-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 27 Mar 2026 22:08:55 +0100
Source: linux-signed-arm64
Architecture: source
Version: 6.19.10+1
Distribution: sid
Urgency: medium
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Changes:
linux-signed-arm64 (6.19.10+1) unstable; urgency=medium
.
* Sign kernel from linux 6.19.10-1
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.19.9
- remoteproc: qcom_wcnss: Fix reserved region mapping failure
- [powerpc*] uaccess: Fix inline assembly for clang build on PPC32
- [powerpc*] kexec/core: use big-endian types for crash variables
- [powerpc*] crash: adjust the elfcorehdr size
- remoteproc: sysmon: Correct subsys_name_len type in QMI request
- remoteproc: mediatek: Unprepare SCP clock during system suspend
- [powerpc*] 83xx: km83xx: Fix keymile vendor prefix
- smb/server: Fix another refcount leak in smb2_open()
- scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
- ACPI: PM: Save NVS memory on Lenovo G70-35
- scsi: ufs: core: Reset urgent_bkops_lvl to allow runtime PM power mode
- fs: init flags_valid before calling vfs_fileattr_get
- scsi: mpi3mr: Add NULL checks when resetting request and reply queues
- ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
- unshare: fix unshare_fs() handling
- wifi: mac80211: set default WMM parameters on all links
- ACPI: OSI: Add DMI quirk for Acer Aspire One D255
- scsi: ses: Fix devices attaching to different hosts
- [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
- [amd64] ASoC: cs42l43: Report insert for exotic peripherals
- scsi: ufs: core: Fix possible NULL pointer dereference in
ufshcd_add_command_trace()
- scsi: ufs: core: Fix shift out of bounds when MAXQ=32
- ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
- drm/amdgpu/vcn5: Add SMU dpm interface type
- ALSA: usb-audio: Check max frame size for implicit feedback mode, too
- nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
- [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi
registers
- xprtrdma: Decrement re_receiving on the early exit paths
- btrfs: hold space_info->lock when clearing periodic reclaim ready
- [arm64] drm/msm/a6xx: Fix the bogus protect error on X2-85
- workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
- perf disasm: Fix off-by-one bug in outside check
- [arm64] drm/msm/a8xx: Fix ubwc config related to swizzling
- dt-bindings: display/msm: qcom,sm8750-mdss: Fix model typo
- [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi
- drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v13
- drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
- drm/amdgpu: Fix kernel-doc comments for some LUT properties
- bonding: do not set usable_slaves for broadcast mode
- bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
- net/mlx5: Fix deadlock between devlink lock and esw->wq
- net/mlx5: Fix crash when moving to switchdev mode
- net/mlx5: Fix peer miss rules host disabled checks
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
- net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
slave xmit (CVE-2026-23277)
- rxrpc, afs: Fix missing error pointer check after
rxrpc_kernel_lookup_peer()
- net: spacemit: Fix error handling in emac_alloc_rx_desc_buffers()
- net: spacemit: Fix error handling in emac_tx_mem_map()
- firmware: cs_dsp: Fix fragmentation regression in firmware download
- spi: amlogic: spifc-a4: Fix DMA mapping error handling
- [arm64] spi: rockchip-sfc: Fix double-free in remove() callback
- ASoC: soc-core: drop delayed_work_pending() check before flush
- ASoC: soc-core: flush delayed work before removing DAIs and widgets
- ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
- net: sfp: improve Huawei MA5671a fixup
- serial: caif: hold tty->link reference in ldisc_open and ser_release
- bnxt_en: Fix RSS table size check when changing ethtool channels
- [amd64] drm/i915/dp: Read ALPM caps after DPCD init
- net: enetc: fix incorrect fallback PHY address handling
- net: enetc: do not skip setting LaBCR[MDIO_PHYAD_PRTAD] for addr 0
- mctp: i2c: fix skb memory leak in receive path
- can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
value
- bonding: fix type confusion in bond_setup_by_slave()
- mctp: route: hold key->lock in mctp_flow_prepare_output()
- [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation
- [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN
disabled
