Package "linux-headers-5.15.0-163"

  linux (5.15.0-163.173) jammy; urgency=medium

  * jammy/linux: 5.15.0-163.173 -proposed tracker (LP: #2127867)

  * Add pvpanic kernel modules to linux-modules (LP: #2126659)
    - [Packaging] Add pvpanic kernel modules to linux-modules

  * Ubuntu 24.04.2: error in audit_log_object_context keep printing in the
    kernel and console (LP: #2123815)
    - SAUCE: fix: apparmor4.0.0 [26/90]: LSM stacking v39: Audit: Add record
      for multiple object contexts

  * Hung task when heavily accessing kernfs files (LP: #2125142)
    - kernfs: switch global kernfs_rwsem lock to per-fs lock
    - kernfs: dont take i_lock on inode attr read
    - kernfs: move struct kernfs_root out of the public view.
    - kernfs: Introduce separate rwsem to protect inode attributes.
    - kernfs: Use a per-fs rwsem to protect per-fs list of kernfs_super_info.
    - kernfs: change kernfs_rename_lock into a read-write lock.
    - kernfs: prevent early freeing of root node
    - kernfs: remove redundant kernfs_rwsem declaration.
    - kernfs: fix NULL dereferencing in kernfs_remove
    - kernfs: fix potential NULL dereference in __kernfs_remove
    - kernfs: fix missing kernfs_iattr_rwsem locking

  * ensure mptcp keepalives are honored when set (LP: #2125444)
    - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN

  * UBUNTU: fan: fail to check kmalloc() return could cause a NULL pointer
    dereference (LP: #2125053)
    - SAUCE: fan: vxlan: check memory allocation for map

  * Jammy update: v5.15.193 upstream stable release (LP: #2127112)
    - [Config] enable CONFIG_MITIGATION_VMSCAPE
    - Linux 5.15.193

  * Jammy update: v5.15.192 upstream stable release (LP: #2126782)
    - bpf: Add cookie object to bpf maps
    - bpf: Move cgroup iterator helpers to bpf.h
    - bpf: Move bpf map owner out of common struct
    - bpf: Fix oob access in cgroup local storage
    - drm/amd/display: Don't warn when missing DCE encoder caps
    - fs: writeback: fix use-after-free in __mark_inode_dirty()
    - tee: fix NULL pointer dereference in tee_shm_put
    - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
    - wifi: cfg80211: fix use-after-free in cmp_bss()
    - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
      after confirm
    - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
    - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
    - xirc2ps_cs: fix register access when enabling FullDuplex
    - mISDN: Fix memory leak in dsp_hwec_enable()
    - icmp: fix icmp_ndo_send address translation for reply direction
    - i40e: Fix potential invalid access when MAC list is empty
    - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
    - wifi: cw1200: cap SSID length in cw1200_do_join()
    - wifi: libertas: cap SSID len in lbs_associate()
    - net: thunder_bgx: add a missing of_node_put
    - net: thunder_bgx: decrement cleanup index before use
    - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
    - ax25: properly unshare skbs in ax25_kiss_rcv()
    - net: atm: fix memory leak in atm_register_sysfs when device_register
      fail
    - ppp: fix memory leak in pad_compress_skb
    - ptp: Add generic PTP is_sync() function
    - net: phy: mscc: Fix memory leak when using one step timestamping
    - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
    - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
    - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
    - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
      arch_sync_kernel_mappings()
    - mm: move page table sync declarations to linux/pgtable.h
    - wifi: mwifiex: Initialize the chan_stats array to zero
    - drm/amdgpu: drop hw access in non-DC audio fini
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path
    - batman-adv: fix OOB read/write in network-coding decode
    - e1000e: fix heap overflow in e1000_set_eeprom
    - mm/khugepaged: fix ->anon_vma race
    - cpufreq/sched: Explicitly synchronize limits_changed flag handling
    - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
    - spi: tegra114: Remove unnecessary NULL-pointer checks
    - spi: tegra114: Don't fail set_cs_timing when delays are zero
    - iio: chemical: pms7003: use aligned_s64 for timestamp
    - iio: light: opt3001: fix deadlock due to concurrent flag access
    - gpio: pca953x: fix IRQ storm on system wake up
    - dma-buf: insert memory barrier before updating num_fences
    - dmaengine: mediatek: Fix a possible deadlock error in
      mtk_cqdma_tx_status()
    - net: dsa: microchip: update tag_ksz masks for KSZ9477 family
    - net: dsa: microchip: linearize skb for tail-tagging switches
    - vmxnet3: update MTU after device quiesce
    - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
    - randstruct: gcc-plugin: Remove bogus void member
    - randstruct: gcc-plugin: Fix attribute addition
    - mm/slub: avoid accessing metadata when pointer is invalid in
      object_err()
    - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
    - pcmcia: Add error handling for add_interval() in do_validate_mem()
    - spi: spi-fsl-lpspi: Fix transmissions when using CONT
    - spi: spi-fsl-lpspi: Set correct chip-select polarity bit
    - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
    - drm/bridge: ti-sn65dsi86: fix REFCLK setting
    - perf bpf-event: Fix use-after-free in synthesis
    - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
    - spi: tegra114: Use value to check for invalid delays
    - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
    - Linux 5.15.192

