Package "linux"

  linux (6.11.0-29.29) oracular; urgency=medium

  * oracular/linux: 6.11.0-29.29 -proposed tracker (LP: #2114305)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
    - [Packaging] update annotations scripts

  * CVE-2025-37890
    - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child
      qdisc
    - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
    - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice

  * raid1: Fix NULL pointer dereference in process_checks() (LP: #2112519)
    - md/raid1: Add check for missing source disk in process_checks()

  * CVE-2025-37798
    - sch_htb: make htb_qlen_notify() idempotent
    - sch_htb: make htb_deactivate() idempotent
    - sch_drr: make drr_qlen_notify() idempotent
    - sch_hfsc: make hfsc_qlen_notify() idempotent
    - sch_qfq: make qfq_qlen_notify() idempotent
    - sch_ets: make est_qlen_notify() idempotent
    - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()

  * CVE-2025-37997
    - netfilter: ipset: fix region locking in hash types

 -- Manuel Diewald <email address hidden> Fri, 13 Jun 2025 18:31:19 +0200

  linux (6.11.0-28.28) oracular; urgency=medium

  * oracular/linux: 6.11.0-28.28 -proposed tracker (LP: #2110681)

  * Oracular update: upstream stable patchset 2025-05-07 (LP: #2110173)
    - drm/dp_mst: Factor out function to queue a topology probe work
    - drm/dp_mst: Add a helper to queue a topology probe
    - drm/amd/display: Don't write DP_MSTM_CTRL after LT
    - watch_queue: fix pipe accounting mismatch
    - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
    - cpufreq: scpi: compare kHz instead of Hz
    - smack: dont compile ipv6 code unless ipv6 is configured
    - smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label
    - sched: Cancel the slice protection of the idle entity
    - cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
    - EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
    - x86/fpu: Fix guest FPU state buffer allocation size
    - x86/fpu: Avoid copying dynamic FP state from init_task in
      arch_dup_task_struct()
    - x86/platform: Only allow CONFIG_EISA for 32-bit
    - [Config] updateconfigs for EISA
    - x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
    - lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
    - PM: sleep: Adjust check before setting power.must_resume
    - cpufreq: tegra194: Allow building for Tegra234
    - RISC-V: KVM: Disable the kernel perf counter during configure
    - kunit/stackinit: Use fill byte different from Clang i386 pattern
    - watchdog/hardlockup/perf: Fix perf_event memory leak
    - selinux: Chain up tool resolving errors in install_policy.sh
    - EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
    - EDAC/ie31200: Fix the DIMM size mask for several SoCs
    - EDAC/ie31200: Fix the error path order of ie31200_init()
    - x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
    - thermal: int340x: Add NULL check for adev
    - PM: sleep: Fix handling devices with direct_complete set on errors
    - lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
    - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
    - x86/traps: Make exc_double_fault() consistently noreturn
    - x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
    - x86/entry: Add __init to ia32_emulation_override_cmdline()
    - regulator: pca9450: Fix enable register for LDO5
    - auxdisplay: MAX6959 should select BITREVERSE
    - media: verisilicon: HEVC: Initialize start_bit field
    - media: platform: allgro-dvt: unregister v4l2_device on the error path
    - auxdisplay: panel: Fix an API misuse in panel.c
    - platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Make symbol static
    - platform/x86: dell-uart-backlight: Make dell_uart_bl_serdev_driver static
    - platform/x86: dell-ddv: Fix temperature calculation
    - ASoC: cs35l41: check the return value from spi_setup()
    - ASoC: amd: acp: Fix for enabling DMIC on acp platforms via _DSD entry
    - HID: remove superfluous (and wrong) Makefile entry for
      CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
    - dt-bindings: vendor-prefixes: add GOcontroll
    - ALSA: hda/realtek: Always honor no_shutup_pins
    - ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio
      compatible
    - ALSA: timer: Don't take register_mutex with copy_from/to_user()
    - drm/bridge: ti-sn65dsi86: Fix multiple instances
    - drm/ssd130x: Set SPI .id_table to prevent an SPI core warning
    - drm/ssd130x: fix ssd132x encoding
    - drm/ssd130x: ensure ssd132x pitch is correct
    - drm/dp_mst: Fix drm RAD print
    - drm/bridge: it6505: fix HDCP V match check is not performed correctly
    - drm: xlnx: zynqmp: Fix max dma segment size
    - drm/vkms: Fix use after free and double free on init error
    - gpu: cdns-mhdp8546: fix call balance of mhdp->clk handling routines
    - drm/amdgpu: refine smu send msg debug log format
    - drm/amdgpu/umsch: fix ucode check
    - PCI: Use downstream bridges for distributing resources
    - PCI: Remove add_align overwrite unrelated to size0
    - drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
    - drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
    - PCI/ASPM: Fix link state exit during switch upstream function removal
    - drm/panel: ilitek-ili9882t: fix GPIO name in error message
    - PCI/ACS: Fix 'pci=config_acs=' parameter
    - drm/amd/display: fix an indent issue in DML21
    - drm/msm/dpu: don't use active in atomic_check()
    - drm/msm/dsi/phy: Program clock inverters in correct register
    - drm/msm/dsi: Use existing per-interface slice count in DSC timing
    - drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
    - drm/amdkfd: Fix Circular Locking Dependency in
      'svm_range_cpu_invalidate_pagetables'
    - PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data
      payload
    - PCI: brcmstb: Set generation limit before PCIe link up
    - PCI: brcmstb: Use internal register to change link capability
    - PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
    - PCI: brcmstb: Fix potential premature regulator disabling
    - PCI/portdrv: Only disable pciehp interrupts early when needed
    - drm/panthor: Update CS_STATUS_ defines to correct values
    - drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
    - drm/msm/a6xx: Fix a6xx indexed-regs in devcoreduump
    - crypto: powerpc: Mark ghashp8-ppc.o as an OBJECT_FILES_NON_STANDARD
    - powerpc/kexec: fix physical address calculation in clear_utlb_entry()
    - PCI: Remove stray put_device() in pci_register_host_bridge()
    - PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
    - drm/mediatek: Fix config_updating flag never false when no mbox channel
    - drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
    - drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer(

