/ch_ktls: disable softirqs around tid_list erases", " - braille: nbcon: Allow to use a serial console with NBCON API as Braille console", " - tipc: destroy topsrv workqueues before closing connections", " - lib/dim: add KUnit test for dim_calc_stats()", " - lib/dim: fix 32-bit overflow in dim_calc_stats() rates", " - net/packet: guard the ll header push in packet_rcv_spkt()", " - selftests: net: amt: check that the relay's queries bypass the amt device", " - amt: send the relay's General Query directly from the receive path", " - net/sched: em_text: reject unterminated algo before autoload", " - srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()", " - tipc: hold a reference to nodes found by link name", " - ibmveth: fix TX LTB and filter unwind on open-fail", " - ibmveth: h_free logical LAN on open-fail after register", " - usb: f81604: fix struct f81604_int_data size mismatch", " - can: fix unique skb identifier regression under RPS", " - can: dev: init_can_skb(): restore skb header initialization", " - tools/power turbostat: Read complete CPU lists", " - drm/vc4: Use kvmalloc_objs() for the BO cache size list", " - drm/vc4: Free the BO cache size list on teardown", " - drm/aspeed: Balance the display clock enable on teardown", " - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN", " - pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions", " - gpio: mpsse: fix race when arming the IRQ poll worker", " - namespace: don't let a pseudo dentry become the root of a mount", " - unshare: don't drop active namespace references that were never taken", " - dcache: don't put a mountpoint on a dentry that's being removed", " - namespace: remove the fsnotify marks of a mount namespace in process context", " - selftests/filesystems: check that the nullfs root can't be reconfigured", " - namespace: don't reconfigure internal superblocks via remount and umount", " - namespace: check the mounts before reading their parents in pivot_root()", " - selftests/filesystems: check that a mount namespace file on top doesn't bury a mount", " - namespace: look at the topmost mount for a mount namespace file", " - selftests/filesystems: check that OPEN_TREE_NAMESPACE keeps mounts covered", " - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE", " - selftests/filesystems: check that a recursive bind mount can't pin the caller's mount namespace", " - namespace: check a recursive bind mount for mount namespace loops", " - selftests/filesystems: check that a busy submount survives a synchronous umount", " - namespace: check a submount for references right before unmounting it", " - namespace: queue a mount only once for mount notifications", " - dm-integrity: validate the superblock on resume", " - gpio: exar: initialize the ID before registering its cleanup", " - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()", " - nouveau: check gsp->rm as well as gsp pointer before gcx ready", " - drm/dp: don't mark the AUX backlight enabled when enabling failed", " - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts", " - selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves", " - sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ", " - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()", " - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them", " - drm/panthor: validate userspace queue count against initialized firmware slot count", " - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4", " - KVM: x86: Use active memslots for the per-vCPU MMIO cache", " - KVM: SEV: Fix page dirtying in sev_gmem_post_populate()", " - KVM: SVM: Clear AVIC Physical ID table entry if vCPU creation fails", " - KVM: SVM: Use \"is AVIC-addressable\" helper to sanity check load()/put()", " - KVM: SVM: Add paranoid helper for checking if vCPU is AVIC-addressable", " - dm-snap: reject the transient exception store for snapshot-merge", " - dm: fix reading free memory in do_resume", " - drm/bridge: Fix unlocked list access in drm_bridge_attach()", " - drm/bridge: Fix unlocked list_del in drm_bridge_add()", " - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands", " - usb: mtu3: Fix double dereference in TP_printk", " - Bluetooth: MGMT: Fix status of pending commands flushed on power off", " - Bluetooth: btintel_pcie: Add shared HW reset for clean start", " - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex", " - Bluetooth: btintel_pcie: fix TX descriptor bounds check", " - memstick: core: wait for request completion before freeing card", " - workqueue: Fix NULL current_pwq deref in chained work check", " - pinctrl: qcom: spmi-gpio: make direction changes exclusive", " - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()", " - sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler", " - ice: skip unnecessary VF reset when setting trust", " - iavf: send MAC change request synchronously", " - i40e: skip unnecessary VF reset when setting trust", " - mmc: cavium-thunderx: destroy slot platform devices on remove", " - mmc: cavium-octeon: destroy slot platform devices on remove", " - Bluetooth: RFCOMM: free the skb when the DLC has no owner", " - mmc: sdhci-sprd: disable runtime PM on remove", " - mmc: mtk-sd: Cancel request timeout work on remove", " - drm/vmwgfx: Add blend mode property", " - drm/vmwgfx: validate pitch coming from userspace", " - pmdomain: rockchip: don't ignore clock lookup errors on attach", " - pmdomain: rockchip: fix clock leak on domain probe failure", " - pmdomain: rockchip: propagate subdomain add errors", " - gpio: xilinx: fix runtime PM leak on request error path", " - drm/bridge: th1520-dw-hdmi: Fix remove() callback", " - drm/bridge: