UbuntuUpdates.org

Package "linux-lowlatency-hwe-6.8-cloud-tools-6.8.0-78"

Name: linux-lowlatency-hwe-6.8-cloud-tools-6.8.0-78

Description:

Linux kernel version specific cloud tools for version 6.8.0-78

Latest version: 6.8.0-78.78.1~22.04.1
Release: jammy (22.04)
Level: updates
Repository: main
Head package: linux-lowlatency-hwe-6.8

Links


Download "linux-lowlatency-hwe-6.8-cloud-tools-6.8.0-78"


Other versions of "linux-lowlatency-hwe-6.8-cloud-tools-6.8.0-78" in Jammy

Repository Area Version
security main 6.8.0-78.78.1~22.04.1
proposed main 6.8.0-78.78.1~22.04.1
PPA: Canonical Kernel Team 6.8.0-78.78.1~22.04.1

Changelog

Version: 6.8.0-78.78.1~22.04.1 2025-08-18 18:07:02 UTC

  linux-lowlatency-hwe-6.8 (6.8.0-78.78.1~22.04.1) jammy; urgency=medium

  * jammy/linux-lowlatency-hwe-6.8: 6.8.0-78.78.1~22.04.1 -proposed tracker (LP: #2120388)

  [ Ubuntu-lowlatency: 6.8.0-78.78.1 ]

  * noble/linux-lowlatency: 6.8.0-78.78.1 -proposed tracker (LP: #2120389)
  [ Ubuntu: 6.8.0-78.78 ]
  * noble/linux: 6.8.0-78.78 -proposed tracker (LP: #2120405)
  * Incorrect backport for CVE-2025-21861 causes kernel hangs
    (LP: #2120330) // CVE-2025-21861
    - mm/migrate_device: don't add folio to be freed to LRU in
      migrate_device_finalize()
  * Incorrect backport for CVE-2025-21861 causes kernel hangs (LP: #2120330)
    - SAUCE: Revert "mm/migrate_device: don't add folio to be freed to LRU in
      migrate_device_finalize()"
    - mm: migrate_device: use more folio in migrate_device_finalize()

Source diff to previous version
2120330 Incorrect backport for CVE-2025-21861 causes kernel hangs
CVE-2025-21861 In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize

Version: 6.8.0-65.68.1~22.04.1 2025-07-31 03:07:01 UTC

  linux-lowlatency-hwe-6.8 (6.8.0-65.68.1~22.04.1) jammy; urgency=medium

  * jammy/linux-lowlatency-hwe-6.8: 6.8.0-65.68.1~22.04.1 -proposed tracker (LP: #2116381)

  [ Ubuntu-lowlatency: 6.8.0-65.68.1 ]

  * noble/linux-lowlatency: 6.8.0-65.68.1 -proposed tracker (LP: #2116382)
  [ Ubuntu: 6.8.0-65.68 ]
  * noble/linux: 6.8.0-65.68 -proposed tracker (LP: #2116399)
  * CVE-2025-38083
    - net_sched: prio: fix a race in prio_tune()
  * CVE-2025-37797
    - net_sched: hfsc: Fix a UAF vulnerability in class handling

 -- Edoardo Canepa <email address hidden> Wed, 16 Jul 2025 12:10:12 +0200

Source diff to previous version
CVE-2025-38083 In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race conditio
CVE-2025-37797 In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a U

Version: 6.8.0-64.67.1~22.04.1 2025-07-17 18:07:05 UTC

  linux-lowlatency-hwe-6.8 (6.8.0-64.67.1~22.04.1) jammy; urgency=medium

  * jammy/linux-lowlatency-hwe-6.8: 6.8.0-64.67.1~22.04.1 -proposed tracker (LP: #2114648)

  [ Ubuntu-lowlatency: 6.8.0-64.67.1 ]

  * noble/linux-lowlatency: 6.8.0-64.67.1 -proposed tracker (LP: #2114649)
  [ Ubuntu: 6.8.0-64.67 ]
  * noble/linux: 6.8.0-64.67 -proposed tracker (LP: #2114668)
  * Unexpected system reboot at loading GUI session on some AMD platforms
    (LP: #2112462)
    - drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush
    - drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush
    - drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
    - drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush
  * [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
    (LP: #2114174)
    - s390/pci: rename lock member in struct zpci_dev
    - s390/pci: introduce lock to synchronize state of zpci_dev's
    - s390/pci: remove hotplug slot when releasing the device
    - s390/pci: Remove redundant bus removal and disable from
      zpci_release_device()
    - s390/pci: Prevent self deletion in disable_slot()
    - s390/pci: Allow re-add of a reserved but not yet removed device
    - s390/pci: Serialize device addition and removal
  * [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
    (LP: #2114174) // CVE-2025-37946
    - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has
      child VFs
  * [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
    (LP: #2114174) // CVE-2025-37974
    - s390/pci: Fix missing check for zpci_create_device() error return
  * [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
    (LP: #2114174) // CVE-2024-56699
    - s390/pci: Fix potential double remove of hotplug slot
  * System will restart while resuming with SATA HDD or nvme installed with
    password set (LP: #2110090)
    - PCI: Explicitly put devices into D0 when initializing
  * Noble update: upstream stable patchset 2025-06-12 (LP: #2114239)
    - btrfs: fix assertion failure when splitting ordered extent after
      transaction abort
    - btrfs: fix use-after-free when attempting to join an aborted transaction
    - arm64/mm: Ensure adequate HUGE_MAX_HSTATE
    - exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
    - s390/stackleak: Use exrl instead of ex in __stackleak_poison()
    - btrfs: fix data race when accessing the inode's disk_i_size at
      btrfs_drop_extents()
    - btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error
      handling
    - sched: Don't try to catch up excess steal time.
    - locking/ww_mutex/test: Use swap() macro
    - lockdep: Fix upper limit for LOCKDEP_*_BITS configs
    - x86/amd_nb: Restrict init function to AMD-based systems
    - drm/virtio: New fence for every plane update
    - drm: Add panel backlight quirks
    - drm: panel-backlight-quirks: Add Framework 13 matte panel
    - drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
    - nvkm/gsp: correctly advance the read pointer of GSP message queue
    - nvkm: correctly calculate the available space of the GSP cmdq buffer
    - drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
    - drm/amd/display: Overwriting dualDPP UBF values before usage
    - printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
    - drm/connector: add mutex to protect ELD from concurrent access
    - drm/bridge: anx7625: use eld_mutex to protect access to connector->eld
    - drm/bridge: ite-it66121: use eld_mutex to protect access to
      connector->eld
    - drm/amd/display: use eld_mutex to protect access to connector->eld
    - drm/exynos: hdmi: use eld_mutex to protect access to connector->eld
    - drm/radeon: use eld_mutex to protect access to connector->eld
    - drm/sti: hdmi: use eld_mutex to protect access to connector->eld
    - drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
    - drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
    - drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
    - drm/amdkfd: Queue interrupt work to different CPU
    - drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
    - drm/bridge: it6505: fix HDCP Bstatus check
    - drm/bridge: it6505: fix HDCP encryption when R0 ready
    - drm/bridge: it6505: fix HDCP CTS compare V matching
    - drm/bridge: it6505: fix HDCP V match check is not performed correctly
    - drm/bridge: it6505: fix HDCP CTS KSV list wait timer
    - safesetid: check size of policy writes
    - drm/amd/display: Increase sanitizer frame larger than limit when compile
      testing with clang
    - drm/amd/display: Limit Scaling Ratio on DCN3.01
    - wifi: rtw89: add crystal_cap check to avoid setting as overflow value
    - tun: fix group permission check
    - mmc: core: Respect quirk_max_rate for non-UHS SDIO card
    - mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
    - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
    - tomoyo: don't emit warning in tomoyo_write_control()
    - mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
    - wifi: rtw88: add __packed attribute to efuse layout struct
    - clk: qcom: Make GCC_8150 depend on QCOM_GDSC
    - HID: multitouch: Add quirk for Hantick 5288 touchpad
    - HID: Wacom: Add PCI Wacom device support
    - net/mlx5: use do_aux_work for PHC overflow checks
    - wifi: brcmfmac: Check the return value of
      of_property_read_string_index()
    - wifi: iwlwifi: pcie: Add support for new device ids
    - wifi: iwlwifi: avoid memory leak
    - i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
    - APEI: GHES: Have GHES honor the panic= setting
    - Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
    - Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
 