  linux (6.11.0-26.26) oracular; urgency=medium

  * oracular/linux: 6.11.0-26.26 -proposed tracker (LP: #2107166)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2025.04.14)

  * drm/xe: prevent potential UAF in pf_provision_vf_ggtt() (LP: #2106652)
    - drm/xe: prevent potential UAF in pf_provision_vf_ggtt()

  * Oracular update: upstream stable patchset 2025-04-09 (LP: #2106703)
    - IB/mlx5: Set and get correct qp_num for a DCT QP
    - RDMA/mana_ib: Allocate PAGE aligned doorbell index
    - scsi: ufs: core: Fix ufshcd_is_ufs_dev_busy() and ufshcd_eh_timed_out()
    - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
    - SUNRPC: convert RPC_TASK_* constants to enum
    - SUNRPC: Prevent looping due to rpc_signal_task() races
    - SUNRPC: Handle -ETIMEDOUT return from tlshd
    - RDMA/mlx5: Fix AH static rate parsing
    - scsi: core: Clear driver private data when retrying request
    - RDMA/mlx5: Fix bind QP error cleanup flow
    - sunrpc: suppress warnings for unused procfs functions
    - ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports
    - Bluetooth: L2CAP: Fix L2CAP_ECRED_CONN_RSP response
    - rxrpc: rxperf: Fix missing decoding of terminal magic cookie
    - afs: Fix the server_list to unuse a displaced server rather than putting it
    - net: loopback: Avoid sending IP packets without an Ethernet header
    - net: set the minimum for net_hotdata.netdev_budget_usecs
    - ipv4: icmp: Pass full DS field to ip_route_input()
    - ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup()
    - ipvlan: Unmask upper DSCP bits in ipvlan_process_v4_outbound()
    - ipv4: Convert icmp_route_lookup() to dscp_t.
    - ipv4: Convert ip_route_input() to dscp_t.
    - ipvlan: Prepare ipvlan_process_v4_outbound() to future .flowi4_tos
      conversion.
    - ipvlan: ensure network headers are in skb linear part
    - net: cadence: macb: Synchronize stats calculations
    - ASoC: es8328: fix route from DAC to output
    - ipvs: Always clear ipvs_property flag in skb_scrub_packet()
    - firmware: cs_dsp: Remove async regmap writes
    - ALSA: hda/realtek: Fix wrong mic setup for ASUS VivoBook 15
    - ice: add E830 HW VF mailbox message limit support
    - ice: Fix deinitializing VF in error path
    - tcp: Defer ts_recent changes until req is owned
    - net: Clear old fragment checksum value in napi_reuse_skb
    - net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
    - net/mlx5: IRQ, Fix null string in debug print
    - net: ipv6: fix dst ref loop on input in seg6 lwt
    - net: ipv6: fix dst ref loop on input in rpl lwt
    - net: ti: icss-iep: Reject perout generation request
    - perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list
    - uprobes: Reject the shared zeropage in uprobe_write_opcode()
    - io_uring/net: save msg_control for compat
    - x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
    - phy: rockchip: naneng-combphy: compatible reset with old DT
    - riscv: KVM: Fix hart suspend status check
    - riscv: KVM: Fix SBI IPI error generation
    - riscv: KVM: Fix SBI TIME error generation
    - tracing: Fix bad hist from corrupting named_triggers list
    - ftrace: Avoid potential division by zero in function_stat_show()
    - ALSA: usb-audio: Re-add sample rate quirk for Pioneer DJM-900NXS2
    - ALSA: hda/realtek: Fix microphone regression on ASUS N705UD
    - perf/core: Add RCU read lock protection to perf_iterate_ctx()
    - perf/x86: Fix low freqency setting issue