th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value", " - drm/vc4: Fix firmware reference leak in vc4_drm_bind()", " - selftests/filesystems: check that a dead mount's overmount isn't followed", " - selftests/filesystems: check that an unmounted mount tree isn't walked", " - namespace: drop the file's reference first in dissolve_on_fput()", " - fs: put the old fs_struct before the old namespaces in unshare()", " - fs: refuse fspick() on internal superblocks", " - namespace: check the target before walking it in do_mount_setattr()", " - namespace: don't copy an unmounted mount tree", " - namespace: don't inherit MNT_UMOUNT in clone_mnt()", " - statmount: read the parent of an unmounted mount under mount_lock", " - namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", " - scsi: qedi: Initialize callback state before registration", " - scsi: ufs: core: Hold a clock reference across the probe", " - selinux: fix data race on AVC latest_notif", " - docs: update the unmount propagation rule", " - fs: don't let a migrating task hide its reference from do_umount()", " - selftests/filesystems: check that a busy propagated copy blocks a synchronous umount", " - fs: don't silently unmount busy mounts", " - selftests/move_mount_set_group: check that an unbindable target is refused", " - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount", " - selftests/filesystems: check that a copied mount namespace keeps unbindable", " - mount: keep a copied mount unbindable", " - drm/vc4: drain the hangcheck timer and works on V3D unbind", " - media: em28xx: use video_unregister_device for radio_dev", " - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains", " - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys", " - power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids", " - pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13", " - PCI: hv: Warn when wait_for_response() waits indefinitely", " - dm ioctl: don't let data_start run past the buffer", " - dm-crypt: reject the lmk IV mode with AEAD ciphers", " - dm-integrity: fix buffer overflow in inline mode with large tag size", " - ARM: configs: sama5: enable current Microchip KSZ DSA symbols", " - PCI: hv: Probe vPCI buses asynchronously", " - mshv_vtl: Check per-CPU register page before mmap", " - tools/hv: fix typo \"retrive\" in comment", " - Drivers: hv: vmbus: fix typo \"substract\" in comment", " - pinctrl: qcom: qcs8300: Fix intr_target_width", " - pinctrl: qcom: maili: Fix intr_target_width", " - pinctrl: qcom: hawi: Fix intr_target_width", " - pinctrl: qcom: nord: fix GPIO interrupt target width", " - Drivers: hv: Don't reset VMBus connection state on error/exit paths", " - x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()", " - x86/hyperv: Fix stale comments after stimer message mode removal", " - Drivers: hv: Avoid infinite retry loop in init_vp_index()", " - arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply", " - soc/tegra: pmc: Fix uninitialised clock rate", " - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value", " - power: supply: Fix maintenance charge table kernel-doc", " - power: supply: max17042_battery: Fix vmin assigned instead of vmax in DT parsing", " - riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts", " - pinctrl: qcom: ipq5210: Publish the OF module alias", " - pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions", " - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value", " - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single", " - arm64: dts: lx2160a: fix incorrect pinmux", " - regmap: irq: Free the irqdomain we create", " - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable", " - clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable", " - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks", " - clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks", " - ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition", " - arm64: dts: qcom: x1-denali: Fix microphone distortion", " - soc/tegra: fuse: Add missing newline to APBMISC error message", " - arm64: tegra: Add PCIe root ports on Tegra264", " - arm64: tegra: Reorder reg and reg-names to match bindings", " - arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit", " - arm64: tegra: Add PWM controllers on Tegra264", " - tee: qcomtee: fix kernel-doc warnings", "" ], "package": "linux", "version": "7.3.0-10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2171639, 2169765 ], "author": "Timo Aaltonen ", "date": "Thu, 22 Oct 2026 08:35:41 +0300" } ], "notes": "linux-tools-7.3.0-10-generic version '7.3.0-10.10' (source package linux version '7.3.0-10.10') was added. linux-tools-7.3.0-10-generic version '7.3.0-10.10' has the same source package name, linux, as removed package linux-headers-7.3.0-9. As such we can use the source package version of the removed package, '7.3.0-9.9', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-headers-7.3.0-9", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-7.3.0-9-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-7.3.0-9-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-v4l2loopback-7.3.0-9-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.3.0-9-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.3.0-9-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-9", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-9-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.10 stonking image from release image serial 20261025 to 20261105", "from_series": "stonking", "to_series": "stonking", "from_serial": "20261025", "to_serial": "20261105", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }