focal/linux-azure: 5.4.0-1132.139 -proposed tracker

[Stefan Bader]

This bug will contain status and test results related to a kernel source (or snap) as stated in the title.

For an explanation of the tasks and the associated workflow see:
  https://wiki.ubuntu.com/Kernel/kernel-sru-workflow

-- swm properties --
built:
  from: b86e9c3960cc5551
  route-entry: 2
comments:
  abi-testing: 1
delta:
  promote-to-proposed: []
  promote-to-security: []
  promote-to-updates: [lrm, lrs, main, meta, signed]
flag:
  boot-testing-requested: true
  bugs-spammed: true
  proposed-announcement-sent: true
  proposed-testing-requested: true
  stream-from-cycle: true
issue: KSRU-12604
kernel-stable-master-bug: 2068291
packages:
  generate: linux-generate-azure
  lrg: linux-restricted-generate-azure
  lrm: linux-restricted-modules-azure
  lrs: linux-restricted-signatures-azure
  main: linux-azure
  meta: linux-meta-azure
  signed: linux-signed-azure
phase: Complete
phase-changed: Wednesday, 26. June 2024 19:18 UTC
reason: {}
synthetic:
  :promote-to-as-proposed: Invalid
trackers:
  bionic/linux-azure-5.4: bug 2068248
  focal/linux-azure-fips: bug 2068247
variant: debs
versions:
  lrm: 5.4.0-1132.139+1
  main: 5.4.0-1132.139
  meta: 5.4.0.1132.126
  signed: 5.4.0-1132.139
versions-replace:
  lrm: [5.4.0-1132.139]
~~:
  announce:
    swm-transition-crankable: 2024-06-12 09:55:07.147722
  clamps:
    new-review: b86e9c3960cc5551
    promote-to-proposed: b86e9c3960cc5551
    self: 5.4.0-1132.139
    sru-review: b86e9c3960cc5551
  tracker:
    last-message: '2024-06-25 22:00:02.886352+00:00'

[Ubuntu Kernel Ancillary Bot (ubuntu-kernel-ancillary-bot)]

amd64/azure canonical-certs.pem unchanged
amd64/azure canonical-revoked-certs.pem unchanged
amd64/azure fwinfo unchanged
amd64/azure modules unchanged
amd64/azure retpoline unchanged
arm64/azure canonical-certs.pem unchanged
arm64/azure canonical-revoked-certs.pem unchanged
arm64/azure fwinfo unchanged
arm64/azure modules unchanged
arm64/azure retpoline unchanged

[Tim Gardner (timg-tpi)]

Stakeholder signoff: Security release, signoff not required.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure - 5.4.0-1132.139

---------------
linux-azure (5.4.0-1132.139) focal; urgency=medium

  * focal/linux-azure: 5.4.0-1132.139 -proposed tracker (LP: #2068249)

  [ Ubuntu: 5.4.0-187.207 ]

  * focal/linux: 5.4.0-187.207 -proposed tracker (LP: #2068291)
  * CVE-2024-26925
    - netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()
    - netfilter: nf_tables: release batch on table validation from abort path
    - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
  * CVE-2024-26643
    - netfilter: nf_tables: mark set as dead when unbinding anonymous set with
      timeout
  * CVE-2024-2201
    - x86/cpufeatures: Add new word for scattered features
    - x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word
    - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file
    - x86/bhi: Add support for clearing branch history at syscall entry
    - x86/bhi: Define SPEC_CTRL_BHI_DIS_S
    - x86/bhi: Enumerate Branch History Injection (BHI) bug
    - x86/bhi: Add BHI mitigation knob
    - x86/bhi: Mitigate KVM by default
    - [Config] updateconfigs for CONFIG_BHI_{AUTO|ON|OFF}
    - x86/bugs: Fix BHI documentation
    - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES
    - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr'
    - x86/bugs: Fix BHI handling of RRSBA
    - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation
    - x86/bugs: Fix BHI retpoline check

 -- Tim Gardner <email address hidden> Wed, 12 Jun 2024 11:27:53 -0700

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

All tasks have been completed and the bug is being closed