    - perf/core: Fix low freq setting via IOC_PERIOD
    - drm/amd/display: Disable PSR-SU on eDP panels
    - drm/amd/display: Fix HPD after gpu reset
    - i2c: npcm: disable interrupt enable bit before devm_request_irq
    - i2c: ls2x: Fix frequency division register access
    - usbnet: gl620a: fix endpoint checking in genelink_bind()
    - net: enetc: fix the off-by-one issue in enetc_map_tx_buffs()
    - net: enetc: keep track of correct Tx BD count in enetc_map_tx_tso_buffs()
    - net: enetc: update UDP checksum when updating originTimestamp field
    - net: enetc: correct the xdp_tx statistics
    - net: enetc: fix the off-by-one issue in enetc_map_tx_tso_buffs()
    - phy: tegra: xusb: reset VBUS & ID OVERRIDE
    - phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk
    - mptcp: always handle address removal under msk socket lock
    - mptcp: reset when MPTCP opts are dropped after join
    - vmlinux.lds: Ensure that const vars with relocations are mapped R/O
    - rcuref: Plug slowpath race in rcuref_put()
    - sched/core: Prevent rescheduling when interrupts are disabled
    - scsi: ufs: core: bsg: Fix crash when arpmb command fails
    - rseq/selftests: Fix riscv rseq_offset_deref_addv inline asm
    - riscv/futex: sign extend compare value in atomic cmpxchg
    - riscv: signal: fix signal frame size
    - Revert "rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads"
    - Revert "rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads"
    - amdgpu/pm/legacy: fix suspend/resume issues
    - x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID
    - x86/microcode/AMD: Pay attention to the stepping dynamically
    - x86/microcode/AMD: Split load_microcode_amd()
    - x86/microcode/intel: Remove unnecessary cache writeback and invalidation
    - x86/microcode/AMD: Flush patch buffer mapping after application
    - x86/microcode/AMD: Return bool from find_blobs_in_containers()
    - x86/microcode/AMD: Make __verify_patch_size() return bool
    - x86/microcode/AMD: Have __apply_microcode_amd() return bool
    - x86/microcode/AMD: Merge early_apply_microcode() into its single callsite
    - x86/microcode/AMD: Get rid of the _load_microcode_amd() forward declaration
    - x86/microcode/AMD: Add get_patch_level()
    - x86/microcode/AMD: Load only SHA256-chec

  linux (6.11.0-25.25) oracular; urgency=medium

  * oracular/linux: 6.11.0-25.25 -proposed tracker (LP: #2107099)

  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts

  * log_check/kernel_tainted failed with kernel warnings at
    kernel/time/timer_migration.c:543 on Oracular (LP: #2106022)
    - timers/migration: Fix off-by-one root mis-connection

 -- Manuel Diewald <email address hidden> Fri, 11 Apr 2025 22:44:50 +0200

  linux (6.11.0-24.24) oracular; urgency=medium

  * oracular/linux: 6.11.0-24.24 -proposed tracker (LP: #2102476)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2025.03.17)

  * ipsec_offload in rtnetlink.sh from ubunsu_kselftests_net fails on O/J
    (LP: #2096976)
    - SAUCE: selftest: netfilter: fix null IP field in kci_test_ipsec_offload

  * Add additional PCI ids for BMG support (LP: #2098969)
    - drm/xe/bmg: Add new PCI IDs

  * wdat_wdt.ko should be pulled in by linux-image-virtual (LP: #2098554)
    - [Packaging]: wdat_wdt.ko is moved from "linux-modules-extra-*-generic" to
      "linux-modules-*-generic"

  * CVE-2025-21756
    - vsock: Keep the binding until socket destruction
    - vsock: Orphan socket after transport release