Source diff to previous version
2114174 [UBUNTU 24.04] s390/pci: Fix immediate re-add of PCI function after remove
2110090 System will restart while resuming with SATA HDD or nvme installed with password set
2114239 Noble update: upstream stable patchset 2025-06-12
2109951 kvmppc_set_passthru_irq_hv: Could not assign IRQ map traces are seen when pci device is attached to kvm guest when \
2106558 Latitude 5450 is experiencing packet loss on Ethernet in Ubuntu 22.04
2109609 cpufreq amd-pstate: cpuinfo_max_freq reports incorrect value
2100340 PCI/ACS: Fix 'pci=config_acs=' parameter
2111599 [UBUNTU 24.04] s390/pci: Fix zpci_bus_is_isolated_vf() for non-VF
2106381 nvme/tcp hangs IO on arm
2111953 Noble update: upstream stable patchset 2025-05-29
2112519 raid1: Fix NULL pointer dereference in process_checks()
1786013 Packaging resync
CVE-2025-37946 In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs W
CVE-2025-37974 In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing check for zpci_create_device() error return The zpci_crea
CVE-2024-56699 In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix potential double remove of hotplug slot In commit 6ee600bfbe0f ("
CVE-2025-37750 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694
CVE-2025-40364 In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can i
CVE-2024-49887 In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to don't panic system for no free segment fault injection f2fs: fix t
CVE-2024-57975 In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when run_delalloc_nocow() failed [BUG] With CONF
CVE-2025-21714 In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP use after free Prevent double queueing of implicit
CVE-2025-21801 In the Linux kernel, the following vulnerability has been resolved: net: ravb: Fix missing rtnl lock in suspend/resume path Fix the suspend/resume
CVE-2025-21809 In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix peer hash locking vs RCU callback In its address list, afs now
CVE-2024-58057 In the Linux kernel, the following vulnerability has been resolved: idpf: convert workqueues to unbound When a workqueue is created with `WQ_UNBOUN
CVE-2024-57953 In the Linux kernel, the following vulnerability has been resolved: rtc: tps6594: Fix integer overflow on 32bit systems The problem is this multipl
CVE-2024-57982 In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in
CVE-2025-21721 In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle errors that nilfs_prepare_chunk() may return Patch series "nilfs
CVE-2025-21722 In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not force clear folio if buffer is referenced Patch series "nilfs2:
CVE-2025-21798 In the Linux kernel, the following vulnerability has been resolved: firewire: test: Fix potential null dereference in firewire kunit test kunit_kza
CVE-2025-21723 In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsg_setup_queue()
CVE-2025-21724 In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() R
CVE-2025-21825 In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT During the upd
CVE-2024-57990 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() This comparison should
CVE-2024-57974 In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socke
CVE-2024-57994 In the Linux kernel, the following vulnerability has been resolved: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() Jakub adde
CVE-2024-57999 In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW Power Hypervis
CVE-2024-58054 In the Linux kernel, the following vulnerability has been resolved: staging: media: max96712: fix kernel oops when removing module The following ke
CVE-2024-58055 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: Don't free command immediately Don't prematurely free the c
CVE-2024-57979 In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consis
CVE-2024-57980 In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() functio
CVE-2024-58056 In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Fix ida_free call while not allocated In the rproc_alloc() fu
CVE-2025-21705 In the Linux kernel, the following vulnerability has been resolved: mptcp: handle fastopen disconnect correctly Syzbot was able to trigger a data s
CVE-2025-21707 In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status MPTCP maintains the received sub-options st
CVE-2024-57981 In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command
CVE-2025-21708 In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: enable basic endpoint checking Syzkaller reports [1] encount
CVE-2025-21826 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length T
CVE-2025-21808 In the Linux kernel, the following vulnerability has been resolved: net: xdp: Disallow attaching device-bound programs in generic mode Device-bound
CVE-2025-21710 In the Linux kernel, the following vulnerability has been resolved: tcp: correct handling of extreme memory squeeze Testing with iperf3 using the "
CVE-2025-21715 In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it can
CVE-2025-21716 In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix uninit-value in vxlan_vnifilter_dump() KMSAN reported an uninit-valu
CVE-2025-21718 In the Linux kernel, the following vulnerability has been resolved: net: rose: fix timer races against user threads Rose timers only acquire the so
CVE-2025-21719 In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries syzbot found that calling
CVE-2025-21802 In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hclge driver, i
CVE-2024-58058 In the Linux kernel, the following vulnerability has been resolved: ubifs: skip dumping tnc tree when zroot is null Clearing slab cache will free a
CVE-2024-58069 In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interfa
CVE-2025-21720 In the Linux kernel, the following vulnerability has been resolved: xfrm: delete intermediate secpath entry in packet offload mode Packets handled
CVE-2025-21803 In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix warnings during S3 suspend The enable_gpe_wakeup() function call
CVE-2025-21810 In the Linux kernel, the following vulnerability has been resolved: driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()
CVE-2025-21811 In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references nilfs_lookup_dirty_
CVE-2025-21804 In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
CVE-2025-21829 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" The Call Trace
CVE-2024-57984 In the Linux kernel, the following vulnerability has been resolved: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition In dw
CVE-2024-58034 In the Linux kernel, the following vulnerability has been resolved: memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_
CVE-2024-57973 In the Linux kernel, the following vulnerability has been resolved: rdma/cxgb4: Prevent potential integer overflow on 32bit The "gl->tot_len" varia
CVE-2025-21725 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to unset link speed It isn't guaranteed that NETWORK_
CVE-2025-21726 In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and
CVE-2025-21727 In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASA
CVE-2025-21728 In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible BPF programs can execute in al
CVE-2024-58070 In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT In PREEMPT_RT, k
CVE-2025-21711 In the Linux kernel, the following vulnerability has been resolved: net/rose: prevent integer overflows in rose_setsockopt() In case of possible un
CVE-2025-21799 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
CVE-2025-21806 In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encou
CVE-2025-21830 In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem (e.g. bcachefs) might retur
CVE-2025-21828 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTH
CVE-2024-58061 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prohibit deactivating all links In the internal API this calls
CVE-2024-57993 In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint chec
CVE-2025-21812 In the Linux kernel, the following vulnerability has been resolved: ax25: rcu protect dev->ax25_ptr syzbot found a lockdep issue [1]. We should re
CVE-2024-58071 In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower Prevent addi
CVE-2024-58063 In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: fix memory leaks and invalid access at probe error path Deinitia
CVE-2024-58072 In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused check_buddy_priv Commit 2461c7d60f9f ("rtlwifi: Up
CVE-2024-58053 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix handling of received connection abort Fix the handling of a connecti
CVE-2024-57996 In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: don't allow 1 packet limit The current implementation does
CVE-2024-57997 In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix channel survey memory allocation size KASAN reported a memor
CVE-2024-58051 In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: Add check devm_kasprintf() returned value devm_kasprintf() can retu
CVE-2024-58068 In the Linux kernel, the following vulnerability has been resolved: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized If a drive
CVE-2024-57998 In the Linux kernel, the following vulnerability has been resolved: OPP: add index check to assert to avoid buffer overflow in _read_freq() Pass th
CVE-2024-58052 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_rang
CVE-2024-57986 In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collect
CVE-2025-21731 In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after disconnect Following process can cause nbd_con
CVE-2025-37798 In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making
CVE-2025-37997 In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in
CVE-2025-22088 In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_ce
CVE-2025-37890 In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As