- [amd64,arm64] amd-xgbe: reset PHY settings before starting PHY
- net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)
- netfilter: nf_tables: Fix for duplicate device in netdev hooks
- netfilter: nf_tables: always walk all pending catchall elements
(CVE-2026-23278)
- netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
- netfilter: x_tables: guard option walkers against 1-byte tail reads
- netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
- netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
(CVE-2026-23274)
- perf annotate: Fix hashmap__new() error checking
- regulator: pca9450: Correct interrupt type
- regulator: pca9450: Correct probed name for PCA9452
- perf ftrace: Fix hashmap__new() error checking
- sched: idle: Make skipping governor callbacks more consistent
- nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
- nvme-pci: Fix race bug in nvme_poll_irqdisable()
- drivers: net: ice: fix devlink parameters get without irdma
- iavf: fix PTP use-after-free during reset
- iavf: fix incorrect reset handling in callbacks
- [amd64] accel/amdxdna: Fix runtime suspend deadlock when there is pending
job
- [amd64,arm64] ASoC: codecs: rt1011: Use component to get the dapm context
in spk_mode_put
- i40e: fix src IP mask checks and memcpy argument names in cloud filter
- e1000/e1000e: Fix leak in DMA error cleanup
- page_pool: store detach_time as ktime_t to avoid false-negatives
- net: bcmgenet: fix broken EEE by converting to phylib-managed state
- ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
- [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
acquisition
- ASoC: detect empty DMI strings
- drm/amdkfd: Unreserve bo if queue update failed
- [amd64] ASoC: amd: acp-mach-common: Add missing error check for clock
acquisition
- io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops
- perf synthetic-events: Fix stale build ID in module MMAP2 records
- net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
- neighbour: restore protocol != 0 check in pneigh update
- [amd64,arm64] net/mana: Null service_wq on setup error to prevent double
destroy
- [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition
- [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt
status
- net: prevent NULL deref in ip[6]tunnel_xmit()
- iio: imu: inv-mpu9150: fix irq ack preventing irq storms
- usb: gadget: f_mass_storage: Fix potential integer overflow in
check_command_size_in_blocks()
- drm/amdgpu: ensure no_hw_access is visible before MMIO
- cgroup: fix race between task migration and iteration
- sched_ext: Remove redundant css_put() in scx_cgroup_init()
- cgroup: Don't expose dead tasks in cgroup
- ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
- ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer
interfaces
- can: gs_usb: gs_can_open(): always configure bitrates before starting
device
- net: usb: lan78xx: fix silent drop of packets with checksum errors
- net: usb: lan78xx: fix TX byte statistics for small packets
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
- net: usb: lan78xx: skip LTM configuration for LAN7850
- gpib: lpvo_usb: fix unintended binding of FTDI 8U232AM devices
- rust: str: make NullTerminatedFormatter public
- ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
- [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
- [arm64] KVM: arm64: Fix protected mode handling of pages larger than 4kB
- [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
- [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
in-kernel APIC
- [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is
(de)activated
- [arm64] KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2
fault
- [arm64] KVM: arm64: vgic: Pick EOIcount deactivations from AP-list tail
- [arm64] KVM: arm64: pkvm: Don't reprobe for ICH_VTR_EL2.TDS on CPU hotplug
- USB: add QUIRK_NO_BOS for video capture several devices
- usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
- USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
- usb: xhci: Fix memory leak in xhci_disable_slot()
- usb: xhci: Prevent interrupt storm on host controller error (HCE)
- xhci: Fix NULL pointer dereference when reading portli debugfs files
- usb: yurex: fix race in probe
- usb: dwc3: pci: add support for the Intel Nova Lake -H
- usb: misc: uss720: properly clean up reference in uss720_probe()
- usb: core: don't power off roothub PHYs if phy_set_mode() fails
