Plucky update: upstream stable patchset 2025-09-14

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2025-09-14

                Ported from the following upstream stable releases:
                        v6.12.38, v6.12.39, v6.15.7

       from git://git.kernel.org/

eventpoll: don't decrement ep refcount while still holding the ep mutex
drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
drm/amdgpu/ip_discovery: add missing ip_discovery fw
crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2
ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH
ASoC: soc-acpi: add get_function_tplg_files ops
ASoC: Intel: add sof_sdw_get_tplg_files ops
ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops
ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches
irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ
sched/core: Fix migrate_swap() vs. hotplug
perf: Revert to requiring CAP_SYS_ADMIN for uprobes
ASoC: cs35l56: probe() should fail if the device ID is not recognized
Bluetooth: hci_sync: Fix not disabling advertising instance
Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
pinctrl: amd: Clear GPIO debounce for suspend
fix proc_sys_compare() handling of in-lookup dentries
sched/deadline: Fix dl_server runtime calculation formula
bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL
arm64: poe: Handle spurious Overlay faults
net: phy: qcom: move the WoL function to shared library
net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol()
netlink: Fix wraparounds of sk->sk_rmem_alloc.
vsock: fix `vsock_proto` declaration
tipc: Fix use-after-free in tipc_conn_close().
tcp: Correct signedness in skb remaining space calculation
vsock: Fix transport_{g2h,h2g} TOCTOU
vsock: Fix transport_* TOCTOU
vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
net: phy: smsc: Force predictable MDI-X state on LAN87xx
net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
atm: clip: Fix potential null-ptr-deref in to_atmarpd().
atm: clip: Fix memory leak of struct clip_vcc.
atm: clip: Fix infinite recursive call of clip_push().
atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info
net/sched: Abort __tc_modify_qdisc if parent class does not exist
rxrpc: Fix bug due to prealloc collision
rxrpc: Fix oops due to non-existence of prealloc backlog struct
ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
x86/mce/amd: Add default names for MCA banks and blocks
x86/mce/amd: Fix threshold limit reset
x86/mce: Don't remove sysfs if thresholding sysfs init fails
x86/mce: Ensure user polling settings are honored when restarting timer
x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
KVM: SVM: Add missing member in SNP_LAUNCH_START command structure
KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
KVM: Allow CPU to reschedule while setting per-page memory attributes
ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp()
ASoC: fsl_sai: Force a software reset when starting in consumer mode
gre: Fix IPv6 multicast route creation.
net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe()
md/md-bitmap: fix GPF in bitmap_get_stats()
pinctrl: qcom: msm: mark certain pins as invalid for interrupts
pwm: Fix invalid state detection
pwm: mediatek: Ensure to disable clocks in error path
wifi: prevent A-MSDU attacks in mesh networks
wifi: mwifiex: discard erroneous disassoc frames on STA interface
wifi: mt76: mt7921: prevent decap offload config before STA initialization
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()
wifi: mt76: mt7925: fix the wrong config for tx interrupt
wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan
drm/imagination: Fix kernel crash when hard resetting the GPU
drm/amdkfd: Don't call mmput from MMU notifier callback
drm/gem: Acquire references on GEM handles for framebuffers
drm/sched: Increment job count before swapping tail spsc queue
drm/ttm: fix error handling in ttm_buffer_object_transfer
drm/gem: Fix race in drm_gem_handle_create_tail()
drm/xe/bmg: fix compressed VRAM handling
Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2"
usb: gadget: u_serial: Fix race condition in TTY wakeup
Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
drm/framebuffer: Acquire internal references on GEM handles
drm/xe: Allocate PF queue size on pow2 boundary
maple_tree: fix mt_destroy_walk() on root leaf node
mm: fix the inaccurate memory statistics issue for users
scripts/gdb: fix interrupts display after MCP on x86
scripts/gdb: de-reference per-CPU MCE interrupts
scripts/gdb: fix interrupts.py after maple tree conversion
mm/vmalloc: leave lazy MMU mode on PTE mapping error
lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()
rust: init: allow `dead_code` warnings for Rust >= 1.89.0
clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data
x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
x86/mm: Disable hugetlb page table sharing on 32-bit
clk: scmi: Handle case where child clocks are initialized before their parents
smb: server: make use of rdma_destroy_qp()
ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
erofs: fix to add missing tracepoint in erofs_read_folio()
erofs: address D-cache aliasing
ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count
netlink: Fix rmem check in netlink_broadcast_deliver().
netlink: make sure we allow at least one dump skb
wifi: cfg80211: fix S1G beacon head validation in nl80211
wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
drm/tegra: nvdec: Fix dma_alloc_coherent error check
md/raid1: Fix stack memory use after return in raid1_reshape
raid10: cleanup memleak at raid10_make_request
wifi: mac80211: correctly identify S1G short beacon
wifi: mac80211: fix non-transmitted BSSID profile search
wifi: rt2x00: fix remove callback type mismatch
drm/nouveau/gsp: fix potential leak of memory used during acpi init
nbd: fix uaf in nbd_genl_connect() error path
drm/xe/pf: Clear all LMTT pages on alloc
erofs: refine readahead tracepoint
erofs: fix to add missing tracepoint in erofs_readahead()
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
net: appletalk: Fix device refcount leak in atrtr_create()
ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
selftests: net: lib: fix shift count out of range
drm/xe/pm: Correct comment of xe_pm_set_vram_threshold()
can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
net/mlx5e: Fix race between DIM disable and net_dim()
net/mlx5e: Add new prio for promiscuous mode
net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
bnxt_en: Fix DCB ETS validation
bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
ublk: sanity check add_dev input for underflow
atm: idt77252: Add missing `dma_map_error()`
um: vector: Reduce stack usage in vector_eth_configure()
ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
io_uring: make fallocate be hashed work
ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
ALSA: hda/realtek: Add quirks for some Clevo laptops
net: usb: qmi_wwan: add SIMCom 8230C composition
driver: bluetooth: hci_qca:fix unable to load the BT driver
HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
net: mana: Record doorbell physical address in PF mode
btrfs: fix assertion when building free space tree
vt: add missing notification when switching back to text mode
bpf: Adjust free target to avoid global starvation of LRU map
riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment
HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
HID: nintendo: avoid bluetooth suspend/resume stalls
selftests/bpf: adapt one more case in test_lru_map to the new target_free
net: wangxun: revert the adjustment of the IRQ vector sequence
ksmbd: fix potential use-after-free in oplock/lease break ack
objtool: Add missing endian conversion to read_annotate()
Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state
Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
arm64/mm: Drop wrong writes into TCR2_EL1
module: Fix memory deallocation on error path in move_module()
KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
ALSA: hda/realtek - Add mute LED support for HP Victus 15-fb2xxx
arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
drm/amdgpu: Include sdma_4_4_4.bin
drm/nouveau: Do not fail module init on debugfs errors
kasan: remove kasan_find_vm_area() to prevent possible deadlock
mm/damon/core: handle damon_call_control as normal under kdmond deactivation
samples/damon: fix damon sample prcl for start failure
samples/damon: fix damon sample wsse for start failure
md/raid1,raid10: strip REQ_NOWAIT from member bios
wifi: mac80211: reject VHT opmode for unsupported channel widths
wifi: mac80211: add the virtual monitor after reconfig complete
bnxt_en: Flush FW trace before copying to the coredump
ASoC: rt721-sdca: fix boost gain calculation error
ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 6 G1a
x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation
netlink: avoid infinite retry looping in netlink_unicast()
UBUNTU: Upstream stable to v6.12.38, v6.12.39, v6.15.7