Version: 6.8.0-63.66.1~22.04.1 2025-06-30 16:07:10 UTC

  linux-lowlatency-hwe-6.8 (6.8.0-63.66.1~22.04.1) jammy; urgency=medium

  * jammy/linux-lowlatency-hwe-6.8: 6.8.0-63.66.1~22.04.1 -proposed tracker (LP: #2114323)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants

  [ Ubuntu-lowlatency: 6.8.0-63.66.1 ]

  * noble/linux-lowlatency: 6.8.0-63.66.1 -proposed tracker (LP: #2114324)
  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
  [ Ubuntu: 6.8.0-63.66 ]
  * noble/linux: 6.8.0-63.66 -proposed tracker (LP: #2114341)
  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
    - [Packaging] update annotations scripts
  * CVE-2025-37798
    - sch_htb: make htb_qlen_notify() idempotent
    - sch_htb: make htb_deactivate() idempotent
    - sch_drr: make drr_qlen_notify() idempotent
    - sch_hfsc: make hfsc_qlen_notify() idempotent
    - sch_qfq: make qfq_qlen_notify() idempotent
    - sch_ets: make est_qlen_notify() idempotent
    - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  * CVE-2025-37997
    - netfilter: ipset: fix region locking in hash types
  * CVE-2025-22088
    - RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
  * CVE-2025-37890
    - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child
      qdisc
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  * raid1: Fix NULL pointer dereference in process_checks() (LP: #2112519)
    - md/raid1: Add check for missing source disk in process_checks()

