Package "linux-headers-5.15.0-125-generic"

  linux-hwe-5.15 (5.15.0-118.128~20.04.1) focal; urgency=medium

  * focal/linux-hwe-5.15: 5.15.0-118.128~20.04.1 -proposed tracker
    (LP: #2072253)

  [ Ubuntu: 5.15.0-118.128 ]

  * jammy/linux: 5.15.0-118.128 -proposed tracker (LP: #2072255)
  * Jammy update: v5.15.160 upstream stable release (LP: #2070292)
    - drm/amd/display: Fix division by zero in setup_dsc_config
    - pinctrl: core: handle radix_tree_insert() errors in
      pinctrl_register_one_pin()
    - nfsd: don't allow nfsd threads to be signalled.
    - KEYS: trusted: Fix memory leak in tpm2_key_encode()
    - Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems"
    - net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access
    - net: bcmgenet: synchronize UMAC_CMD access
    - netlink: annotate lockless accesses to nlk->max_recvmsg_len
    - netlink: annotate data-races around sk->sk_err
    - KVM: x86: Clear "has_error_code", not "error_code", for RM exception
      injection
    - drm/amdgpu: Fix possible NULL dereference in
      amdgpu_ras_query_error_status_helper()
    - binder: fix max_thread type inconsistency
    - usb: typec: ucsi: displayport: Fix potential deadlock
    - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
    - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
    - KEYS: trusted: Do not use WARN when encode fails
    - admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
    - docs: kernel_include.py: Cope with docutils 0.21
    - Linux 5.15.160
  * Jammy update: v5.15.159 upstream stable release (LP: #2070028)
    - dmaengine: pl330: issue_pending waits until WFP state
    - dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
    - wifi: nl80211: don't free NULL coalescing rule
    - ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
    - ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
    - ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
    - eeprom: at24: Use dev_err_probe for nvmem register failure
    - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
    - eeprom: at24: fix memory corruption race condition
    - pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
    - pinctrl/meson: fix typo in PDM's pin name
    - pinctrl: core: delete incorrect free in pinctrl_enable()
    - pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic
    - pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
    - pinctrl: mediatek: paris: Rework support for
      PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
    - sunrpc: add a struct rpc_stats arg to rpc_create_args
    - nfs: expose /proc/net/sunrpc/nfs in net namespaces
    - nfs: make the rpc_stat per net namespace
    - nfs: Handle error of rpc_proc_register() in nfs_net_init().
    - power: rt9455: hide unused rt9455_boost_voltage_values
    - power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator
    - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
    - regulator: mt6360: De-capitalize devicetree regulator subnodes
    - bpf, kconfig: Fix DEBUG_INFO_BTF_MODULES Kconfig definition
    - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
    - bpf: Fix a verifier verbose message
    - spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs
    - s390/mm: Fix storage key clearing for guest huge pages
    - s390/mm: Fix clearing storage keys for huge pages
    - xdp: Move conversion to xdp_frame out of map functions
    - xdp: Add xdp_do_redirect_frame() for pre-computed xdp_frames
    - xdp: use flags field to disambiguate broadcast redirect
    - bna: ensure the copied buf is NUL terminated
    - octeontx2-af: avoid off-by-one read from userspace
    - nsh: Restore skb->{protocol,data,mac_header} for outer header in
      nsh_gso_segment().
    - net l2tp: drop flow hash on forward
    - s390/vdso: Add CFI for RA register to asm macro vdso_func
    - net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
    - net: qede: use return from qede_parse_flow_attr() for flower
    - net: qede: use return from qede_parse_flow_attr() for flow_spec
    - net: qede: use return from qede_parse_actions()
    - ASoC: meson: axg-fifo: use FIELD helpers
    - ASoC: meson: axg-fifo: use threaded irq to check periods
    - ASoC: meson: axg-card: make links nonatomic
    - ASoC: meson: axg-tdm-interface: manage formatters in trigger
    - ASoC: meson: cards: select SND_DYNAMIC_MINORS
    - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()
    - s390/cio: Ensure the copied buf is NUL terminated
    - cxgb4: Properly lock TX queue for the selftest.
    - net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
    - net: bridge: fix multicast-to-unicast with fraglist GSO
    - net: core: reject skb_copy(_expand) for fraglist GSO skbs
    - tipc: fix a possible memleak in tipc_buf_append
    - s390/qeth: don't keep track of Input Queue count
    - s390/qeth: Fix kernel panic after setting hsuid
    - drm/panel: ili9341: Respect deferred probe
    - drm/panel: ili9341: Use predefined error codes
    - net: gro: add flush check in udp_gro_receive_segment
    - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
    - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
    - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
    - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
    - scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
    - scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port()
    - gfs2: Fix invalid metadata access in punch_hole
    - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
    - wifi: cfg80211: fix rdev_dump_mpp() arguments order
    - net: mark racy access on sk->sk_rcvbuf
    - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
    - btrfs: return accurate error

