linux-oem-6.0 (6.0.0-1020.20) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1020.20 -proposed tracker (LP: #2026458)

  * CVE-2023-2640 // CVE-2023-32629
    - Revert "UBUNTU: SAUCE: overlayfs: Skip permission checking for
      trusted.overlayfs.* xattrs"
    - SAUCE: overlayfs: default to userxattr when mounted from non initial user
      namespace

  * CVE-2023-35001
    - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval

  * CVE-2023-31248
    - netfilter: nf_tables: do not ignore genmask when looking up chain by id

  * Packaging resync (LP: #1786013)
    - [Packaging] resync update-dkms-versions helper
    - [Packaging] update annotations scripts

  * CVE-2023-3389
    - io_uring/poll: serialize poll linked timer start with poll removal

  * CVE-2023-21106
    - drm/msm/gpu: Fix potential double-free

  * CVE-2022-47929
    - net: sched: disallow noqueue for qdisc classes

 -- Manuel Diewald <manuel.diewald@canonical.com>  Thu, 13 Jul 2023 10:36:42 +0200

linux-oem-6.0 (6.0.0-1019.19) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1019.19 -proposed tracker (LP: #2024151)

  * CVE-2023-2430
    - io_uring: get rid of double locking
    - io_uring: extract a io_msg_install_complete helper
    - io_uring/msg_ring: move double lock/unlock helpers higher up
    - io_uring/msg_ring: fix missing lock on overflow for IOPOLL

  * Various backlight issues with the 6.0 kernel (LP: #2023638)
    - ACPI: video: Add auto_detect arg to __acpi_video_get_backlight_type()
    - ACPI: video: Make acpi_backlight=video work independent from GPU driver
    - SAUCE: ACPI: video: Stop trying to use vendor backlight control on laptops
      from after ~2012

  * CVE-2022-4842
    - fs/ntfs3: Fix attr_punch_hole() null pointer derenference

  * CVE-2023-2124
    - xfs: verify buffer contents when we skip log replay

  * CVE-2023-0597
    - x86/kasan: Map shadow for percpu pages on demand
    - x86/mm: Randomize per-cpu entry area
    - x86/mm: Recompute physical address for every page of per-CPU CEA mapping
    - x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
    - x86/mm: Do not shuffle CPU entry areas without KASLR

  * cls_flower: off-by-one in fl_set_geneve_opt (LP: #2023577)
    - net/sched: flower: fix possible OOB write in fl_set_geneve_opt()

  * Some INVLPG implementations can leave Global translations unflushed when
    PCIDs are enabled (LP: #2023220)
    - x86/mm: Avoid incomplete Global INVLPG flushes

  * CVE-2023-2176
    - RDMA/core: Refactor rdma_bind_addr

  * Fix Monitor lost after replug WD19TBS to SUT port with VGA/DVI to type-C
    dongle (LP: #2021949)
    - thunderbolt: Increase timeout of DP OUT adapter handshake
    - thunderbolt: Do not touch CL state configuration during discovery
    - thunderbolt: Increase DisplayPort Connection Manager handshake timeout

  * CVE-2023-1073
    - HID: check empty report_list in hid_validate_values()

  * CVE-2023-0459
    - uaccess: Add speculation barrier to copy_from_user()

  *  selftest: fib_tests: Always cleanup before exit  (LP: #2015956)
    - selftest: fib_tests: Always cleanup before exit

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 20 Jun 2023 12:57:07 +0300

linux-oem-6.0 (6.0.0-1018.18) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1018.18 -proposed tracker (LP: #2019422)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * No  HDMI/DP audio output on dock(Nvidia GPU) (LP: #2020062)
    - SAUCE: ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 30 May 2023 11:18:35 +0300

linux-oem-6.0 (6.0.0-1017.17) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1017.17 -proposed tracker (LP: #2019649)

  * CVE-2023-26606
    - fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs

  * CVE-2023-32233
    - netfilter: nf_tables: deactivate anonymous set from preparation phase

  * CVE-2023-2612
    - SAUCE: shiftfs: prevent lock unbalance in shiftfs_create_object()

  * CVE-2023-1670
    - xirc2ps_cs: Fix use after free bug in xirc2ps_detach

  * CVE-2023-30456
    - KVM: nVMX: add missing consistency checks for CR0 and CR4

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Thu, 18 May 2023 15:32:19 +0300

linux-oem-6.0 (6.0.0-1016.16) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1016.16 -proposed tracker (LP: #2016550)

  * both dell_backlight and nvidia_0 backlight interface appear, and can't
    adjust the display  brightness (LP: #2017774)
    - ACPI: video: Add acpi_video_backlight_use_native() helper
    - ACPI: video: Drop backlight_device_get_by_type() call from
      acpi_video_get_backlight_type()
    - ACPI: video: Refactor acpi_video_get_backlight_type() a bit
    - ACPI: video: Make acpi_video_backlight_use_native() always return true
    - ACPI: video: Simplify __acpi_video_get_backlight_type()
    - ACPI: video: Prefer native over vendor

  * CVE-2022-4139
    - drm/i915: fix TLB invalidation for Gen12 video and compute engines

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Thu, 27 Apr 2023 13:15:34 +0300

linux-oem-6.0 (6.0.0-1015.15) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1015.15 -proposed tracker (LP: #2016822)

  * CVE-2023-23455
    - net: sched: atm: dont intepret cls results when asked to drop

  * CVE-2023-26545
    - net: mpls: fix stale pointer if allocation fails during device rename

  * CVE-2023-1829
    - net/sched: Retire tcindex classifier
    - [Config]: Make sure CONFIG_NET_CLS_TCINDEX is not available