 -- Edoardo Canepa <email address hidden> Fri, 20 Jun 2025 16:23:18 +0200

Source diff to previous version
1786013 Packaging resync
2112519 raid1: Fix NULL pointer dereference in process_checks()
CVE-2025-37798 In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making
CVE-2025-37997 In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in
CVE-2025-22088 In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_ce
CVE-2025-37890 In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As

Version: 6.8.0-62.65.1~22.04.1 2025-06-23 14:07:07 UTC

  linux-lowlatency-hwe-6.8 (6.8.0-62.65.1~22.04.1) jammy; urgency=medium

  * jammy/linux-lowlatency-hwe-6.8: 6.8.0-62.65.1~22.04.1 -proposed tracker
    (LP: #2110716)

  [ Ubuntu: 6.8.0-62.65.1 ]

  * noble/linux-lowlatency: 6.8.0-62.65.1 -proposed tracker (LP: #2110717)
  [ Ubuntu: 6.8.0-62.65 ]
  * noble/linux: 6.8.0-62.65 -proposed tracker (LP: #2110737)
  * Rotate the Canonical Livepatch key (LP: #2111244)
    - [Config] Prepare for Canonical Livepatch key rotation
  * KVM bug causes Firecracker crash when it runs the vCPU for the first time
    (LP: #2109859)
    - vhost: return task creation error instead of NULL
    - kvm: retry nx_huge_page_recovery_thread creation
  * CVE-2025-2312 cifs.upcall could access incorrect kerberos credentials cache
    (LP: #2099914) // CVE-2025-2312
    - CIFS: New mount option for cifs.upcall namespace resolution
  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640)
    - ASoC: wm8994: Add depends on MFD core
    - ASoC: samsung: Add missing selects for MFD_WM8994
    - seccomp: Stub for !CONFIG_SECCOMP
    - scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
    - of/unittest: Add test that of_address_to_resource() fails on non-
      translatable address
    - irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
    - hwmon: (drivetemp) Set scsi command timeout to 10s
    - ASoC: samsung: Add missing depends on I2C
    - ata: libata-core: Set ATA_QCFLAG_RTF_FILLED in fill_result_tf()
    - Revert "libfs: fix infinite directory reads for offset dir"
    - libfs: Replace simple_offset end-of-directory detection
    - Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
    - ALSA: usb-audio: Add delay quirk for USB Audio Device
    - Input: xpad - add support for Nacon Pro Compact
    - Input: atkbd - map F23 key to support default copilot shortcut
    - Input: xpad - add unofficial Xbox 360 wireless receiver clone
    - Input: xpad - add QH Electronics VID/PID
    - Input: xpad - improve name of 8BitDo controller 2dc8:3106
    - Input: xpad - add support for Nacon Evol-X Xbox One Controller
    - Input: xpad - add support for wooting two he (arm)
    - ASoC: codecs: es8316: Fix HW rate calculation for 48Mhz MCLK
    - ASoC: cs42l43: Add codec force suspend/resume ops
    - ALSA: hda/realtek: Fix volume adjustment issue on Lenovo ThinkBook 16P Gen5
    - libfs: Return ENOSPC when the directory offset range is exhausted
    - Revert "libfs: Add simple_offset_empty()"
    - libfs: Use d_children list to iterate simple_offset directories
    - wifi: rtl8xxxu: add more missing rtl8192cu USB IDs
    - HID: wacom: Initialize brightness of LED trigger
    - Upstream stable to v6.6.75, v6.12.12
  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
    CVE-2025-21689
    - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
    CVE-2025-21690
    - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
    CVE-2025-21691
    - cachestat: fix page cache statistics permission checking
  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
    CVE-2025-21692
    - net: sched: fix ets qdisc OOB Indexing
  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
    CVE-2025-21699
    - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
  * Noble update: upstream stable patchset 2025-04-29 (LP: #2109640) //
    CVE-2024-50157
    - RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop
  * rtw89: Support hardware rfkill (LP: #2077384)
    - wifi: rtw89: add support for hardware rfkill
  * Introduce configfs-based interface for gpio-aggregator (LP: #2103496)
    - gpio: introduce utilities for synchronous fake device creation
    - bitmap: Define a cleanup function for bitmaps
    - gpio: aggregator: simplify aggr_parse() with scoped bitmap
    - gpio: aggregator: protect driver attr handlers against module unload
    - gpio: aggregator: reorder functions to prepare for configfs introduction
    - gpio: aggregator: unify function naming
    - gpio: aggregator: add gpio_aggregator_{alloc, free}()
    - gpio: aggregator: introduce basic configfs interface
    - [Config] Enable DEV_SYNC_PROBE as module
    - SAUCE: gpio: aggregator: Fix error code in gpio_aggregator_activate()
    - gpio: aggregator: rename 'name' to 'key' in gpio_aggregator_parse()
    - gpio: aggregator: expose aggregator created via legacy sysfs to configfs
    - SAUCE: gpio: aggregator: fix "_sysfs" prefix check in
      gpio_aggregator_make_group()
    - SAUCE: gpio: aggregator: Fix gpio_aggregator_line_alloc() checking
    - SAUCE: gpio: aggregator: Return an error if there are no GPIOs in
      gpio_aggregator_parse()
    - SAUCE: gpio: aggregator: Fix leak in gpio_aggregator_parse()
    - gpio: aggregator: cancel deferred probe for devices created via configfs
    - Documentation: gpio: document configfs interface for gpio-aggregator
    - selftests: gpio: add test cases for gpio-aggregator
    - SAUCE: selftests: gpio: gpio-aggregator: add a test case for _sysfs prefix
      reservation
  * Noble update: upstream stable patchset 2025-04-16 (LP: #2107449)
    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
    - net: add exit_batch_rtnl() method
    - gtp: use exit_batch_rtnl() method
    - gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
    - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
    - nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
    - net: xilinx: axienet: Fix IRQ coalescing packet count overflow
    - net/mlx5: Fix RDMA TX steering prio
    - net/mlx5e: Rely on reqid in IPsec tunnel mode
    - net/mlx5e: Always start IPsec sequence number from 1
    - drm/vmwgfx: Add new keep_resv BO param
    - drm/v3d: Assign job pointer to NULL before signaling