  linux-hwe-5.15 (5.15.0-117.127~20.04.1) focal; urgency=medium

  * focal/linux-hwe-5.15: 5.15.0-117.127~20.04.1 -proposed tracker
    (LP: #2072057)

  [ Ubuntu: 5.15.0-117.127 ]

  * jammy/linux: 5.15.0-117.127 -proposed tracker (LP: #2072059)
  * CVE-2024-27017
    - netfilter: nft_set_pipapo: constify lookup fn args where possible
    - netfilter: nft_set_pipapo: walk over current view on netlink dump
    - netfilter: nf_tables: missing iterator type in lookup walk
  * CVE-2024-26952
    - ksmbd: fix potencial out-of-bounds when buffer offset is invalid
  * CVE-2024-26886
    - Bluetooth: af_bluetooth: Fix deadlock
  * CVE-2023-52752
    - smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
  * CVE-2024-25742
    - x86/sev: Harden #VC instruction emulation somewhat
    - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler
  * CVE-2024-36016
    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

 -- Stefan Bader <email address hidden> Thu, 11 Jul 2024 16:28:05 +0200

  linux-hwe-5.15 (5.15.0-116.126~20.04.1) focal; urgency=medium

  * focal/linux-hwe-5.15: 5.15.0-116.126~20.04.1 -proposed tracker
    (LP: #2071602)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.hwe-5.15/dkms-versions -- update from kernel-versions
      (main/2024.06.10)

  [ Ubuntu: 5.15.0-116.126 ]

  * jammy/linux: 5.15.0-116.126 -proposed tracker (LP: #2071603)
  * idxd: NULL pointer dereference reading wq op_config attribute (LP: #2069081)
    - SAUCE: dmaengine: idxd: set is_visible member of idxd_wq_attribute_group
  * AMD GPUs fail with null pointer dereference when IOMMU enabled, leading to
    black screen (LP: #2068738)
    - SAUCE: Revert "drm/amdgpu: init iommu after amdkfd device init"

  [ Ubuntu: 5.15.0-115.125 ]