  * Oracular update: upstream stable patchset 2025-03-05 (LP: #2100983)
    - ASoC: wm8994: Add depends on MFD core
    - ASoC: samsung: Add missing selects for MFD_WM8994
    - seccomp: Stub for !CONFIG_SECCOMP
    - scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
    - of/unittest: Add test that of_address_to_resource() fails on non-
      translatable address
    - irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
    - hwmon: (drivetemp) Set scsi command timeout to 10s
    - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
    - smb: client: handle lack of EA support in smb2_query_path_info()
    - net: sched: fix ets qdisc OOB Indexing
    - Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
    - cachestat: fix page cache statistics permission checking
    - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
    - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
    - ALSA: usb-audio: Add delay quirk for USB Audio Device
    - Input: xpad - add support for Nacon Pro Compact
    - Input: atkbd - map F23 key to support default copilot shortcut
    - Input: xpad - add unofficial Xbox 360 wireless receiver clone
    - Input: xpad - add QH Electronics VID/PID
    - Input: xpad - improve name of 8BitDo controller 2dc8:3106
    - Input: xpad - add support for Nacon Evol-X Xbox One Controller
    - Input: xpad - add support for wooting two he (arm)
    - drm/v3d: Assign job pointer to NULL before signaling the fence
    - ASoC: codecs: es8316: Fix HW rate calculation for 48Mhz MCLK
    - ASoC: cs42l43: Add codec force suspend/resume ops
    - drm/amd/display: Initialize denominator defaults to 1
    - ALSA: hda/realtek: Fix volume adjustment issue on Lenovo ThinkBook 16P Gen5
    - drm/connector: hdmi: Validate supported_formats matches ycbcr_420_allowed
    - ASoC: samsung: Add missing depends on I2C
    - mm: zswap: properly synchronize freeing resources during CPU hotunplug
    - mm: zswap: move allocations during CPU init outside the lock
    - libfs: Return ENOSPC when the directory offset range is exhausted
    - Revert "libfs: Add simple_offset_empty()"
    - Revert "libfs: fix infinite directory reads for offset dir"
    - libfs: Replace simple_offset end-of-directory detection
    - libfs: Use d_children list to iterate simple_offset directories
    - wifi: rtl8xxxu: add more missing rtl8192cu USB IDs
    - HID: wacom: Initialize brightness of LED trigger
    - Upstream stable to v6.6.75, v6.12.12

  * CVE-2025-21702
    - pfifo_tail_enqueue: Drop new packet when sch->limit == 0

  * CVE-2025-21703
    - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()

  * Fix line-out playback on some platforms with Cirrus Logic “Dolphin” hardware
    (LP: #2099880)
    - ALSA: hda/cirrus: Correct the full scale volume set logic

  * Enable Large Language Model (LLM) workloads using Intel NPU (LP: #2098972)
    - accel/ivpu: Increase DMA address range

  * Introduce and use sendpages_ok() instead of sendpage_ok() in nvme-tcp and
    drbd (LP: #2093871)
    - net: introduce helper sendpages_ok()
    - nvme-tcp: use sendpages_ok() instead of sendpage_ok()
    - drbd: use sendpages_ok() instead of sendpage_ok()

  * Intel Be201 Bluetooth hardware error 0x0f on Arrow Lake (LP: #2088151)
    - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP

  * Oracular update: upstream stable patchset 2025-02-26 (LP: #2100328)
    - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
    - bpf: Fix bpf_sk_select_reuseport() memory leak
    - openvswitch: fix lockup on tx to unregistering netdev with carrier
    - pktgen: Avoid out-of-bounds access in get_imix_entries
    - gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
    - gtp: Destroy device along with udp socket's netns dismantle.
    - nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
    - net: xilinx: axienet: Fix IRQ coalescing packet count overflow
    - net: fec: handle page_pool_dev_alloc_pages error
    - net/mlx5: Fix RDMA TX steering prio
    - net/mlx5: Clear port select structure when fail to create
    - net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel
    - net/mlx5e: Rely on reqid in IPsec tunnel mode
    - net/mlx5e: Always start IPsec sequence number from 1
    - drm/vmwgfx: Add new keep_resv BO param
    - drm/v3d: Ensure job pointer is set to NULL after job completion
    - soc: ti: pruss: Fix pruss APIs
    - hwmon: (tmp513) Fix division of negative numbers
    - Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
    - i2c: mux: demux-pinctrl: check initial mux selection, too
    - i2c: rcar: fix NACK handling when being a target
    - smb: client: fix double free of TCP_Server_Info::hostname
    - mac802154: check local interfaces before deleting sdata list
    - hfs: Sanity check the root record
    - fs: fix missing declaration of init_files
    - kheaders: Ignore silly-rename files
    - cachefiles: Parse the "secctx" immediately
    - scsi: ufs: core: Honor runtime/system PM levels if set by host controller
      drivers
    - sel