2111244 Rotate the Canonical Livepatch key
2109859 KVM bug causes Firecracker crash when it runs the vCPU for the first time
2109640 Noble update: upstream stable patchset 2025-04-29
2103496 Introduce configfs-based interface for gpio-aggregator
2107449 Noble update: upstream stable patchset 2025-04-16
1786013 Packaging resync
CVE-2025-2312 A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to th
CVE-2025-21689 In the Linux kernel, the following vulnerability has been resolved: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() This patch
CVE-2025-21690 In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there'
CVE-2025-21691 In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()'
CVE-2025-21692 In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found
CVE-2025-21699 In the Linux kernel, the following vulnerability has been resolved: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag Truncate an inod
CVE-2024-50157 In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop Driver waits inde
CVE-2025-21672 In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held wh
CVE-2025-21682 In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: always recalculate features after XDP clearing, fix null-deref Recal
CVE-2024-53124 In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning
CVE-2024-57924 In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is
CVE-2024-57951 In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU
CVE-2024-57949 In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() The
CVE-2025-21668 In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mp-blk-ctrl: add missing loop break condition Currently imx8mp_bl
CVE-2025-21684 In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: Convert gpio_lock to raw spinlock irq_chip functions may be calle
CVE-2025-21694 In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix softlockup in __read_vmcore (part 2) Since commit 5cbcb62dddf5 ("f
CVE-2025-21665 In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits On 32-bit kernels, folio_see
CVE-2025-21666 In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reports hav
CVE-2025-21669 In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket has been d
CVE-2025-21670 In the Linux kernel, the following vulnerability has been resolved: vsock/bpf: return early if transport is not assigned Some of the core functions
CVE-2025-21667 In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap
CVE-2024-57948 In the Linux kernel, the following vulnerability has been resolved: mac802154: check local interfaces before deleting sdata list syzkaller reported
CVE-2025-21673 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double free of TCP_Server_Info::hostname When shutting down th
CVE-2025-21697 In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Ensure job pointer is set to NULL after job completion After a job com
CVE-2025-21674 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Attempt
CVE-2025-21675 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clear port select structure when fail to create Clear the port select
CVE-2025-21676 In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd functi
CVE-2025-21678 In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtp_newlink() link
CVE-2025-21680 In the Linux kernel, the following vulnerability has been resolved: pktgen: Avoid out-of-bounds access in get_imix_entries Passing a sufficient amo
CVE-2025-21681 In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit in a
CVE-2025-21683 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sk_select_reuseport() memory leak As pointed out in the original c



About   -   Send Feedback to @ubuntu_updates