How to get the bug fixes or patches between two linux kernel versions?

Question

I am trying to find information related to the bugs that have been fixed between two kernel versions.

Lets say on my ubuntu the current kernel version is 5.4.0, so i want to know what are bugs or security risks that are fixed between 5.4.0 - 5.4.1 or 5.5.0

Answer 1

I understand that it is not obvious to the questioner but the question is a little ill-specified. Let me explain.

The issue is: what is a "kernel version" in the context of this question ?

For the "main" (upstream, i.e. ultimately https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/ or one of the maintained branches thereof) Linux development, the "version" is a git commit tag of sorts, and differences / changelogs can be found and created using the git command, like:

~/build/linux$ git log --pretty=oneline  v5.15-rc5..v5.15-rc6
519d81956ee277b4419c723adfb154603c2565ba (tag: v5.15-rc6) Linux 5.15-rc6
cd079b1f870729a9fe3294f800dff18b548f129d Merge tag 'libata-5.15-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata
f2b3420b921d142b4c55f7445385bdab4060d754 Merge tag 'block-5.15-2021-10-17' of git://git.kernel.dk/linux-block
cc0af0a95172db52db2ab41b1e8a9c9ac0930b63 Merge tag 'io_uring-5.15-2021-10-17' of git://git.kernel.dk/linux-block
3bb50f8530c9cb5ec69c0744b7fd32d0ca404254 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
be9eb2f00fa7245116d49f76614054cce8e07af8 Merge tag 'powerpc-5.15-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
...

So that part is "easy".

But this is not at all the same thing as a ubuntu kernel changelog, even for the same version tags ... and they're never the same.

To start with, Ubuntu (and Debian, and certain other distributions) split the kernel build into multiple packages. They can contain different changes even when "version tagged" in the same way.

In my case, currently Ubuntu 20.04, I have:

~/build/linux$ dpkg -S /lib/modules/`uname -r` /boot/vmlinuz-`uname -r`
linux-modules-5.11.0-38-lowlatency, linux-headers-5.11.0-38-lowlatency: /lib/modules/5.11.0-38-lowlatency
linux-image-5.11.0-38-lowlatency: /boot/vmlinuz-5.11.0-38-lowlatency

i.e. three packages, linux-modules, linux-headers and linux-image.

One can ask the package subsystem (apt) for (*.deb package) changelogs on these:

$ apt changelog linux-image-5.11.0-38-lowlatency

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Get:1 https://changelogs.ubuntu.com linux-signed-hwe-5.11 5.11.0-38.42~20.04.1 Changelog [102 kB]
linux-signed-hwe-5.11 (5.11.0-38.42~20.04.1) focal; urgency=medium

  * Master version: 5.11.0-38.42~20.04.1

 -- Stefan Bader <stefan.bader@canonical.com>  Tue, 28 Sep 2021 17:39:40 +0200

linux-signed-hwe-5.11 (5.11.0-37.41~20.04.2) focal; urgency=medium

  * Master version: 5.11.0-37.41~20.04.2

 -- Stefan Bader <stefan.bader@canonical.com>  Fri, 24 Sep 2021 10:43:02 +0200
...

but as you can see these "meta-refer" - to Ubuntu's main distribution kernel branches.

At this point ... you deeply jump into distribution-dependent behaviour (Ubuntu packages/maintains their kernels differently from how Debian does, not to talk about differences to RHEL/CentOS or Alpine, or or or or ...).

For Ubuntu, the "distro kernels" are available on git, https://wiki.ubuntu.com/Kernel/Dev/KernelGitGuide and you can again clone that and query it for differences (now using the "Ubuntu version" tags) just as shown above for mainline. I leave that as an exercise to the reader :-)

For other Linux distributions (RHEL derivatives, to start with), the package changelogs contains short descriptions of the changes applied together with (distro) bug numbers, rpm --changelog kernel (usually). But at least Redhat does not have an open/public git repo that you could use to see the actual codechanges behind.

To explain the reasons why (and how, i.e. when/how they sync with mainline and/or selectively backport) distributions maintain their own kernel trees would take a lot more than the margin of this SO post; I'll defer on this for now, as off-topic wrt. to the main question.