- usb: cdc-acm: Restore CAP_BRK functionnality to CH343
- usb: roles: get usb role switch from parent only for usb-b-connector
- usb: typec: altmode/displayport: set displayport signaling rate in
configure message
- USB: usbcore: Introduce usb_bulk_msg_killable()
- USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
- USB: core: Limit the length of unkillable synchronous timeouts
- usb: class: cdc-wdm: fix reordering issue in read code path
- usb: renesas_usbhs: fix use-after-free in ISR during device removal
- usb: gadget: f_hid: fix SuperSpeed descriptors
- usb: mdc800: handle signal and read racing
- usb: gadget: uvc: fix interval_duration calculation
- usb: image: mdc800: kill download URB on timeout
- usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
- usb: gadget: f_ncm: Fix atomic context locking issue
- usb: legacy: ncm: Fix NPE in gncm_bind
- Revert "usb: gadget: f_ncm: Fix atomic context locking issue"
- Revert "usb: legacy: ncm: Fix NPE in gncm_bind"
- Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing
net_device"
- Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind"
- Revert "usb: gadget: u_ether: add gether_opts for config caching"
- usb: gadget: f_ncm: Fix net_device lifecycle with device_move
- mm/tracing: rss_stat: ensure curr is false from kthread context
- ceph: fix i_nlink underrun during async unlink
- ceph: do not skip the first folio of the next object in writeback
- ceph: fix memory leaks in ceph_mdsc_build_path()
- ALSA: usb-audio: Improve Focusrite sample rate filtering
- objtool/klp: Fix detection of corrupt static branch/call entries
- objtool: Fix data alignment in elf_add_data()
- objtool: Fix another stack overflow in validate_branch()
- [riscv64] irqchip/riscv-aplic: Preserve APLIC states across suspend/resume
- [riscv64] irqchip/riscv-aplic: Do not clear ACPI dependencies on probe
failure
- [riscv64] irqchip/riscv-aplic: Register syscore operations only once
- time/jiffies: Mark jiffies_64_to_clock_t() notrace
- sched/mmcid: Prevent CID stalls due to concurrent forks
- sched/mmcid: Handle vfork()/CLONE_VM correctly
- sched/mmcid: Remove pointless preempt guard
- sched/mmcid: Avoid full tasklist walks
- i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
- [powerpc*] perf: Check that current->mm is alive before getting user
callchain
- scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
- scsi: qla2xxx: Completely fix fcport double free
- scsi: hisi_sas: Fix NULL pointer exception during user_scan()
- mm/kfence: fix KASAN hardware tag faults during late enablement
- mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
- mm/kfence: disable KFENCE upon KASAN HW tags enablement
- mmc: sdhci-brcmstb: use correct register offset for V1 pin_sel restore
- mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support
- mmc: core: Avoid bitfield RMW for claim/retune flags
- [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and
start
- tipc: fix divide-by-zero in tipc_sk_filter_connect()
- firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled
- kprobes: avoid crash when rmmod/insmod after ftrace killed
- ceph: add a bunch of missing ceph_path_info initializers
- libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
- libceph: reject preamble if control segment is empty
- libceph: prevent potential out-of-bounds reads in process_message_header()
- libceph: Use u32 for non-negative values in ceph_monmap_decode()
- libceph: admit message frames only in CEPH_CON_S_OPEN state
- Revert "tcpm: allow looking for role_sw device in the main node"
- Revert "ptdesc: remove references to folios from __pagetable_ctor() and
pagetable_dtor()"
- mm: Fix a hmm_range_fault() livelock / starvation problem
- nsfs: tighten permission checks for ns iteration ioctls
- liveupdate: luo_file: remember retrieve() status
- kthread: consolidate kthread exit paths to prevent use-after-free
- cpufreq: intel_pstate: Fix NULL pointer dereference in
update_cpu_qos_request()
- drm/amdgpu: add upper bound check on user inputs in signal ioctl
- drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl
- drm/amdgpu: add upper bound check on user inputs in wait ioctl
- drm/amd: Disable MES LR compute W/A
- ipmi:si: Don't block module unload if the BMC is messed up
- ipmi:si: Use a long timeout when the BMC is misbehaving
- drm/bridge: samsung-dsim: Fix memory leak in error path
- drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
- ipmi:si: Handle waiting messages when BMC failure detected
- nouveau/gsp: drop WARN_ON in ACPI probes
- [amd64] drm/i915/alpm: ALPM disable fixes
- gpiolib: normalize the return value of gc->get() on behalf of buggy
drivers
- ipmi:si: Fix check for a misbehaving BMC
- drm/xe/sync: Fix user fence leak on alloc failure
- drm/xe/sync: Cleanup partially initialized sync on parse failure
- [s390x] pfault: Fix virtual vs physical address confusion
- bpf: Fix kprobe_multi cookies access in show_fdinfo callback
- [arm64] gcs: Honour mprotect(PROT_NONE) on shadow stack mappings
- nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
- device property: Allow secondary lookup in fwnode_get_next_child_node()
- [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the
range the ITS supports
- btrfs: fix chunk map leak in btrfs_map_block() after
btrfs_chunk_map_num_copies()
- sched_ext: Disable preemption between scx_claim_exit() and kicking helper
work
- sched_ext: Fix starvation of scx_enable() under fair-class saturation
- iomap: don't mark folio uptodate if read IO has bytes pending
- iomap: reject delalloc mappings during writeback
- nsfs: tighten permission checks for handle opening
- nstree: tighten permission checks for listing
- ice: reintroduce retry mechanism for indirect AQ
- ixgbevf: fix link setup issue
- mm: memfd_luo: always make all folios uptodate
- mm: memfd_luo: always dirty all folios
- mm/huge_memory: fix a folio_split() race condition with folio_try_get()
- mm/damon/core: clear walk_control on inactive context in damos_walk()
- mm/slab: fix an incorrect check in obj_exts_alloc_size()
- staging: sm750fb: add missing pci_release_region on error and removal
- staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
- staging: rtl8723bs: fix potential out-of-bounds read in
rtw_restruct_wmm_ie
- media: dvb-net: fix OOB access in ULE extension header tables
- [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds
- net: Fix rcu_tasks stall in threaded busypoll
- ice: fix retry for AQ command 0x06EE
- fgraph: Fix thresh_return clear per-task notrace
- tracing: Fix syscall events activation by ensuring refcount hits zero
- net/tcp-ao: Fix MAC comparison to be constant-time
- fgraph: Fix thresh_return nosleeptime double-adjust
- net/tcp-md5: Fix MAC comparison to be constant-time
- batman-adv: Avoid double-rtnl_lock ELP metric worker
- drm/xe/xe2_hpg: Correct implementation of Wa_16025250150
- pmdomain: rockchip: Fix PD_VCODEC for RK3588
- nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
- [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
- hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
- io_uring/zcrx: use READ_ONCE with user shared RQEs
- [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults
- io_uring/net: reject SEND_VECTORIZED when unsupported
- pmdomain: bcm: bcm2835-power: Fix broken reset status read
- drm/ttm: Fix ttm_pool_beneficial_order() return type
- [amd64] crypto: ccp - allow callers to use HV-Fixed page API when SEV is
disabled
- [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint
- ata: libata-core: Disable LPM on ST1000DM010-2EP102
- [s390x] xor: Fix xor_xc_2() inline assembly constraints
- drm/amd/display: Fallback to boot snapshot for dispclk
- [s390x] xor: Fix xor_xc_5() inline assembly
- slab: distinguish lock and trylock for sheaf_flush_main()
- memcg: fix slab accounting in refill_obj_stock() trylock path
- ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
- smb: server: fix use-after-free in smb2_open()
- ksmbd: Don't log keys in SMB3 signing and encryption key generation
- ksmbd: fix use-after-free by using call_rcu() for oplock_info
- net: mctp: fix device leak on probe failure
- net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
- net: ncsi: fix skb leak in error paths
- net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
- net: macb: Shuffle the tx ring before enabling tx
- drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
- drm/amdgpu: Fix use-after-free race in VM acquire
- drm/amd: Set num IP blocks to 0 if discovery fails
- drm/amd: Fix NULL pointer dereference in device cleanup
- [amd64] drm/i915: Fix potential overflow of shmem scatterlist length
- [amd64] drm/i915/psr: Repeat Selective Update area alignment
- [arm64] drm/msm: Fix dma_free_attrs() buffer size