  * jammy/linux: 5.15.0-115.125 -proposed tracker (LP: #2068396)
  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2024.06.10)
  * Jammy update: v5.15.158 upstream stable release (LP: #2067974)
    - smb: client: fix rename(2) regression against samba
    - cifs: reinstate original behavior again for forceuid/forcegid
    - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc
    - HID: logitech-dj: allow mice to use all types of reports
    - arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 Puma
    - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
    - arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
    - arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts
    - arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg
    - arm64: dts: mediatek: mt7622: add support for coherent DMA
    - arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch
    - arm64: dts: mediatek: mt7622: fix clock controllers
    - arm64: dts: mediatek: mt7622: fix IR nodename
    - arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
    - arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
    - arm64: dts: mediatek: mt2712: fix validation errors
    - ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
    - wifi: iwlwifi: mvm: remove old PASN station when adding a new one
    - wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd
    - vxlan: drop packets from invalid src-address
    - mlxsw: core: Unregister EMAD trap using FORWARD action
    - icmp: prevent possible NULL dereferences from icmp_build_probe()
    - bridge/br_netlink.c: no need to return void function
    - NFC: trf7970a: disable all regulators on removal
    - ipv4: check for NULL idev in ip_route_use_hint()
    - net: usb: ax88179_178a: stop lying about skb->truesize
    - net: gtp: Fix Use-After-Free in gtp_dellink
    - ipvs: Fix checksumming on GSO of SCTP packets
    - net: openvswitch: Fix Use-After-Free in ovs_ct_exit
    - mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
    - mlxsw: spectrum_acl_tcam: Rate limit error message
    - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
    - mlxsw: spectrum_acl_tcam: Fix warning during rehash
    - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
    - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
    - netfilter: nf_tables: honor table dormant flag from netdev release event
      path
    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
    - i40e: Report MFS in decimal base instead of hex
    - iavf: Fix TC config comparison with existing adapter TC config
    - net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets
    - af_unix: Suppress false-positive lockdep splat for spin_lock() in
      __unix_gc().
    - serial: core: Provide port lock wrappers
    - serial: mxs-auart: add spinlock around changing cts state
    - drm-print: add drm_dbg_driver to improve namespace symmetry
    - drm/vmwgfx: Fix crtc's atomic check conditional
    - Revert "crypto: api - Disallow identical driver names"
    - net/mlx5e: Fix a race in command alloc flow
    - tracing: Show size of requested perf buffer
    - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker
      together
    - x86/cpu: Fix check for RDPKRU in __show_regs()
    - Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
    - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
    - Bluetooth: qca: fix NULL-deref on non-serdev suspend
    - mmc: sdhci-msm: pervent access to suspended controller
    - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
    - cpu: Re-enable CPU mitigations by default for !X86 architectures
    - [Configs] Update CPU mitigation configs
    - arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
    - drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3
    - drm/amdgpu: Fix leak when GPU memory allocation fails
    - irqchip/gic-v3-its: Prevent double free on error
    - ethernet: Add helper for assigning packet type when dest address does not
      match device address
    - net: b44: set pause params only when interface is up
    - stackdepot: respect __GFP_NOLOCKDEP allocation flag
    - mtd: diskonchip: work around ubsan link failure
    - tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
    - tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
    - dmaengine: owl: fix register access functions
    - idma64: Don't try to serve interrupts when device is powered off
    - dma: xilinx_dpdma: Fix locking
    - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
    - riscv: fix VMALLOC_START definition
    - riscv: Fix TASK_SIZE on 64-bit NOMMU
    - i2c: smbus: fix NULL function pointer dereference
    - fbdev: fix incorrect address computation in deferred IO
    - HID: i2c-hid: remove I2C_HID_READ_P

  linux-hwe-5.15 (5.15.0-113.123~20.04.1) focal; urgency=medium

  * focal/linux-hwe-5.15: 5.15.0-113.123~20.04.1 -proposed tracker
    (LP: #2068240)

  [ Ubuntu: 5.15.0-113.123 ]

  * jammy/linux: 5.15.0-113.123 -proposed tracker (LP: #2068242)
  * CVE-2024-26924
    - netfilter: nft_set_pipapo: do not free live element
  * CVE-2024-26643
    - netfilter: nf_tables: mark set as dead when unbinding anonymous set with
      timeout

 -- Stefan Bader <email address hidden> Wed, 12 Jun 2024 19:16:50 +0200

  linux-hwe-5.15 (5.15.0-107.117~20.04.1) focal; urgency=medium

  * focal/linux-hwe-5.15: 5.15.0-107.117~20.04.1 -proposed tracker
    (LP: #2063633)

  [ Ubuntu: 5.15.0-107.117 ]

  * jammy/linux: 5.15.0-107.117 -proposed tracker (LP: #2063635)
  * CVE-2023-52530
    - wifi: mac80211: fix potential key use-after-free
  * CVE-2024-26622
    - tomoyo: fix UAF write bug in tomoyo_write_control()
  * CVE-2023-47233
    - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach

 -- Stefan Bader <email address hidden> Tue, 30 Apr 2024 12:11:28 +0200