  * Jammy update: v5.15.191 upstream stable release (LP: #2125626)
    - pinctrl: STMFX: add missing HAS_IOMEM dependency
    - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
    - scsi: core: sysfs: Correct sy

  linux (5.15.0-160.170) jammy; urgency=medium

  * jammy/linux: 5.15.0-160.170 -proposed tracker (LP: #2126548)

  * [Regression Updates] System hangs when loading audit rules
    (5.15.0-156.166) (LP: #2126434)
    - netlink: avoid infinite retry looping in netlink_unicast()

  linux (5.15.0-158.168) jammy; urgency=medium

  * jammy/linux: 5.15.0-158.168 -proposed tracker (LP: #2124104)

  * [UBUNTU 22.04] s390/pci: Handle PCI error codes other than 0x3a
    (LP: #2120344)
    - s390/pci: Handle PCI error codes other than 0x3a

  * sources list generation using dwarfdump takes up to 0.5hr in build process
    (LP: #2104911)
    - [Packaging] Don't generate list of source files

  * CVE-2024-26700
    - drm/amd/display: Fix MST Null Ptr for RV

  * CVE-2023-52593
    - wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
    - wifi: wfx: fix memory leak when starting AP
    - wifi: wfx: repair open network AP mode

  * CVE-2025-38477
    - net/sched: sch_qfq: Fix race condition on qfq_aggregate
    - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
      qfq_delete_class

  * CVE-2025-38617
    - net/packet: fix a race in packet_set_ring() and packet_notifier()

  * CVE-2025-38618
    - vsock: Do not allow binding to VMADDR_PORT_ANY

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

 -- Stefan Bader <email address hidden> Tue, 16 Sep 2025 16:14:00 +0200

  linux (5.15.0-156.166) jammy; urgency=medium

  * jammy/linux: 5.15.0-156.166 -proposed tracker (LP: #2120207)

  * minimal kernel lacks modules for blk disk in arm64 openstack environments
    where config_drive is required (LP: #2118499)
    - [Config] Enable SYM53C8XX_2 on arm64

  linux (5.15.0-152.162) jammy; urgency=medium

  * jammy/linux: 5.15.0-152.162 -proposed tracker (LP: #2117618)

  * [UBUNTU 22.04] kernel: Fix z17 elf platform recognition (LP: #2114450)
    - s390: add z16 elf platform
    - s390: Add z17 elf platform