  * CVE-2023-1859
    - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race
      condition

  * CVE-2023-0468
    - io_uring: update res mask in io_poll_check_events
    - io_uring: fix tw losing poll events
    - io_uring: cmpxchg for poll arm refs release
    - io_uring: make poll refs more robust
    - io_uring/poll: fix poll_refs race with cancelation

  * CVE-2023-0386
    - ovl: fail on invalid uid/gid mapping at copy up

  * Miscellaneous Ubuntu changes
    - [Config] Update gcc version

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Tue, 18 Apr 2023 16:01:23 +0300

linux-oem-6.0 (6.0.0-1014.14) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1014.14 -proposed tracker (LP: #2011920)

  * CVE-2022-4382
    - USB: gadgetfs: Fix race between mounting and unmounting

  * CVE-2023-23559
    - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid

  * CVE-2023-1118
    - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()

  * CVE-2023-26605
    - fs: do not update freeing inode i_io_list

  * CVE-2023-26607
    - ntfs: fix out-of-bounds read in ntfs_attr_find()

  * CVE-2022-36280
    - drm/vmwgfx: Validate the box size for the snooped cursor

  * CVE-2023-1074
    - sctp: fail if no bound addresses can be used for a given scope

  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
    - [Packaging] update Ubuntu.md
    - [Packaging] update update.conf

 -- Manuel Diewald <manuel.diewald@canonical.com>  Fri, 31 Mar 2023 17:29:02 +0200

linux-oem-6.0 (6.0.0-1013.13) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1013.13 -proposed tracker (LP: #2008351)

  * CVE-2023-1281
    - net/sched: tcindex: update imperfect hash filters respecting rcu

  * CVE-2023-1032
    - net: avoid double iput when sock_alloc_file fails

  * rtcpie in timers from ubuntu_kernel_selftests randomly failing
    (LP: #1814234)
    - SAUCE: selftest: rtcpie: Force passing unreliable subtest

  * CVE-2022-2196
    - KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS

  * Fix HFP mSBC support on Realtek Bluetooth USB controller (LP: #2007331)
    - Bluetooth: btrtl: Add btrealtek data struct
    - Bluetooth: btusb: Ignore zero length of USB packets on ALT 6 for specific
      chip

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Thu, 16 Mar 2023 17:59:47 +0200

linux-oem-6.0 (6.0.0-1012.12) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1012.12 -proposed tracker (LP: #2004348)

  * CVE-2023-0469
    - io_uring/filetable: fix file reference underflow

  * LSM: Configuring Too Many LSMs Causes Kernel Panic on Boot (LP: #1987998)
    - SAUCE: LSM: Change Landlock from LSMBLOB_NEEDED to LSMBLOB_NOT_NEEDED

  * CVE-2023-0045
    - x86/bugs: Flush IBP in ib_prctl_set()

  * CVE-2022-47520
    - wifi: wilc1000: validate pairwise and authentication suite offsets

  * CVE-2022-3567
    - ipv6: Fix data races around sk->sk_prot.

  * CVE-2022-45934
    - Bluetooth: L2CAP: Fix u8 overflow

  * CVE-2022-42896
    - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm

  * CVE-2022-43945
    - NFSD: Remove "inline" directives on op_rsize_bop helpers
    - NFSD: Cap rsize_bop result based on send buffer size

  * CVE-2022-20369
    - NFSD: fix use-after-free in __nfs42_ssc_open()

  * CVE-2023-0461
    - net/ulp: prevent ULP without clone op from entering the LISTEN status
    - net/ulp: use consistent error code when blocking ULP

  * Expose built-in trusted and revoked certificates (LP: #1996892)
    - [Packaging] Expose built-in trusted and revoked certificates

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Fri, 10 Feb 2023 12:37:27 +0200

linux-oem-6.0 (6.0.0-1011.11) jammy; urgency=medium

  * jammy/linux-oem-6.0: 6.0.0-1011.11 -proposed tracker (LP: #2001806)

  * jammy/linux-oem-6.0: 6.0.0-1011.11 -proposed tracker (LP: #2003453)

  * Revoke & rotate to new signing key (LP: #2002812)
    - [Packaging] Revoke and rotate to new signing key

  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2023.01.02)

  * Fix speaker mute hotkey doesn't work on Dell G16 series (LP: #2003161)
    - SAUCE: platform/x86: dell-wmi: Add a keymap for KEY_MUTE in type 0x0010
      table

  * CVE-2023-0179
    - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits

  * Fix headset mic not working issue on Dell Latitude 5340 (LP: #2002013)
    - ALSA: hda - Enable headset mic on another Dell laptop with ALC3254

  * Mediatek FM350-GL wwan module failed to init: Invalid device status 0x1
    (LP: #2002089)
    - SAUCE: Revert "net: wwan: t7xx: Add AP CLDMA"
    - net: devlink: extend info_get() version put to indicate a flash component
    - SAUCE: net: wwan: t7xx: Add AP CLDMA
    - SAUCE: net: wwan: t7xx: Infrastructure for early port configuration
    - SAUCE: net: wwan: t7xx: PCIe reset rescan
    - SAUCE: net: wwan: t7xx: Enable devlink based fw flashing and coredump
      collection
    - SAUCE: net: wwan: t7xx: Devlink documentation

  * Fix flicker display problem on some panels which support PSR2 (LP: #2002968)
    - drm/i915/psr: Add continuous full frame bit together with single

 -- Timo Aaltonen <timo.aaltonen@canonical.com>  Mon, 23 Jan 2023 20:30:00 +0200

# For older changelog entries, run 'apt-get changelog linux-modules-ivsc-6.0.0-1020-oem'