- drm/amd: Fix a few more NULL pointer dereference in device cleanup
- [amd64] drm/i915/vrr: Configure VRR timings after enabling
TRANS_DDI_FUNC_CTL
- tracing: Fix enabling multiple events on the kernel command line and
bootconfig
- tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
- net-shapers: don't free reply skb after genlmsg_reply()
- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
- can: dev: keep the max bitrate error at 5%
- io_uring/kbuf: check if target buffer list is still legacy on recycle
- cifs: make default value of retrans as zero
- xfs: fix integer overflow in bmap intent sort comparator
- xfs: fix returned valued from xfs_defer_can_append
- xfs: fix undersized l_iclog_roundoff values
- xfs: ensure dquot item is deleted from AIL only after log shutdown
- sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags
- [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
- dt-bindings: display: msm: Fix reg ranges and clocks on Glymur
- ublk: fix NULL pointer dereference in ublk_ctrl_set_size()
- [s390x] dasd: Move quiesce state with pprc swap
- [s390x] dasd: Copy detected format information to secondary device
- [powerpc*] pseries: Correct MSI allocation tracking
- [powerpc*] bpf: fix kfunc call support
- [powerpc*] bpf: fix the address returned by bpf_get_func_ip
- lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
- scsi: core: Fix error handling for scsi_alloc_sdev()
- [amd64] x86/apic: Disable x2apic on resume if the kernel expects so
- kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
- lib/bootconfig: fix snprintf truncation check in
xbc_node_compose_key_after()
- lib/bootconfig: check bounds before writing in __xbc_open_brace()
- smb: client: fix atomic open with O_DIRECT & O_SYNC
- smb: client: fix in-place encryption corruption in SMB2_write()
- smb: client: fix iface port assignment in parse_server_interfaces
- btrfs: fix transaction abort when snapshotting received subvolumes
- btrfs: fix transaction abort on file creation due to name hash collision
- btrfs: fix transaction abort on set received ioctl due to item overflow
- btrfs: add missing RCU unlock in error path in
try_release_subpage_extent_buffer()
- btrfs: abort transaction on failure to update root in the received subvol
ioctl
- iio: dac: ds4424: reject -128 RAW value
- iio: frequency: adf4377: Fix duplicated soft reset mask
- iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
- iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
- iio: magnetometer: tlv493d: remove erroneous shift in X-axis data
- iio: potentiometer: mcp4131: fix double application of wiper shift
- iio: chemical: bme680: Fix measurement wait duration calculation
- iio: buffer: Fix wait_queue not being removed
- iio: gyro: mpu3050-core: fix pm_runtime error handling
- iio: imu: adis: Fix NULL pointer dereference in adis_init
- iio: gyro: mpu3050-i2c: fix pm_runtime error handling
- iio: imu: inv_icm45600: fix regulator put warning when probe fails
- iio: light: bh1780: fix PM runtime leak on error path
- iio: imu: inv_icm45600: fix INT1 drive bit inverted
- iio: imu: inv_icm42600: fix odr switch to the same value
- iio: imu: inv_icm42600: fix odr switch when turning buffer off
- iio: proximity: hx9023s: fix assignment order for __counted_by
- iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
- i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
- i3c: mipi-i3c-hci: Factor out DMA mapping from queuing path
- i3c: mipi-i3c-hci: Consolidate spinlocks
- i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
- i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
- i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
- mm/damon: rename DAMON_MIN_REGION to DAMON_MIN_REGION_SZ
- mm/damon: rename min_sz_region of damon_ctx to min_region_sz
- mm/damon/core: disallow non-power of two min_region_sz
- [arm64] KVM: arm64: gic: Set vgic_model before initing private IRQs
- [arm64] KVM: arm64: Eagerly init vgic dist/redist on vgic creation
- io_uring: ensure ctx->rings is stable for task work flags manipulation
(CVE-2026-23275)
- io_uring/eventfd: use ctx->rings_rcu for flags checking
- cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch
- bpf: drop kthread_exit from noreturn_deny
- sched_ext: Use WRITE_ONCE() for the write side of scx_enable helper
pointer
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.19.10
- NFSD: Defer sub-object cleanup in export put callbacks
- NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
- HID: bpf: prevent buffer overflow in hid_hw_request
- sunrpc: fix cache_request leak in cache_release
- nvdimm/bus: Fix potential use after free in asynchronous initialization
- crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying
- mm/rmap: fix incorrect pte restoration for lazyfree folios
- mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()
- mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for
shared THP
- NFC: nxp-nci: allow GPIOs to sleep
- net: macb: fix use-after-free access to PTP clock
- bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler
- batman-adv: avoid OGM aggregation when skb tailroom is insufficient
- mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
- [amd64] crypto: padlock-sha - Disable for Zhaoxin processor
(Closes: #1113996)
- Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
- Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
- drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
- smb: client: fix krb5 mount with username option
- ksmbd: unset conn->binding on failed binding request
- ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
- [amd64] drm/i915/dsc: Add Selective Update register definitions
- [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET
parameters
- [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode
- net: macb: Introduce gem_init_rx_ring()
- net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
resume
- firmware: stratix10-svc: Delete some stray tabs
- firmware: stratix10-svc: Add Multi SVC clients support
- netconsole: fix sysdata_release_enabled_show checking wrong flag
- cifs: open files should not hold ref on superblock
- drm/xe: Fix memory leak in xe_vm_madvise_ioctl
- ipmi: Consolidate the run to completion checking for xmit msgs lock
- ipmi:msghandler: Handle error returns from the SMI sender
- ata: libata-core: disable LPM on ADATA SU680 SSD
- ata: libata-scsi: report correct sense field pointer in
ata_scsiop_maint_in()
- mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
- mmc: sdhci: fix timing selection for 1-bit bus width
- pmdomain: mediatek: Fix power domain count
- pmdomain: bcm: bcm2835-power: Increase ASB control timeout
- spi: fix use-after-free on controller registration failure
- spi: fix statistics allocation
- mtd: spi-nor: Fix RDCR controller capability core check
- mtd: rawnand: pl353: make sure optimal timings are applied
- mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
cadence_nand_init()
- mtd: Avoid boot crash in RedBoot partition table parser
- [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
- [amd64] iommu/vt-d: Only handle IOPF for SVA when PRI is supported
- io_uring/poll: fix multishot recv missing EOF on wakeup race
- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
- io_uring/kbuf: propagate BUF_MORE through early buffer commit path
- vt: save/restore unicode screen buffer for alternate screen
- serial: 8250_pci: add support for the AX99100
- serial: 8250: Fix TX deadlock when using DMA
- serial: 8250: always disable IRQ during THRE test
- serial: 8250: Protect LCR write in shutdown
- serial: 8250_dw: Avoid unnecessary LCR writes
- serial: 8250: Add serial8250_handle_irq_locked()
- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling
- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm
- serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
BUSY
- serial: 8250_dw: Ensure BUSY is deasserted
- serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
- serial: uartlite: fix PM runtime usage count underflow on probe
- drm: Fix use-after-free on framebuffers and property blobs when calling
drm_dev_unplug
- drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START,
END}
- drm/amdgpu/gmc9.0: add bounds checking for cid
- drm/amdgpu/mmhub2.0: add bounds checking for cid
- drm/amdgpu/mmhub2.3: add bounds checking for cid
- drm/amdgpu/mmhub3.0.1: add bounds checking for cid
- drm/amdgpu/mmhub3.0.2: add bounds checking for cid
- drm/amdgpu/mmhub3.0: add bounds checking for cid
- drm/amdgpu/mmhub4.1.0: add bounds checking for cid
- drm/imagination: Fix deadlock in soft reset sequence
- drm/imagination: Synchronize interrupts before suspending the GPU
- drm/radeon: apply state adjust rules to some additional HAINAN vairants
- drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
- drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
- drm/amdgpu: rework how we handle TLB fences
- [amd64] drm/i915/dmc: Fix an unlikely NULL pointer deference at probe
- [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
- [amd64] drm/i915/psr: Disable PSR on update_m_n and update_lrr
- drm/xe/guc: Ensure CT state transitions via STOP before DISABLED
- drm/xe/oa: Allow reading after disabling OA stream
- drm/xe: Always kill exec queues in xe_guc_submit_pause_abort
- drm/xe: Fix missing runtime PM reference in ccs_mode_store
- drm/xe: Open-code GGTT MMIO access protection
- Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
(CVE-2026-23395)
- btrfs: log new dentries when logging parent dir of a conflicting inode
- btrfs: tree-checker: fix misleading root drop_level error message
- [riscv64] soc: microchip: mpfs: Fix memory leak in
mpfs_sys_controller_probe()
- [riscv64] cache: starfive: fix device node leak in starlink_cache_init()
- [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning
- [amd64,arm64] tee: shm: Remove refcounting of kernel pages
- wifi: mac80211: remove keys after disabling beaconing
- wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times
- wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
- wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
- [arm64] dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator
- [arm64] dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator
- [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
- [arm64] dts: renesas: r9a09g077: Fix CPG register region sizes
- [arm64] dts: renesas: r9a09g087: Fix CPG register region sizes
- [arm64] dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2
- [arm64] dts: renesas: r8a78000: Fix out-of-range SPI interrupt numbers
- [arm64] firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap()
- [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path
- [arm64] firmware: arm_scmi: Fix NULL dereference on notify error path
- Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
- Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
- Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
- Bluetooth: ISO: Fix defer tests being unstable
- Bluetooth: hci_sync: Fix hci_le_create_conn_sync
- Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
- Bluetooth: HIDP: Fix possible UAF
- Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
- Bluetooth: qca: fix ROM version reading on WCN3998 chips
- af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)
- bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393)
- net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
- ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
- mpls: add missing unregister_netdevice_notifier to mpls_init
- netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
- netfilter: conntrack: add missing netlink policy validations
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
sip_help_tcp()
- netfilter: nf_flow_table_ip: reset mac header before vlan push
- netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
- nf_tables: nft_dynset: fix possible stateful expression memleak in error
path
- netfilter: nft_ct: drop pending enqueued packets on removal
- netfilter: xt_CT: drop pending enqueued packets on template removal
(CVE-2026-23391)
- netfilter: xt_time: use unsigned int for monthday bit shift
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
- [amd64] crypto: ccp - Fix leaking the same page twice
- [arm64] net: bcmgenet: increase WoL poll timeout
- [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel()
by reordering teardown
- sched: idle: Consolidate the handling of two special cases
- PM: runtime: Fix a race condition related to device removal
- bonding: prevent potential infinite loop in bond_header_parse()
- net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
- net/sched: teql: Fix double-free in teql_master_xmit
- net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
- net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
- clsact: Fix use-after-free in init/destroy rollback asymmetry
- net: usb: aqc111: Do not perform PM inside suspend callback
- ACPICA: Update the format of Arg3 of _DSM
- igc: fix missing update of skb->tail in igc_xmit_frame()
- igc: fix page fault in XDP TX timestamps handling
- iavf: fix VLAN filter lost on add/delete race
- libie: prevent memleak in fwlog code
- wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
- wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
headroom
- wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
- ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
- net: macb: fix uninitialized rx_fs_lock
- ipv6: add NULL checks for idev in SRv6 paths
- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
- net/mlx5e: Prevent concurrent access to IPSec ASO context
- net/mlx5e: Fix race condition during IPSec ESN update
- udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
- net: bonding: fix NULL deref in bond_debug_rlb_hash_show
- netfilter: bpf: defer hook memory release until rcu readers are done
- netfilter: nf_tables: release flowtable after rcu grace period on error
(CVE-2026-23392)
- nfnetlink_osf: validate individual option lengths in fingerprints
(CVE-2026-23397)
- [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in
buffer switching
- net: shaper: protect late read accesses to the hierarchy
- net: shaper: protect from late creation of hierarchy
- [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
paths
- icmp: fix NULL pointer dereference in icmp_tag_validation()
(CVE-2026-23398)
- MPTCP: fix lock class name family in pm_nl_create_listen_socket
- hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return
value
- hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return
value
- hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return
value
- hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
- i2c: cp2615: fix serial string NULL-deref at probe
- i2c: fsi: Fix a potential leak in fsi_i2c_probe()
- i2c: pxa: defer reset on Armada 3700 when recovery is used
- [riscv64] irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in
rpmi_sysmsi_probe()
- [amd64] perf/x86/intel: Add missing branch counters constraint apply
- [amd64] perf/x86: Move event pointer setup earlier in x86_pmu_enable()
- ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
- tracing: Fix failure to read user space from system call trace events
- tracing: Fix trace_marker copy link list updates
- [amd64] x86/mce/amd: Check SMCA feature bit before accessing SMCA MSRs
- binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4
- mtd: rawnand: serialize lock/unlock against other NAND operations
- mtd: rawnand: brcmnand: skip DMA during panic write
- [amd64] x86/hyperv: Use __naked attribute to fix stackless C function
- drm/vmwgfx: Don't overwrite KMS surface dirty tracker
- iommu: Fix mapping check for 0x0 to avoid re-mapping it (Closes: #1130971)
- [amd64] iommu/sva: Fix crash in iommu_sva_unbind_device()
- [amd64] iommu/amd: Block identity domain when SNP enabled
- drm/amd/display: Fix DisplayID not-found handling in
parse_edid_displayid_vrr()
- drm/amd: fix dcn 2.01 check
- drm/bridge: dw-hdmi-qp: fix multi-channel audio output
- ksmbd: fix use-after-free of share_conf in compound request
- ksmbd: fix use-after-free in durable v2 replay of active file handles
- [amd64] drm/i915/gt: Check set_default_submission() before deferencing
- lib/bootconfig: check xbc_init_node() return in override path
- tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
- [arm64] realm: Fix PTE_NS_SHARED for 52bit PA support
- drm/xe/guc: Fail immediately on GuC load error
- hwmon: (max6639) Fix pulses-per-revolution implementation
- xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
- xen/privcmd: add boot control for restricted usage in domU
.
[ Ben Hutchings ]
* Fix ordering of kernel version strings for multiple Debian revisions
(Closes: #1113728)
Checksums-Sha1:
a2ad26f711b19430dffed730d840f9db3f4b0e91 7154 linux-signed-arm64_6.19.10+1.dsc
789c527ddde86941899f298d4e85ca2c0006e7b6 716008 linux-signed-arm64_6.19.10+1.tar.xz
Checksums-Sha256:
35728918edc4647e69ed014e9580f56b473e9fa31c53f67f7250005fbc451981 7154 linux-signed-arm64_6.19.10+1.dsc
6800437cfe04b895994380458a4fd648771eeb296e5a0298c2e13fbefddddbc5 716008 linux-signed-arm64_6.19.10+1.tar.xz
Files:
f2b9b6e8b68696138c42f589f003e958 7154 kernel optional linux-signed-arm64_6.19.10+1.dsc
b0ea120fc5a57022d92aa6ee1229a85e 716008 kernel optional linux-signed-arm64_6.19.10+1.tar.xz
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQSInBJdRTWyTRy0ztFCTVFtUgONCgUCacda0wAKCRBCTVFtUgON
ClGwAP0dB6Av7q9yTUYpRsN5lnliZtwfbcp/a9R07m6gSA86hQEAvlqJo2HEHFxi
YOVu8dfujodJLcij101D3dyaOsdo1AA=
=G+PP
-----END PGP SIGNATURE-----