  * Jammy update: v5.15.185 upstream stable release (LP: #2115240)
    - dma-mapping: avoid potential unused data compilation warning
    - cgroup: Fix compilation issue due to cgroup_mutex not being exported
    - net: enetc: refactor bulk flipping of RX buffers to separate function
    - bpf: fix possible endless loop in BPF map iteration
    - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
    - kconfig: merge_config: use an empty file as initfile
    - NFSv4: Check for delegation validity in
      nfs_start_delegation_return_locked()
    - tracing: Mark binary printing functions with __printf() attribute
    - mailbox: use error ret code of of_parse_phandle_with_args()
    - fbdev: fsl-diu-fb: add missing device_remove_file()
    - fbcon: Use correct erase colour for clearing in fbcon
    - fbdev: core: tileblit: Implement missing margin clearing for tileblit
    - NFSv4: Treat ENETUNREACH errors as fatal for state recovery
    - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
    - SUNRPC: rpcbind should never reset the port to the value '0'
    - thermal/drivers/qoriq: Power down TMU on system suspend
    - dql: Fix dql->limit value when reset.
    - lockdep: Fix wait context check on softirq for PREEMPT_RT
    - PCI: dwc: ep: Ensure proper iteration over outbound map windows
    - tools/build: Don't pass test log files to linker
    - pNFS/flexfiles: Report ENETDOWN as a connection error
    - PCI: vmd: Disable MSI remapping bypass under Xen
    - mmc: host: Wait for Vdd to settle on card power off
    - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
    - i2c: qup: Vote for interconnect bandwidth to DRAM
    - i2c: pxa: fix call balance of i2c->clk handling routines
    - btrfs: make btrfs_discard_workfn() block_group ref explicit
    - btrfs: avoid linker error in btrfs_find_create_tree_block()
    - btrfs: get zone unusable bytes while holding lock at
      btrfs_reclaim_bgs_work()
    - btrfs: send: return -ENAMETOOLONG when attempting a path that is too
      long
    - i3c: master: svc: Fix missing STOP for master request
    - dlm: make tcp still work in multi-link env
    - um: Store full CSGSFS and SS register from mcontext
    - um: Update min_low_pfn to match changes in uml_reserved
    - ext4: reorder capability check last
    - scsi: st: Tighten the page format heuristics with MODE SELECT
    - scsi: st: ERASE does not change tape location
    - vfio/pci: Handle INTx IRQ_NOTCONNECTED
    - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
    - rtc: rv3032: fix EERD location
    - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
    - kbuild: fix argument parsing in scripts/config
    - crypto: octeontx2 - suppress auth failure screaming due to negative
      tests
    - dm: restrict dm device size to 2^63-512 bytes
    - xen: Add support for XenServer 6.1 platform device
    - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
    - posix-timers: Add cond_resched() to posix_timer_add() search loop
    - timer_list: Don't use %pK through printk()
    - netfilter: conntrack: Bound nf_conntrack sysctl writes
    - arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
    - mmc: sdhci: Disable SD card clock before changing parameters
    - ipv6: save dontfrag in cork
    - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct
      hd44780_common"
    - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
    - cpufreq: tegra186: Share policy per cluster
    - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
    - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
    - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
    - rtc: ds1307: stop disabling alarms on probe
    - ieee802154: ca8210: Use proper setters and getters for bitwise types
    - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
    - media: c8sectpfe: Call of_node_put(i2c_bus) only once in
      c8sectpfe_probe()
    - remoteproc: qcom_wcnss: Handle platforms with only single power domain
    - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
    - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
    - net: ethernet: ti: cpsw_new: populate netdev of_node
    - net: pktgen: fix mpls maximum labels list parsing
    - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
    - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
    - clk: imx8mp: inform CCF of maximum frequency of clocks
    - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
    - hwmon: (gpio-fan) Add missing mutex locks
    - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
    - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
    - fpga: altera-cvp: Increase credit timeout
    - PCI: brcmstb: Expand inbound window size up to 64GB
    - PCI: brcmstb: Add a softdep to MIP MSI-X driver
    - net/mlx5: Avoid report two health errors on same syndrome
    - selftests/net: have `gro.sh -t` return a correct exit code
    - drm/amdkfd: KFD release_work possible circular locking
    - net: xgene-v2: remove incorrect ACPI_PTR annotation
    - bonding: report duplicate MAC address in all situations
    - soc: ti: k3-socinfo: Do not use syscon helper to build regmap
    - x86/build: Fix broken copy command in genimage.sh when making isoimage
    - drm/amd/display: handle max_downscale_src_width fail check
    - x86/nmi: Add an emergency handler in nmi_desc & use it in
      nmi_shootdown_cpus()
    - cpuidle: menu: Avoid discarding useful information
    - libbpf: Fix out-of-bound read
    - x86/kaslr: Reduce KASLR entropy on mo